← What the Hack?
Loading summary
Transcript72 lines
- [00:02]
Beau Friedlander
The Constitution has made for some truly great entertainment.
- [00:08]
Nathan Fried Wessler
Where the hell does it say you've got a right to kick down doors, torture suspects?
- [00:13]
Beau Friedlander
Deny medical attention and legal counsel? Where have you been?
- [00:17]
Nathan Fried Wessler
Does Escobedo ring a bell? Miranda? I mean, you must have heard of the Fourth Amendment.
- [00:24]
Beau Friedlander
That's the prosecutor in Dirty Harry talking about the Scorpio killer. Well, I'm all broken up about that man's rights. You should be. I've got news for you, Callahan. As soon as he's well enough to
- [00:35]
Nathan Fried Wessler
leave the hospital, he walks.
- [00:38]
Beau Friedlander
What are you talking about?
- [00:40]
Nathan Fried Wessler
He's free.
- [00:41]
Beau Friedlander
And that's how we're used to thinking about the Fourth Amendment. Illegal search and seizure. We've been talking a lot about surveillance. Specifically cameras and systems sold by companies with often outdated software. Unsecured operating systems or insufficient ones. Stuff that anyone with a little technical ability can hack. I don't. Even if you want to call it hacking. And law enforcement, they can. They can use it to track anyone anywhere in the United States without a warrant. But think about it. Martin. Find him. He's still on the call.
- [01:17]
Nathan Fried Wessler
Come out, come out, wherever you are.
- [01:20]
Beau Friedlander
The Truman show depicted a controlled environment with cameras everywhere. That that movie ends with Truman opting out.
- [01:31]
Nathan Fried Wessler
In case I don't see ya, good
- [01:34]
Beau Friedlander
afternoon, good evening and good night. Good night indeed. Hooray for Hollywood. Showbiz has always seen things coming way before they were mostly science fiction, right? Long before it happened. Like literally the 1927 silent film, like really literally. The very beginning of film Metropolis featured video calls. Okay. And AI automation. Now, I wish I could play a clip, but it was. You're just going to hear music. War Games introduced moviegoers to the emerging threat of hacking. In 1983, for reference, the police as priesting Michael Jackson and oh what a Feeling by Irene Cara held the top slots in the Billboard's top chart then, right? Deepfakes. Those were predicted four decades ago in the Running Man.
- [02:26]
Nathan Fried Wessler
Tony, this better work, pal, or you'll
- [02:28]
Beau Friedlander
be a digital memory. Take it easy, Damon.
- [02:31]
Nathan Fried Wessler
We're loading Richard's image onto the database. And when he's mapped onto the stunt double, you'll never know the difference.
- [02:36]
Beau Friedlander
Now for a reality check.
- [02:38]
Nathan Fried Wessler
It's like once you're in it, you can query the cameras of other states and municipalities. You can do either a statewide search or you can do a nationwide search. And so in some cases you can like say you're a local police department. You can say, hey, I'm looking for this license plate of a stolen vehicle. And you're not just searching the cameras that you have personally bought and like, paid the subscription fee for. You can search all the ones in your state, all the ones in the country, if you want to. So it's become this massive network of tens of thousands of devices. And you really, like, can't drive in many major cities and small, even some small towns at this point without driving by one of these things.
- [03:26]
Beau Friedlander
And of course, the current surveillance state was foreseen in so many movies, but I'm guessing that's because humans are wired for results and the law, you know, is a hindrance. There's a story about general George Patton in Sicily. Obviously it's in his movie Patton, or not his movie, but the biopic Patton, his column. His soldiers are stuck on a mountain road in Sicily. And they're behind. They're all stuck behind this peasant with his two mules. And the mules refuse to go. Soldiers have their shoulder behind the cart. Everyone's trying to get him to move. Nothing's working. Patton gets out, shoots both mules, and yells at his men to throw them over the side of the bridge so they can get where they're going. Now, he didn't think of himself as doing anything wrong. There, there. And I'm not gonna play the clip because I think it's so sad. But there, there was a. There was a war to win, right? In his mind, people say, shoot the donkey. To this day, especially in business circles, when they're talking about getting rid of stupid impediments. Shoot the donkey. Those people are generally not animal lovers. Today's for profit surveillance industry, led by Flock Safety at the moment, is in the process of installing a Truman show level of camera coverage across the country on telephone poles and parking lots, outside car dealerships, in private neighborhoods. You know, what they're doing really is they're shooting the donkey. When it comes to the need for warrants, they're not owned by the police. And that's the point when law enforcement wants your location history, your travel patterns, who you were with, when they would generally need a warrant for that. But they don't now. They just ask Flock or whatever company has that data. There are other companies, not just Flock Safety, and they can get it because private companies are just selling data, data that they collected on their machines. And there's no law against that. It's kind of crazy, isn't it? Unlike the donkeys in Patton, the fourth amendment is still here, at least for the time being. Nobody shot it yet. Or maybe it's getting killed by a thousand cuts or a billion cuts or 20 billion cuts a month, as you'll hear later. Anyway, the basic idea here that matters is the government needs a reason before gets to know things about you. That's what the Fourth Amendment says, a real reason, one that a judge signed off on, not a hunch and not something that you can just look up because you happen to have a subscription paid at the moment. It needs a warrant. This week we're talking about all that with Nathan Fried Wessler, deputy director of the ACLU's Speech, Privacy and Technology Project. He's been fighting surveillance overreach in federal courts for over a decade and in 2018 argued a case before the Supreme Court called Carpenter vs United States. That changed, maybe permanently, how the Fourth Amendment applies to the digital world.
