← It Could Happen Here
Loading summary
Transcript99 lines
- [00:00]
A
This is an iHeart podcast. Guaranteed Human. Welcome to It Could Happen Here, a show that is sometimes about surveillance, digital privacy, and all the ways that little black rectangle you keep in your pocket could be used against you. I'm Garrison Davis. Today I am joined by Cooper Quinton, a security researcher and senior public interest technologist at the EFF, or the Electronic Frontier Foundation. Cooper, hello.
- [00:35]
B
Hey, Garrison. Happy to be here again.
- [00:37]
A
Yes. Always happy to have you on. And you will be especially useful today because we are going to be talking about geofencing because last week the Supreme Court ruled that geofencing qualifies as a search under the Fourth Amendment. Now, before we get into what that means and why it's important, all very normal terms. Before we do that, let's start to define some of our terms here. Starting off with, what is geo fencing?
- [01:06]
B
Yeah. So geofence warrants, which are what this case is about, are warrants to a tech company, usually Google, that say, give us all of the identity account IDs that had phones in this set of geographic coordinates at this time period. So they send that to Google. Google sends back a list of all of the accounts they know, usually anonymized at first, but that were in that, you know, geographic square from, you know, time A to time B, which is actually not something that Google does anymore. They've recently taken steps to no longer technically be able to respond to these forms, which is a rare dummy you for Google. But that is a geofence warrant. That's what's at the heart of that.
- [01:56]
A
Yeah, I mean, and the goal is essentially to identify what phones and by extension, which people were present around the time a crime was committed. To narrow down a suspect from a very large pool of just random people in an area.
- [02:12]
B
Yes, exactly, exactly. So there's a couple ways you can think about this, right? If there is a protest and you want us to know the identities of all the protesters, you could get a geofence warrant for the area of that protest, for the time of the protest, or if there was a bank robbery, which happens here. Right. You get a geofence warrant for two locations you think the bank robber might have been in, and then you are able to narrow it down from which identities show up in both places. Right. And that's your list of primary suspects.
- [02:46]
A
So the reason why we're talking about this today is because on Monday, June 29, in a 6, 3 ruling, the Supreme Court found that police getting access to location data through a geofence does constitute a, quote, unquote, search under the fourth Amendment. And this, this finding could have really big impacts on digital privacy rights. The fact that geofencing is a fourth Amendment search means that the practice of geofencing is subject to fourth Amendment restrictions and protections. Now, there's also been some people I think maybe exaggerating certain aspects of this ruling because the court did not rule that geofence warrants are themselves unreasonable, just like in general.
- [03:26]
B
That's right.
- [03:27]
A
That, that question is still, is still going to be determined by, by the 4th Circuit. But what the court did find here also should not be minimized. It also is pretty significant to quote from the majority, quote, an individual has a reasonable expectation of privacy in records about his cell phone's location and police intrude on that constitutionally protected interest when they demand the information, even though for only a limited time and from a third party tech company, unquote. Well, we'll get into some of what that's referencing in terms of like third party tech companies later. As you mentioned, this, this case does revolve around a bank robbery. And I want to get into some of the context of this because it also will help understand sort of the ongoing case regarding the specific geofence warrant that was used. So in 2019, someone made off with almost $200,000 from a credit union and the suspect was seen on their phone prior to the robbery. So police asked Google to hand over the location data for all cell phones or the devices in a 150 meter radius around the bank. Within an hour of that robbery, 19 anonymous users were first identified. Police then narrowed that down to nine users who they got more information from from Google. They tracked the location for a longer period of time before police then requested personally identifying information on three users, which they then used to arrest the suspect. So the suspect eventually pleaded guilty, but it was like a conditional plea because they were still challenging the evidence that was obtained through the geofence warrant suspect citing a fourth amendment violation.
- [05:05]
B
That's right.
