ICE, CBP Want To Sit With The Adults, Angling For Entrance Into The Intelligence Community

Privacy

from the all-about-foreigners-but-operating-domestically dept

Has the DHS been trying to put the “IC” in ICE? A letter reviewed by Betsy Woodruff of The Daily Beast seems to indicate ICE is possibly now part of the “Intelligence Community,” bringing it in line with the FBI, CIA, and others who have access to the NSA’s collections.

The revelation came in a letter that David Glawe, DHS’ undersecretary for intelligence and analysis, wrote to Congress late last year. This letter, the contents of which have not been previously reported, sheds new light on ICE’s relationship with the 17 U.S. government organizations that collect and analyze intelligence, known collectively as the Intelligence Community or IC.

It’s no secret ICE wants in. Previous reporting by The Daily Beast shows ICE and CBP both felt they had something to offer the Intelligence Community. Both agencies collect a lot of data on travelers and visitors, and the latter agency is cloning the contents of electronic devices (phones, laptops, etc.) with increasing frequency.

This attempt to cozy up to the IC was noticed by members of Congress, who asked for clarification on ICE’s intents and partnerships. This led to a letter from David Glawe the Beast reviewed — sent late last year — claiming ICE’s application for membership had been declined.

“The Secretary of Homeland Security and I agree that this is not the right time to pursue potential IC membership for CBP and ICE,” he wrote.

That’s what part of the letter states. The rest of it, however, isn’t nearly as clear. As Woodruff points out, Glawe’s answer is filled with jargon, making it difficult to parse ICE/CBP’s links to the IC. But there’s enough contained in the letter to make it appear as though ICE/CBP are doing exactly the thing David Glawe says they’re not doing. The letter refers to ICE’s “enhanced intelligence capabilities,” which include “collection.” This could be referring to some unreported programs ICE is running or new tech it’s deployed. But it also could mean what it says literally: that ICE is tapping into the IC’s collections.

This densely-worded flow of contradictions has raised concerns in the civil liberties community. (It should raise concerns elsewhere, but it almost always starts here.) What it sounds like is potentially-unlawful domestic surveillance.

“I’m curious about the phrases ‘fuses intelligence into operational functions’ and ‘activities to inform actions,’ which sound like there is some type of information sharing arrangement going on,” said Jake Laperruque, a lawyer for the Project on Government Oversight who focuses on privacy and surveillance. “If information is coming from PATRIOT Act Sec. 215 or FISA Section 702, that would be a huge controversy.”

Domestic surveillance in the interest of enforcing immigration laws would be a new twist on an old formula. Other IC components already have access to NSA data stores, which allow them to perform backdoor searches on domestic data and communications. ICE operates domestically but targets foreign persons here unlawfully. That novel blend will make blurring the lines on access to domestic communications and data that much easier.

Added to this mix is the CBP’s newfound enthusiasm for demanding social media account passwords and performing forensic searches of electronic devices. These two initiatives routinely ensnare US citizens and others here legally. With an IC partnership, domestic surveillance would expand — all under the theory that anything shared will result in better national security.

The Daily Beast has asked the DHS for clarification on the data collection it already performs as well as its “enhanced capabilities” via its connection to the Intelligence Community. The agency has yet to comment on Glawe’s cryptic, but worrisome, response to Congressional questions. There’s a good chance any answers provided will be just as cryptic and/or composed mainly of non-denial denials. This administration has made border security a priority. This is the ideal environment for expanding the IC to include immigration agencies. And once they’re in, they’ll stay in, no matter who’s running the White House in the future.

Filed Under: cbp, dhs, ice, intelligence, intelligence community, law enforcement, surveillance

Marcus Hutchins — The Guy Who Stopped Wannacry — Pleads Guilty To Conspiracy Charges

Legal Issues

from the enjoy-your-hollow-victory,-DOJ dept

Almost two years after Marcus Hutchins, a.k.a. MalwareTech, was detained by the FBI at the airport as he left a security conference in Las Vegas, the government finally has finally gotten its man.

Charges were stacked and restacked over the past couple of years, as the government brought pressure to bear on Hutchins, who maintained his innocence right up to the point he signed the plea agreement [PDF]. Faced with possibility of spending several years in jail — and evidence of his past, somewhat shadier exploits continuing to surface — the man who saved the world from the Wannacry ransomware has pleaded guilty to two conspiracy charges. This means the government will be dropping the other eight charges against Hutchins, which will hopefully keep the researcher from spending several years in jail.

The defendant voluntarily agrees to plead guilty to Counts One and Two of the superseding indictment.

