Law Enforcement Official Claims Citizens Use Better Encryption Than Cops Do

Say That Again

from the when-you-don't-understand-the-subject-but-think-you-should-offer-an-expert-o dept

Arguing against encryption is a popular law enforcement pastime. The problem is there really aren’t many good arguments to be made against the use of encryption, so people like Attorney General Bill Barr and FBI Director Chris Wray have to summon up apocalyptic scenarios or beat down straw men of their own creation to score points for their side.

Given that the anti-encryption side is loaded with disingenuous intentions, it’s really no surprise to see statements being made by law enforcement officials that are either stupid or lies… or maybe some combination of both. A recent NPR discussion of calls to end encryption features a real gem from an official representing a Tennessee law enforcement agency.

[NPR Host Martin] KASTE: There’s been a lot of media attention lately on the FBI showdowns with Apple about opening iPhones used in terrorism. But those situations are relatively rare, given that the feds often have other ways of getting information. What’s more common is that end-to-end encryption is frustrating local law enforcement – people like Cpt. Clay Anderson.

CLAY ANDERSON: It comes into play at least probably once or twice every single week.

KASTE: He supervises investigations for the sheriff’s office in Humphreys County, Tenn. They get a lot of cases involving sexual exploitation – predators grooming minors via online messaging.

ANDERSON: In those cases, you run into dead ends because you can’t get past encryption. I mean, who needs that type of encryption other than maybe the military with some type of sensitive operation that they’re doing? You know, we don’t even in law enforcement use encryption like that.

First off, YES, law enforcement uses encryption like that. Do officers carry smartphones? Then they’re using “encryption like that.” Are the sheriff office’s internal communications and on-site databases encrypted? Then they’re using “encryption like that.” How about the laptops in their vehicles? I sincerely hope those are protected by “encryption like that.”

“Encryption like that” apparently refers to encryption law enforcement can’t break easily. In other words, encryption law enforcement doesn’t have the passwords to. There’s no “military-grade” encryption. Either encryption works or it doesn’t. It’s not a matter of “grades.” These words might sound meaningful to people not familiar with encryption, but they’re meaningless to anyone with the slightest familiarity with the subject.

“Military grade” meant something nearly 30 years when the government restricted the export of encryption methods that couldn’t easily be broken by US agencies. The explosion of consumer products (computers, smartphones) that has occurred since that point has rendered the line between “consumer” and “military-grade” encryption nonexistent.

The military uses the same encryption consumers do. Captain Clay Anderson’s parroting of Bill Barr’s idiotic talking points suggesting device manufacturers start using a dumbed-down encryption method for consumer electronics is just that: idiotic. To compromise encryption millions of consumers use would also compromise the encryption the government (home of “military-grade”) uses, as Bruce Schneier points out.

The thing is, that distinction between military and consumer products largely doesn’t exist. All of those “consumer products” Barr wants access to are used by government officials — heads of state, legislators, judges, military commanders and everyone else — worldwide. They’re used by election officials, police at all levels, nuclear power plant operators, CEOs and human rights activists. They’re critical to national security as well as personal security.

Hopefully, Captain Anderson is just ignorant. Hopefully his officers and his department are making full use of “encryption like that.” To do otherwise would be irresponsible. Or maybe Anderson is just upset he can’t get all the evidence he needs by sitting at his desk. He doesn’t really seem to be the best choice for investigating crimes against children.

In early September 2012, Jackie Little went to investigators with the Humphreys County Sheriff’s Office to report that she had been raped by three men.

In recorded video of her interview, Sheriff Chris Davis can be heard vowing to investigate while sitting in a room with the detective assigned to the case, Clay Anderson.

“If they’ve done this to you, we’re going prosecute them. We’re going to prosecute them wide open,” Davis said.

But our investigation found Anderson never even attempted to gather DNA evidence, didn’t seek out one piece of potential video and interviewed the three suspects several months after the rape was reported.

Anderson was twice recommended for termination by other law enforcement agencies, but resigned before termination could occur, leaving him free to join this department and add his, um, “skills” to their investigatory unit. Now, he’s the regional face of “going dark” and his arguments are proving to be just as questionable as his law enforcement career.

Filed Under: clay anderson, encryption, law enforcement

Senators Pitch Temporary Facial Recognition Ban, Leave Door Wide Open For Abuse By Federal Agencies

(Mis)Uses of Technology

from the take-another-pass-or-three-before-sending-this-out-for-a-vote-pls dept

Here’s a promising development on the facial recognition front — one that won’t make facial recognition tech developers very happy. Bans have been popping up around the nation but this legislative pitch would (sort of) prevent the federal government from deploying the tech.

On Wednesday, Senators Jeff Merkley (D-OR) and Cory Booker (D-NJ) introduced legislation to place a moratorium on the use of facial recognition by the federal government or with federal funds—unless Congress passed regulations for the technology.

