To find suspects, police quietly turn to Google

http://www.wral.com/to-find-suspects-police-quietly-turn-to-google/17377435/

by dlgeek • 8 years ago

232 160 8 years ago

danso• 8 years ago

This seems to me to be a major revelation: police in North Carolina have successfully requested Google account information on all phones near a crime scene. While Google routinely responds to search warrants, this is a much broader type of data request.

londons_explore2• 8 years ago

Arguably, this leaks everyones data. Anyone who was not in the area will be excluded from the list, therefore letting the police know where I wasn't at the time.

I wonder how Google show that on their transparency report? Hopefully "Accounts searched: 1.5 Billion"

TheCoreh• 8 years ago

While I understand your point, and think it's a valid privacy concern, the reasoning about leaking info on all of Google's users doesn't make sense. If I install a security camera in my room, I'm not leaking information about you if it shows you're not here. There was no expectation of the possibility of that in the first place, so no information is leaked. This is only leaking information about the Google users who are reasonably likely to be within the radius where the query is executed. So perhaps a couple thousand users, (so a legit privacy concern) but not all of them.

salad77• 8 years ago

Anyone who was not in the area will be excluded from the list, therefore letting the police know where I wasn't at the time.

No, at best this only shows that your google linked device (presumably a phone) did not have location information for that area at the specific time.

Alternatively it suggests the device could have been switched off/disconnected from the network to hide your presence - making you really a suspect of interest if your name comes into the investigation for some reason.

Dragnet approaches to law enforcement are inherently wrong. They unreasonably cast suspicion on everyone without any good basis and reverse the accepted safeguard that your guilt requires to be proven, and replace it with the idea that you require to prove your innocence.

pmorici6• 8 years ago

Police have used this sort of investigative technique for ages this is just an instance of it being applied to Google and phones.

For example, Sparkfun received a subpoena[0] once and they ended up having to turn over customer details of anyone from Georgia who purchased a particular Sparkfun product that was used in some crime.

Another example, we've all seen movies or heard where someone sees a vehicle that flees the scene of the crime and they knew the make and color or the first few digits of the plate but not enough to identify the vehicle so they go and pull all DMV records matching the vague description and use those leads to narrow things down from there.

This Google thing is really the same thing in this case they have a vague description of a person and a narrow time period and area in which to search. They also are getting a warrant. Seems like an application of an old technique to modern technology.

[0] https://www.sparkfun.com/news/836

ams61102• 8 years ago

So this is another reason why as a business you want to keep minimal information on your customers. Not only does it respect their privacy, but it makes your data security compliance much easier.

logic1010102• 8 years ago

Your DMV example is not quite the same as what is being done. If it was, it would quite probably be reasonable in the circumstances.

The dragnet is every device, not just those matching a partial description of a suspect. For it to compare with your car example, the police would need to have a description of a suspect using an Android Galaxy S4 (or whatever) and then ask only for Galaxy S4 devices in the area.

Overtonwindow• 8 years ago

Wow that's deeply disturbing but also feels like a similar tactic to the stingrays. Does simply owning a cell phone and being in a geographical area make you open to 4th amendment search and identification?

Normal_gaussian2• 8 years ago

Unsurprisingly being in close proximity to a crime makes you a reasonable initial suspect.

Identifying those close to a crime is and always has been standard and reasonable police procedure.

The reasonableness of a subsequent search based on this location information is context dependent.

roywiggins5• 8 years ago

It seems morally similar to scooping up all CCTV from nearby businesses.

If this is going through a warrant process, and it's geofenced around a specific crime they're investigating, it's hard to feel too worried about it. The worst case scenario I can see is that it makes it easy to generate false hypotheses and put innocent people under suspicion, but then so can canvassing the neighborhood and trawling all the nearby CCTV.

Klathmon• 8 years ago

Hasn't it been shown that the 4th doesn't apply to information you give to someone else?

They are requesting this from Google, not you, so your 4th amendment rights don't matter.