The defendant acknowledges, understands, and agrees that he is, in fact, guilty of the offenses described in paragraph 4. The parties acknowledge and understand that if this case were to proceed to trial, the government would be able to prove the facts in Attachment A, as well as the facts set forth in Counts One and Two of the superseding indictment, beyond a reasonable doubt. The defendant admits that these facts are true and correct and establish his guilt beyond a reasonable doubt. The information in Attachment A is provided for the purpose of setting forth a factual basis for the plea of guilty. It is not a full recitation of the defendant’s knowledge of, or participation in, the offenses.

The agreement says both counts carry a possible five-year sentence each, but it seems unlikely it will ask the judge to depart upward from the guidelines. Marcy Wheeler’s back-of-the-envelope math puts this at about six months per charge, given Hutchins’ lack of criminal history. It may end up being more than that if the DOJ pitches something longer as some twisted form of payback for Hutchins exercising his right to defend himself against criminal charges. That’s not exactly unheard of.

Hutchins has also posted a short message at his personal website, admitting guilt and apologizing for the damage he may have caused.

As you may be aware, I’ve pleaded guilty to two charges related to writing malware in the years prior to my career in security. I regret these actions and accept full responsibility for my mistakes. Having grown up, I’ve since been using the same skills that I misused several years ago for constructive purposes. I will continue to devote my time to keeping people safe from malware attacks.

Hutchins’ plea brings an end to a dubious DOJ prosecution — one that makes the unproven assertion that creating and selling malware is a criminal act, whether or not Hutchins himself engaged in illegal acts using this malware. And it only further blurs the lines security researchers operate in, increasing the chance that research — which often includes the creation and deployment of malware — will be treated as criminal activity.

Filed Under: conspiracy, doj, fbi, guilty plea, malware, malwaretech, marcu hutchins, wannacry

Federal Agent: Using A Taped Box To Send Stuff Overnight Via FedEx Is Suspicious Behavior

Legal Issues

from the nothing-more-evil-than-a-convenient-shipping-option dept

Here’s how we’re fighting the War on Drugs. Lots of stuff going on, but not much seems to be happening in terms of actually, you know, keeping drugs from ending up in buyers’ hands. The byproduct of the problem — the cash — is all anyone seems interested in.

As Brad Heath points out in his tweets referencing this in rem complaint, federal agents camp out at major air traffic hubs looking for nothing but cash. As we’ve covered here earlier, the DEA is actually paying TSA agents to search for cash and alert officers if any amount worth seizing rolls through checkpoints.

The same thing is happening in FedEx hubs. In this case, officers from the DHS, Indiana State Police, Indiana Metro PD all combined to stop some cash from traversing the country from Ohio to Arizona.

The filing lets us know what the government finds suspicious in terms of packaging and sending stuff around the country: everything. If you like using FedEx and their new boxes, but apply a bit too much tape, you might be a drug dealer. From the complaint [PDF]:

Based on information and experience, task force officers can easily identify suspicious packages with indicators, such as newly-bought boxes bought from the shipping company, overnight shipping, and excessive taping at the seams of the box.

Boxes, tape, and overnight shipping are literally what FedEx is known for. Yes, these officers uncovered a lot of suspicious stuff once they were IN the boxes — packages of cash wrapped in fabric softener sheets — but they needed something to justify the search of the boxes in the first place. I’m sorry, but “information and experience” asserting little more than what hundreds of FedEx customers do every day just doesn’t cut it.

Sure, they ran a dog around the boxes and it alerted, but cash will probably prompt alerts anyway, given how much of it has circulated close to drugs or has been used as a drug delivery device. (A “blind” drug sniff is mentioned later, suggesting the dog and boxes were tossed into the room without a handler. It’s a nice control but doesn’t mean much when there’s already been an alert with the handler present. If the dog had “failed” to detect drugs without the handler present, this simply would have been omitted from the warrant.)

The only other link to suspicion was the fact that the package was being shipped to Arizona from Ohio, but both the “To” and “From” labels contained the same Arizona address. God forbid you ship anything to or from Arizona — not if any drug interdiction teams are in the area:

Parcels 6920 and 7068 drew attention for other reasons: they were heavily taped and being shipped to Arizona, known by law enforcement as a source for illegal controlled substances…

This is same assertion made about several states and major cities. Everything has a drug nexus if you’re in the business of drug warring. The thing is, there’s a lot of innocent activity going on in these same cities and states, but it all looks suspicious through a drug interdiction lens.