- [05:06]
A
Arguing that the warrant authorizing the location data search was invalid. And this claim made its way through the district court to the appeals court, to the Supreme Court. And we'll, we'll get into that in a bit. You already laid out some of the details of the specific like geofence warrant that was used. It has this three step process. First this big pool, then a smaller pool, and then personal identifying information on the smallest pool. One thing that is very interesting to me is that the process for setting up this warrant was set up with the help of Google. They like worked Together to make this process back when this was still like an emerging investigative avenue, like five, six, seven years ago.
- [05:53]
B
Yeah, that's right.
- [05:54]
A
And also, as you've mentioned, Google's location history feature operates differently now. The information that is being collected is stored on the user's phone.
- [06:05]
B
Yeah.
- [06:06]
A
They don't have the same type of access that they had back in 2019, in which this case emerges.
- [06:12]
B
That's right. They are no longer able to respond to geofence warrants, which is great. This does not mean they can't respond to other types of warrants and this doesn't mean that other companies won't respond to geofence warrants.
- [06:22]
A
Yeah, I guess. Do you want to discuss a few of the different ways in which location data is collected?
- [06:27]
B
Yeah, certainly. So there's a couple of ways let's, I guess sandbox this entirely just to cell phone location because we don't want to go off on a tangent about license plate readers or other location tracking mechanisms. But one of the big ways that people have been, that's kind of been on people's minds lately is advertising location data. So this is like the product Weblock, which is owned by this company Panlink, which I recently bought a contract with, and several other law enforcement agencies by contract with the Citizen Lab, just put out a pretty great report about them. But the way that they get their data is through a combination of advertising APIs from applications, basically. So when an application on their phone wants to show an ad, first it sends a request to what's called a real time bidding database. And it sends a request with a unique ID for your phone called a mobile ad ID or maid, and some information about you which can include your location. And then companies, any random company, you or I could set up a company to sit at these real time bidding centers and just kind of gather all this data and never make any bids or that data never spend any money, just gather all that data of pairing People's mobile advertising IDs with their location information. And this is exactly what Weblock does. So what they do is they sell this information to police. Police can then buy access to this information. And this is another thing that gets confused with geofencing a lot. But it's a different type of geofencing. They can sort of draw a circle around a specific area and WeBlock will show them all of the information they have about phones that have been in that area recently or during a specific time period. And that's not a geofence warrant, that is a geofenced Search of a database, which is essentially the same thing Google is doing on the back end. But there's no warrant involved in this case. But that's a very common method of tracking. The other way that they get data is just through code that they embed in certain ad libraries that will get them that data sort of the same way, but without going through the real time bidding process. But it's still data being given to them basically by ad libraries that they pay a bit of money for to the ad company or whatever.
- [09:00]
A
In a little bit, we'll discuss some of the implications of the Supreme Court's findings specifically on, like, the third party doctrine. But do you think that there's a possibility that the ruling in this case might be able to be used to put up challenges towards something like advertising location collection?
- [09:20]
B
Yeah, again, I'm not a lawyer. Legal strategy is quite outside my general domain of expertise. But it certainly seems to me like there should be an opening here the big loophole that law enforcement has been exploiting locally. We call it the data broker loophole. Right?
- [09:41]
A
Yeah.
- [09:42]
B
Has been a problem for a while. There was a bill called the Fourth Amendment is Not for Sale Act. It passed the House and then died in the Senate. Unfortunately, it was proposed by Senator ron Wyden in 2021. That was an attempt to close this loophole. But given the wording of the. Of the opinion here, you know, specifically around people's location data being very, very much private data, you know, I think that there's a reasonable argument to bring a case to the Supreme Court about the sale specifically of cellular location data.
- [10:18]
A
Yeah.
- [10:19]
B
Because they did rule that the third party doctrine, which we can get into, does not apply to cellular location data. So that's. I mean, I think that's a pretty big point in favor of shutting down the loophole for location data. It would not shut down the loophole for other data.
