Cops Lose CSAM Evidence Because They Couldn’t Be Bothered To Include Probable Cause In Their Warrant Application

Legal Issues

from the not-that-difficult-to-be-specific dept

As has been noted here before, it’s often the worst people that generate the best case law. People staring down the barrel of several years in prison are extremely motivated to find any reason to have the evidence against them dismissed. People not faced with the same reality rarely find a reason to trouble the courts with their complaints.

It’s also been noted here that “for the children” is a powerful motivator. It’s an argument that allows governments to expand their power and sidestep constitutional rights because — as it’s argued — doing otherwise means siding with those sexually exploiting children.

In this case, brought to us by FourthAmendment.com, both of these elements are present. The (allegedly) worst people challenged the way the government obtained evidence to use against them. And the government apparently felt that simply informing the court that this was a CSAM investigation would be all it needed to satisfy its probable cause requirements.

The Sixth Circuit Appeals Court has taken a look at this and decided [PDF] this is only going to hurt the government employees who couldn’t be bothered to do their jobs correctly. The published opinion says it takes more than what’s seen here to support a search of someone’s electronics.

It’s a short opinion, running only 18 pages. But it says what needs to be said: copy-pasting boilerplate isn’t an acceptable substitution for actual probable cause.

The case began with an overseas tip to the DHS, informing Homeland Security agents a US-based IP address was being used to view CSAM (child sexual abuse material). This IP address led DHS agents and Kentucky State Police officers to the home of Edward Lewis.

Lewis invited the officers and agents into his home. Shortly after, he was informed the government had reason to suspect “there was child sexual exploitation activity at the house.” Lewis signed a form consenting to a search of his home and a couple of his devices.

A forensic examiner generated a “preview” of Lewis’s laptop, revealing file names presumed to be indicative of CSAM. Thumbnail images obtained during the preview appeared to confirm this — images that were created by Lewis recording his cousin’s children while they bathed. At no point were any of the files opened or examined further.

Following a call to a local prosecutor, Detective Gatson of the Kentucky State Police decided to obtain a search warrant.

Detective Gatson prepared a search warrant for Lewis’s house and any electronic devices stored inside the home that could contain evidence of child pornography, including the laptop and cell phone that Detective Gatson and Rollins had reviewed at Lewis’s home. Detective Gatson did not share the proposed search warrant or his affidavit in support of the warrant with a prosecutor, but instead took the documents directly to a Franklin County judge. Detective Gatson did not provide the state judge with any additional information beyond what he included in the proposed search warrant and his affidavit. The state judge signed the search warrant.

So far, so good. A warrant was obtained, a judge signed it, the warrant was executed, and evidence was obtained.

Actually, it’s not so good. The warrant was filled with words suggesting probable cause, but the words were ultimately meaningless since they had little to do with the specifics of this investigation.

The lower court agreed there wasn’t much in terms of actual probable cause, but granted good faith to the government because… well, a judge had signed it. So, even if the judge was wrong to do so, the cops were right to rely on it.

Not so fast, says the Sixth Circuit.

The government does not dispute that Detective Gatson’s affidavit failed to establish probable cause. “Detective Gatson provided the state judge only one fact in support of the existence of probable cause: that a search of Mr. Lewis’s laptop and cell phone had occurred.” Absent additional information, such as a description of the evidence uncovered during that search, Detective Gatson’s affidavit merely stated his belief that Lewis had viewed child pornography. That conclusory statement was too vague and insubstantial to establish probable cause to search Lewis’s electronic devices. The search warrant that was issued based on Detective Gatson’s affidavit therefore violated the Fourth Amendment’s probable-cause requirement.

Whether it was haste or laziness on Detective Gatson’s part that led to him deciding it wasn’t worth describing what had been observed during the cursory search of Lewis’s laptop, the end result is the same: no probable cause was established. That Gatson decided the warrant application should be 99% boilerplate and 1% probable cause is on Gatson. And that means the warrant is invalid.

But wait! If a judge signed it, surely the execution of the warrant was in good faith? Wrong again, says the Sixth Circuit.

Considering the complete lack of factual information included in Detective Gatson’s affidavit, we hold that no reasonable officer would rely on the affidavit to establish probable cause to believe that Lewis’s electronic devices would contain evidence of a child sexual-exploitation offense or any other crime.

In addition to buying donuts for the KSP every morning for the foreseeable, one would hope this detective has been instructed to attend a few AFFIDAVIT 101 classes. I mean, this is everything wrong with this warrant, as the Appeals Court points out:

As discussed above, the non-boilerplate portion of Detective Gatson’s affidavit begins by stating that “[a]n HSI investigation identified Edward L Lewis . . . as a person of interest.” The affidavit does not explain what “HSI” stands for, why HSI considered Lewis to be a person of interest, or the significance of HSI’s person-ofinterest designation. Reading that initial portion of Detective Gatson’s affidavit, a judge would have no factual basis upon which to conclude that Lewis may have committed any crime, let alone the specific crime of child sexual exploitation as defined by Kentucky law.

Next, the affidavit states that Lewis “consent[ed] to [a] search [of] his laptop and cell phone” and that “[d]uring [the] search it became apparent that Mr. Lewis had used his laptop to view images of child sexual exploitation.” This section clearly expresses Detective Gatson’s belief that Lewis had committed a crime, but it does not provide a factual basis upon which a magistrate could independently reach that conclusion. Indeed, Detective Gatson’s conclusion that “it became apparent that” Lewis had “view[ed] images of child sexual exploitation” was “a
mere conclusory statement that [gave] the magistrate virtually no basis at all for making a judgment regarding probable cause.” Illinois v. Gates, 462 U.S. 213, 239 (1983). A magistrate
could conclude that there was probable cause to search Lewis’s electronic devices only by substituting Detective Gatson’s evaluation of the evidence for the magistrate’s own evaluation.

Lastly, the affidavit states that “[b]ased on [Detective Gatson’s] knowledge, experience and training, Edward L Lewis has demonstrated a pattern of criminal activity related to child pornography, and there is a reasonable likelihood that the user treats child pornography as a
valuable commodity to be retained and collected, a characteristic common to many people interested in child pornography.” This final statement likewise fails to set forth any factual information. It is tantamount to a statement that “probable cause existed”—the very definition of a conclusory statement.