In total, there’s a $108,000 being forfeited as suspected drug proceeds. The final nail in the evidentiary coffin is the background check on the package’s recipient. Not sure how it all adds up to drug dealing, but I guess all crimes are gateway crimes or whatever.

Richard Reyes has a criminal history for theft, assault causing bodily injury, and criminal mischief. In 2003, Richard Reyes was found guilty of one count of theft in case number M-0111051 (Tarrant Criminal County Court, Texas). In 2003, Richard Reyes was also found guilty of one count of assault causing bodily injury and one count of criminal mischief in case numbers 0610831 and 0610832 (Travis County Court, Texas).

I’m not saying Reyes isn’t a drug dealer. I’m saying this is pretty thin connective tissue if someone’s trying to prove the money came from the sale of drugs. But the evidentiary bar is so low law enforcement is probably going to get to keep this cash.

Then there’s the presence of a DHS agent. This allows Indiana law enforcement to profit from suspected criminal activity occurring outside of its jurisdiction. The package was sent from Ohio to Arizona but intercepted in Indianapolis. Dragging a federal agent along keeps the money from going into the coffers of coppers in the two states where drug dealing may actually be occurring. Handy that.

This is just one of dozens of similar litigation filed every year in the federal court system to take cash from people the government has no interest in arresting or charging. Somehow, seizing cash is supposed to cripple drug cartels. Seeing as civil forfeiture has experienced no serious income dips over the past 30 years, it’s safe to say this process is doing nothing but enriching government agencies who prefer cash to preventing crime.

Filed Under: 4th amendment, dhs, indiana, indiana metro pd, indiana state police, probable cause, shipping, tape, war on drugs
Companies: fedex

The French Govt's Hand-Rolled Encrypted Messaging Service (Briefly) Allowed Anyone To Pretend They Were A Government Official

Failures

from the inauspicious-debut dept

Early last year, news leaked out the French government was building its own encrypted messaging service. This seemed a bit disingenuous when this same government was routinely calling for backdoors in encryption for everyone else. The potential upside of the government rolling its own is that it would push government officials off third-party services and onto a platform where they might not be compromised along with everyone else if or when these privately-run platforms were hacked/backdoored.

The problem with rolling your own encryption is it’s a more daunting task than those asking for it imagine it will be, as Mike Masnick pointed out in last year’s post.

However, doing encrypted messaging well is… difficult. It’s the kind of thing that lots of people — even experts — get wrong. Rolling your own can often get messy, and you have to bet that a government rolling its own encryption for government officials to use is going to be a clear target for nation-state level hackers to try to break in. That’s not to say it can’t be done, but there are a lot of tradeoffs here, and I’m not sure that the best encryption is going to come from a government employee.

So far, this warning has proven true. The best encryption hasn’t come from a government employee. At least, not yet. As Sean Gallagher writes for Ars Technica, the government’s handmade messaging service, Tchap, has already been broken by a security researcher.

The name servers set up by the departments and ministries of the French government running Matrix’s code were parsing email addresses submitted for new accounts to check against existing email addresses within their directory services. After doing code analysis on the Tchap package posted to Google’s Play store, [researcher Baptiste] Robert used the Frida proxy tool to alter a Web request for a new account from the app to pass a crafted email address value that grafted his own address onto a known account on the targeted directory server—presidence@elysee.fr, the official email address of the Élysée, the official residence of France’s president. The value sent to the server used an @ symbol to separate the two addresses (anaddress@protonmail.com@presidence@elysee.fr).

Because of the way the directory service validated the email address, it matched the address in the second half of the pair with the known address. But the code that parsed the address for the validation email on the server side, which was built with the Python email.utils module, trimmed off everything after the first valid address. That means Robert got an email back for verification of the account, and the server thought the address was an official government account.

Not only was Robert able to get his faux account validated within two hours of downloading the app, he was also able to obtain plenty of info linked to other government account profiles. On the bright side, the team behind the app reacted quickly to notification of the security flaw and suspended account creation until it could be patched. The French government has also instituted a bug bounty program for Tchap, which will hopefully result in further flaws being addressed before they’re exploited by criminals or state-sponsored hackers.

To be fair, Tchap is still in its “beta” stage. But that’s not much comfort considering it was rolled out for use in this state, exposing government employees’ personal account info and allowing any outsider to take a seat at the Tchap table just by exploiting the system’s less-than-robust validation process.