The Ethical Use of Facial Recognition Act aims to create a 13 member congressional commission representing interested parties—including law enforcement, communities subjected to surveillance, and privacy experts.

It’s a temporary ban but it’s better than doing nothing about the federal government’s enthusiasm for unproven tech. The DHS has been pushing for this tech to be deployed everywhere travelers might board conveyances or cross borders. Federal law enforcement agencies are just as interested in using this tech despite its horrible track record, amassing large collections of facial pictures and granting access to just about any local agency expressing an interest in rolling the dice on biased software. Then there’s Clearview, which is its own monstrosity — one that implicates far more variables than government access.

Unfortunately, there’s a big exception carved out for law enforcement agencies, which would include DHS components assigned to borders and airports. The only thing keeping this bill from being completely useless is that the exception is tied to a warrant requirement, which means no more biometric scanning at international airports.

Or maybe it doesn’t. The bill [PDF] doesn’t specifically address the Constitutional no-man’s land that are our border crossings and international airports. So, it may be possible for law enforcement agencies working in these areas to abide by the partial ban while still ignoring the warrant requirement because the normal rules just don’t apply within 100 miles of any border crossing.

That’s not to say it’s a terrible bill. It just could have been a much better bill. It will prevent inland use of facial recognition tech without a warrant and, importantly, would force the federal government to develop and implement standards governing its use and (hopefully) set some baselines contractors would need to meet before selling their tech to government agencies.

At this point, the only thing Congress has done in response to the rapid deployment of facial recognition tech is express its concern and suggest some hearings might be in order. What it hasn’t done is prevent the sketchy tech from being deployed as rapidly as government agencies can nail down contracts. Hitting the pause button for a few years is a far better idea than allowing things to continue to run towards the direction of amok, especially when it has been made clear most companies’ offerings are biased and inaccurate.

Filed Under: ban, cory booker, facial recognition, jeff merkley

Stalkerware Developer Demands TechCrunch Remove Article Detailing Its Leaking Of Sensitive Data

Failures

from the set-weapons-to-'backfire' dept

Last week, stalkerware purveyor ClevGuard was discovered to be hosting tons of sensitive data harvested from victims’ phones in an Alibaba data bucket set to public with no password protection. ClevGuard makes KidsGuard, an app whose name suggests it’s something parents can use to monitor their children’s cell phone use, but the developer has helpfully noted the software’s also great for monitoring spouses and employees.

After being notified of the issue, Alibaba secured the bucket and made sure ClevGuard was made aware of the problem. But ClevGuard’s not finished being stupid about this. Rather than quietly go about securing its exfiltrated data — which includes contacts, photos, GPS location data, and content harvested from a variety of messaging apps — the company has decided it would like to raise its infamy level and ensure even more people know about its horrific stalkerware.

Zack Whittaker broke the news at TechCrunch, publishing a lengthy expose of both the product and its insecure data storage. And now ClevGuard is baselessly demanding he take down his article.

If you can’t see/read the tweet, Whittaker says:

We just received an email from ClevGuard asking us to delete the two articles we published this week about the KidsGuard stalkerware, which has been used to spy on thousands of victims.

We declined.

Whittaker has also put together a how-to guide for removing this stalkerware from your device, which probably isn’t improving TechCrunch/ClevGuard relations.

And while we’re discussing ClevGuard, let’s take a quick look at its marketing efforts, which directly contradict the End User License Agreement the company pushes on users.

Here are the limitations ClevGuard supposedly imposes on users, in all of its original, gloriously-broken English:

You comprehend that the Site and ClevGuard will be utilized just for the reasons for underneath (I) parental control of their kids, (ii) on a gadget, which is of your possession, under such situation, you should get authorization from the client being observed, (iii) other legal points as per the laws in your very own purview. The terms of Child is characterized as underneath:

Youngster: Your very own lawful kid that is under the legitimate age of 18 (as characterized by US law). The kid must be observed utilizing a perfect telephone that you possess. You can’t screen a kid on the off chance that you hold one of the accompanying connections:

• Brother/Sister
• Step-Brother/Step-Sister
• Step-Father/Step-Mother
• Aunt/Uncle; Cousin/Nephew
• Grandfather/Grandmother
• Great-Grandfather/Great-Grandmother

Worker: Your representative at an organization you claim or a representative at indistinguishable organization from you and you have administrative duties regarding. The representative must be checked utilizing a perfect telephone claimed by the organization and issued to the worker under your organization’s approaches with respect to organization telephones. The representative must give assent and be advised they are being observed before checking can start.

So, according to ClevGuard’s own EULA, the stalkerware can only “legally” be used to monitor “youngsters” and “workers.” (And only on “perfect telephones,” which are generally only found in the Oval Office.)