- [10:35]
A
But, yeah, it is frustrating how we have to kind of take this one step at a time. And that's. That is a sort of frustration that actually the Supreme Court voiced.
- [10:45]
B
Yeah, reformism is rough, man.
- [10:47]
A
This, like, case by case, app by app approach does not actually make very much sense.
- [11:00]
B
Queen Carvania stood haloed by the morning sun. An army hung on her every word.
- [11:07]
A
My champions, I have sold my chariot on Carvana. Twas a lovely suv. An inexplicably queenly offer. They're even coming to the castle to collect it. Tonight we feast. An offer you can feast on. Sell your car today on Carvana. Pickup fees may apply. Before we get into that. Let's go back to the bank robbers. Initial. Initial challenge based on the Fourth Amendment. So a district court did agree that the search violated the Fourth Amendment, but it did not actually block the data from being permitted as evidence because the court found that the police officer's reliance on the data was not, quote, unquote, objectively unreasonable, allowing the, quote, good faith exemption to the exclusionary rule, unquote. This was basically because the technology was still new and because there was few leads in this case, the district court found that the officer's use of this was not necessarily unreasonable. So they have this good faith exemption, which could become a problem later. Yeah, or might not. We'll see. Now, this was appealed to the 4th Circuit, who went back and forth a bit initially ruling 2:1, that the geofence did not even qualify as a search, so warrant wasn't needed in the first place. Now, one judge dissented from this, arguing that the warrant issued was, quote, so lacking in particularity and probable cause that it was invalid, unquote. Now, this too could become important. Later on, the full Fourth Circuit panel reheard the case again, but were divided seven, seven, half, ruling the warrant violated the Fourth Amendment. But most justices still found that the exclusionary rules good faith exception applied in this case. And that then leads us back to the Supreme Court. And the ruling last Monday only actually covers the Fourth Amendment aspect of the case. They're not ruling on the good faith exemption. And the Fourth Amendment question itself is split into two issues. Did the police conduct a search under the Fourth Amendment by acquiring location data from Google? And second, did the multi step geofence warrant issued in this case, did that warrant make this search unreasonable? Now, the court only answered this first question, did it actually qualify as a search? And handed off the second part of the question to the Fourth Circuit Court of Appeals, who will then also rule on the good faith exemption aspect of this case. To quote the majority quote, we leave it to the Court of Appeals. The further question whether, given the warrant issued, the search here was reasonable, meaning that each of its steps was properly described with particularity and, and found to be supported by probable cause, unquote. Justice Kagan then writes out instructions for the Fourth Circuit, most of which relate just to the Fourth Amendment itself, saying that the Fourth Amendment protects against, quote, unquote, the unreasonable search and seizures of persons, houses, papers and effects, and requires that warrants may only be issued upon probable cause and must particularly describe, quote, the place to be searched and the persons or things to be seized, unquote. And this particularity requirement is going to be a big part of this, of this case going forward. Because to issue a warrant, a judge must determine if there's a, quote, unquote, fair probability that the evidence of a crime would be found and that the search is of an appropriate scope. This is quoting from the majority, again, quote, that it's carefully tailored to its justifications and will not take on the character of the wide ranging exploratory searches that the Framers intended to prohibit, unquote. And this is the specific key issue with these geofence warrants, the fact that they cast this large dragonet over just everyone in a certain area at a certain time.
- [15:01]
B
That's right. You're, you're basically searching, you know, potentially hundreds, potentially thousands of people. Right. If you imagine a geofence warrant in downtown Manhattan or something. Right. Like you're, you're treating everyone as a suspect right off the bat. And that's, I mean, that's the problem with any, any sort of mass surveillance, any sort of dragnet surveillance. But that's exactly what this is. And so, I mean, this is, this is a good ruling by the Supreme Court. Right. It's not perfect, but it's surprisingly good given this Supreme Court.