Filed Under: encryption, france

A Seamless Journey Awaits You On The Outbound Flights: All You Have To Give Up Is Your Face

Privacy

from the say-cheese,-citizens dept

The DHS’s airport panopticon is rolling out slowly, but surely. And of course it’s being done with as little oversight or guidance as possible. Major international airports are already turning your face into your ID, giving travelers little option but to get their faces out if they don’t want to receive extra questioning.

If you’re worried about adding your face to the government’s extra-large bin o’ biometrics, you’re welcome to opt out. The easiest way to avoid this is to not travel at all, which is exactly what the DHS suggests. There are other options, but by the time you know they’re available, you’ve likely already had your face scanned and matched against the DHS database by software known mostly for its failure rate.

This happened to a JetBlue flier who noticed her face had been scanned and matched against… something… before she was able to board her international flight. She reached out to JetBlue via Twitter and got some not-very-enlightening answers and a couple of disturbing clarifications.

I just boarded an international @JetBlue flight. Instead of scanning my boarding pass or handing over my passport, I looked into a camera before being allowed down the jet bridge. Did facial recognition replace boarding passes, unbeknownst to me? Did I consent to this?

JetBlue responded to Mackenzie Fegan with the sort of apology one offers on Twitter: I’m sorry this made you feel [x]. The option no one at JetBlue will point out to you remains an option.

You’re able to opt out of this procedure, MacKenzie. Sorry if this made you feel uncomfortable.

Note that it’s “this” and not “we.” This is how a corporate entity absolves itself of responsibility while nominally offering an apology. Good stuff.

Fegan’s follow-up question was more on point:

Presumably these facial recognition scanners are matching my image to something in order to verify my identity. How does @JetBlue know what I look like?

JetBlue’s response was not very comforting:

The information is provided by the United States Department of Homeland Security from existing holdings.

Oh. “Exisiting holdings.” Awesome. But where did this “existing holding” get its backstock of facial photos? Well, some may have come from passports. Some likely came from state driver’s license databases. The DHS has a number of sources for people’s photos: mugshots, government employee records, biometric info collected from various state and federal agencies charged with vetting volunteers and applicants for certain forms of employment (day care, elder care, any job the government feels you need a license to perform…), and any place else the government may have acquired a photo of you (or someone who somewhat resembles you).

The process works nearly instantaneously. It’s seamless and slick and all the work is done behind the scenes. Just smile and move forward. Sure, you can opt out — or so JetBlue says — but the link JetBlue provided explains nothing but its fervent belief that more facial recognition databases can only be a boon for airline passengers.

Since the program’s launch in 2017, more than 50,000 customers have participated in biometric boarding on 500+ flights across all four cities. There is no pre-registration required. Customers can simply step up to the camera for a photo match and make their way onto the aircraft.

“The success of JetBlue’s biometric boarding program is a testament to the airline’s ongoing work to create a personal, helpful and simple experience,” said Ian Deason, senior vice president of customer experience, JetBlue. “The boarding touchpoint is an area that needs innovation and we feel biometrics will change the future of air travel as we look to create a more seamless journey throughout the airport.”

Opting in is as simple as putting your face in front of the cameras the DHS and JetBlue nudge travelers toward. Opting out, however, doesn’t appear to be a process anyone — the DHS or JetBlue — are willing to talk about openly. The DHS just says, “Don’t fly.” JetBlue says, “Why would anyone want to make their ‘journey’ less ‘seamless?'”

Flying has always been something the government has taken great interest in. The pitch is passenger safety, but the more the government knows about where and when you travel, the more secure it feels. It doesn’t do much for the security of passengers but it eases the government’s mind when its freely-moving citizens can still be tracked. Grabbing faces at checkpoints to ensure “seamless journeys” is just another step down the path the government’s been traveling for awhile now, which includes allowing the CBP and DEA to warrantlessly peruse traveler data to find people it wants to track… or to shake down for cash.

The tech is finally catching up with the government’s post-9/11 desires. It has asked repeatedly for us to trade privacy and personal security for a nebulous greater good. And it’s gone ahead and made those tradeoffs no matter what the answer has been.

Filed Under: boarding pass, dhs, facial recognition, flights, homeland security
Companies: jetblue

Watchdog Says Australia's Traffic Enforcement System Has Hits Hundreds Of Drivers With Bogus Fines

(Mis)Uses of Technology

from the move-fast-and-break-things:-hefty-bureaucracy-edition dept

In Australia, the government has automated traffic enforcement, letting the machines do the work. It’s also automated the limited due process procedures, giving aggrieved citizens the chance to have their complaints and challenges ignored at scale, as The Newspaper reports.