But the company’s quasi-blog suggests customers should use the software in ways that break the EULA, offering up reasons why KidsGuard is better than its competitors for stalking spouses and significant others. Here’s a post detailing the “2 Best Ways to Track my Girlfriend’s Phone,” with KidsGuard beating out the built-in “Find My Phone” feature. Here’s a list of the “10 Best Couple Tracker Apps” with KidsGuard topping the list. ClevGuard’s site is full of “helpful” posts pushing KidsGuard to monitor something other than “youngsters” and “workers,” suggesting it’s not just “perfect telephones” that can be spied on with ClevGuard’s software.

To sum up: ClevGuard is a terrible company offering a horrible product that can be abused to spy on nearly anyone without their knowledge. The data then — until recently — ended up in unsecured data buckets. But why should ClevGuard try harder? This sensitive data belongs to people being spied on. Screw them for being covertly surveilled, I guess. Nothing to hide, nothing to fear, etc. The bogus demand TechCrunch remove its article is just the expired icing on ClevGaurd’s garbage cake.

Filed Under: data breaches, kidsguard, leaks, sensitive data, stalkerware
Companies: clevguard, techcrunch

Greyhound Finally Bans CBP, Border Patrol From Suspicionless Searches Of Its Buses And Passengers

Legal Issues

from the bus-operator-boards-the-ban-bus dept

Greyhound has finally, definitively decided to stop serving up its customers to US border agencies.

A week ago, a CBP memo obtained by the Associated Press made something clear to CBP agents that should have been clear all along: they could not perform sweeps of buses without the permission of the bus driver or the bus company itself. Unfortunately, this means a bus driver can consent to a search on behalf of passengers, but it still was better than Greyhound’s stance. The company had stated that it believed it could not legally refuse to allow CBP officers to board buses.

This was a problem. CBP officers were wandering far inland to perform searches, often targeting buses that never crossed a border. Anything within 100 miles of a border was considered fair game and reports of bus sweeps by CBP agents were trickling down from depots near the nation’s northern borders — far away from the supposedly deeply-troubled southern border where the current president believes more walls are needed to stop drugs, terrorism, and the possibility of being unable to secure an existence for whites and their progeny.

Greyhound was wrong and the CBP memo confirmed it. But Greyhound still refused to issue a blanket refusal on behalf of its drivers, many of who would probably feel (individually) it was perhaps unwise — if not illegal — to tell CBP agents to perform their fishing expeditions elsewhere.

The company has finally taken a stand, making it much easier for drivers to refuse access to their buses.

In an emailed statement, the company said it would notify the Department of Homeland Security that it does not consent to unwarranted searches on its buses or in areas of terminals that are not open to the public — such as company offices or any areas a person needs a ticket to access.

Greyhound said it would provide its drivers and bus station employees updated training regarding the new policy, and that it would place stickers on all its buses clearly stating that it does not consent to the searches.

This is the right step to take, although it would have been better to do it as soon as it became obvious the company had the right to refuse warrantless, suspicionless searches of its buses and passengers. With this in place, the company’s statements that it cares about the safety and security of its drivers and customers are a whole lot less empty.

The sad fact is this never should have come to this point. It’s highly presumptuous of these agencies (CBP, Border Patrol) to believe they can just board buses and search passengers when the targeted buses aren’t at checkpoints or crossing borders. This is the sort of thing we should be above — something only heard about from other countries without enshrined rights and protections. Emulating Cold War Russia and its eastern bloc subsidiaries is a piss poor look for US government agencies operating dozens of miles away from any border in need of securing.

Filed Under: 4th amendment, buses, cbp, ice, searches
Companies: greyhound

Not Clearly Established A Jailer Can't Spray A Prisoner In The Eyes With Pepper Spray For No Reason, Says Fifth Circuit

Legal Issues

from the this-is-pretty-clearly-some-bullshit dept

A recent decision [PDF] by the Fifth Circuit Court of Appeals once again highlights the utter absurdity of qualified immunity. To qualify for immunity, all a law enforcement officer needs to do is show they violated someone’s rights in a new way — one not previously considered by the court. Since there’s no on-point precedent, it was not “clearly established” that this violation of rights was actually a violation of rights the officer should have been aware of, so the officer walks away from the lawsuit unscathed.

“On-point” means this exact thing happened before. If a cop shoots an unarmed person who happened to walk by a window rather than through a door, and it’s only been established that shooting an unarmed person walking through a door is a Constitutional violation, the window shooting is good to go and qualified immunity is handed to the officer. Even when it should be apparently clear shooting an unarmed person through a window would violate their right to be free of bullets when walking past their own windows while inside their own home, it somehow isn’t clear to cops. Nor is it to the courts, that only consider established precedent when deciding whether or not an officer’s actions were “reasonable” in this situation.

This case involves the actions of a corrections officer. Prince McCoy was sprayed in the face with pepper spray by a guard referred to in the lawsuit only as “Mr. Alamu.”