I don't necessarily agree with that ruling, but as far as I know that's the current state of things.

roywiggins5• 8 years ago

Well, they did get a warrant. The 3rd party doctrine would say that you don't need a warrant at all.

There's actually a court case at SCOTUS that may more closely define what is and isn't covered by the 3rd party doctrine when it comes to phones.

http://www.scotusblog.com/2017/08/symposium-will-fourth-amen...

John_KZ2• 8 years ago

What's even worse is that sooner than later, not owning a cellphone with gps tracking will be seen as incriminating. Were you trying to hide your position? How do we know that you weren't there at the time of the crime?

purple-again• 8 years ago

I don’t think this is a valid fear. The cost of a state issued license is considered too high to be fair in use in a much less important area of society, voting.

Ownership of a gps enabled tracking device? No chance that is ever cheap enough to be considered required to own as evidence against incarceration.

larkeith2• 8 years ago

Yet another reason to disable GPS and location history (and any other functionality you use infrequently) when not actively necessary.

Normal_gaussian2• 8 years ago

Or alternatively use a self hosted or less well known alternative.

karmakaze• 8 years ago

The only way is to not use any Google services. If you connect from mobile IP ranges as other users who are in the area, you could also easily be included. Same goes for cell towers but at least it's not a single entity.

stefan_• 8 years ago

Google collects location data from WLAN networks in reach, triangulates from cell tower signal strength, GPS, GLONASS, geoip and if all that fails, sheer historical prediction.

And no one quite knows why, other than "because we can". There is Google Maps, but when I'm not using it, when exactly is this orwellian infrastructure to my benefit and not exclusively Googles?

dumbsite56923• 8 years ago

That does absolutely nothing. If you don't want to be tracked, don't carry a phone. It's the only way.

matthewmacleod• 8 years ago

I mean, it literally does things.

giancarlostoro2• 8 years ago

Airplane mode?

larkeith2• 8 years ago

That does absolutely nothing

[Citation Needed]

While your location can absolutely still be tracked (via WiFi, Cell Towers, etc), disabling GPS significantly reduces the accuracy of this tracking, and disabling location history makes it even more difficult to freely track you.

While it's certainly possible Google maintains location history even after you opt out, doing so would likely be illegal, would possibly invalidate any data obtained from a warrant, and would unquestionably be a PR fiasco for Google when it got out.

As far as I'm aware, there's no evidence that GPS continues to function after turning off the software kill switch.

cornholio• 8 years ago

In principle and with some caveats, I support this use of tracking information: it's usually quite specific, it has a very positive efect for law enforcement, it's not a breach of fundamental rights of the suspect as confirmation of the physical location at a certain time is not secret and can be obtained by the police from CCTV cameras, eyewitnesses etc.

The privacy of the bystanders is not significantly reduced if and only if the police will use the specific datadump for the purpose of solving the crime for which the warant has been issued - as opposed to building a massive cross-referenced database from multiple such incidents. I am concerned that a few warrants like 'all information on everybody who was at the Superbowl' would quickly download massive amounts of data from Google to the police.

I think regulation should be enacted that balances the social interest with the private interest, for example, Google could be issued a specific warrant of the type "data on all individuals that were in location X1,T1 and also in X2,T2", and Google should answer only when the query is sufficiently specific to return only a handful of results.

ribosometronome• 8 years ago

I don't know if I really understand your argument. You're justifying this by comparing it to CCTVs and eyewitnesses, but there isn't really any expectation that CCTVs and eyewitnesses respect the privacy of bystanders or limits on reviewing CCTV data or receiving reports of crimes from eyewitnesses in most areas.

Which isn't to say that I think we should allow limitless collection but rather that, even while justifying it using CCTVs, you're still treating them differently. I'd wager that's because it is different.

roywiggins5• 8 years ago

I think you're being downvoted for having an unpopular opinion, which seems unfair. You're on-topic and cogent.