At least 397 motorists in Victoria, Australia, lost their right to drive because the state government bungled the handling of speed camera fines. In a report released Wednesday, Victoria Ombudsman Deborah Glass blasted Fines Victoria, the agency responsible for overseeing the handling of citations. The report reviewed 605 complaints from members of the public about how this year-old state agency handled their situations.

“Many complaints were about delay in the processing of nominations, completing reviews and implementing payment plans,” Glass said in a statement. “The impact of these issues should not be underestimated. People had their licenses wrongly suspended, or were treated as liable for substantial fines, when they had committed no offense.”

Automating the back end and the front end results in this sort of thing — just one of several personal anecdotes the Ombudsman collected from angry Australians forced to deal with the user-unfriendly system. From the report [PDF]:

Dan contacted the Ombudsman about infringements incurred by his late son who had died in tragic circumstances. Dan said he made multiple attempts to call Fines Victoria, but on each occasion the phone went to an automated service, or he was on hold for a long time.

Dan also said he had sent through multiple complaints online but had not received a response. We contacted Fines Victoria, providing a copy of the Coroner’s ‘confirmation of death certificate’ for Dan’s son. We followed up several times after receiving no response. Fines Victoria said later they had not received the email from us.

Dan received further enforcement letters which he said was extremely stressful and upsetting. He became increasingly concerned the Sheriff would go to his son’s home which he had shared with housemates.

Fines Victoria put all 27 outstanding matters, totalling $7,636.60, on hold pending their withdrawal. The enquiry process, however, went for close to 40 days. This is despite Dan providing all relevant information to Fines Victoria a number of times before contacting us.

That’s one of the possible outcomes of Fines Victoria mishandling its end of the complaint process: law enforcement showing up to seize property and auction it off to pay fines. All of this is set in motion automatically via date triggers. From the report, it appears Australian citizens can spend every day of their challenge periods on hold without ever reaching anyone who could help them with a resolution.

Even the lucky few who manage to speak to a live person aren’t going to receive much help. The multiple failures detailed in the report received responses from Fines Victoria ranging from “not our fault” to “we’ll try not to screw so many people over in the future.”

One citizen sums up the Fines Victoria experience succinctly:

When we make a mistake, we pay. When they make a mistake, we pay.

Some of this could have been prevented if Fines Victoria had used all of its allotted time to ensure proper functionality before bringing the system online. Instead, the government decided to rush implementation, leading to a spectacular run of failures that stripped people of their licenses, hit them with bogus fees, and otherwise made their lives miserable.

On 31 December 2017, Fines Victoria began operation with only partial IT functionality. Problems with IT functionality, and related procedural and processing issues, have been apparent since the inception of the agency…

It was not clear why, with a default commencement date of 31 May 2018, the decision was taken to commence earlier than this on 31 December 2017. This decision was perplexing considering Fines Victoria was reporting that significant IT challenges were affecting its operation from the time it commenced.

This rush job led directly to Australians being punished by a system that was much, much worse than the one it replaced.

Complaints received about Fines Victoria in 2018 represented a 74 per cent increase from the number of complaints received the previous year about Civic Compliance Victoria.

All the new system added was “significant IT challenges,” significant hold times, and a much lower chance of having problems resolved.

In addition to the rise in the number of complaints, Ombudsman staff observed a change in the nature of the complaints. People were expressing frustration about delays and being unable to make contact with Fines Victoria much more frequently than with the predecessor agency. There was also an increase in complexity about the administration of infringements which meant many complaints could not be resolved through a quick series of enquiries.

It’s not just the software. It’s also the people. The Ombudsman notes that the problems in the system were made worse by the government employees fielding complaints, who often seemed to go out of their way to push problems back on drivers.

Enforcement at this scale isn’t possible without at least some automation. But the government’s botched implementation shows it cared more about maximizing revenue than minimizing error. And when everything goes this wrong this quickly, it’s the citizens who end up paying for both the end results of a broken system and the costs involved in fixing it.

Filed Under: australia, automated traffic enforcement, fines, mistakes, traffic enforcement, victoria

State Investigator Granted Immunity For Hours-Long Detention Of Doctor At Gunpoint During A Search For Medical Records

Failures

from the CAREFUL!-HE'S-GOT-A-FAX-MACHINE! dept

How far can a law enforcement officer go to ensure an administrative search — one looking for records, rather than contraband — is carried out without interference? Pretty damn far, it appears.