- [06:35]
Nathan Fried Wessler
Mr. Wessler. Thank you, Mr. Chief justice, and may it please the court.
- [06:39]
Beau Friedlander
You heard some of Nate last week. There was a lot more to cover. So here we are again. I'm Beau Friedlander, and this is what the Hack, the podcast that asks in a world where your data is everywhere, how do you stay safe online? Nate, welcome to the show.
- [07:14]
Nathan Fried Wessler
Thank you so much. Really glad to be here.
- [07:16]
Beau Friedlander
It's a real honor to have you on the show. You've done really important work for privacy and surveillance for the protection of Americans from unwarranted surveillance. And that's why we're talking today. I think I want to start, if you don't mind, with Carpenter, just to give people a sense of it wasn't that long ago, I think it was 2018. It was decided.
- [07:36]
Nathan Fried Wessler
Yeah. So Timothy Carpenter himself was a man in the Detroit area who was arrested by police, started as Detroit police and then became a federal prosecution on suspicion of participating in a series of robberies, kind of ironically, robberies of cell phone stores. There was an allegation that there was a group of guys who was ripping off smartphones from stores and reselling them. And in the course of the investigation, one of the things the government did was go to his cell phone company and get without a warrant, with a court order, but on a much lower legal standard, not probable cause you need for a warrant. Got an order, went to the phone company and got months worth, about seven months worth, of his historical cell phone location information. Our cell phones are basically radios, right? In order to make or receive a cell phone call, send or receive a text message or make a data connection, our phones have to talk to a cell tower, and they have to talk actually to a directional antenna coming off of that cell tower. It turns out that Every time our phone makes one of those connections, the phone company is recording information about which cell tower, which side of the cell tower the phone is. And the companies retain that information for their own reasons, for billing purposes, for network diagnostics.
- [08:47]
Beau Friedlander
Your phone is constantly looking for the nearest cell tower. It has to be, otherwise calls wouldn't come through. And every time it finds one, the phone company logs it. Time, location, what tower, right? All day, every day, without you doing anything. This is very different from GPS data. That's a global positioning satellite providing pinpoint accuracy to help you know where you are. Turn left, turn right, make a U turn, send a bomb somewhere, spy on you. And of course most phones these days have GPS receivers. It's a problem. But back to those cell towers, that data is different. It lists the nearest cell terrors to you 24 7. Do that a thousand times a day across weeks, months and years and you don't have a footnote. You have a diary. A diary you now have with detailed timestamps, an unbroken record of where you've been. It's worth noting diaries are protected by the fourth amendment.
- [09:47]
Nathan Fried Wessler
What law enforcement had figured out over the course of a day. When we're carrying our phones with us, that just charts out everywhere you've been. And it's a rare investigation where knowing where a suspect was at the time of an alleged crime isn't useful.
- [10:01]
Beau Friedlander
Forget a witness who might misremember, forget alibis that are hard to check. If you have someone's cell phone location data, you can put them in a general vicinity at a particular time. We've all been near a crime scene whether or not we were aware of it. I know it's kind of creepy, but true. The data also shows who else is in the same area. Your accomplice for example, or your kid. It's enough to convict someone of a crime. That is, if they get a warrant to review the data.