Gatson should have done better with the warrant application. And, because he didn’t, no one should have felt it was reliable, even with a judge’s signature.

By omitting the essential facts of his investigation and communicating only his bottomline conclusion, Detective Gatson asked the magistrate to find probable cause based solely on his
say-so. “No reasonable officer could have believed” under those circumstances “that the
affidavit was not so lacking in indicia of probable cause as to be reliable.”

And that leads up back to the signature this warrant application obtained. If no “reasonable officer” could rely on it, how could the judge possibly have felt this application — one completely devoid of probable cause — was something worth their signature? We’ll never know because judges are completely immune from legal action arising from their approval of obviously deficient warrants.

But, setting aside this inexplicable judicial approval of this warrant, the problem detailed here starts with the investigator. “Training and experience” is a completely empty phrase when you don’t apply that knowledge when seeking search warrants.

Neither the laws nor the facts are complex. A law-enforcement officer with as much training and experience as Detective Gatson—and indeed any reasonable law-enforcement officer—should know that a warrant affidavit must provide enough non-conclusory information to allow a neutral magistrate to determine whether there is probable cause.

That’s why the warrant fails and that’s why the good faith exception doesn’t apply, despite the initial judicial approval of Gatson’s deficient warrant.

Rejecting the application of the good-faith exception is necessary to demonstrate that Detective Gatson and the other officers had a duty to ensure that the affidavit was free of obvious constitutional defects and to underscore the costs of not discharging that duty.

The warrant is dead. The evidence obtained with it? Gone. The conviction predicated on this evidence? Vacated. And that all could have been prevented if Detective Gatson had taken just a bit more time to actually write a warrant application, rather than just fill it with copy-pasted boilerplate. For someone presumably serious about prosecuting crimes against children, Detective Gatson did nothing but put the victims of this alleged crime that much further away from seeing justice done.

Filed Under: 4th amendment, 6th circuit, csam, edward lewis, evidence, kentucky state police, probable cause, warrant

FBI, Federal Judge Agree Fighting Botnets Means Allowing The FBI To Remotely Install Software On People’s Computers

(Mis)Uses of Technology

from the all's-fair-in-love-and-cyber-war dept

The ends aren’t always supposed to justify the means. And a federal agency that already raised the hackles of defense lawyers around the nation during a CSAM investigation probably shouldn’t be in this much of hurry to start sending out unsolicited software to unknowing recipients.

But that’s the way things work now. As a result of the DOJ-propelled push to change Rule 41 jurisdiction limitations, the FBI is now able to infect computers anywhere in the United States using a single warrant. In the “Playpen” case, the software was used to obtain information about users and devices visiting a seized (but still live) dark web CSAM site.

A couple of years later, the lack of jurisdiction limitations were used for something a bit more useful for even innocent computer users: the FBI secured a single warrant authorizing it to send its botnet-battling software to computers all over the nation, resulting in the disinfection of thousands of computers.

And while this all seems like a net positive for US computer users, the underlying facts are a bit more worrying: judges will allow the FBI to place its software on any user’s computer at any time, provided it can convince a court the end result will be something other than a massive number of privacy violations.

It’s inarguable that disrupting botnets is a public good. But is it inarguable that disruption should occur by any means necessary… or, at least, any means convenient. The disruption of another botnet has been achieved with the assistance of the FBI, a federal judge, and some government software deployed without notification to an unknown number of infected devices.

The FBI quietly wiped malicious programs from more than 700,000 computers around the world in recent days, the agency said Tuesday, part of an operation to take down a major component of the cybercrime ecosystem.

[…]

The FBI got a court’s permission to proceed with the operation on Aug. 21, according to a copy of the warrant. Agents proceeded to hack into Qakbot’s central computer infrastructure four days later, the FBI announced, and forced it to tell the computers in its botnet to stop listening to Qakbot.

An unnamed FBI “source” added this:

Victims will not be notified that their devices had been fixed or that they had ever been compromised, he said.

All of that was accomplished with a five-page warrant [PDF] that doesn’t have much to say about the probable cause compelling this invasion of users’ computers. The warrant authorized the FBI to, in effect, “search” every computer it sent its software to.

PROPERTY TO BE SEARCHED
This warrant applies to the electronic storage media contained in victim computers located in the United States onto which malicious cyber actors have installed, without authorization, the Qakbot malware, and which computers are in communication with the Qakbot botnet infrastructure.

What’s not immediately clear is how the FBI determined which computers were infected. Instead, it seems to authorize an intrusion into all computers it could access, with infections determined following the mass search.

The warrant says “remote access techniques may be used:”

To search the electronic storage media identified in Attachment A [PROPERTY TO BE SEARCHED, as shown above] and to seize or copy from those media any electronically stored information, such as encryption keys and server lists, used by the administrators of the Qakbot botnet to communicate with computers that are part of the Qakbot botnet infrastructure; and

To search the electronic storage media identified in Attachment A and to seize or copy from those media any electronically stored information, such as IP addresses and routing information, necessary to determine whether any digital device identified in Attachment A continues to be controlled by the Qakbot administrators after the seizure or copying of the electronically stored information identified in Paragraph 1.

At first glance, it might appear that the FBI limited its software deployment to known infected devices. But that’s clearly not the case, as was noted earlier in the NBC report quoted above. Here are the facts again, given a bit more weight with the addition of the FBI’s RAT warrant:

The FBI got a court’s permission to proceed with the operation on Aug. 21, according to a copy of the warrant. Agents proceeded to hack into Qakbot’s central computer infrastructure four days later, the FBI announced…

So, odds are the FBI didn’t know which computers were infected when it deployed its “remote access technique.” That means it was given permission to target any device it could access via the internet, with controlling factors only appearing four days after it had already performed its “search.”

The only mitigating factor is the last paragraph of the approved warrant. And that’s only mitigating if you believe the FBI would not use this opportunity to sniff around for others things it might be interested in.

This warrant does not authorize the seizure of any tangible property. Except as provided in the accompanying affidavit and in Paragraphs 1 and 2, this warrant does not authorize the seizure or copying of any content from the electronic storage media identified in Attachment A or the alteration of the functionality of the electronic storage media identified in Attachment A.