Anyway, you might be interested in Carpenter v United States, which is testing the third-party doctrine in front of the Supreme Court and will be decided soon. https://en.wikipedia.org/wiki/Carpenter_v._United_States

quadrangle• 8 years ago

Tangentially, that's why upvote/downvote is inadequate — it squashes unpopular opinions and creates echo-chambers/groupthink. The solution is to have reactions that separate constructive/unconstructive, agree/disagree, and so on (a few other sensible categories) and only bury based on being unconstructive…

dwaltrip6• 8 years ago

The idea that they will use such data responsibly seems like handing a bag of candy to a 6 year-old and saying "Make sure to only eat one!"

Perhaps I'm wrong, but I can't imagine them managing the overwhelming temptations to quietly abuse the data, especially as time goes on.

Edit: I realize this is a crude analogy that glosses over a lot of important details, but it gets at the heart of my intuition on the matter. The lack of restraints found in the child-candy system seems to mirror very well the weakness of restraints found in the dynamics between government apparatuses and fancy tools.

For many tools, this is fine. But I'm worried about the long tail risks and externalities of large-scale privacy destroying tools.

I don't think this is exclusively an issue with government organizations. However, in America they are the only organization with the ability to forcefully restrict the actions of individuals and groups. So extreme vigilance is required to balance out this immense power. If a random company overuses a fancy tool, the potential damages are more limited.

Digit-Al3• 8 years ago

I can see both sides on this. I do think that such data when used responsibly can really help in solving serious crimes. But, as you say, there is a serious danger of law enforcement abusing the system and gathering far more data than they need. It's not like they haven't been guilty of such abuses in the past. Look at the situation with gathering fingerprints or DNA and then not scrubbing the data of innocents once an investigation has finished.

I am wondering if the solution is to have an independent service. One that would sit as a middleman between police and technology companies such as Google. Their mandate would be to provide the minimum amount of data required for an investigation (the example used in the article is a good one, where anonymous data for a particular location at a particular time-frame is requested and used to narrow down the search and then get more information on a subset of that data). They could be required to keep logs of what is being requested and what is being provided and could be audited at intervals by, say, the EFF. Obviously this is only a rough sketch of the idea, it would need fleshing out more completely.

bertil3• 8 years ago

It is not Google’s role to restrict the use of judge-mandated information share. If we suspect that law-enforcement agencies abuse their request, then their oversight committees need the ability to check this is not happening; whistle-blower within the agency should be protected.

codezero2• 8 years ago

CCTV and eye witnesses can’t give you the suspect’s name and address.

wolf550e• 8 years ago

CCTV and facial recognition can give you address (follow face to where they sleep). That and one of any number of databases can give you a name. Biometric national id / passport makes it all easy, but it's not a requirement.

pkilgore2• 8 years ago

That 'regulation' is the fourth amendment to the U.S. Constitution and the 200+ years of accumulated case law describing what is and is not appropriate.

Individual notions of fundamental rights aside, very recent cases have addressed protection given to location information: https://www.supremecourt.gov/opinions/11pdf/10-1259.pdf

A very, very related case to the article above is currently pending a decision by the Supreme Court: https://www.oyez.org/cases/2017/16-402

joering24• 8 years ago

This is probably one of the cons of using VPN. If criminal used VPN service that you happen to use and connect to the same node, expect police to read your emails, courtesy of Google.

I'm still in the process of getting off google mail and switching to Proton. It takes time to go thru all my google emails and clean them up. Yes I know deleting them won't change a thing BUT at least I consent to deleting them on my end, versus merely abandoning my mailbox altogether.

I know Google has capacity to keep all emails forever, but whether they do so or delete them after X amount of years, I don't know.

londons_explore2• 8 years ago

Google guarantees to actually delete your emails 30 days after you delete them from your account.

The GDPR law in europe requires them to do this for european citizens.

olympus2• 8 years ago

Does it guarantee to do this for everyone or just Europeans? Genuinely curious here since they might have separate policies in place for different countries- I imagine that China prefers to keep all its citizens' emails indefinitely.

joering24• 8 years ago

How do I know where my mailbox is located??

zeep• 8 years ago

unless there is a secret law that prevents them to actually do it...

arca_vorago2• 8 years ago

Stop using Google, Facebook, Microsoft, etc if you care about privacy!

bitmapbrother3• 8 years ago

I noticed you left out Apple - the same company that handed over control of their cloud servers to a Chinese state run company.