- [15:37]
A
Now, a lot of this ruling is based on a previous ruling, or it's built on a previous ruling from 2018, this case called Carpenter v. United States, which was also a very important ruling that affected the way police can gain access to cell phone location history through cell site towers.
- [15:59]
B
Yeah, so. So Carpenter ruled that police required a warrant to get cell site location information, specifically historic cell site location information. CSLI is the, is the acronym for that. CSLI is basically the police go to a phone company and say, tell us who was connected to these towers at this time or tell us what towers this phone connected to. And the core rule that, that was essentially equivalent to putting a ankle monitor was their specific language on Everybody in the U.S. right, that, that was that fine grained location data. And so they ruled that you needed a warrant to get that location data, which was a really excellent ruling. This case was brought to the court on the basis of that Carpenter versus United States ruling. And this reaffirmed and expanded. The big difference was that the information that law enforcement had gotten from the phone companies in this case covered a larger amount of people. But the Chatri case covered a much smaller area and a much smaller amount of people. But the court decided that this ruling still applied even in the smaller case, which is great. It's, you know, really, it's. It's narrowing it down. Right. Which is how the Supreme Court works. Right. You get a broad ruling, but then sort of exceptions to that rule and, like, you know, the limits of that end up being tested. Which brings us back to what we were saying before. Right. So, like, the next thing. I think the next thing to test is, does this. Does the Supreme Court think this ruling applies to purchased data? Yeah, it seems like maybe they hinted at that a little bit, but it's, you know, it won't be clear until somebody actually brings that case to the Supreme Court.
- [17:45]
A
One of the most promising sentences in the ruling is, quote, a new technology should not transform what individuals had reasonably thought they could withhold from the government.
- [17:57]
B
Yeah.
- [17:57]
A
And I mean, that sort of reasoning, and there's. There's actually a lot of it throughout the majority's ruling, but, like, there's. There's a lot of sentences like that, that could. That could be really, really useful going forward.
- [18:08]
B
Yeah.
- [18:08]
A
And like, you know, a carpenter was itself based on another surveillance case called United States versus Jones, which covered another method of tracking physical location and movements. And this was through a. Using a GPS to monitor a vehicle.
- [18:20]
B
Right.
- [18:21]
A
And that. That was a 5, 4 ruling. So. Very close. Yeah. But in that case, the. The court found that GPS tracking does qualify as a Fourth Amendment search because, quote, unquote, individuals have a reasonable expectation of privacy in the whole of their physical movements.
- [18:35]
B
Right.
- [18:36]
A
And essentially because of how difficult it was to at the time, like, secretly monitor and track the movements of a vehicle, including on and off public roads. So. Including on private roads.
- [18:49]
B
Yep.
- [18:49]
A
It was then reasonable to expect a certain level of privacy because. Because of how difficult this was. But upon the proliferation of GPS trackers, the ease in which this type of government surveillance could be achieved, you know, changed dramatically. And that's the context in which Justice Kagan is writing this sentence, that a new technology should not transform what individuals had reasonably thought they could withhold from the government.
- [19:11]
B
Yeah, that's right. And I mean, I think that that's a. That's a really important sense for a lot of things. Right. That's an important sentence for the fight against license plate readers and Flock and the, you know, other companies in that industry. That's an important sentence for cellular location information. Right. Like, this is a great ruling. Right. But it leaves open the whole issue, like I was saying, of, you know, being able to buy surveillance information.
- [19:36]
A
Right.
- [19:36]
B
And, like, that's what enables license plate readers. That's what enables companies that surveil social media, that's what enables tools like WeBlock that sell location information from ad tech. Right. And it does seem like they are, they are hinting that maybe they, you know, that they are ready to rule on that. To me, it's a very, it's a very self apparent argument, right. That, that just because the police bought something doesn't mean they should get around the warrant. The terrible part of this is that, you know, we will probably have to argue in technology in its own right. Unless, you know, we had a functioning Congress and well, they were able to pass very popular.