- [10:34]
Nathan Fried Wessler
And so police started making huge volumes of requests to the cell phone companies for historical cell phone location data and doing it without getting a search warrant, without getting the kind of warrant that police have always been required to get under the fourth amendment to, to say, search our homes, search our closed containers, search our private areas or private information. They were doing that under the theory that when you do business with a company and they gain your private information through the relationship with you as a consumer, you've given up your privacy interest. It's now the business's records, it's not your private data anymore. And so you just have no fourth amendment rights. In it and the government can go without a warrant. And that was the central question in the Carpenter case. Does the fact that this is held by a cell phone company mean there's just no privacy rights? Or do we need to have kind of a re understanding of how to apply old fourth amendment protections in the digital age?
- [11:27]
Beau Friedlander
I mean, when I first learned about the fourth Amendment, it had to do with, I think, Brady and the illegal use of a journal, the illegal use of a person's private journal and the prosecution of someone. Our phones are kind of like electronic journals, aren't they?
- [11:42]
Nathan Fried Wessler
Oh, absolutely. Courts love operating by analogy. And phones are, you know, they're so sensitive and so needing of protection, in part because they're all the things. They're a journal, they're an almanac, they're. They're a medical file, they're a family photo album. In fact, they're the entire shelf worth of family photo albums. They're your doctor's file. Right. They're your billing records. Right. There's just a diversity and a variety and a depth of information that's unprecedented to be saved in a single place and relevant to the Carpenter decision. They're also a tracking device. Right. They're a sophisticated computer, but they're also a GPS location tracker that's sitting in our pockets. And that, without protections, means an incredible depth of really private information about where we go, when we go there, who we spend time with, what we're doing. It's just free for the taking. That's why the law had to step in.
- [12:39]
Beau Friedlander
The government had been arguing that your location data belonged to the phone company, not you. You waived all rights when you signed up for service. That's a legal doctrine called third party rule. And for decades, it worked because in the pre digital world, the only records a phone company had were things like the phone numbers that you dialed, not a rolling diary of where he went. Carpenter changed that. Chief Justice Roberts, a nuanced conservative when it comes to privacy, wrote the majority opinion. He said that when the government gets a comprehensive record of a person's past movements, that is a search and you need a warrant.
- [13:20]
Nathan Fried Wessler
This would be revolutionary to fundamentally change
- [13:23]
Beau Friedlander
the understanding of the application of the fourth Amendment amendment to subpoenas. Do you want us to do that?
- [13:29]
Nathan Fried Wessler
Well, I, I don't think it's revolutionary at all. This is unlike a warrant. And all of this court's cases on the good faith exception have dealt with warrants based on affidavits from an investigating officer. This is an unsworn application from A prosecutor who we think should know better. Thank you.
- [13:42]
Beau Friedlander
Thank you, counsel. The case is submitted. Nate argued that case. He won that case five to four. And now every surveillance company in the land is living with the fallout. Go, Nate.
- [14:09]
Nathan Fried Wessler
Another thing the government does is they'll go to a cell phone company or another company like Google and say, we want to know all the phones that were in this geographic area in this time frame on the theory that a crime happened there or nearby, and they want to know who was nearby. But of course, you're going to get tons of innocent people then, and then you'll know that they were in some vicinity at some some time without any particularized suspicion.
- [14:33]
Beau Friedlander
You'd think that there would be a resistance on the side of a private sector company that would say you're going to have to get a warrant if you want that information. But that is not always how it has worked, is it?
- [14:47]
Nathan Fried Wessler
That's right. It's important actually to understand what Congress has done and when in this area, because there are some rules, but they're really old. So the relevant federal statute that governs law enforcement requests to technology companies or communication service providers. So that's things like the telecoms, cell phone service companies AT&T and Verizon or the landline companies, or entities like Google or Meta or Apple, any of those. They're governed by the Electronic Communications Privacy Act. Now, that's a law that dates from the 1980s when the Internet barely existed, when email was still basically an experiment between university campuses. So in 1986, Congress said, well, at least for certain contents of communications. Right? And today that would be contents of your email messages, your text messages, or social media direct messages. Many of those will require a warrant, although there are some loopholes that made maybe some logical sense 40 years ago, don't make any sense today. And there's some very basic information called basic subscriber information, name, billing, information, network connection times that you can get with a subpoena, which is just a piece of paper that a government agent sends, and then everything else in the middle. Any other record pertaining to a customer or user, you can get either with a warrant or with one of these court orders on the reasonable grounds standards, which is very easy to meet. It's a very low threshold.