All this means is the court trusts the FBI not to abuse this access. And it forces all of us to operate by the same questionable standard, since the FBI has made it clear it is not willing, nor legally obligated, to inform computer users their computers were compromised by FBI software, however briefly or usefully.

Given that lack of disclosure, it’s going to make it almost impossible to challenge evidence of other criminal activity that might have been obtained during this mass search. It also means users aren’t able to double-check the FBI’s work by ensuring their devices are free of either botnet infections or FBI software.

And there’s a very good chance the FBI handled this all honestly and decently and actually performed a useful public service. The point is there are now court-accepted mechanisms in place that would easily allow the FBI to engage in activities that are more abusive of people’s rights without worrying too much about judicial oversight and/or victims of questionable spyware deployments ever finding out they were targeted during FBI activities ostensibly meant to take down botnets.

Filed Under: 4th amendment, botnets, fbi, qakbot, remote installs, warrant

County Attorney Rejects Warrant Used In Raid Of Small Kansas Newspaper, Asks Court To Force Cops To Return Seized Devices

Journalism

from the fucking-around,-finding-out dept

Last week, cops in a small Kansas town decided they’d just toss aside the First Amendment and raid a local newspaper.

There were competing narratives. The first was that the paper was in possession of information related to the drunk driving arrest of local business owner Kari Newell, who had allegedly been convicted of DUI and driving without a license.

The thing is the paper never made this information public. Instead, it verified the information handed to it by a source and then contacted the Marion, Kansas police department.

The second narrative appeared during an interview with the surviving co-owner of the paper, Eric Meyer. This one suggested the raid of the paper’s offices and the home of 98-year-old co-owner, Joan Meyer, were prompted by the paper’s ongoing investigation of Marion police chief Gideon Cody’s misconduct history, which allegedly involved sexual misconduct.

I used the word “surviving” for a reason. Joan Meyer died shortly after suffering through the raid of her paper’s office and the raid of her home. During these raids, nearly every electronic device possessed by Meyer and the paper was seized, including the paper’s servers and Joan Meyer’s personal computer and internet router.

According to what little information was available (including a very noncommittal statement by the Marion PD), the supposed crime was identity theft aided and abetted by unauthorized computer access.

But whatever the real reason for this disturbing abuse of government power, it appears to be headed towards a swift denouement. At least some of this accelerated pace can be attributed to the piqued interest of outside government entities, which arrives on the heels of nationwide coverage.

Outrage from Eric Meyer, the owner and publisher of the Marion Record, appears to have reached the KBI [Kansas Bureau Investigation].

On Wednesday, the law enforcement agency announced in conjunction with the Marion County Attorney that the investigation would continue without the examination of any evidence seized during the raid.

That accompanies a letter sent by the paper’s attorney, Bernard Rhodes — a letter that points out the raids violated the First Amendment, Fourth Amendment, and state laws that protect journalists and their sources.

All of this has added up to Marion County Attorney Joel Ensey announcing that he has formally withdrawn the warrant and has asked for law enforcement to return everything officers seized.

On Monday, August 14, 2023, I reviewed in detail the warrant application made on Friday, August 11, 2023 to search various locations in Marion County including the office of the Marion County Record. The affidavits, which I am asking the court to release, established probable cause to believe that an employee of the newspaper may have committed the crime of K.S.A. 21-5839, Unlawful Acts Concerning Computers. Upon review, however, I have come to the conclusion that insufficient evidence exists to establish a legally sufficient nexus between this alleged crime and the places searched and items seized. As a result, I have submitted a proposed order asking the court to release the evidence seized. I have asked local law enforcement to return the material seized to the owners of the property.

The matter remains under review until such time as the Kansas Bureau of Investigation, the agency now in charge of the investigation, may submit any findings to the office for a charging decision. At such time, a determination will be made as to whether sufficient evidence exists under the applicable rules and standards to support a charge for an offense.

Some good things there. The call for the release of the documents. The call for the release of the seized electronics (albeit on that doesn’t appear to demand law enforcement destroy any copies of data investigators may have made). And the correct call on the incident in question: it appears unlawful, even if the county attorney (for reasons related to his continued employment) isn’t willing (yet) to go on record as calling “unlawful.”

There are some bad things, too. It seems unlikely the KBI will uncover evidence of criminal activity by newspaper staff. But it does allow another law enforcement agency to root around in seized data and try to find some connection between the charge leading to these rights violations, in hopes of turning them into something resembling probable cause.

The county attorney has asked law enforcement to release everything seized. But it’s only a request. That the Marion PD has yet to publicly state it will release the seized devices suggests it’s not nearly as willing to admit it’s in the wrong. Nor is it as willing to make things rights. And that’s going to end up costing county residents their tax dollars, which will be added to the tab already rung up by local cops — one that now includes shattered trust and an extremely damaged relationship with the town it serves.

Filed Under: 1st amendment, eric meyer, free press, gideon cody, intimidation, joan meyer, joel ensey, journalism, kansas, kbi, marion county, police raid, raid, warrant
Companies: marion county record

NSA Asks Congress To Not Block Federal Agencies From Collecting Location Data Without A Warrant

Privacy

from the well,-no-one-has-ever-stopped-us-before-so... dept

For several years, the government was able to route around the Fourth Amendment by turning cell service providers into proxy tracking devices. Thanks to the Third Party Doctrine, location data generated by cell phones wasn’t given an expectation of privacy.

A Supreme Court decision handed down in 2012 strongly suggested the government needed to obtain a warrant before placing tracking devices on people’s vehicles. No problem, said the government. People take their phones more places they take their cars and all that information can be obtained without a warrant.

If the Supreme Court closes a door, the government opens a window. That worked for another six years — a lifetime in terms of constitutional protections in an ever-evolving tech world. But, in 2018, the Supreme Court said the government needed a warrant to obtain long-term location tracking info. The decision mainly dealt with cell service providers but the implications ran beyond that, suggesting an expectation of privacy existed for any bulk, long-term collection of location data the government could use to track a person’s movements over weeks or months.

Once again, rather than seek warrants, the government looked for other warrantless options. And far too many data brokers were more than happy to help out. While the location information gleaned from apps might produce data that was less exhaustive than the data points generated by every cell tower a cell user connects to, it was still worth something to the government. Even better, the 2018 Carpenter decision did not explicitly say the government couldn’t use other means or methods to engage in the same long-term tracking the Supreme Court said was unconstitutional without a warrant.