A case before the Fifth Circuit Court of Appeals alleges Fourth Amendment violations during a search for medical records. Dr. Ikechukwu Okorie was on the receiving end of a search due to the state licensing board’s suspicion he was over-prescribing opioids. Okorie wasn’t facing criminal charges. The state board of licensing had suspended his license while it investigated. Okorie sought recertification. The board agreed to meet with him but also sought an administrative warrant to search his medical office for evidence it needed to make a determination on his recertification.

Serving a warrant of this type — one not linked to any criminal accusations — takes a village, apparently. From the decision [PDF]:

According to his complaint and Rule 7 supplement to that pleading, a large team made up of the following executed the warrant: five Board investigators, a Mississippi Bureau of Narcotics agent, a Hattiesburg High Intensity Drug Trafficking Agent, and two federal DEA agents.

Lots of bored federales hanging around Hattiesburg, it seems. That initial show of force — nine officers, most of them armed — was followed by more shows of force. One officer in particular — a board investigator — was especially enthusiastic about ensuring Dr. Okorie didn’t leave the premises or disrupt the search.

On entering the clinic, Board investigator Jonathan Dalton brandished his gun and pushed Okorie into his office. He then served Okorie with the warrant. After reviewing the warrant, Okorie attempted to leave his office to discuss it with his staff. Dalton stopped Okorie. He pushed Okorie down while saying, “if you don’t sit down I will put you down!” Okorie feared for his life. Dalton eventually allowed Okorie to instruct his staff to fax the warrant to his lawyers and print the requested patient records. But while Okorie did so, Dalton stood next to him with his gun drawn.

This is extremely odd behavior for a Board investigator, especially since Dr. Okorie had approached the board to ask for a recertification hearing. But that wasn’t the extent of the investigator’s abuse of his position.

Once Okorie briefly spoke with his staff, Dalton brought him back into his office, where Okorie was detained for the remainder of the search. After two hours had passed, Okorie asked to go to the bathroom and was told no. Okorie “plead[ed]” with Dalton, explaining that he would have to urinate himself if not allowed to use the restroom. At this point, Dalton, “with his gun drawn,” escorted Okorie to the bathroom. Dalton forced Okorie to leave the bathroom door open the entire time, even though a female investigator and other individuals were present. Dalton also instructed Okorie to keep his hands where Dalton could see them. Only when the agents were done executing the search, three to four hours after it began, was Okorie allowed to leave the clinic.

The lower court granted the investigator immunity, ruling that it was not clearly established government agents couldn’t act like unreasonable assholes during an administrative search not related to a criminal investigation. Sure, it seems excessive, considering how many officers were present during the search (nine) and how cooperative Dr. Okorie was, but there’s a dearth of caselaw related to the Fourth Amendment and administrative searches.

The Fifth Circuit Court notes that these cases are becoming more common — suggesting the government behaves just as badly during non-criminal searches. This is the third case dealing with administrative searches it has seen in the last year. Unfortunately for everyone who isn’t a law enforcement agent, the cases haven’t been perfectly identical, so government employees keep escaping being held personally responsible for rights violations.

The last case the Fifth Circuit examined dealing with these issues resulted in a win for the accused officer and a blistering statement from Judge Don Willett on the farce that is qualified immunity.

The court is right about Dr. Zadeh’s rights: They were violated.

But owing to a legal deus ex machina—the “clearly established law” prong of qualified-immunity analysis—the violation eludes vindication. I write separately to register my disquiet over the kudzu-like creep of the modern immunity regime. Doctrinal reform is arduous, often-Sisyphean work. And the entrenched, judge-made doctrine of qualified immunity seems Kevlar-coated, making even tweak-level tinkering doubtful. But immunity ought not be immune from thoughtful reappraisal.

[…]

To some observers, qualified immunity smacks of unqualified impunity, letting public officials duck consequences for bad behavior—no matter how palpably unreasonable—as long as they were the first to behave badly.

There’s no dissent attached to this one, even though it ultimately finds in favor of the government. The court says Okorie’s claims are valid. There was nothing about this search that justified the show of force by Dalton.

Though law enforcement has understandable safety concerns when initially securing any scene, cf. Bailey v. United States, 568 U.S. 186, 195 (2013) (noting that Summers recognizes a need to “secure the premises” and for officers to take “command of the situation”), that would not seem to support hours-long detention of nonviolent individuals present at an administrative search. Yet Dalton allegedly drew his gun while accompanying Okorie and made him keep his hands visible at all times, even two hours into the detention. By this point, concerns about safety did not justify such intrusive measures. And with nine agents present in the office to execute the search, the need for such an intrusive detention was even lower.

[…]

Nothing indicates Okorie would have been uncooperative had he not been detained, and certainly nothing indicates that a drawn gun was necessary to keep Okorie restrained.

