from the starting-with-what-we-don't-know-and-working-our-way-backwards dept
Reverse warrants have been deployed again. And, again, Wisconsin law enforcement agencies are involved. The feds used a reverse warrant to track down robbers who hit a bank at a strip mall just outside of Milwaukee earlier this year.
The feds are at it again. This time it’s the ATF and the targets are two people suspected of arson.
The “reverse” warrant affidavit [PDF] spends a great deal of time letting us know what Special Agent Thomas Greenwich knows: that phones generate a ton of location info using a variety of connections (WiFi, Bluetooth, cell towers) and this information tends to get hoovered up almost immediately by service providers. In this instance the target is Google and the ATF wants any records that fall within two geofenced areas surrounding the sites of two suspicious fires.
If there’s any upside here, it’s that the geofenced locations won’t be sweeping in as many non-suspects as other reverse warrants we’ve seen. And it includes photos depicting the areas targeted by the non-targeted warrant, which helps judges (and interested citizens) see how much potential data the ATF is targeting.
There were two suspected arsons in Milwaukee, located less than 5 miles apart, occurring within three weeks of each other. Both started at the back of the houses and both used accelerants. And both houses had a common denominator: John P. Hunt. Hunt had been evicted from one address (4047 N. 7th) two weeks prior to the first fire, and had been trying to claim tools left behind by a deceased family member, which were stored at the second address (5915 N. 42nd St.). This included one unscheduled visit to reclaim the disputed possessions which had been sorted out by local law enforcement four days before the second suspicious fire.
Here are the geofence coordinates included with the affidavit:
The geofences here are about as limited as they can be, given the nature of the crime. These are much more constrained than others we’ve seen — ones that cover entire blocks in heavily-trafficked areas.
That being said, there are still a few problems. First, coarse location data isn’t precise enough to exclude people living in surrounding houses. The geofenced areas will also capture foot and road traffic that passed through the area during the time frame investigators are looking at.
Finally, there’s the problem that simply does not ever go away, no matter how tightly-constrained the geofence is: these warrants work in reverse, providing law enforcement with location data on people who aren’t suspected of committing criminal acts and allowing investigators to use a pile of non-suspicious data to develop reasonable suspicion.
This data request seems almost extraneous. The ATF already appears to have a couple of suspects — ones well-known to both federal agents and the Milwaukee Police Department. The MPD executed a search warrant at the 4047 N. 7th Street address last summer (following “10-15 visits” to the house by MPD officers during that same summer), recovering “a large amount of narcotics and several firearms.” John Hunt — the person connecting the two torched properties — was charged with several drug and gun-related offenses.
Given this fact, it would seem investigators might want to start with John Hunt and then work their way outward if that doesn’t pan out. Instead, they’re demanding location info on everyone in the area and then hoping to narrow this list of info down to the person (or people) they already suspect. Yes, it’s always useful to have as much evidence in hand as possible before arresting someone, but that law enforcement desire needs to be weighed against the impact it will have on non-suspects just because they happened to connect to cell towers in the wrong place at the wrong time.