Iowa Dept. Of Transportation Announces Plan To Give Police Officers, Security Personnel Full Access To Your Smartphone
from the privacy-is-so-20th-century dept
Raise your hand if you think this might be a bad idea.
Iowans will soon be able to use a mobile app on their smartphones as their official driver’s license issued by the Iowa Department of Transportation.
People will still be able to stick a traditional plastic driver’s license in their wallet or purse if they choose, [DOT Director Paul] Trombino said. But the new digital license, which he described as “an identity vault app,” will be accepted by Iowa law enforcement officers during traffic stops and by security officers screening travelers at Iowa’s airports, he said.
Nowhere in the course of the Des Moines Register article are any concerns expressed about potential abuse by law enforcement. Perhaps that’s due to the sole source being Paul Trombino of the Dept. of Transportation — a government agency that, like many others, likely views law enforcement officers as “good guys” and defers to their judgment.
But what happens where you’re pulled over? The first thing an officer does is ask for license and registration and then takes both items back to his/her vehicle. How many people feel comfortable with allowing an officer to take and maintain control of their cellphone for an indefinite period of time?
Sure, we have a Supreme Court decision that states warrants must be obtained before cellphones can be searched, but how much of a deterrent is that? Let’s say the officer thinks you might be some sort of drug runner. Well, now he has both your cellphone and “exigent circumstances.” Even if the eventual search turns up nothing, he’s still had a chance to look through your cellphone and, quite possibly, your vehicle, all without a warrant. Iowa’s law enforcement officers already take advantage of the state’s asset forfeiture laws. There’s no reason to believe they won’t take advantage of additional opportunities to root around in the contents of someone’s cellphone. All it takes is a routine traffic stop.
That’s only one problematic area. What about officers who like to send explicit or suggestive photos to their to their cop buddies? Are we really supposed to believe that this sort of behavior is limited to just a couple of officers in California? Human nature is universal and handing over the access and opportunity just makes it that much easier for those who would take advantage of both to do so.
Sure, the Iowa DOT app requires a pin to unlock, but your whole phone is an open book once you’ve unlocked it to access the drivers license app. Trombino says it’s “highly secure,” and maybe the app itself is, but it doesn’t keep cops and TSA officers out of the rest of the contents of your smartphone. This app may be a technological step forward, taking advantage of something people carry more often than they do purses or wallets, but it’s also an easy way for law enforcement and security personnel to achieve access to an unlocked phone without having to bother with Constitutional niceties.
If the app could be accessed without unlocking the entire phone, it would be a bit more useful. But there’s really no way to make an app that ignores the underlying system that enables it to function — at least not one put together by a state agency. And since you can’t separate the two, it just makes more sense to carry around a slab of plastic until someone comes up with a better idea.
Filed Under: driver's license, iowa, phones, police, privacy, security
Comments on “Iowa Dept. Of Transportation Announces Plan To Give Police Officers, Security Personnel Full Access To Your Smartphone”
And the permissions this app will require?
Let me guess that installation of this app will require the user to give it access to all data and records on the phone.
Time to crack the app and set up alternate Iowa identities: 22 hours max. Bits are easy.
Is a warrant still needed?
Correct me if I’m wrong, but if you hand your unlocked phone to an officer, he no longer needs a warrant, you handed it to him freely.
Kinda like inviting a vampire into your house, you know? Just a bad idea.
Re: Is a warrant still needed?
Apple’s iOS has a little known feature called “guided access” which you can use to lock a phone to a single running app.
So potentially you could pull up the app, lock it, and hand your phone over and the only thing they could see is that app.
Re: Re: Is a warrant still needed?
My Android phone has layers of security that would allow me to unlock only a specific set of applications. However, that and a guided access won’t stop anything if Whoever is right with the first post. Doesn’t matter how the other apps are blocked if the one allowed app is allowed to access everything.
Re: Re: Re: Is a warrant still needed?
that and a guided access won’t stop anything if Whoever is right with the first post. Doesn’t matter how the other apps are blocked if the one allowed app is allowed to access everything.