Even so, the lack of anything on point means Dalton can’t be held accountable, seeing as he was the first to violate someone’s rights in this particular manner.

As we have discussed, that at a minimum affects the balancing of Summers’s interests in analyzing the intrusiveness of a detention even if it does not outright eliminate the government’s right to detain without probable cause. But we have never considered the question, and only a few other courts have. The dearth of caselaw on this question might indicate the government rarely detains people while executing administrative searches, a fact that would be consistent with Okorie’s view of the Fourth Amendment. The consequence, though, is that Okorie is unable to point to caselaw clearly establishing the unlawfulness of this type of detention. As a result, qualified immunity defeats Okorie’s claim.

Here’s the silver lining: if any armed officer decides to violate someone’s rights this way in the future during an administrative search… well, they’ve been duly warned.

Going forward, an hours-long detention of a person during an administrative search of a medical clinic or similar establishment, during which a gun is drawn, will be unlawful absent heightened security concerns.

That’s the bright line. It’s very specific, dealing with only one type of search, and has requirements that could possibly be overlooked if the government can make the court believe the search presented “heightened security concerns.” Careful with those “furtive movements,” searchees.

Filed Under: 5th circuit, dea, ikechukwu okorie, immunity, jonathan dalton, licensing, qualified immunity, warrant

Reverse Warrant For Cell Site Location Info Results In Wrong Man Being Jailed

Privacy

from the first-but-certainly-not-the-last dept

Reverse warrants are the new regular warrants. Ever since law enforcement discovered most Americans carry tracking devices with them 24/7, they’ve been approaching cellphone providers with warrants targeting geographic areas rather than people.

When a crime has been committed but cops don’t have any suspects, they ask Google and others to canvass the area for them. Officers hand providers a geofence and ask for everyone who wandered into the selected area during a certain timeframe. Once cops have everyone, they start looking for someone.

It seems weird but it’s really not all that different than sending officers out to areas around crime scenes to ask anyone if they’ve seen anything. The difference here is cops are getting info about people’s movements in an area when they’re not suspected of any criminal activity. In addition, the areas covered by warrants often include high-traffic areas like businesses and multi-family housing, increasing the chance cops are going to zero in on the wrong suspect simply because someone lives or works near a crime scene.

That’s exactly what happened in Phoenix, Arizona. Detectives investigating a shooting handed a reverse warrant to Google. This data was used to arrest the wrong person, as Jennifer Valentino-DeVries reports for the New York Times.

The police told the suspect, Jorge Molina, they had data tracking his phone to the site where a man was shot nine months earlier. They had made the discovery after obtaining a search warrant that required Google to provide information on all devices it recorded near the killing, potentially capturing the whereabouts of anyone in the area.

[…]

But after he spent nearly a week in jail, the case against Mr. Molina fell apart as investigators learned new information and released him. Last month, the police arrested another man: his mother’s ex-boyfriend, who had sometimes used Mr. Molina’s car.

Police like the new tool, but acknowledge it has its limits. First, there’s a lot of junk data to sort through, and not all investigators have the training necessary to make sense of these quasi-tower dumps. But that hasn’t stopped them from using this option with increasing frequency. Google — which holds up to ten years of location data in a massive database referred to by employees as the “Sensorvault” — is now receiving up to 180 requests a week for mass location data.

Prosecutors seem cautious about the tool as well, which is a good sign. But considering what happened to Jorge Molina, this statement seems a bit too optimistic.

“It doesn’t pop out the answer like a ticker tape, saying this guy’s guilty,” said Gary Ernsdorff, a senior prosecutor in Washington State who has worked on several cases involving these warrants. Potential suspects must still be fully investigated, he added. “We’re not going to charge anybody just because Google said they were there.”

Well, maybe Ernsdorff won’t. But it appears others will. The more law enforcement shoots first and asks questions later, the more often it’s going to end up putting the wrong person behind bars. Like any other bulk collection, the potential to reach the wrong conclusion while sorting through haystacks is omnipresent. If Google’s responding to tens of thousands of requests a year for bulk location data, Jorge Molina’s story isn’t going to remain an outlier for long. Certainly the tool has proven useful in other cases, but the sheer number of requests suggests law enforcement isn’t using this tool cautiously. That’s bad news for everyone carrying a cellphone.