This growth market in no-warrant-needed data sales has, at least, provoked congressional responses. For the past few years, Senator Ron Wyden has been attempting to pass a law instituting a warrant requirement for location data purchases. Those efforts finally appear to be moving forward, with the latest iteration of bill being passed out of committee where it may (eventually) be subjected to a vote on the Senate floor.

And his effort isn’t the only one. The must-pass National Defense Authorization Act (NDAA) bill has been hit with an amendment that would do the same thing the Wyden bill does: add a warrant requirement to location data purchases from data brokers.

A copy of the [Warren] Davidson- [Sara] Jacobs amendment reviewed by WIRED shows that the warrant requirements it aims to bolster focus specifically on people’s web browsing and internet search history, along with GPS coordinates and other location information derived primarily from cellphones. It further encapsulates “Fourth Amendment protected information” and would bar law enforcement agencies of all levels of jurisdiction from exchanging “anything of value” for information about people that would typically require a “warrant, court order, or subpoena under law.”

The NSA — which is one major beneficiary of defense budget bills — is alarmed that federal agencies might have to comply with Carpenter decision by securing warrants before seeking access to long-term location tracking info. It seems upset that refusing to follow the spirit of the Carpenter decision has resulted in a concerted effort to close a loophole government agencies have exploited for the last half-decade.

Not only does it need to continue to fight for its right to engage in the warrantless spying it already does as an enabler of decades of FBI abuses, it now needs to fight for its right to ignore Supreme Court precedent just because the precedent did not consider the limits it placed on location data collection would be sidestepped by data brokers who discovered selling to shady government agencies could be as profitable as selling to shady advertisers. Dell Cameron has the details for Wired:

Republican and Democratic aides familiar with ongoing defense-spending negotiations in Congress say officials at the National Security Agency (NSA) have approached lawmakers charged with its oversight about opposing an amendment that would prevent it from paying companies for location data instead of obtaining a warrant in court.

It’s unclear how often the NSA itself purchases data from brokers but some info has leaked out around the edges that suggests it considers it to be a useful part of its national security efforts. Considering it has a wealth of collection options not currently subject to warrant requirements suggests this effort is more about keeping options open for other federal law enforcement agencies, rather than the NSA itself being negatively effected by this amendment. That the military is known to purchase bulk location data from brokers likely factors into this lobbying effort, considering this amendment is attached to a bill that affects both the NSA’s and the US military’s budgets.

The NSA is fighting a battle on multiple fronts. And it’s not clear why this one appears to be worth the effort. The bigger concern for the NSA is the possible loss of its Section 702 surveillance authority — something that has been undermined for years by the FBI’s continuous abuse of its access to NSA Section 702 collections. But the NSA appears to believe its best move at this point is to persuade legislators no one in the government should be denied warrantless access to data brokers’ offerings. Perhaps it might be more useful for it to go after the FBI for undermining the public’s trust, setting it up for a fight it didn’t provoke and now finds itself faced with the suddenly, very real possibility of losing.

Filed Under: 3rd party doctrine, 4th amendment, location data, ndaa, nsa, privacy, surveillance, third party doctrine, warrant

New Jersey Supreme Court: If Cops Are Going To Digitally Wiretap A Facebook Account, They Need A Wiretap Order

Legal Issues

from the your-analog-analogies-are-only-hurting-your-digital-arguments dept

Gathering evidence has never been easier than it is now. So much is created so easily and so often. And there are so many access points for law enforcement.

Sure, a few outliers (and outright liars [cough] Chris Wray [cough]) may claim everything is “going dark,” but never before in history have there been this many communication options facilitated by this many services. And most of those communications can be accessed without much difficulty, despite the occasional encryption roadblock.

Law enforcement entities are definitely taking advantage of the opportunities created by always-on(line) existences so many of us lead. But they often forget they still have an obligation to respect constitutional protections put in place years before so many of their investigative targets turned their lives into open books.

And that brings us to this case recently decided by the top court in New Jersey. Investigators in that state decided to use a very creative definition of the word “stored” to a constitutional fight. And they’ve lost. (h/t FourthAmendment.com)

In this criminal case, investigators served Facebook with a standard Communications Data Warrant (CDW). In other words, it was a regular search warrant authorizing a search of Facebook’s stored data for information related to suspected criminal activity.

But what the warrant demanded was far from the norm for search warrants. It didn’t ask Facebook to hand over whatever it already had. Instead, it demanded Facebook ride shotgun on the targeted account and turn over any new content created by the user every 15 minutes for the next 30 days.

My friends, that is not a search. That is a wiretap. And a regular warrant cannot possibly justify this sort of ongoing, near-real time intrusion. That’s the ruling [PDF] of the state’s top court, which overturns the appellate court’s inexplicable decision to pretend content retrieved every 15 minutes (which is as fast as Facebook can produce them) have somehow been “stored” long enough to lower constitutional protections against government eavesdropping. It did limit this sort of “search” to a ten-day window, but otherwise decided that future communications were also “stored” communications during this time frame.

The government made the same pitch to the state Supreme Court. It said 15-minute intervals were the same thing as “stored,” that nothing in any statutory text said otherwise, and — on top of all that — claimed being limited to ten-days of eavesdropping using a regular warrant was where the appellate court actually went wrong.

Facebook — and a ton of amici — disagree:

Facebook argues that neither federal nor state statutory law authorizes the use of a search warrant to compel disclosure of the contents of prospective communications. Facebook instead maintains that the challenged searches are governed by the enhanced privacy protections of the wiretap acts.

Facebook also contends that the Appellate Division’s decision contravenes the Federal and State Constitutions, which bar multiple intrusions based on a single warrant. Facebook argues as well that the CDWs are not anticipatory warrants and cannot be justified under the reasonable continuation doctrine.

[…]

Amici all support Facebook’s position. The ACLU emphasizes that “data surveillance” today is “far more invasive” than “wiretaps of old.” As a result, the ACLU urges the Court to apply wiretap-like protections, as does the NJSBA [New Jersey State Bar Association].

Microsoft and Google represent that no other jurisdiction has sought ongoing, prospective surveillance of electronic communications based on a warrant. The companies state that when law enforcement agencies outside of New Jersey have made similar requests, they have presented wiretap orders.