- [20:20]
A
Let's not get too ridiculous. Let's not.
- [20:23]
B
Right.
- [20:23]
A
Let's keep things grounded in reality here.
- [20:26]
B
Yeah, yeah, I'm gonna, I'm gonna hope for more realistic goals like total anarchy.
- [20:31]
A
No, I mean, absolutely. It would be great to see some of this stuff just be enshrined. But there is, there is a lot to look forward to considering this ruling. And I think to that point, before we close, let's talk about the third party doctrine. Specifically, what is the third party doctrine?
- [20:44]
B
So the third party doctrine is a doctrine in US Law that states that people don't have a reasonable expectation of privacy in information that they've given to a third party, such as a phone company or a bank or a tech company.
- [21:03]
A
Yeah.
- [21:03]
B
Essentially, this is how historically law enforcement has gotten information from phone companies or from banks, et cetera, with other tech companies without a warrant. And the heart of this ruling is that the justice has said that cellular location data being equivalent total surveillance to that of an ankle monitor. Yeah. The third party doctrine does not apply to cellular location data.
- [21:31]
A
Yeah, because like the third party doctrine was set up specifically in reference to like the types of financial information that you will hand over to a bank that's right. To do business at the bank or by dialing a phone number, the phone company that knows what the phone number is.
- [21:46]
B
Right.
- [21:46]
A
Like those for the specific instances that establish third party doctrine. And a third party third party auction was not applied in Carpenter v. U.S. and so Kagan wrote that for the very same reasons it should not be applied to location history from tech companies. And even more specifically, because the types of information that location history from Google had access to was even more intimate and fine tuned than what you could get from just picking a cell tower.
- [22:12]
B
That's right. Because the location information from Google is based on not only your tps, I mean it is your TPS location, which is fairly accurate, but also the triangulation of your location from WI fi devices and Bluetooth devices around you. Whereas the location you get from csli, which was what was at issue in Carpenter, is going to depend on how dense cell towers are in the area you're in. Because it's just mathematical equation of like what your signal strength is to your nearest three cell towers. And you can kind of triangulate somebody to a, to a broader area based on that.
- [22:51]
A
Well, and location history from Google at this point was tracking people's movements like every two minutes and could operate on a longitude and latitude. So they could not only just figure out where you were on a map, but if you were in a building, what floor you were on that building, like a much more fine tuned look.
- [23:11]
B
Right. Altitude as well. Yeah, yeah.
- [23:13]
A
Part of what Carpenter found was that cell phone location information is, quote, unquote, quantitatively different from telephone numbers and bank records.
- [23:22]
B
Yes.
- [23:23]
A
And so because of that finding, they applied that same, that same logic to this case. And I want to read through kind of two paragraphs that, similar to the line about, about how, you know, people's expectation of privacy should not be changed because of technological developments, I think there's, there's two lines here that could become really important going forward in terms of how we understand, like even just the notion of digital privacy. Quote, cell phone location information is not truly shared as one normally understands the term, because cell phones and the services they provide are such a pervasive and insistent part of daily life, indispensable to participation in modern society, that a person could hardly help but generate a trail of location data in no meaningful sense. The court thought, does that mean the person voluntarily exposes to any third party a comprehensive dossier of his physical movements? Yeah, so that's Justice Kagan kind of combining the analysis for this specific case with the analysis for Carpenter. And then she goes on to write, quote, the government's app by app, feature by feature method of granting Fourth Amendment protections misapprehends the very nature of modern cell phone use. Pretty much everything a person does on a smartphone requires some kind of opt in. The point of carrying cell phones is to use what's on them, as Carpenter said, to use the apps and the services they provide. That is what has become a pervasive and insistent, even indispensable part of daily life. And so that is what Carpenter insulated from the third party doctrine.