Here’s McCoy’s side of the story:

On that day in 2016, Alamu came by McCoy’s cell block. As Alamu approached the cell of Marquieth Jackson, one of McCoy’s neighboring inmates, Jackson threw some water on Alamu. Alamu radioed a sergeant, “who dealt with the matter.” About an hour and a half later, Alamu returned to conduct a roster count. Again, Jackson doused Alamu with water. Angered, Alamu grabbed his chemical spray and yelled “where you at?” repeatedly at Jackson. McCoy’s fellow inmates screamed “you can’t spray him!” But because Jackson had blocked the front of his cell with sheets, Alamu couldn’t do anything. Two minutes passed. Alamu re-holstered the spray and walked toward McCoy’s cell, asking for McCoy’s name and prisoner number. As McCoy approached the front of the cell to inform him, Alamu “sprayed [McCoy] directly in the face with his [chemical] spray for no reason at all.”

And here’s Mr. Alamu’s:

He states that after being “chunked with an unknown liquid” by Jackson, he “immediately . . . ran away from the cell for cover.” As he approached McCoy’s cell, he “went blank” after McCoy threw “an unknown weapon” at him, striking him in the face. Feeling that his “life was in danger,” “the next thing that crossed [his] mind was to use” the spray. He characterized his panicked reaction as an “involuntary action.” Documents in the record suggested that the “weapon” was a “piece of rolled toilet paper.” McCoy denies throwing anything.

It’s refreshing to know correctional officers feel it’s acceptable to “go blank” when (allegedly) being hit in the face with a “piece of rolled toilet paper.” “Going blank” is great — especially when tied to “life in danger” — because it can be used to justify every bit of excessive force that happens after that. This doesn’t work for civilians. Assaulting someone after “going blank” and supposedly acting in self-defense tends not to sway juries when the end result is an unarmed, assaulted victim.

The prison’s Use of Force report determined Alamu’s pepper spraying of McCoy was unnecessary and inconsistent with policy. Alamu was placed on three month’s probation. The Fifth Circuit is far more sympathetic to Alamu’s use of unnecessary force. It does find Alamu violated McCoy’s rights by spraying him with pepper spray because a different prisoner had thrown water on Alamu.

Alamu has two main responses, but neither saves him. First, he contends that he reasonably perceived a threat because McCoy threw a wad of toilet paper at him. But even if that factual contention might persuade a jury, it does not justify summary judgment. McCoy denies throwing anything at Alamu and supports his denial with competent evidence. Relatedly, Alamu suggests that the spray was justified because the undisputed facts showed that Jackson had twice thrown liquids on Alamu. But the conclusion doesn’t follow: Alamu sprayed McCoy, not Jackson. McCoy should not bear the iniquities of his fellow inmate.

Second, Alamu appears to contend that McCoy cannot show a violation because his injuries were de minimis. But unfortunately for Alamu, the Supreme Court has rejected that line of reasoning. “Injury and force . . . are only imperfectly correlated, and it is the latter that ultimately counts.” Wilkins, 559 U.S. at 38. Accordingly, because a reasonable jury could conclude that Alamu’s use of force was excessive, McCoy meets his burden at the first QI prong.

But that’s the end of the good news. Although McCoy cited previous cases pretty much on point dealing with the assault of prisoners who posed no threat to officers, the court decides those cases just aren’t “on point” enough.

Above, we held that the spraying crossed that line. But it was not beyond debate that it did, so the law wasn’t clearly established. This was an isolated, single use of pepper spray. McCoy doesn’t challenge the evidence that Alamu initiated the Incident Command System immediately after the spray, nor that medical personnel promptly attended to him and provided copious amounts of water. Nor does he provide evidence to contest the Use of Force Report’s finding that Alamu used less than the full can of spray… [O]n these facts, it wasn’t beyond debate that Alamu’s single use of spray stepped over the de minimis line. For that reason, the law wasn’t clearly established.

The dissent asks the questions that need to be asked — the ones that aren’t addressed by the majority. Why is it still OK to pepper spray someone when it’s been clearly established assaulting a prisoner in the same position with fists, batons, or Tasers isn’t? As the dissent points out, pepper spray is arguably more dangerous than anything else on this list.

Although the majority purports to recognize that the instrument of force does not matter in a “no provocation” case, its grant of immunity ultimately turns on the fact that the guard used pepper spray instead of a fist, taser, or baton. It relies on the absence of law clearly establishing that wantonly spraying a prisoner with a chemical agent involves more than a de minimis use of force. The same could have been said in Newman about tasing. Unexplained in the majority opinion is why tasing is a more serious use of force than pepper spraying. The use of pepper spray is no small thing. The chemical agent, which temporarily blinds its recipients, is—unlike tasers—banned for use in war.