Filed Under: cell site location info, csli, false arrests, jorge molina, phoenix, reverse warrant
Companies: google

Another Attempt To Tie Twitter To Terrorist Acts And Another Dismissal With Prejudice

Legal Issues

from the Definition-Of-Insanity,-PLLC dept

“A series of lawsuits,” the court calls it. This is the ongoing work of 1-800-LAW-FIRM and Excolo Law — two firms that specialize in bringing losing lawsuits to federal courts. It’s a series of lawsuits and a series of losses. An unbroken string of dismissals at both the district and appellate levels — all in response to the firms’ attempts to hold social media companies responsible for the acts of terrorists.

Mandy Palmucci — a victim of the terrorist attacks in Paris, France — filed an incredibly long lawsuit (121 pages!) last year with the assistance of these two law firms. She needn’t have bothered. This one joins the pile of rejected complaints passing through the federal court system. (h/t John Roddy)

The only thing notable about this latest loss is how irritated Judge William H. Orrick seems to be with these lawsuits that keep landing in his court. Handling one of these lawsuits twice appears to have dug deep into Judge Orrick’s reserves of patience. From the decision [PDF]:

In two decisions – Fields v. Twitter, Inc., 217 F. Supp. 3d 1116 (N.D. Cal. 2016) and Fields v. Twitter, Inc., 200 F. Supp. 3d 964 (N.D. Cal. 2016) – I concluded that surviving family members of government contractors killed by an ISIS-identified terrorist could not pursue claims for direct liability under the ATA (or related state law claims) because there was no proximate cause “between Twitter’s provision of accounts to ISIS and the deaths of” plaintiffs’ family members. Id. at 1127. I also held that Twitter was immune from liability for its provision of services to users (even terrorist users) under Section 230 of the Communications Decency Act (CDA), 47 U.S.C. § 230(c)).

The judge points out the Appeals Court reached the same conclusions, but more expeditiously. It decided the plaintiffs’ “proximate cause” claims were so weak it didn’t even need to discuss Section 230 immunity.

Then the judge sends a not-too-subtle message to the law firms pushing these baseless lawsuits

Following the Fields decisions, materially similar direct liability claims have been rejected by numerous judges in this District and elsewhere. See Clayborn v. Twitter, Inc., 17-CV-06894- LB, 2018 WL 6839754 (N.D. Cal. Dec. 31, 2018); Copeland v. Twitter, Inc., 352 F. Supp. 3d 965, 17-CV-5851-WHO (N.D. Cal. 2018); Taamneh v. Twitter, Inc., 343 F. Supp. 3d 904, 17-CV04107-EMC (N.D. Cal. 2018); Cain v. Twitter Inc., 17-CV-02506-JD, 2018 WL 4657275 (N.D. Cal. Sept. 24, 2018); Gonzalez v. Google, Inc., 335 F. Supp. 3d 1156, 16-CV-03282-DMR (N.D. Cal. 2018) (Gonzalez II); Gonzalez v. Google, Inc., 282 F. Supp. 3d 1150 (N.D. Cal. Oct. 23, 2017) (Gonzalez I); Pennie v. Twitter, Inc., 281 F. Supp. 3d 874, 17-CV-00230-JCS (N.D. Cal. Dec. 4, 2017); see also Crosby v. Twitter, Inc., 303 F. Supp. 3d 564 (E.D. Mich. March 30, 2018).

Given the short and whatever’s the opposite of “illustrious” history of these lawsuits, the judge asked the plaintiff why he should be bothered to allow the case to proceed.

In light of the similarities between Palmucci’s theories of liability and factual allegations here and those in Copeland et al v. Twitter, Inc. et al., No. 17-CV-05851-WHO and Fields v. Twitter, No. 16-CV-0213-WHO, I issued an Order on November 30, 2018, requiring plaintiff to “file a supplemental brief not exceeding five pages identifying what material facts differentiate this case from the facts pleaded in Copeland, Fields” and two other decisions from this District, Cain v. Twitter Inc., No. 17-CV-02506-JD and Gonzalez v. Google, Inc., 16-CV-03282-DMR.

And received, “Ummmmmm… because?” for a reply:

Palmucci was given an opportunity to explain why – in light of the caselaw identified above – her case should continue. She declined, essentially admitting that no additional facts could be alleged that might state her claims under the ATA or state law.

Dismissed with prejudice. That means there will be no re-filing of this lawsuit. Just the inevitable appeal — one that will be headed to an appeals court that’s already found these lawsuits baseless. Another rejection awaits, and a bit more of the courts’ time will be wasted by a couple of opportunistic law firms that have discovered a way to make money without actually being of any use to their clients.

Filed Under: mandy palmucci, material support, section 230, william orrick
Companies: 1-800-law-firm, excolo law, twitter