- [24:53]
B
Yeah, my short term memory is terrible, so I've forgotten the exact wording. But the part where she's addressing how piecemeal it is. Right. And how like she's, yeah, this applies to all apps. This applies to all uses of this location data, never shall this be subject to any third party doctorate. Right. I think that that is pretty damning for companies that are currently selling this data to law enforcement. It should be pretty damning anyway.
- [25:19]
A
Yeah. And like the idea that through simply using these devices which are now necessary for modern life, using these does not mean that we're voluntarily giving this data over to companies and by extension the government, they don't just have free access to it because we are using the things that are necessary for daily life. If they want access to it, they have to go through the proper channels, which are laid out in the fourth Amendment.
- [25:42]
B
Yes. You have to get a warrant at least.
- [25:44]
A
Yes. And so to close, let's, let's talk about kind of what this could mean going forward. Right. Because the question of whether the particular geofence warrant used in this bank robbery case, if that was reasonable or unreasonable, now goes to the 4th Circuit, who will determine if probable cause was established to support the scope of the search and if the warrant satisfied the particularity requirements, considering the fact that it cast a broad dragnet over a whole area rather than being, you know, fine tuned to a specific suspect or even a group of suspects. Kagan wrote of the warrant, quote, how the officers would make their choices at the second and third steps, how they would pick the users subject to more intense scrutiny. The warrant said very little, unquote. This is kind of part of like the instructions in which they are writing to the 4th Circuit now. The, the suspect, the bank robber suspect, compared the geofence warrant to a, quote, unquote, unconstitutional general warrant lacking in probable cause, with steps two and three of the warrant, leaving, quote, too much authority to police officers and too little to the magistrate, unquote. So what that's saying is that in this like three step warrant, when the police are able to determine who in the broad pool of people caught in the dragnet who to investigate further, that choice was just up to police officers. That question was not laid out in front of a judge. A judge did not authorize that aspect of the search. That was just up to the discretion of officers. That is part of his argument that this was a constitutional violation. Now, of course, that's not the government's take, Right. The government claims that the information was, quote, unquote, particularized information from Google's database based on probable cause to believe that Google had the information that would help solve a crime. They also argue that the discretion given to officers in the execution of steps 2 and 3 of the Warrant fell within the Bounds of reasonable lists. So going forward, when the fourth Circuit rules on the reasonableness or unreasonableness of this warrant, they will also consider what the district court and the fourth Circuit themselves have previously ruled on. They will reconsider the quote unquote good faith exemption.
- [27:51]
B
Yeah, the good faith exception is a doctrine in US Law that allows generally evidence obtained without a warrant is inadmissible in court. The good faith exception allows for evidence which was obtained with a faulty warrant where the law enforcement agents had reasonable cause to believe that it was a valid warrant and they thought they were obtaining a lot of evidence, quote unquote, in good faith with a valid warrant that that evidence can still be admissible in court even if the warrant is found to be invalid. So that's what they're, that's what they'll be evaluating in this case. And I mean that's what they've already decided on and will have to decide on again. Yeah, even if this warrant is invalid or even if this data is invalid because the second and third step didn't have a warrant associated with them, can this still be admissible in his case under good base exception?
- [28:50]
A
And the Supreme Court does have like instructions for how, how they want the 4th Circuit to reevaluate that question, knowing that they've already ruled on it before, but they are instructing them based on, you know, the legal opinion that is outlined in the majority that they do have to re approach this question with these new insights from the Supreme Court. Hey, it's Ryan Reynolds here from Mint Mobile. Now I was looking for fun ways to tell you that Mint's offer of unlimited Premium Wireless for $15 a month is back. So I thought it would be fun if we made $15 bills, but it turns out that's very illegal.
- [29:31]
B
So there goes my big idea for the commercial.
- [29:33]
A
Give it a try@mintmobile.com Switch upfront payment
- [29:36]
B
of $45 for three months, $90 for
- [29:38]
A
six months or $180 for a 12 month plan.
- [29:39]
B
Request required $15 per month equivalent taxes and fees. Extra initial plan term only greater than 50 gigabytes. Me slow when network is busy. See terms.