- [16:10]
Beau Friedlander
But there's no failure of imagination in 1980, because that's just unfair. There's a failure to update laws.
- [16:17]
Nathan Fried Wessler
It sounds. Yes, that's absolutely right. Congress made some mild, very minor amendments in the mid-90s to that statute. And it's basically just sat there since then as our lives have moved completely online. And so that's why we have these questions that Congress just hasn't revisited, like, well, what do you do with cell phone location records? They're not content and communications. So the statute doesn't say you need a warrant, but the fourth amendment says something about it.
- [16:41]
Beau Friedlander
You're carrying. You're carrying a vault around with you all the time. You're carrying, you know, what should be in a safe or a safety deposit box in your pocket constantly. And that's not something that the law could have foreseen at all. But at the same time, there's this data that is. It's off gassing that the legal system or the courts have not yet recognized as being. That should be protected. That's what I'm hearing.
- [17:11]
Nathan Fried Wessler
That's right. I mean, until the Carpenter case, the Supreme Court hadn't engaged in this question. The court had dealt with a couple other privacy in the digital age cases and really set some protective rules about searching the contents of cell phones after someone's arrested. Where the old rule is, if you're under arrest, police can search what's in your pockets just because you're under arrest. And the Supreme Court updated that rule for cell phones, saying, yeah, maybe that's true for a cigarette pack or even a wallet. But cell phones, because they contain so much private information and such a diversity of that information, you need a warrant. Police can secure the phone while you're under arrest, but if they want to go into it, you've got to go to a judge first. But this fundamental question of what you do with data that's not held on your device itself, not held in your pocket, but is held on the servers of a company you've interacted with. And that was a new one to the Supreme Court.
- [17:58]
Beau Friedlander
It was a new one to consumers, too. Yeah. I don't think consumers were thinking, oh, I am now. You can find me day or night. You'll always know where I am or where I have been. Yeah. If phone records, including where you've been, are the property of a phone company, which arguably they would be because it's just data that has happened as a result of someone signing up for their service, can they sell it? Can a law enforcement person who's finding that a judge is saying, nope, sorry, can they just go through a data broker and buy it?
- [18:33]
Nathan Fried Wessler
Yeah. So this is now a really pressing question. So the phone companies themselves are barred by federal law from selling our cell phone location data. There's a statute called the Federal Communications Act, Telecommunications act that protects what's called customer proprietary network information, and particularly, which is a whole category of records about our phone use, but has special protections actually for location data. So the phone companies aren't allowed to sell it, and they can't voluntarily turn it over to the government. So the government has to come with some piece of paper. And now we know from the Supreme Court in Carpenter that that piece of paper has to be a warrant. But there's a whole other class of companies out there that are not regulated by the Telecommunications Act. The app companies. On a modern smartphone, there are, of course, a bunch of apps that come preloaded, but then we download apps left and right, and a lot of them are free, purportedly. Right. You're not paying cash up front. But these are for profit entities in a capitalist system trying to make money. So how do they do that? Through advertising and through selling whatever data they can. Federal lodges has not caught up to these kinds of commercial data harms that can come from selling, say, a complete record of GPS location points that the app on your phone has collected. There's a whole gray market now, the data broker market for that data, going to advertiser networks, insurance companies, lots of others, but also now to the government. And there are a number of these data brokers who have realized that there's a really lucrative business to be made from selling people's app derived location data to law enforcement, which lets law enforcement get around the warrant requirement from Carpenter, because now they are paying money instead of going to a phone company with a warrant.
- [20:15]
Beau Friedlander
What about the irs, the Pentagon, the Department of Homeland Security?
- [20:19]
Nathan Fried Wessler
Well, it's actually. It's actually happening at all of those. The IRS got caught buying this data. They said they. They shut it down several years ago. And the Pentagon has also gotten caught buying this data from Americans. From Americans.
- [20:31]
Beau Friedlander
Nate, can you talk about the tech that ICE is using? Like stingrays?
- [20:36]
Nathan Fried Wessler
Yeah. So stingrays are one of several ways that a government agent, a law enforcement officer, can try to locate a phone or identify somebody. These stingrays, more generically they're called cell site simulators, are designed by these private surveillance vendors to send out signals that mimic cell phone towers that trick phones into thinking, oh, I'm talking to a tower. And then the phone identifies itself with its unique serial number, and the stingray can force the phone to keep transmitting that and then really triangulate and zero in on exactly where that phone is. Can also either intentionally or just as a byproduct of this pinging all the phones in the area figure out all the phones that are nearby. So even when the government's looking for a particular suspect, it's forcing all the phones in the area to talk to the Stingray device. And these devices can be configured to retain that information too, to purposefully download a list of all the phones nearby. The location tracking ability of these devices is really precise. I've seen cases where police were able to figure out exactly what behind which window in a very large apartment building the phone they were looking for was at, because they're just narrowing in on where that signal's coming from.