As for the majority’s inability to find a case on point to deny QI, the dissent says its willingness to abandon common sense in favor of precedent does not reflect well on it.

The majority neglects that the gratuitous tasing in Newman was deemed an “obvious” case of excessive force, 703 F.3d at 764, a label that also fits the pepper spraying of McCoy “for no reason.” Qualified immunity is often a game of find-that-case, but not always. Common sense still plays a role; when the violation of constitutional rights is “obvious,” there is no immunity. […] That knowledge of illegality necessarily exists when an officer commits an obvious constitutional violation. That’s what obvious means.

Our rights are supposed to protect us from our government. But somehow, these rights are only vaguely established when they’re violated by government employees. Years of jurisprudence hasn’t brought us any closer to a “reasonable” ideal that actually reflects reasonable thought, much less common sense. The only thing “clearly established” is that law enforcement officers can violate rights with almost no fear of reprisal.

Filed Under: 5th circuit, clearly established, police, prince mccoy, qualified immunity

South Carolina's Top Court Decides Black Men Should Feel Free To Terminate 'Consensual' Stops By Law Enforcement Officers

Legal Issues

from the sure,-if-you-ignore-everything-about-cops dept

A stop-and-frisk case that resulted in arrest made it to the top of the South Carolina court system, only to be rejected by three white judges with a dissent written by two black judges. (via FourthAmendment.com)

Here’s a brief summary of the underlying events (and the court’s decision) by John Monk of The State:

Two white justices — John Few and Buck James — wrote that in a public encounter with law enforcement where there are no grounds for police to question a person, that person is free to decline to answer questions and has the right to walk away from police. Associate Justice Kaye Hearn agreed in a concurring opinion.

However, in this encounter with police, as Spears started to answer officers’ questions, he began patting his shirt, prompting one officer to repeatedly request Spears not to move his hands. After Spears refused, the officer told him he was going to frisk him to “be sure he didn’t have any weapons on him or anything that was going to hurt me,” the majority ruling said.

It was during that frisk that Agent Dennis Tracy found under Spears’ shirt a small ball of what turned out to be less than half an ounce of crack cocaine.

Because Spears did not at first refuse to answer questions and keep on walking, he had in effect given his consent to what happened next, the majority opinion said.

There’s a question about race to be asked here, but it wasn’t asked by the defendant, so the appeals court’s finding the stop was an unjustified seizure is overturned. But the decision [PDF] was even closer than that. The concurring opinion, written by Justice Hearn (who is white), asks a question about biased policing the court is unable to answer for procedural reasons.

I concur but write separately because I share many of the dissent’s concerns regarding whether Eric Spears—an African-American male— actually felt free to walk away from the encounter with law enforcement. While I am skeptical that he did, this does not change the fact that our standard of review requires us to affirm unless there is clear error, meaning we cannot substitute our judgment for that of the trial court.

[…]

Spears never raised the argument the dissent advances to the trial court, where it would have had the opportunity to specifically address this issue when deciding whether he was seized pursuant to the totality of the circumstances. Indeed, had Spears raised this issue to the trial court and briefed it before this Court, we would be in a position to consider the reasoning of the dissent.

The dissent does address this. It also addresses the fact the officers who stopped Spears did not have an objective basis to perform a stop. DEA officers often watched bus depots for travelers originating from New York City under the theory that New York is a drug source town and every stop along the way is a “destination” town. That’s a pretty thin premise since people who aren’t in the illicit drug business also use the same buses to travel for normal, law-abiding reasons.

The very thin premise was stretched even thinner by the officers’ sworn declarations about the “activity” they observed that supposedly justified their stop of Spears. From the dissent:

In addition to paying the agents an “excessive” amount of attention, the officers made only the following observations prior to stopping Spears: Spears and his companion arrived on a bus line known to be used by criminals; the pair retrieved four large pieces of luggage; Spears did not appear to be meeting anyone at the bus stop; Spears began walking down the road away from the bus stop; and, while walking away, Spears’s companion handed him an unidentified item. In my view, none of these facts, standing alone or together, provide articulable and reasonable suspicion to justify a seizure.

Several of the aforementioned facts are entirely reasonable given the context of the situation. One would expect two people traveling to South Carolina from New York to have several pieces of luggage. Further, walking away from a bus stop after disembarking is not suspicious activity. Indeed, Spears’s companion testified the pair decided to walk when their ride failed to show up. In addition, Spears walked at a normal pace even though he knew he was being followed. Moreover, not one agent could testify regarding the specifics of what Spears’s companion handed him— or even if she actually handed Spears anything at all. Therefore, these facts cannot be relied upon to establish a reasonable suspicion that criminal activity was afoot.

This pretext is made even more flimsy by the officers’ statements that they were at the bus station following up on a tip that two black males were transporting drugs to South Carolina via the bus line. Their decision to chase down a man and a woman who exited the bus stop makes little sense in this context and makes even less sense when all they had really observed (other than the disputed pass of an unidentified object) was a couple exiting a bus station with their luggage.