After a detailed discussion of both federal (Stored Communications Act) and state laws, including wiretap provisions built into both sets of electronic surveillance laws, the court puts in plain English the state’s desired outcome: the elimination of wiretap warrants (along with their safeguards and restrictions) entirely so long as the communications being targeted occur online.

Imagine instead an attempt by law enforcement to gain broad access to future electronic communications, including private messages, within 15 minutes, the earliest possible moment they are available, for 30 days — the very situation this case presents. A strict contemporaneity rule adopted before the advent of the Internet would not be a good fit to address that or other situations technology presents today. Nor would such a rule be consistent with the underlying purpose of the wiretap statutes — to protect individual privacy.

In addition, from a practical standpoint, if a strict contemporaneity approach applied, law enforcement today would never need to apply for a wiretap order to obtain future electronic communications from Facebook users’ accounts on an ongoing basis. With either a wiretap order or a CDW, the State today cannot receive information from Facebook any sooner than 15 minutes after a communication has been transmitted. In light of that reality, it would be only natural for law enforcement to apply for a CDW [Communications Data Warrant], which is easier to obtain but has fewer safeguards for individual privacy.

The State’s argument raises yet other, similar concerns. In time, as technology improves, today’s unavoidable 15-minute delay may well get shorter and shorter. The logical extension of the State’s position is that law enforcement could avoid the requirements and protections of the wiretap acts by simply asking Facebook to wait a few minutes, while data is stored, before providing electronic communications on an ongoing, future basis. That cannot be right given the underlying aim of the statutes.

The state’s arguments all fail. The intrusion the state wants the court to bless with a ruling in its favor is even more intrusive than normal wiretaps, in which irrelevant or privileged conversations cannot be legally captured or listened to by investigators. The state Supreme Court isn’t having it.

[N]early contemporaneous access to a wide array of prospective electronic communications, every 15 minutes for a full month into the future, is highly intrusive.

There are no limits to the content the State seeks here. In addition to public posts by Facebook users, the proposed orders encompass private communications of all sorts, including any messages to one’s spouse, cleric, doctor, or lawyer. Yet the CDW orders have no minimization requirements.

In essence, the State seeks the functional equivalent of a wiretap — but without the added safeguards the wiretap acts require.

Nope. Wrong. Not going to happen.

As a result, we find that a warrant based on probable cause is not enough to monitor prospective electronic communications in nearly real time, on an ongoing basis, under the constitution. The principles set forth in Berger and its progeny require the State to make a heightened showing and adhere to the additional safeguards provided in the wiretap acts. Our conclusion is grounded in the privacy protections the State Constitution guarantees.

Down goes the warrant. Up goes the precedent. And none of this should have come as a surprise to law enforcement. If you want to eavesdrop, you need more than a regular warrant. That it’s Facebook, rather than phone companies, being targeted doesn’t change the underlying constitutional equation. The state tried to pull a fast one and Facebook called it out on its bullshit. And everyone in New Jersey is better protected thanks to its refusal to comply with an obviously unlawful order.

Filed Under: 4th amendment, new jersey, police, stored communication, surveillance, warrant, wiretaps
Companies: facebook

State Court Tells Cops Getting A Warrant Two Years After An Illegal Phone Search Doesn’t Suddenly Make The Search Legal

Legal Issues

from the do-it-right-the-first-time dept

The Supreme Court’s Riley decision has been the law of the land since 2014. If cops want to search seized cell phones, they need a warrant. Nearly a decade on, cops are still violating it. The inability to follow the rules has seen evidence in this criminal case (brought to us by FourthAmendment.com) tossed twice.

The first tossing of evidence occurred in 2022, following this chain of events. From the Georgia Appeals Court decision [PDF]:

So viewed, the record shows that on November 10, 2020, police executed a search warrant for Thurston’s residence. The warrant authorized the seizure of a number of items, including “digital devices such as smartphones,” but did not authorize a search of the contents of such devices. During the execution of the warrant, a cell phone was taken from Thurston’s person and was later given to a detective, who was asked to extract digital data from the phone after being told that police had seized it pursuant to a search warrant.

The detective explained during a motion to suppress hearing that he was not limited in any way in searching the cell phone contents because he believed a valid search warrant existed. He further stated that he would not have searched the phone if he had known that the initial warrant did not authorize the search of its contents. According to the detective, there were some discussions with the assistant district attorney and/or the case investigators regarding the evidence downloaded in 2020.

Nigel Thurston was charged with a variety of crimes, with the state asserting (nearly two years later) the phone contained “unidentified evidence of […] armed robbery.”

Thurston moved to suppress the evidence. The trial court granted this motion on May 10, 2022, pointing out the obvious: the search of Thurston’s phone was unconstitutional due to the lack of a search warrant.

Sensing things weren’t going its way, the government very belatedly tried to salvage evidence that was on the verge of disappearing.

[O]n April 26, 2022, while Thurston’s motion to suppress was pending, the State applied for and obtained a warrant authorizing the search of his cell phone, and the same detective again downloaded its contents. The State acknowledges in its appellate brief that the detective used the same protocol, procedures, and forensic extraction software when he extracted data from Thurston’s cell phone in 2020 and 2022. In fact, the detective testified during the suppression hearing that extractions done in 2020 and 2022 were basically the same. Even the prosecutor admitted to the trial court that the information extracted in 2022 “mirror[ed]” that extracted in 2020.

Well, that’s not how things work, the Appeals Court says. You can’t salvage a warrantless search by acquiring a new warrant two years later. That’s what the lower court said, too, resulting in the state’s attempt to have that ruling overturned.

Based on these findings, the court granted Thurston’s second motion to suppress, concluding that “the 2022 warrant was obtained solely as an attempt to overcome the Constitutional violation which occurred in 2020, of which the State became concerned after review[ing] Defendant’s first Motion to Suppress.”

Allowing the state to get away with this would make warrant requirements irrelevant. Without the deterrent of losing illegally obtained evidence, cops could just search first and obtain warrants later. That’s what happened here and the existence of a warrant two years after the fact does nothing to make the first search any less illegal. Nor does it make the second search any more legal.

The independent discovery doctrine argument fails. The court points out the state copy-pasted most of the new warrant affidavit from the old one that did not give it permission to search the contents of Thurston’s phone. The original warrant only permitted seizure of the device. Using the same facts to acquire a new warrant permitting a more intrusive search doesn’t impress this court any more than it impressed the trial court.