- [21:45]
Beau Friedlander
A lot of this was done used without proper warrants, is that right?
- [21:51]
Nathan Fried Wessler
That's right. For a long time, the government was not getting warrants. There was a flurry of litigation that the ACLU and criminal defense attorneys brought about a decade ago, maybe 12, 13 years ago, that started turning, turning the tide. And there's now, you know, a small critical mass of court decisions that explain that a warrant is absolutely required for this. There also is federal policy now in both Department of Justice and Department of Homeland Security that dates back about a decade and as far as I know, is still in effect. But the problem is that if you're walking around with a phone, there's no reliable way to know unless you have some pretty sophisticated software on that phone that's tailor made for this, no good way to know whether a Stingray is in the area locating you. So we have to kind of trust that the government's actually following the policies.
- [22:38]
Beau Friedlander
But there has been stories about ICE using it. Are we guessing or hoping that there are warrants in every instance?
- [22:46]
Nathan Fried Wessler
Yeah, I mean, there has been some really troubling reporting suggesting that there are kind of digital fingerprints of Stingray use out on phones nearby. Some ICE buildings, for example, in Portland, Oregon, there was reporting by a journalist who, who had some kind of sophisticated tailor made software on their phone that was looking for, for some kind of signal artifacts that might suggest that are highly suggestive of there being a Stingray.
- [23:11]
Beau Friedlander
Stingrays, data brokers, third party doctrine. It's, it's all a lot for the non expert. What is the fourth amendment supposed to protect and how has it evolved in the digital age? We'll explore this after the break. Okay, Nate, you're an expert at this. You work for the aclu. We keep saying warrants, warrant, no warrant, wrong warrant, didn't get a warrant, should have gotten a warrant. Why does that word matter to someone who's never been in a courtroom in their life?
- [24:03]
Nathan Fried Wessler
Yeah, so the Fourth Amendment is the part of our Constitution in the Bill of Rights that put some guardrails around searches and seizures by the government. The basic rule is that when the government engages in a search or a seizure, and there's now a whole body of case law defining what those are, the default rule is it has to get a warrant. Police have to go to a judge, demonstrate probable cause, particularly describe the thing or the place they're going to search, and then they have to get judicial authorization to do that. The Supreme Court has given us kind of two legal tests for what is a search. How do you know if the Fourth Amendment applies? One is called the reasonable expectation of privacy test, where the court asks, starting in the 1960s, whether society reasonably expects that a particular place or thing or item or information is private. And in parallel, the Court has also said that when there's a trespass or a physical imposition on your body or your property or your things for the purpose of gathering information, that's a search, too. And you don't even have to look at privacy interests. You just look at, did police basically touch your stuff or your person in order to gather information? And if so, that's a Fourth Amendment search, and they should have gotten a warrant, unless some specified exception to the warrant requirement applies.
- [25:17]
Beau Friedlander
And that would include saying, like, pull up your sleeve. I want to see if you have a tattoo.
- [25:20]
Nathan Fried Wessler
Generally, yes. You know, there are some questions about, you know, brief stops on the street and what police are allowed to do, but generally, yeah, if the government is. If they're putting hands on you and pull. Pulling up your sleeve themselves, and that's a search. The ACLU won a case in the Michigan Supreme Court just a few years ago about police in a city in Michigan fingerprinting people during brief stops to question them on the street. And the justification purportedly was people who aren't carrying an id, we don't trust that they're identifying themselves accurately. So we're going to fingerprint them. And the ACLU brought this case all the way up to the state Supreme Court, and unanimously, every member of the court said, well, this is easy. Of course it's a search. And a warrant should have been required because police are grabbing your finger, pressing it to ink, and pressing it to cardstock. They've now trespassed on your body. They've. They've physically imposed on your body in order to gather information, your fingerprint and your identity. That's a search. Yeah. So, yeah, even. Even really minor physical impositions can trigger
- [26:17]
Beau Friedlander
this requirement now, the Fourth Amendment, then serves as a form of outrage, right? A form of like, how dare you? Don't get away. And it is. And it's. And it's. It's coded in our laws saying, I don't live in England anymore. You can't have my money, and stop pulling up my sleeve to look at my tattoo. None of your business. And we have historically taken this law extremely seriously. We've seen heinous criminals, people we were pretty sure did bad things go free because the fourth amendment was not observed in all of its complexity, Correct?