- [29:49]
A
There is, you know, evidence that rulings like this have impacted the way police operate surveillance, specifically by collecting information from like cell towers. You are kind of the, the expert in cell site simulators. And there's I think reason to believe that the Carpenter ruling also affected the way that cell site simulators were used despite it not being the particular focus of that ruling. If you want to kind of as, as A very ending the Ray Hunter project. And you know how some previous rulings have like, impacted the way that that type of surveillance has kind of fallen out of fashion.
- [30:20]
B
Yeah, for sure. So stalled flight simulators, also known as Stingrays or MC Catchers, these are fake cell towers that police set up to locate a specific person's cell phone, or I should say a specific cell phone, which is often associated with a specific person with a very fine granular level of detail. At eff, I and some of my colleagues have created a product called Ray Hunter to get an idea of how often cell site simulators were being used in the US Specifically, what we were concerned about was that law enforcement could use a cell site simulator to spy on and identify the people present at First Amendment protected activities. So find out who is at a protest, find out who is going to an abortion clinic, find out who is showing up at a mosque. Right. So that was the big concern we had, was that they were being used for that instead of, or what police said they were using them for, which is manhunts, basically, or, you know, identifying that somebody is in a specific location before SWAT team does a raid on that house. So for the last year or so, we've had hundreds of people all over the country bringing these devices around with them to protests. And just as they go about their daily lives to find out sort of what the lay of the land is and how often these are being used. And the reasoning for this is that we were getting the impression that a lot of activists seem to have the impression that cell size simulators were being used at every protest and that police were driving around with one of these in every car. Right. And there was a lot of, I think, fear and uncertainty and doubt and sort of folk wisdom and misinformation going around. So we wanted to be able to get some real facts on the ground to clear it up. And so over the last year, what we've seen is we have seen evidence of cell site simulators occasionally. What we have not seen is a preponderance of them. From what we're seeing, they're not being used constantly, all the time, everywhere. Right. They're being used much more rarely than most people think. And we haven't seen really hardly any evidence of them being used at protests. What we've seen is them being used kind of sometimes around major cities. We've seen them being used outside the US A bit, but inside the US we have not seen them being used for sort of the mass surveillance reason that we feared that has Been backed up by looking at the warrants for salesizing letters that we've been able to get access to. Been backed up by talking to people who are close with law enforcement and who understand kind of how law enforcement is actually using these. What we're hearing and what we're seeing sort of evidence of is that cell site simulators are being used with warrants now. Because law enforcement by and large thinks that the Carpenter ruling does apply to cell site simulators because that is cell site location information.
- [33:57]
A
It's the same type of data.
- [33:58]
B
It is the same exact type of data. Right. And so it makes sense that a warrant should apply to that as well. Before when they figured a warrant didn't apply to this. Right. Because I don't know, I don't know what the mental gymnastics were there. Right. I think it's possible that these were used a lot more. But now it seems like most law enforcement agencies have come to the conclusion that the federal government has come to the conclusion that this technology does require a warrant and that it's more useful or locating a specific person than identifying people in a specific area. I think in addition to the warrants, it makes technical sense because if you want to find the people who are in a specific area, cell site simulator is a expensive, cumbersome, complicated tool for doing that. When the alternatives are sending a geofence warrant to Google.
- [34:55]
A
Asking Google just to tell me.
- [34:56]
B
Yeah, asking Google to tell you or asking the phone company for a tower dump. Getting a warrant for a tower dump, which is where you ask them to tell you everybody that was connected to a specific tower.
- [35:09]
A
Yeah.