The end result of this suspicionless stop (that the government argues was consensual and not a seizure under the Fourth Amendment) is a mandatory thirty-year sentence for Eric Spears. That the state’s top court found the stop “consensual” shows the “reasonable person” standard cannot be deployed across the board — not when you consider the history of law enforcement’s treatment of black people. Since there has been little equitable treatment of minorities by law enforcement, it’s unreasonable to expect minorities to feel the same as Caucasians about “consensual” stops when approached by officers.

Here’s some more from the dissent:

Our Fourth Amendment jurisprudence does not take into account personal characteristics such as race, sex, age, disability, and so forth when making this determination. The test does, however, consider the totality of the circumstances. In my view, a true consideration of the totality of the circumstances cannot ignore how an individual’s personal characteristics—and accompanying experiences—impact whether he or she would feel free to terminate an encounter with law enforcement.

[…]

The United States population includes 42 million Americans of African descent. Inexplicably, these Americans are basically invisible to those of us who apply the analytical framework for reasonable behavior or beliefs. Somehow the judiciary, intentionally or not, excludes these Americans’ normal behaviors, responses, and beliefs in circumstances involving law enforcement agents. For most, the “totality of the circumstances” does not include consideration of the reasonable behavior or response of African-Americans when confronted with certain stimuli. Thus, the regrettable and unsettling conclusion is that the question of what is “reasonable” is viewed solely from the perspective of Americans who are White. I shudder to think about the probable result had the defendant continued to walk and ignore the police.

This won’t head off the inevitable comments about how it’s “unfair” to treat blacks differently than whites when applying the Fourth Amendment to supposedly “consensual” encounters with law enforcement, but I’m putting this here anyway:

Ask yourself why it’s unreasonable to apply the history of our nation — specifically, law enforcement’s relationship to minority communities — to determinations of what a “reasonable” person would do during a stop like this. Then ask yourself why minorities should only have to come out on the losing end of “inequitable” applications. Minorities weren’t even treated as actual human beings for more than 100 years in this country and blacks were treated as property until after the Civil War. Then, once they were freed, they were treated as a lower class of human being than whites, subjected to open discrimination. The trend continues to this day, where people of color are treated as inherently suspicious, whether they’re shopping at WalMart or just hanging out with people of their own race. If they have the misfortune of living in a high-crime area, they’re treated as de facto criminals. Applying a different standard to Fourth Amendment jurisprudence makes sense. It levels the playing field for people of color. It does not elevate them above whites. It only recognizes that a person’s race is a factor that should be considered when determining whether a consensual encounter with law enforcement could “reasonably” be ended by the person being stopped.

Filed Under: 4th amendment, consensual stops, police stops, race, south carolina, stop and frisk

Ring Continues To Pitch Facial Recognition To Law Enforcement While Claiming It Won't Be Adding Facial Recognition To Its Cameras

(Mis)Uses of Technology

from the boths-sides-of-mouth-fully-operational dept

Ring continues to insist it is not adding facial recognition to its sadly super-popular doorbell cameras. Its insistence is suspect for several reasons.

First, it employs a “Head of Facial Recognition Tech” at its Ukraine office. A company that isn’t planning to add facial recognition doesn’t need anyone in charge of tech it’s not planning on using.

Second, its lengthy answers to Congressional questions stated that the company would continue to develop and explore other options in response to “customer demand.” If enough customers express an interest in facial recognition, Ring would be stupid not to add that to its list of features, even if it has spent months denying it ever plans to do so.

Third, its answers to direct questions about facial recognition software are anything but direct. Cyrus Farivar of NBC News asked Ring about this feature after receiving something that indicated otherwise from a public records request. The response sounds firm but really isn’t.

Morgan Culbertson, Ring spox, emailed:

“The features described are not in development or in use, and Ring does not use facial recognition technology…”

This sounds definitive but Ring’s pitch to cops — obtained by Farivar — says something different:

At the 1:30 mark, the video says the company is working on future versions that will include “suspicious activity detection and person recognition.”

How does the company reconcile this pitch to law enforcement with its public statements on the subject? It can’t. So, it doesn’t. Farivar’s questions to Ring about this video went unanswered.

Maybe the explanation is that Ring isn’t planning to add it to its consumer products but is developing something for law enforcement to apply to footage via its portal. This would allow Ring to continue to claim it’s not adding facial recognition software to its cameras while still making use of its “Head of Facial Recognition” person.

But there’s also no reason to believe Ring is being honest about any of this. Like any company under the x-ray, it will say what serves it best right now even if it means rolling back those quasi-promises the minute Ring feels it can get away with making its products even more problematic.