- [26:53]
Nathan Fried Wessler
Absolutely right. And the important thing about the Fourth amendment is it's supposed to protect all of us. The most frequent cases that make it through the courts are criminal cases where someone's accused of having done an illegal thing, and then they're saying, well, you actually violated my rights trying to gather that information. And sometimes then courts have to throw out cases if police didn't get a warrant or otherwise violated the fourth amendment. But those cases really serve as the canary in the coal mine or the restraint that protects all of us, because without these rules, police could just. You know, they could bust down every door in a neighborhood because they have a hunch that somebody has marijuana inside one of them. Right? They could do anything they want. And the whole point, as you said of the fourth amendment, is to check government power. It's really about abuse of power and checking discretion of law enforcement agents and imposing, really, an independent decision maker, a judge, in between police and the most sensitive searches they might want to conduct.
- [27:50]
Beau Friedlander
Which brings us back to Flock safety and what we talked about last week. Because Flock doesn't do dirty Harry. Why. Why kick down a door when you can clock someone's location 24 hours a day? Thanks to this new growth sector in law enforcement technology, Stacks, There are cameras on public streets in places where you now have zero reasonable expectation of privacy. But not as a legal thing. Just as a matter of fact. These cameras take pictures of your license plate, and then they. They build a nationwide network of places where your picture can be taken and tell any subscriber at the click of a button everywhere your car has been. There weren't no judge, no probable cause, just that subscription. Is Flock safety right now creating a structural workaround for the fourth amendment in the United States.
- [28:49]
Nathan Fried Wessler
Yeah, I think it's tremendously dangerous. Yes, it is.
- [28:53]
Beau Friedlander
Every time your car passes one of these cameras, and there are billions of These reads now 20 billion a month on Flock safety's network alone, that creates a record just like your cell phone pinging a tower. One camera, that's a data point. Two cameras, that's a commute. 100 cameras scattered around the city. And some cities have far more than that. And suddenly you have something else entirely. You have a map pattern of life where someone sleeps, where they work, where they go to on a Tuesday night, when they do things that they might not want to tell you about. And it's. And it's just not one person, right? It's everyone. Everyone who drove past, all of us, all the time, sitting in their database. Flock Safety is the biggest company in this space, but they're not alone. I know you keep hearing me say that, and it's not. That's not me being careful. It's just true. They're all building different versions of the same thing. A permanent, searchable, nationwide record of where American cars have been and the people inside them just sitting there waiting. Right now, officials in Illinois are sounding
- [29:58]
Nathan Fried Wessler
the alarm, saying deputies here in Texas
- [30:01]
Beau Friedlander
misused their license plate cameras. Last week, we received disturbing news that police in Texas illegally access data from automatic license plate readers used throughout Illinois. They did so to track down a woman regarding an abortion care related matter. Police in Texas used license plate reader data to track a woman who drove to Illinois to get an abortion. Maybe you're okay with that. Maybe you think that states should be able to enforce their laws wherever residents go, right? Okay, that's a position. But sit with that for a second. She didn't know she was being tracked. There was no warrant. No judge decided her trip was suspicious enough to justify surveillance. There was just a database, a private company's database. One that also seems to maybe not be super secure. According to rigorous reporting by 404 Media, YouTuber Ben Jordan and others, her trip was just there. That's the thing about a system with high walls and no legal oversight. You don't get to control what it gets used for or who uses it or when. The companies building these networks, their business model is access, not safety. A police department in your city doesn't just get access to the cameras in your city, by the way. They buy the whole country. Every plate, every time stamp, every state line crossed, all at the click of a button. And now, you know me, You. I hear a story like what happened in Carpenter, and I turn my phone off when I go places to mess up the pattern of life that my provider sells. I know how that sounds. But after you consider what we've talked about today, I don't think it's an extreme position, you know, but while I can turn off my phone, I can't. I can't turn off my license plate, facial recognition. I can turn my face off with a mask, I guess. But is that where we are now? One of the things that I keep wondering is, you know, I have not yet downloaded an app in California lately anyway, and, and, but I'm wondering, you know, to me, I wouldn't be surprised if while in California, I downloaded an app and it said, do you want to turn location services on instead of it being by default? Because it's, that is the kind of tiny little win, which is a huge win that says that everything that you buy is set to private, not sharing anything by default, and you have to opt in everywhere. And it's as simple as that. And all of the manufacturers, I don't care if it's software or actual devices, they know this. All they have to, they could all just say, we're going to make people safe. You know, the first company to do it, Apple, is going to get market share if they advertise it correctly.