- [35:10]
B
At a specific period of time. That is something that is not addressed by any of these. Tower dumps are still a thing you can get with a warrant. Right. So that's, that's an option. And then of course all of the other methods of non cell phone based surveillance. Right. Face recognition is an option. License pay readers are an option. Right. So there are so many easier ways to get the identities of everybody in a specific area. It doesn't make sense to use the simulators for that. And that's what we're seeing. It seems like what they're being used for, for the vast majority of things is identifying that a specific person is in a specific house before a no knock raid is executed. And no knock raids are highly problematic. I am not a fan of the SWAT teams. There's a lot of issues there. But if they're going to happen, like, I guess, yeah, like let's, let's make sure we're raiding the right house so that they can be sure of which dogs they're killing before they. I mean.
- [36:07]
A
Yeah, I mean, swatting has become a huge like harassment like tool for people just to deploy against someone that they don't like or an influencer that they find annoying. And that, that is a real issue as well.
- [36:18]
B
So not the biggest issue there. Right. The existence of spot teams and how liberally they're used is the much bigger issue, I think.
- [36:27]
A
So based on how Carpenter seemingly affected the police's reticence to use cell site simulators, I think, like we've discussed, there's hope that this new ruling might also be able to be applied to some other surveillance methods, but that will only really become clear over time. There's one particular that I'm also interested in is like keyword warrants where police will just ask a tech company to like get information on all users who typed a specific thing into a search bar. Right, right. And so there's aspects of this recent ruling that could possibly apply to something like that as well. But you know, despite Kagan's annoyance at the, you know, app by app way in which fourth Amendment protections are granted, organizations like legal rights organizations, including like the eff, you know, might still have to kind of approach this from an F by app basis to get like confirmation.
- [37:17]
B
Yeah.
- [37:17]
A
That these things are subject to the fourth Amendment. So it's something that we will see
- [37:21]
B
over time until and unless we can get comprehensive federal privacy law, which again is not. I'm not, I'm not holding out hope for Congress to pass any privacy bills anytime, anytime soon.
- [37:33]
A
Not in the immediate future, but we could hope one day. Right. And that is a real thing. Same thing with like data centers. This is a thing that I think people should try to build a mass movement around.
- [37:43]
B
Yeah, absolutely. It is happening to some degrees at the state level. Right. California has a pretty good privacy law. It's not perfect, but it's certainly better than the non existent federal one. Montana became the first state to close the loophole allowing law enforcement to buy data from third parties. Right. So it's, it's. There is hope that at least at the state level we can try to start closing these loopholes, you know, as a band aid until the federal government maybe steps up in four to eight to 20 years.
- [38:22]
A
You know, we'll take that. You know, it is, it is very rare to have a nick it happen here episode that ends with there is some hope in general.
- [38:30]
B
It's very rare to have a conversation with me that ends with anybody positively at all.
- [38:35]
A
So true. No, I'm sure. Yeah, I'm sure we can have you on to talk about Pegasus to bum us all out again at some point.
- [38:41]
B
Absolutely. I have many ways to bum you out.
- [38:44]
A
But where can people find your work online if they want to hear more about Ray Hunter and all the research you do at EFF?
- [38:53]
B
Yeah, you can find me at Bluesky. I'm@cooperq.com on Bluesky or Mastodon if you're that flavor of Linux nerd. You can find me at cooperqasto Hackers Town on Mastodon. Or you can find me@eff.org of course, where I publish all of my writing and that we highly recommend checking out our surveillance self defense guides. @ssd.eff.org we have the pretty much the longest, the longest continuously updated technical self defense guides that have ever existed. And they're, they're really, really excellent resource. I think they're my favorite resource that we put out. So go check those out as well.
- [39:36]
A
Thank you.
- [39:37]
B
Thank you.
- [39:38]
A
Turn off your phone. It Could Happen Here is a production of Cool Zone Media. For more podcasts from Cool Zone Media, Visit our website, coolzonemedia.com or check us out on the iHeartRadio app, Apple Podcasts, or wherever you listen to podcasts you can now find sources for It Could Happen here listed directly in Episode Descriptions. Thanks for listening. This is an iHeart podcast. Guaranteed Human.