SubiculumCode2• 8 years ago

I notice you left out Amazon. In fact, there are a number of players to list, which is the reason the grandparent wrote 'etc..'

arca_vorago2• 8 years ago

Not sure why I left out Apple, but I agree.

etc covers too many to list though... because everyone is doing it (even yc companies)

nkurz• 8 years ago

This is an important story, but a little difficult to summarize. Here's my attempt at an overview:

1. Google stores location history data for more of its mobile users than you might expect. The precision is greatest when GPS is on, but less precise data from cell towers and WiFi sources is used almost any time a Google app is being used on an Android or non-Android phone. There have been cases in the past where Google has recorded such information even when the user has explicitly turned off all location services, but Google says they have stopped this practice.

2. On multiple recent occasions, police in North Carolina have quietly been successful in obtaining search warrants that force Google to turn over these records. Rather than "standard" search warrants asking for the location of a particular suspect in a crime, these "reverse" or "area based" warrants ask for time and location data for all users who have entered a geographical area during a time of interest. The records returned are initially anonymous account numbers, and the police then make followup requests for identifying information of the subset of accounts that they think are of interest to the case.

3. This open-ended "drag net" approach scares some people. Typically, at least in the US, suspects are identified first, and then further information is gathered that confirms or removes the suspicion. The express fear seems to be that innocent people will be falsely accused due to coincidence, but there is also a more general fear that once mechanisms are in place that allow the police to have easy access to location tracking information, this information will end up being abused.

wildrhythms• 8 years ago

Google stores location history data for more of its mobile users than you might expect

What do you mean by this?

pmorici6• 8 years ago

You don't have to be using Maps or an app that obviously uses location for Google to be collecting location related information. I have no idea when they do or don't but I'd bet people would be surprised if they found that the gmail app was relaying their location to Google. On the other hand few wouuld be surprised at all if you told them the maps app was sending their location.

dwaltrip6• 8 years ago

Holy shit. So my paranoia about turning off Google location tracking was completely well-founded, and way more quickly than I would have hoped.

GDPR can't come soon enough...

inetknght• 8 years ago

Now sit back and think about what else people get called paranoid for.

ams61102• 8 years ago

Yeah I'm typically not a very paranoid person but I only have location services on when I'm actually using Maps to navigate.

My main reason is to squash the annoying notifications about "heavy traffic in your area" at 5:00pm. Yeah, I would never have guessed...

muro3• 8 years ago

Google tells you regularly that you have it enabled - you get emails with your full history. How would anyone not know it's recorded?

petilon• 8 years ago

You live in Los Angeles (according to Google). How will GDPR help you? Companies such as Google and Facebook aren't going to implement European laws for their American customers!

notahacker• 8 years ago

Law enforcement can triangulate location from a mobile phone signal via your celluar network provider with or without Google's help, and has been able to do so since the very beginning.

pmoriarty• 8 years ago

I've taken to just not carrying a cell phone with me, or just keeping it off.

I don't really need it most of the time, and I find the sense of privacy liberating.

shpx• 8 years ago

https://takeout.google.com/settings/takeout

You're looking for "Location History".

lopmotr3• 8 years ago

Why don't you want the police to be able to find your when there's a crime? What if you're the victim of a kidnapping? Or murder that goes unsolved because Google wouldn't tell them who did it?

thomasahle3• 8 years ago

GDPR can't come soon enough...

GDPR was approved on 14 April 2016. Google appears to have been complying for a while, starting to remove search results year ago.