- [33:19]
Nathan Fried Wessler
Yep.
- [33:20]
Beau Friedlander
I mean, it was just like that very smart ad that one AI company ran during the super bowl towards another AI company that was starting to run ads. It's a smart thing to say we're different.
- [33:33]
Nathan Fried Wessler
Yeah. I mean, I think design changes absolutely can make a huge difference. You know, one of the things I, you know, I think about every day when I'm online is, is websites now largely as a result of European privacy regulations, but a little bit because of US Regulations. Put these cookie permission screens up. Right. Like, are you going to allow cookies
- [33:53]
Beau Friedlander
all of them, or some of them
- [33:54]
Nathan Fried Wessler
are just the necessary ones. Right. You know, it's good that we have choice, but I spend a lot of my time clicking in to turn off cookies. Right. One by one, forcing websites to account for universal choices where you just toggle in your browser. No, I just want, I don't want to be tracked. And the websites actually listen to that would save all of us the effort. And means you just have to once per web browser, you've set your preferences and those preferences are already in the web browsers. It's just a question of making the companies that are operating the websites listen to it. What we really need is for lawmakers in Congress, in state legislatures, in city governments to step in and set strong, durable rules and to keep them updated to protect all of us.
- [34:39]
Beau Friedlander
Nate Wessler, thank you so much for joining us today. I appreciate you giving us so much time and hopefully we'll talk again.
- [34:47]
Nathan Fried Wessler
Such a pleasure to talk. Take care.
- [34:55]
Beau Friedlander
The courts are moving slowly, case by case, appeal by appeal, but moving. The Supreme Court said in Carpenter that your cell phone location data is yours. There's a case in front of them right now about geofence warrants that could extend that protection further to show for another day. That's real. Congress has a bill, the Fourth Amendment is Not for Sale Act. That's. We've already talked to one of its authors, Senator Ron Wyden. I hope to speak to the other author soon. It passed the House, stalled in the Senate, but it could could move again. That's also real. A handful of state legislatures are passing laws with actual teeth. Illinois says you can't use license plate readers for immigration enforcement, period. Colorado is considering a law that would bar them from abortion enforcement. Small patchwork, but real. And the tech companies, the ones who receive the subpoenas, who know when ICE comes knocking, who sit in the middle of all of this, some of them are starting to push back too quietly, imperfectly. But it's happening. So that's good news. And I don't want to minimize it because none of that was inevitable and all of it required people who cared. But here's the other thing. The cameras don't come down when a law passes. The database doesn't get deleted when it in administration changes. The network that Flock and Ring and others have spent a decade building, that exists. It's out there. And whenever rules we eventually write will be written around a surveillance infrastructure that is already everywhere, already collecting, already waiting, you know, not quite clear how that's all going to get taken apart. If it's going to be taken apart, what gets deleted? Is there such a thing as deleting them? There's a study I wanted to share with you. Researchers found that in neighborhoods with high levels of surveillance, people were less likely to recognize faces. Think about that for a second. Not less likely to commit crime. Less likely to recognize faces. Because when you feel watched all the time, your brain sees every stranger as a potential threat. And that creates hyper vigilance fatigue. I didn't make that up. Look it up. Hyper vigilance fatigue. Fun, but I can't stop thinking about it. When the thing that makes you feel safe is also the thing that makes you trust people less, isn't that creating a world of Bernard Getz's Bernie Getz? If you listen to Lou Reed. Anyway, if you're too young to know who that is, Daniel Penny might ring a bell. He's the guy who got acquitted for murder after killing a former Michael Jackson Impersonator fallen on hard times. That man's name was Jordan Neely, often referred to as a panhandler murder victim. That happened in 2023 on a new York subway. And what I mean by all this is, aren't we just creating a paranoid society? A society of potential vigilantes everywhere? The fourth Amendment was written by people who had just lived through what happens when a government doesn't respect its peeps, right? They didn't. They didn't write it because they trusted the government of the moment. Right? They wrote it because they knew that the moment they were in was going to end and that power changes hands and that the tools built by one administration are inherited by the next. The warrant requirement isn't a technicality. It's a question. It's society asking itself every single time. Is this search worth what it could allow to happen to all of us at some point in the future? Is privacy worth less than whatever needs to be found? And now it's time for the Tinfoil swan, our paranoid takeaway to keep you safe on and offline. Your