Unless the app is installed into a virtual OS.
Re: Re: Is a warrant still needed?
And Android Lolipop now has “screen pinning”, which locks the screen to any single selected app.
http://www.cnet.com/how-to/ho-to-pin-apps-in-android-5-lollipop/
But who knows what access the app might have to all of your data as a requirement to insure “security”? :-p
Re: Re: Re: Is a warrant still needed?
on Android L, make a new account (Settings | User), don’t associate that with your (main) Google account, and then load the State Sponsored warez.
You can then block Phone/SMS that 2nd account, and since it won’t have any data, there is nothing to see.
To use, simply pull down and change. When the cop wants to get back to the main account, it might have a password.
Or, go the old fashioned way – carry a plastic license and avoid all of this mess.
Re: Re: Re:2 Is a warrant still needed?
“You can then block Phone/SMS that 2nd account, and since it won’t have any data, there is nothing to see.”
Except for all the data on your phone.
Re: Re: Re:3 Is a warrant still needed?
http://gizmodo.com/google-may-bring-multiple-accounts-to-your-smartphone-w-1617218668
Your data should be locked.
Re: Re: Re:4 Is a warrant still needed?
Where does the article say that? In fact, the article says very nearly nothing at all about this feature.
To the best of my knowledge, the multiple accounts facility only really affects online access (in-app purchases, etc.), but apps can still access the contents of the phone itself to the same degree as they always have. I could be wrong, of course, but if Android put in the strong kind of control that you’re saying, that would have been a very major and widespread change that would have been greatly discussed.
I’ll have to grab v5 and take a look.
Re: Is a warrant still needed?
Why would he need to ask you for your phone when their app is sending all of your data to them regularly anyway?
Hands up, Don't shoot!
Yea so you reach into your coat for your phone and when the officer sees a largish, black item in your hand decides he wants to go home tonight even if you don’t.
Not a good plan.
Re: Hands up, Don't shoot!
Not to mention that cops are apparently being trained to use the excuse that phones could be guns in order to get you to stop recording them or at least let them get a hold of your phone “to inspect it.”
Re: Hands up, Don't shoot!
Doesn’t even have to be a black object:
http://www.loweringthebar.net/2014/11/banana-followup.html
Re: Re: Hands up, Don't shoot!
A banana. They thought a banana was a gun…
I know the people who hire police make sure to weed out anyone smart enough to question orders, but I didn’t realize they also prioritized hiring people with terrible vision as well.
And the fact that they arrested him over it… what exactly was the charge there? ‘Making officers fear for their life due to fruit-related threats’? ‘Making a pair of officers look like buffoons’?
Re: Re: Re: Hands up, Don't shoot!
An old banana may be pretty black, and I’m pretty sure Keystone Cops have been injured by slipping on these things.
We have to think about officer safety.
Yeah but when a private company does it, no one bats an eye.
https://www.youtube.com/watch?v=gaxLfdbiuKc
The linked article links to another article which includes:
“In the case of a traffic stop, spokesmen for the Iowa State Patrol and Des Moines Police Department both said bar codes contained in the mobile app would have to be scanned using hardware that’s inside an officer’s cruiser.
Drivers therefore would have to hand over their phones to an officer and allow the officer to take it back to the cruiser, noted West Des Moines defense attorney Nicholas Sarcone. That raises all kinds of questions.
What if drivers wish to use the phone to record their interactions with the police officer? What if they want to make a call or send a text during the traffic stop — perhaps to a lawyer? What if the phone has a lock mechanism that would lock officers out before they are able to scan the license bar code?
And what of the pitfalls inherent in storing critical data on an electronic device? What if the phone’s battery is dead — or dies in the midst of the traffic stop? What if the screen is cracked in a way that makes the bar code unreadable?”
..
“While the logistics are murky at this stage, attorneys surveyed this week generally downplayed the potential for civil liberty concerns associated with digital licenses.