Filed Under: doorbells, facial recognition, law enforcement, police
Companies: amazon, ring

Stalkerware Developer Found Leaking Sensitive Data From Thousands Of The Software's Victims

Failures

from the it-all-starts-with-not-giving-a-fuck-about-anyone dept

Oh, if only this were more of a surprise. Another vendor selling sketchy spyware has been discovered to be careless with its handling of all the sensitive communications and data it pulls from victims’ cell phones. (via Databreaches.net)

The company doing all the leaking is ClevGuard, which I guess is short for “clever.” It apparently isn’t. Its phone-snooping app, KidsGuard, is supposed to allow parents to monitor their children’s cell phone usage. Obviously, there are other applications for it, like monitoring the activity of spouses, ex-spouses, girlfriends/boyfriends of the current and ex- variety, employees, dissidents, journalists… just about anyone someone else wants to spy on.

The name isn’t deliberately misleading but the app disguises itself as a system update app, allowing it to hide in plain sight, untroubled by surveillance targets. The company even advertises the app’s flexibility as going beyond monitoring kids to spying on other adults.

Zach Whittaker has the details on the leaky app for TechCrunch:

TechCrunch obtained a copy of the Android app from Till Kottmann, a developer who reverse-engineers apps to understand how they work.

Kottmann found that the app was exfiltrating the contents of victims’ phones to an Alibaba cloud storage bucket — which was named to suggest that the bucket only stored data collected from Android devices. It’s believed the bucket was inadvertently set to public, a common mistake made — often caused by human error — nor was it protected with a password.

Using a burner Android device with the microphone sealed and the cameras covered, TechCrunch installed the app and used a network traffic analysis tool to understand what data was going in and out of the device — and was able to confirm Kottmann’s findings.

The app — in its full paid form — is pervasive. In addition to hoovering up contacts, photos, SMS message content, and location data, it provides a wealth of information about conversations occurring in WhatsApp, Viber, and Facebook Messenger. It also compromises more secure services like Snapchat and Signal by taking snapshots of conversations and relaying them to the company’s servers.

The company has since shut down access to the leaky Alibaba cloud storage bucket, but the damage may already have been done. And it’s just more evidence that companies selling malicious stalkerware care very little about the security of their customers… and even less about the security of their software’s victims.

Filed Under: data breach, kidsguard, parents, snooping
Companies: clevguard

Ring Says It Helps Cops Fight Crime But The Data Shows It's No Better At This Than Any Other Security Camera

Overhype

from the and-its-competitors-aren't-dragged-down-by-law-enforcement-baggage dept

The number of law enforcement agencies Ring partners with continues to grow — up to nearly 900 by the latest count. Ring pitches its devices to homeowners as a better way to keep their homes secure. And maybe it is. But the pitches it makes to law enforcement agencies are something else.

Ring drives this particularly questionable engagement by insinuating people who’ve received free or cheap cameras will become part of a surveillance network overseen by cops, who will be able to solve tons of crimes and receive tons of footage from compliant recipients without a warrant.

None of this appears to be happening. While homes with Ring cameras are arguably more secure, the same could be said for any consumer camera — most of which aren’t handed to homeowners by law enforcement. A recent report by Cyrus Farivar for NBC News shows there’s not much crime being solved by the vast network of Ring cameras and the company’s hundreds of law enforcement partners. (via Jeffrey Nonken in the Techdirt chat window)

Thirteen of the 40 jurisdictions reached, including Winter Park, said they had made zero arrests as a result of Ring footage. Thirteen were able to confirm arrests made after reviewing Ring footage, while two offered estimates. The rest, including large cities like Phoenix, Miami, and Kansas City, Missouri, said that they don’t know how many arrests had been made as a result of their relationship with Ring — and therefore could not evaluate its effectiveness — even though they had been working with the company for well over a year.

The extensive agreements with Ring — ones that allow the company to write press releases and veto law enforcement statements it doesn’t like — apparently don’t require any sort of data gathering or reporting that would tie Ring cameras to arrests. The report says none of the 40 departments contacted collect data that might indicate whether or not the increased installation of cameras has reduced crime or resulted in more arrests.

Ring cameras may be everywhere, but their contribution to combating crime is apparently no greater than its competitors. Any other camera company could boast it’s contributed just as much as Ring has, all without blurring the line between public and private by aggressively courting law enforcement agencies. The list of criminals taken down by Ring footage reads like a small town paper’s police blotter:

Of the arrests that police connected to Ring, most were for low-level non-violent property crimes, according to interviews and police records reviewed by NBC. These arrests detailed the theft of a $13 book, the theft of a Nintendo Switch video game console (and several items, including two coffee mugs, purchased from the Home Shopping Network valued at $175. In Parker County, Texas, two people were arrested for allegedly stealing a dachshund named Rufus Junior, valued at $200.