phone company knows where you are from. Cell tower data. That's just how cellular works. Your phone is always pinging the nearest tower so calls and texts can reach you. You can't make that stop entirely, but you can make the data a lot less useful to them. The simplest thing you can do costs nothing. Turn off your phone sometimes when you're out, not forever, not always. Just when you're walking around, sometimes running errands, doing things you'd rather keep private and doing things that you always do. No signal means no location ping. It also means no call, so use your judgment. But the habit of occasionally going dark is one of the easiest privacy moves there is. All these phone companies sell pattern of life data. Make it a point to make yours suck. The next step is a vpn, and here's why it matters. For location specifically, your carrier always knows which towers your phone is hitting, so they know roughly where you are. What they can also see without a VPN, is where your Internet traffic is going, which apps, which websites at what times. And they combine that location data with that traffic data to build a profile that is worth selling. A VPN breaks that combination. They still know you're at the corner of 8th and Broadway, but they can't see that you were on a medical website or looking at a job listing while you were standing there. That's what they sell. The combination. A VPN makes your location data a lot less valuable, even if it doesn't Erase it. I'm not going to recommend any particular vpn. Just make sure whichever one you choose, you're paying for it. Because the ones you don't pay for, I don't trust them. Now for the apps on your phone. That's a separate layer of location tracking, and this you can control completely on an iPhone. Go to Settings, then Privacy and Security, then Location Services. You can hit, you know, 15 seconds back if you need to hear this again. You'll see every app that has ever asked for your location. Go through the list for anything that doesn't genuinely need to know where you are. Shopping apps, games, news apps, social media. Switch it to Never for maps or weather. Set it to while using. Not always. Always means the app is tracking you in the background even when you're not using it. Now, on Android, it's the same idea. Go to Settings and location, then app permissions, same drill. Set everything you can to only while using or deny and save always for navigation. That's it. Now, one last thing, and this one surprises people. This is. This is cool. Buried in your location settings is something called significant locations, at least on your iPhone. Go to Privacy and then Location Services, and then System Services, then Significant locations. It's at the very bottom of the list. Imagine that. Totally hard to find, of course. Now delete the record and turn it off. Your phone has been keeping a diary of everywhere you've been. Gross, right? I mean, seriously. The goal here isn't perfection, because that's impossible, but making your location data thin enough or unreliable, even enough that there's not much left worth selling, or people start complaining about what they've bought. That's it for this week. Stay private out there, stay safe, and I'll see you next week. This episode of what the Hack was produced by me and Andrew Stephen, who also did the editing. Our theme music is by Andrew Steven. If you think you heard Ben Jordan's music in the mix, you're right. There's some other stuff, but there's some Ben Jordan, too. Check them out on Bandcamp or wherever you get your stuff. What? The hack is a production of Delete Me, which was picked by the New York Times Wirecutter as the number one personal information removal service. You should be using it already. If you're not and you want to, well, you can. Here's what to do. Go to joindeleteme.com wth that's joindeleteme.com WTH and get 20% off. I kid you not. 20%. 20% off. That's joindeleteme.Com wth now stay safe out there. See you around. And come back next week. We're gonna be talking about flock safety. We all need advice, but it's not always clear who to ask, even in 2026. Enter how to the Long Standing Advice show an Ambie Award nominated Best Personal Growth Podcast. That's back with new episodes and a new host. Who? Me, Mike Pesca. Each week I tackle a listener question ranging from travel to finance to relationships and beyond, with help from a world class expert. You know, someone who actually very much knows what they're talking about. Think of it as eavesdropping on someone else's therapy session without the copay or awkward silences. You've got questions, we'll find the experts and the answers. So follow how to with Mike Pesca Wherever you get podcasts.
- [44:13]
Nathan Fried Wessler
Have you ever asked yourself, can the president really do that? Or wondered if there was too much money in political campaigns? Then check out the new season of youf Might Be Right, hosted by us former Tennessee governors Phil Bredesen and Bill Haslam. We're back for a brand new season now, and you Might Be Right cements the idea that constructive disagreement can lead to real problem solving. This season we're going to dig into the role of the National Guard AI regulation, and a lot more new episodes drop every other week. Follow youw Might Be Right Wherever you get your podcasts.