The U.S. Supreme Court ruled earlier this year that searches of mobile phones require a warrant, meaning police cannot simply take a driver’s phone and scroll through the contacts, photos or text messages looking for incriminating material.
If a driver handed over his phone for the purpose of providing license information, he or she presumably would be granting permission only for the officer to access the DOT-provided license app, attorneys said. Without consent, the police could not snoop into the driver’s text messages or photos.
“Anytime they expand the scope of the search beyond the scope of consent, then they would be running into Fourth Amendment problems,” Des Moines defense attorney Gary Dickey said.
But here’s another hypothetical: What if a text message arrives while the officer possesses the phone?”
And what if the phone is stolen and a person is stopped before they get a new phone and they don’t have a paper license? And how about the thief now having your address, dob and other license info?
Mmm, let me think.. I’ll have a plastic one please.
Re: Re:
Re: Re: No PIN needed
Except that I don’t need a PIN to open your stolen wallet. I (should) need a PIN to unlock your stolen phone.
Re: Re:
“Without consent, the police could not snoop into the driver’s text messages or photos.”
You mean “should not snoop”… We’ve seen that fail before. Also, remember there are people in office that believe if you don’t know your stuff have been spied on, there’s no harm done. And if you can’t prove they’ve spied on you, you have no standing.
Nope. If they don’t have the opportunity, they won’t be tempted.
Re: Re:
“Without consent, the police could not snoop into the driver’s text messages or photos.”
So the app has magical “consent” technology that prevents cops from snooping if consent hasn’t been given? Oh, damn, that’s not what they mean. What they mean is “the police can absolutely snoop into your phone, but it would be an illegal search and we all know that cops never engage in illegal searches so don’t worry your pretty little head, citizen.”
Re: Re:
What if the officer installs malware?
Re: Re:
It’s encouraging at least that the Des Moines Register considered these other issues, asked questions, and listened to people outside the DOT who know a thing or two. This is journalism done right.
Re: Re:
What if the phone is recording audio when the officer takes it back to their cruiser? Has the officers privacy been violated? That would be a HUGE problem.
Re: Re: Performance of Duty
The officer is performing official duties in public. We’re covered here. Just have the videos automatically uploaded to Google+, and call it good.
Re: Re:
“WITHOUT CONSENT, THE POLICE COULD NOT SNOOP INTO THE DRIVER’S TEXT MESSAGES OR PHOTOS.”
In your comment that line stood out to me.
Story time!
About a decade ago, I was arrested and held in a local city jail. The reason? Long story made short, my car broke down on the side of the road late at night next to a school. The officer clearly didn’t like my appearance and using a drug sniffing dog that very obviously jumped on my car based on his cues (touching the door handles), he searched my vehicle and found items he found to be “of a suspicious nature”. Said items consisted of various tools (to fix my car on the side of the road should it break down) and change in the center console that had that crusty stuff that forms on old change. In my case he decided that because some of it was brown it was clearly all heroin.
I was handcuffed, forced to sit on an anthill, which I complained about once I realized where I was sitting, threatened when I refused to sit still once ants were on me and eventually taken in. Booked, processed, etc. All my personal effects were taken from me and booked into evidence. My shoes, belt, sweater and more importantly wallet. This was done by a by the book truly decent and good police officer.
The next morning, as I was let out, namely because a relative worked for an attorney and he basically got them to drop the highly dubious charges I was handed my stuff back by the same decent cop from the night before. As we went through it we came to an anomaly. All the cash from my wallet, which was in police lock up in evidence, was mysteriously missing. The officer then called another officer over who stated in front of me, “Maybe he didn’t come in with any money.” The cop replied, “No, sir. He came in with fifty dollars in various bills, I personally logged it into evidence myself. Now it is missing from his wallet and he and I both realized this after I took it out from the bag in which it had been placed along with his other items.”
Needless to say I filed a complaint, like the decent cop suggested I do. “I’m the supposed criminal here and you have someone stealing from my wallet in your locked evidence room? Ha. Fuck yeah I wanna file a complaint.”