And the detective can’t rely on the good faith exception to excuse the first warrantless search because… the good faith exception simply doesn’t exist in Georgia.

We likewise reject the State’s suggestion that the good faith exception should apply because the detective believed he had authority to search the cell phone in 2020. “Georgia law precludes adoption of the . . . ‘good-faith exception’ to the exclusionary rule as part of the jurisprudence of Georgia.” Gary v. State, 262 Ga. 573, 574 (422 SE2d 426) (1992). Despite the State’s suggestion, this Court is not at liberty to overrule Supreme Court of Georgia precedent.

And away goes the evidence for a second time. The Appeals Court says the same thing the lower court did: you can’t undo a constitutional violation by trying to be a bit more constitutional two years after the violation. We’ll see if the government learns from this experience. If nothing else, it might want to put together some remedial constitutional law classes for its investigators and prosecutors.

Filed Under: 4th amendment, evidence, georgia, nigel thurston, riley, search, warrant

Court Tosses Phone Evidence After First Warrant Was Too Vague And Second Warrant Was Too Late

Legal Issues

from the reasonable-AND-timely dept

For searches to be compliant with the Constitution, their underlying warrants need to be just as compliant. Warrants have been required for cell phone searches since 2014, thanks to the Supreme Court’s Riley decision.

Nearly a decade on, and the government is still suffering periodic bouts of unreasonableness when performing phone searches. We recently covered a case where evidence was suppressed because the FBI took more than three years to crack a phone and performed a search anyway, despite agreeing to time limits placed on the original warrant by the magistrate judge.

This case, coming to us via FourthAmendment.com, involves two problematic warrants, both of which combine to hand the government a loss in the evidence department. The decision [PDF], handed down by a New York trial court, says the government failed twice when handling searches related to a domestic dispute between Naquan Smith and his girlfriend — one that allegedly involved Smith brandishing a gun.

Smith’s girlfriend filed domestic violence complaints following two consecutive incidents, occurring November 28 and 29 of 2021. An additional report from a neighbor reporting a man carrying a gun led to the recovery of a gun at a field near the apartment Smith resided in. During the course of his arrest, Smith’s iPhone was seized. A search warrant was obtained four days after Smith’s arrest on November 29.

But this warrant was pretty much a worthless piece of paper and was successfully challenged by Smith’s lawyer following his indictment.

In a decision dated July 20, 2022, the court found the warrant application failed to provide case-specific facts to establish reasonable cause to believe that Smith used the Iphone to communicate about the incident and that relevant evidence would be found on the iPhone. The affidavit contained no allegation that anyone observed Smith using his cell phone before, during or after the time of the incidents. Rather than providing case-specific facts, the supporting affidavit merely offered generalized conclusions that individuals who engage in domestic violence and illegally possess firearms use cell phones to communicate regarding past and future criminal actions. Thus, the search warrant application lacked the necessary support for a Fourth Amendment privacy intrusion.

Somehow that bit of legal fiction was approved by a judge. While there are criminal acts that involve regular phone communications, domestic violence generally isn’t one of them. And the apparent ditching of the gun suggested Smith was trying to distance himself from physical evidence, so it would seem unlikely he would have confided in anyone else about this weapon.

The first search warrant was executed on December 2, 2021. A year later — and six months after the first search warrant was successfully challenged in court — the investigator applied for a second search warrant. And somehow, this one was also granted.

On December 3, 2022, this court was presented with a new search warrant application for the Iphone, supported by an affidavit from the same officer, who by then had achieved the rank of detective. The detective repeated the background information that was supplied in the first application, but supplemented it with additional details, including a description of text message exchanges between the complainant and Smith the day of the incident, and also between the defendant’s brother and Smith as the police were attempting to apprehend them. The People represented that no fruits of the first search warrant application were utilized in the People’s application for the second search warrant.

That last assertion seems suspect, to say the least. The text messages the investigator claimed weren’t derived from the first unconstitutional search were used to shore up the rest of the shaky assertions that were seemingly copy-pasted from the original (deficient) warrant.

The court says the second warrant was valid and provided probable cause for a search. But that’s not the end of the discussion. There’s the matter of timeliness. And that’s where the second warrant falls apart. The court quotes Second Circuit precedent, derived from a case involving a seized tablet.

The Second Circuit employs a four factor test to discern whether the application is timely: (1) the length of time before seeking a search warrant; (2) the importance of the seized property to the defendant; (3) whether the defendant had a reduced property interest in the seized item; and (4) the strength of the prosecution’s justification for the delay. United States v. Smith, 967 F3d 198 (2d Cir. 2020). Federal courts have invalidated search warrant applications where the prosecution delayed for merely a period of days.

Almost every factor is in play here, but the court emphasizes the second prong: a phone is even more crucial to day-to-day existence than a tablet computer.

At issue here is a cell phone, arguably even more valuable to the owner because of its greater inter functionality. This court concludes that although probable cause for the Iphone searches was made out in the December, 2022 application, the search then was not in accord with the Fourth Amendment. Under the four factor test the Second Circuit articulated, the People’s unreasonable delay in seeking this application outweighs other considerations.

But also important is the justification of any delayed searches by the state. Nothing was offered here.

The People’s search warrant application ran afoul of the legislative intent that the defense have access to all discoverable material as soon as possible. The People served and filed their certificate of readiness in this case on April 23, 2022. On July 20, 2022, the court issued its decision granting the defendant’s motion to controvert the first search warrant. On September 29, 2022, with no change in the parties’ respective positions, the court directed them to be ready for hearings and trial on November 10, 2022. The People offer no cognizable explanation for why they waited until after the original hearing and trial date was set to resurrect their search for the target items, or why there was any need to do so ex parte.

It runs counter to the legislative intent to permit the People to declare their readiness, yet continue to obtain investigative material for their use at trial from the defendants without his knowledge. The court must assume that the People filed their certificate of readiness in good faith, and that no information derived from these searches would be necessary to try the defendant.

Notice also the “ex parte.” The government sought a search warrant without notifying the defense of its intention to do so by using the judicial backdoor. Only after it had performed this search did it bother to inform the defense. That’s trial by ambush. And, fortunately for the defendant, the court has tossed the evidence derived from this second, secret, and long-delayed warrant.