These are the success stories. And that’s from agencies that actually have success stories to relate. Most don’t have anything to talk about or are only reporting a very small number of arrests in relation to their cities’ overall property crime rate.

But it has opened a dialog of sorts between citizens and law enforcement. Some people view their cameras and the law enforcement portal as a “may I speak to the manager” connection.

Ring makes it so frictionless to share footage with police that some residents submit videos of anything they find displeasing, even when there is no indication that a crime has been committed, Lt. Santos, of Winter Park, said.

“We’ve gotten videos of racoons in the yard, with people saying, ‘Hey, can you deal with these racoons?’” he said. “That’s the type of people we’re dealing with. They’re constantly sending us video clips.”

Ring continues to insist its hundreds of law enforcement partnerships makes citizens safer. But outside of a handful of arrests related to small property crimes, there’s nothing in the data that suggests the thousands of cameras and hundreds of partnerships has actually increased public safety.

Filed Under: doorbells, law enforcement, overhype, policy, ring, security
Companies: amazon, ring

Kentucky Appeals Court Says Cops Need Warrants To Obtain Real-Time Cell Site Location Info

Privacy

from the another-post-Carpenter-trimming-of-the-Third-Party-Doctrine dept

The Supreme Court’s Carpenter decision added Fourth Amendment protections to historical cell site location information (CSLI). The Court recognized people had a privacy interest in their location info, even if it was collected and stored by third parties. This narrow finding — that historical cell site info is covered by the Fourth Amendment — has created ripples that are rocking the Third Party Doctrine boat, resulting in the Carpenter decision being applied to other records historically believed to be outside the Constitution’s protections.

Kentucky’s Court of Appeals has extended protections to real-time cell site location info — something the country’s top court expressly refused to do. (via FourthAmendment.com)

During an investigation of an armed robbery, police officers contacted the suspect’s cell phone carrier and had an employee “ping” the phone to discover its location. The officers remained in contact with the carrier for the next hour-and-a-half, pinging the phone until they located the phone and the suspect. Officers intercepted the suspect upon his return to the town where the robbery took place. No warrant was sought.

Citing the Supreme Court’s Carpenter decision (and a recent Massachusetts state court ruling), the court [PDF] agrees with the defendant: it’s makes little sense to say tracking someone’s past movements with historical CSLI is somehow be more worthy of Constitutional protection than actively tracking them using real-time CSLI.

We agree that the acquisition of real-time CSLI implicates significant, legitimate privacy concerns. As the Supreme Judicial Court of Massachusetts recently observed, when the police are able to ping a cell phone in order to discover its location, they also acquire the ability to identify the real-time location of its owner, which is “a degree of intrusion that a reasonable person would not anticipate[.]” Commonwealth v. Almonor, 120 N.E.3d 1183, 1195 (Mass. 2019) (quoting State v. Earls, 70 A.3d 630, 642 (N.J. 2013)). This distinguishes the situation from one in which the police track an individual in the public thoroughfare or seek access to records held by a third party. “Although our society may have reasonably come to expect that the voluntary use of cell phones — such as when making a phone call — discloses cell phones’ location information to service providers, and that records of such calls may be maintained, our society would certainly not expect that the police could, or would, transform a cell phone into a real-time tracking device without judicial oversight.”

Tracking people using CSLI does more than reveal their movements in public spaces — places they could theoretically be observed by anyone, including law enforcement. It also tracks their movements in private spaces, since their phones go wherever they go. This puts it in Fourth Amendment territory.

Thus, because pinging a cell phone enables the police almost instantaneously to track individuals far beyond the public thoroughfare into areas where they would have a reasonable, legitimate expectation of privacy, we conclude that a warrant is required to acquire real-time CSLI.

The government argued that the good faith exception should apply. The real-time pings were performed two years before the Supreme Court delivered its Carpenter ruling. Beyond that, the officers said the state courts had delivered no rulings on point that would have put cops on notice they needed warrants to obtain real-time CSLI.

Wrong, says the court. The standard that needs to be applied to gray areas where privacy rights might be implicated isn’t the lack of a “no” from the courts. It’s the absence of a “yes.”

Unfortunately for our purposes, the Hedgepath Court did not rule on the matter because it was able to resolve the case on other grounds, but its commentary makes it clear that at the time Reed’s cell phone was pinged, there was no clearly established, binding precedent in Kentucky regarding real-time CSLI upon which the police could rely. In the absence of such precedent, the decision to proceed without a warrant and without a showing of exigent circumstances or other exception does not support a finding of good faith.

Very few courts are willing to draw the line here. Usually, good faith is granted if no case on point has directly established cops cannot do certain things. But officers should be held to a higher standard: one that demands they have clearly established legal standards before they act, not simply assume the lack of legal blessing (from the legislature or courts) will make their questionable actions acceptable.

Filed Under: 4th amendment, cell site location info, csli, kentucky, location info, warrants