So that line about not going through someone’s stuff without their consent is worth absolutely nothing. The law and rulings on the matter in favor of the public mean nothing to the less than scrupulous officers out there. Not all cops are bad cops, but there are enough bad cops out there that we really shouldn’t feel safe or trust any at all. They have to prove themselves, trust shouldn’t be inherently placed in them from the get go just because of who they are.
Re: Re: To the guy who got his $50 stolen
I know a retired cop. One of his favorite stories is about how they responded to a late-night burglary. They got the store owner on the phone and the guy asked, “Did they find my safe?” The sergeant asked, “Where’s the safe?” The owner told him and the sergeant said, “Yeah, unfortunately they did.” The cop then proceeded to steal the money from the owner’s safe.
The retired cop I know wouldn’t take a dime that wasn’t his–I’ve known him for decades. But he not only saw no problem with this other cop stealing from the public, to this day he thinks it’s funny as hell.
Cops are tribal. There is a double standard for morality that we can’t fix. Not only should they not be inherently trusted above others–they should be trusted a hell of a lot less.
Android lock screen
My first thought was:
“Modern Android* devices (4.2 if not earlier) have a lock screen where you can put widgets, so a solution may be for the app to enable you to stick your license on the lock screen, so do that and you don’t need to unlock the phone”
Then I realized that driving licenses include personal information**, and that solution would stick that information somewhere where it wasn’t secure…
So yeah, bad idea all around!
*: I don’t have an iphone / Windows phone, so can’t speak for them.
**: My UK license has my name, date and country of birth and current address, other countries and states may vary.
What about TSA & smartphone airline tix ?
Aren’t you giving TSA access to your unlocked smartphone?
Re: What about TSA & smartphone airline tix ?
My wife uses those (I don’t), but the key difference is that when you use the airline smartphone apps, your phone never leaves your hand. You just hold it out, they scan the code, and you’re done.
Re: What about TSA & smartphone airline tix ?
The app that gets loaded is from the Airline.
TSA just uses a barcode scanner to read the code off the phone. They specifically don’t take the phone from you in my experience – you just wave it under the scanner. Same is true when you board the plane, again, in my experience.
Re: Re: What about TSA & smartphone airline tix ?
Same answer, use an android phone with multiple accounts, 1 account for D.L. app, tickets, boarding passes, nothing else.
🙂
It’ll probably require permission to the location features and tell on you if you’re speeding.
Re: Re:
I’m very surprised this wasn’t in the article. It’s so obvious.
All I can say is nope nope nope NOPE. If this was somehow made law that I must use this kind of license, I’d buy a dedicated phone and only put the battery in when pulled over.
Re: ... tell if you're speeding
It also might indicate when and where you’ve been and if a crime were committed where you’ve been, you might become a suspect even if you were an innocent passerby.
Screen Pinning / Guided Access
So a possible solution for up-to-date Android phones would be Screen Pinning, which locks the device to a single app as long as there is some type of security on the lockscreen. This feature is only available on Android 5.0 (Lollipop). iOS seems to have a slightly more robust feature called Guided Access (as mentioned by Michael Long), but I’m not sure which versions of iOS have it (I know at least iOS 8 does).
Re: Screen Pinning / Guided Access
Looks like Guided Access was introduced with iOS 6, so as far back as the 3GS (so basically, just about any iPhone somebody would be using right now).
NFC
Simple enough to enable the NFC chip to tap-to-send your ID to their electronic ticket book.
Now you just have to believe that you’re ONLY sending what you think you’re sending.
Re: NFC
Sounds great until you realize that their “electronic ticket book” is in the cruiser.
Most police departments have policies that officers collect license and insurance information and go back to their cruiser to verify and write tickets. This policy makes sense – they should not be holding a bunch of things while they want to and from the vehicle of a suspect that could, you know, want to kill them. If they were standing next to a vehicle writing a ticket, a suspect could pull a weapon and attack them while they are distracted and do not have a free hand to pull their sidearm.