It’s not like there isn’t any legal guidance or precedent in cases like these. The New York trial court quoted plenty in its brief, but pointed, rejection of the second warrant. But apparently the side with all the law on it just doesn’t much care for laws and legal precedent that might dissuade it from doing what it wants.

Filed Under: 2nd circuit, 4th amendment, naquan smith, probable cause, riley, timeliness, warrant

Cops Raid Swedish VPN Provider Only To Find Out There’s No ‘There’ There

Privacy

from the oh-no-the-things-aren't-even-there dept

There are few things I enjoy writing about more than cops who feel waving around a piece of paper will ensure they can get what they want. I’ve handled a few of these stories before, most of them centered on Signal, the little messaging service that could — one that does not collect user data and would rather exit the marketplace than subject itself to encryption-breaking government mandates.

So, it always gives me pleasure to learn that cops armed with court orders approached a privacy oriented tech company only to find out the stuff they wanted didn’t actually exist at the place they searched. Due diligence is a thing, investigators. Your boilerplate is obviously false if you’ve claimed (based on “training and expertise“) that the place you want to search contains the information you wish to obtain.

That’s the case here. A Swedish VPN provider was raided by local law enforcement, but was unable to produce any of the information officers were searching for… something officers might have realized prior to the search if they’d bothered to read the terms of service. Here’s Michael Kan with the details for PC World:

The company today reported that Swedish police had issued a search warrant two days earlier to investigate Mullvad VPN’s office in Gothenburg, Sweden. “They intended to seize computers with customer data,” Mullvad said.

However, Swedish police left empty-handed. It looks like Mullvad’s own lawyers stepped in and pointed out that the company maintains a strict no-logging policy on customer data. This means the VPN service will abstain from collecting a subscriber’s IP address, web traffic, and connection timestamps, in an effort to protect user privacy. (It’s also why Mullvad VPN is among our most highly ranked VPN services.)

If the cops had run a search of Mullvad’s website before running a physical search of its offices, it might have discovered the stuff they swore would be found there actually wouldn’t be found on Mullvad’s premises. It’s not like it’s that difficult to find:

There is a law to collect user data in India and other countries. Does this affect Mullvad?

Mullvad does not collect user data. Mullvad is based in Sweden and none of the Swedish regulations (https://mullvad.net/help/swedish-legislation/) can force VPN providers to secretly collect traffic-related data. We also have no servers, infrastructure or staff in India.

In other words, bring all the law you want, but in the end:

Raid if you want. But you can’t have what providers like Mullvad are unwilling to collect. In the end, you’ve done nothing more than make some noise and embarrass yourself. It’s all there in the Mullvad FAQ, including the fact that Mullvad performs no logging of user activity. If your investigation leads you to providers like Mullvad, it’s a dead end. Look elsewhere.

This policy isn’t in place because Mullvad wants to protect criminals. It’s in place because people all over the world deserve protection from government overreach. That criminals may benefit from policies like these doesn’t make these policies bad, it just makes it more difficult for abusive governments to engage in third-party-enabled surveillance.

And the long history here shows Mullvad isn’t a home for criminals. It’s just an extremely well-run VPN provider:

“Mullvad has been operating our VPN service for over 14 years. This is the first time our offices have been visited with a search warrant,” the company added.

You know who is in the best position to stop local law enforcement officers from embarrassing themselves? LOCAL LAW ENFORCEMENT. Maybe read the ToS and FAQ at the site you’re planning to raid before you approach a court with a bunch of assumptions and half-truths to secure a fruitless warrant demanding companies turn over information they don’t retain. Doing otherwise means looking bad at your job (at best) and authoritarian (at worst). If cops want to regain the respect and trust they swear they’ve always enjoyed in the past, the first thing they can do is actually do the investigative parts of investigations. That way they won’t look ridiculous when they go marching out of a tech company’s offices with fuck all in their hands.

Filed Under: logs, privace, sweden, vpn, warrant
Companies: mullvad

Vermont’s Supreme Court: Obtaining Real Time Cell Site Location Data Requires A Warrant

Privacy

from the start-breaking-out-the-boilerplate,-boys dept

In 2018, the Supreme Court of the United States overrode the Third Party Doctrine to declare cell site location info (CSLI) off-limits without a warrant. Recognizing the fact that ubiquitous cell phone use was generating reams of data daily that would allow law enforcement to engage in long-term tracking of people’s movements, the Supreme Court said the Third Party Doctrine didn’t cover this third-party data, at least not as presented in this case.

But the findings were limited. SCOTUS had nothing to say about real-time tracking with CSLI. It offered no opinion about wardriving with Stingray devices to find suspects. And it didn’t address shoulder-surfing law enforcement liaisons at cell service providers to use cell tower pings to locate and track suspects.

But the baseline the US Supreme Court established has had a butterfly effect. CSLI is no longer considered nothing more than a third-party record — something voluntarily shared with cell providers that has no expectation of privacy.

State courts have referenced the Carpenter decision while coming to their own, more restrictive conclusions. The US Constitution — like the Carpenter ruling — is only a baseline. States (and state courts) are free to establish higher privacy protections for their residents via their own constitutions and court decisions.

In early 2019, the top court in Massachusetts instituted a warrant requirement for real-time CSLI data. Three years later, the top court in Kentucky did the same thing.

Now it’s Vermont’s turn. A recent ruling [PDF] from the state’s Supreme Court says cops need warrants if they want access to real-time CSLI. (h/t FourthAmendment.com)

In December 2018, Vermont investigators approached AT&T in hopes of locating a shooting suspect. The first attempt to track them down using CSLI failed.

The lead detective contacted AT&T’s law enforcement compliance center and served a subpoena request. In support of the exigent request, the officer indicated that there had been a bar fight, an active shooter, a victim who was unfamiliar with the suspect, and that the shooter might be unreasonable or “in some sort of mental state” and in possession of a firearm. AT&T complied with the request but initially informed police that defendant’s phone was turned off and, as a result, it had no information about the phone’s location.