So, they are likely to have to take your phone with them.
End around
I think I would have to buy a second phone with only the app on it.
“Feel free to search that phone officer!”
Re: End around
My second phone would have this app, the phone numbers for the mayor’s office, police chief, state senators, and my local representative – and then a bunch of porn.
Let them figure out what to do with that.
Re: Re: End around
Option 1 – Charge you with possession of pornography in violation of Statute 42B-Section3a.
Option 2 – Charge you with attempting to bribe Officer by offering to share said porn.
Option 3 – Charge you with attempted blackmail of said politicians with said porn.
Possible Option 4 – If any of the porn pics look remotely underage, fully investigate you for possible child porn possession, creation and/or distribution charges.
It is quite a coincidence that shorty after the Supreme Court ruling on warrants for cellphone searches. We now have a drivers license app for smartphones.
I’m glad I read this article. I never considered the implications of needing to unlock my phone in order to use such an app.
Thanks Tim!
Dead Cell phone battery is the new Contempt of Cop?
So, a dead cell phone battery now potentially turns into a “Contempt of Cop” charge with the associated felony arrest procedures?
I can hear the Cop’s conversation w/ his Union Rep now…
Once upon a time, this would have been a stretch…
Washington State has a similar statute, but it has to do with showing proof of insurance. However, it specifically bans police from looking through the phone, or at anything other than the image of the insurance being shown on the phone. I do not believe that they may even take the phone.
Death of iPhone in Iowa...
Use an android phone, setup one account for the D.L., then another for whatever else you want, each with their own password.
Unlock the driver’s license side, with nothing else on it, leaving the other side locked.
Or do what I intend to do, never get the app.
Re: Death of iPhone in Iowa...
When you set up multiple users on Android, that does not prevent apps from accessing the data that is on the phone, so doing this doesn’t address the security risks the app presents.
Re: Re: Death of iPhone in Iowa...
Interesting, since I cannot access my primary account data from a secondary account.
Using 2 different google accounts to login, the 2nd account restricted to 2 or 3 applications, with their own profile and data.
Barcode?
So let me get this right. The only thing this app supposedly does is display a bar code that needs to be scanned by the police to retrieve the actual data.
Now how does the app actually know which bar code to display? It would need to access some kind of back end system that holds all the information of every driver’s license in the state. It should also make sure that you can only ever get your own bar code. This means an API needs to be provided that can check that you are who you claim to be and return just enough data to generate the bar code
I can’t wait to see how long it takes before the API that’s used by this app is abused to scrape all the data in the database. Let’s just hope it’s more complex than just changing a number in the URL.
Re: Barcode?
Now how does the app actually know which bar code to display? It would need to access some kind of back end system that holds all the information of every driver’s license in the state.
Not necessarily, there would be ways to get just the one bar code needed into the app.
what if you don’t have a phone, can you still drive?
Re: Re:
Normal driver’s license cards still exist. The phone app is 100% optional.
who cares
Yet another reason to add to the already long list of reasons NOT to use a smartphone as it is rather not smart at all!
Re: who cares
How is this a reason to not use a smartphone?
TSA
Just so yall know, TSA doesn’t yet consider this a valid form of identification. TSA is not permitted to remove the device from your possession. There is no instance that TSA should demand control of your phone. If they ask, it’s up to you to determine if you would like to. However, they should just direct you to what they need (i.e. certain boarding pass information).
The moment you install government provided app on your cell phone
it is already to late to worry about your phone being searched without a warrant by a police officer you hand it to.
Because they can have their nice network backdoor in their app and pull data from your phone remotely, no need to bother with physical access.
Plus it can log your GPS coordinates and time and detect speeding and issue you speeding tickets automatically, no police involvement necessary.
Awesome idea.
Similar with the GEICO proof of insurance app.
I guess people will have to start carrying two cell phones.
Re: The moment you install government provided app on your cell phone
I guess people will have to start carrying two cell phones.
Or a cell phone and a driver’s license…
best selling app:
random valid ID generator for traffic stops