After this failure, the investigators sought a warrant for the phone’s historical CSLI. This was obtained shortly before 5 p.m. on December 29, 2018. But before it could be served to AT&T, this happened:

Approximately ninety minutes after the warrant issued but before it was served on AT&T, AT&T notified police that defendant’s phone had been turned back on and that a subsequent ping had located defendant’s phone in West Springfield, Massachusetts. Vermont police obtained a warrant for defendant’s arrest. They alerted Springfield police that a homicide suspect’s cellphone had been pinged as being located within several feet from a motel at a particular address. A second ping placed the suspect near a particular restaurant on a specific street. A police officer spotted a person fitting the suspect’s description and then received information that a third ping placed the suspect in the area where he was observed. Defendant was arrested shortly thereafter near a motel where he was staying and charged with first-degree murder.

The lower court said this was not a constitutional violation. And even if it was, exigent circumstances (the search for a suspected murderer) justified any rights violations.

The state Supreme Court says otherwise. Analyzing the case, it notes the US Supreme Court’s Carpenter decision does not specifically address real-time CSLI. Given that fact, the Vermont court says the suppression motion must be analyzed under the state’s constitution. And under that set of rights, real-time CSLI cannot be obtained without a warrant.

Quoting a handful of state court decisions (including the Massachusetts and Kentucky rulings noted earlier in this post) that have reached this same conclusion, the Vermont Supreme Court recognizes an expectation of privacy in real-time cell site location info. The key here is the word “reasonable.”

We agree that individuals do not reasonably expect that by using their phone, they will be sharing their real-time location information with police. They do not expect their cellphone to act as “a hidden tracking device that can be activated by law enforcement at any moment, subject only to the constraints of whether law enforcement knows the phone number and whether the cellphone is turned on.” The fact that police can now, through real-time CSLI, obtain “near perfect surveillance of its user” and “access to a category of information otherwise unknowable,” Almonor, 120 N.E.3d at 1194-95 (quotations omitted), does not mean they should be allowed to do so without judicial oversight. We must guard against allowing technological advances to result in fewer privacy rights.

The court says allowing the government to obtain real-time location data without a warrant would give law enforcement permission to “invade individuals’ most private and closely-held constitutionally protected activities.”

Put more simply:

A ping is a search that requires a warrant…

That’s the new baseline in Vermont. In this case, it doesn’t do much for the defendant. The state’s top court says exigent circumstances existed and justified the bypassing of constitutional protections to find a suspected shooter, still in possession of a weapon and possibly suffering some sort of mental health breakdown.

But none of that changes the baseline. Warrant exceptions will always exist. And a warrant requirement forces the government to justify its decision to bypass the requirement, rather than simply show up and claim no precedent put officers on notice a warrant might be needed. Vermont’s a bit more insulated from law enforcement overreach following this ruling and, even if it doesn’t help the defendant, it’s a win for the rest of the state’s residents.

Filed Under: 4th amendment, cell site location data, csli, real time tracking, stingray, vermont, warrant

FBI Latest To Admit To Bypassing Warrant Requirements By Purchasing Location Info From Data Brokers

Privacy

from the do-whatever-the-fuck dept

Well… fuck the Supreme Court, I guess.

That’s how law enforcement is working these days, bypassing the restraints of the Carpenter decision to do what they want, when they want, with whatever location data they can purchase from private third-party brokers.

It’s the “third party” that counts. It’s also the narrower aspects of the Supreme Court’s Carpenter decision, which limited the warrant requirement to obtaining “long term” (not specifically defined in the decision) location data from cell service providers.

The implications of the decision suggested finding alternate routes for long-term tracking of US citizens via cell phone location data was off limits without a warrant. But specificity matters and this decision just didn’t have it. Thanks to the limitations of this ruling, federal agencies are violating the spirit of the decision en masse because the justices failed to consider the existence of third-party data brokers which hoover up location data from popular apps and sell access to this data to whoever wants it: advertisers, marketers, CBP, ICE, the US Secret Service, the IRS, state prisons, etc.

The latest to admit to bypassing the implications of Supreme Court precedent is (to the surprise of nobody) the FBI. And that revelation comes from an expected source: Senator Ron Wyden, who has always made a point of staying on top of rights violations and government surveillance overreach. This is from Dell Cameron’s latest article for Wired, which covers the FBI’s admission it has joined its fed counterparts in paying private companies to access to massive amounts of location data.

The disclosure came today during a US Senate hearing on global threats attended by five of the nation’s intelligence chiefs. Senator Ron Wyden, an Oregon Democrat, put the question of the bureau’s use of commercial data to its director, Christopher Wray: “Does the FBI purchase US phone-geolocation information?” Wray said his agency was not currently doing so, but he acknowledged that it had in the past. He also limited his response to data companies gathered specifically for advertising purposes. 

FBI Director Wray offered more details, albeit not actual details contained in actual FBI paperwork. BUT DETAILS NONETHELESS!

“To my knowledge, we do not currently purchase commercial database information that includes location data derived from internet advertising,” Wray said. “I understand that we previously—as in the past—purchased some such information for a specific national security pilot project. But that’s not been active for some time.” He added that the bureau now relies on a “court-authorized process” to obtain location data from companies. 

Well, then I assume the FBI will be presenting the paper trail for this “court-authorized process” immediately. And it will presumably be presenting Senator Wyden (and the general public by extension) with contractual information about its past purchases and its termination of said contracts in the near future.

Look, I know I sound patently ridiculous. But the FBI director swore before God and country the g-men were on the up and up. What better way to demonstrate that then by… you know… actually demonstrating that.

Without supporting documentation, all we have are Chris Wray’s (untrustworthy) words that the FBI may have misbehaved in the past but is all good and constitutional at this particular point in its timeline. And if there’s anything the FBI has demonstrated over the years, it’s that when it says everything is above-board, everything absolutely isn’t.

The FBI is known for backdoor searches of NSA collections, encouraging civil rights leaders to kill themselves, engaging in massive amounts of domestic surveillance abuse, and refusing — for years now — to address cell phone encryption with anything approaching good faith or honesty. For it to claim its abuses are behind it when it comes to patronizing data brokers, the FBI should absolutely not be trusted until it can publicly demonstrate — with supporting documents — that it can be. Until we hear otherwise, assume the FBI is still doing the thing it just told Senator Ron Wyden it isn’t doing.

Filed Under: 3rd party data, 4th amendment, christopher wray, data, fbi, ron wyden, warrant