I have heard of people getting a copy of all the data Google stored, but I haven't heard of location deletion requests yet. Will be interesting.

bduerst• 8 years ago

Google already allows you delete your account-linked location data: https://myactivity.google.com

Just be aware that deletion isn't instant though. From the TOS:

We aim to maintain our services in a manner that protects information from accidental or malicious destruction. Because of this, after you delete information from our services, we may not immediately delete residual copies from our active servers and may not remove information from our backup systems.

htoooh• 8 years ago

Waltreezy! Hope you're well buddy

codezero2• 8 years ago

Much less afraid of false accusation and more concerned with incidental data being used against me later, or being used to build a profile the police can use in some other way.

lopmotr3• 8 years ago

Is this actually a real problem for normal non-criminal people? Murders happen every day and this would help deter or prevent repeat offenses. But having information about you that's correct, and can't be used in court because it was obtained without the correct warrant, when is that ever a problem? I'm not talking about high profile journalists or terrorist suspects. Just normal people like you.

pasbesoin3• 8 years ago

In addition to all the other, very serious concerns, I'll also ask this:

How long until these records are available for subpoena, e.g. in a divorce case? (Maybe -- hopefully! -- not in area sweeps, but nonetheless, where was the other party and who was in proximity. As I'm writing this, well, maybe they will ask for all connections in proximity, that list then to be whittled down to a list of candidates (per the police's approach in the OP's story)).

When are police going to start sweeping such data up en masse, looking for e.g. parole violations?

When will every "free association" be a tracked association?

pkilgore2• 8 years ago

How long until these records are available for subpoena, e.g. in a divorce case?

I see nothing preventing this information being sought in U.S. discovery right now--at least in Federal litigation[0]. That isn't to say that the subpoena won't be squashed by a court for one of the traditional rationales under FRCP 26(b).[1]

When are police going to start sweeping such data up en masse, looking for e.g. parole violations?

Arguably runs afoul of the particularity requirement of the fourth amendment, although I do not pretend to be an expert on criminal law. That said, I understand the fourth amendment to be a low bar these days.

When will every "free association" be a tracked association?

Rhetorical question?

[0] Your specific example, divorces, are state law in the US. I don't do that, and the relevant laws / cases can change on a state-by-state basis.

[1] https://www.law.cornell.edu/rules/frcp/rule_26

martin-adams• 8 years ago

I once used an app to record my location, which I'm sure was in my Google account. It mis-recorded my location to be in the centre of a park in the town I was in the middle of the night, but I was actually at home asleep. Needless to say, it crossed my mind if this data could be used as a false positive in any investigation if they got hold of all people recorded as being in that area.

wavegeek• 8 years ago

The use of this information in the hands of the statistically incompetent will lead to miscarriages of justice and disaster. This basically institutionalizes the prosecutor's fallacy.

bigiain3• 8 years ago

"statistically incompetent" and/or over ambitious and over zealous career climbing LEO...

mirimir• 8 years ago

Innocent people are commonly investigated because they were nearby when crimes were committed. Or because they somewhat match a victim's description of the attacker. Or because they're driving a vehicle that somewhat matches a description.

But this is taking it to another level. Here, location and time are the only identifiers. Once you've identified someone who was at the location of the crime when it was committed, they were either a perpetrator or a witness. Or maybe neither, because they weren't close enough in space and time.

But anyway, what happens next? Police hope to get a confession? Maybe some physical evidence. Or witnesses. But then, people often lie. And there's less opportunity for an alibi, except maybe a friend who says he was there with you. But his phone had better agree with yours.

And really, it's hard to imagine that someone doing serious crime would be carrying a smartphone. At least, one that's not turned off, and in a Faraday bag. But then, some criminals are just plain stupid, I guess.

rdtsc• 8 years ago

But then, people often lie

Police can lie with impunity when interrogating and it is all legal and protected mostly. They can get innocent people to plead guilty to all kind of crimes the didn't commit simply by threatening them.

mtgx• 8 years ago

And Google, now a defense contractor willing to work on weapons of war to make a (bigger) profit, will gladly assist them.

They're themselves creating the incentive to do that, just as when they got into the content and content licensing game, they ended up creating the most aggressive content censorship system on the (free) internet, beyond even what the laws require. It's no longer a matter of "choosing to do the right thing". The (bad) incentives are already in place. Now Google just reacts to the incentives it created.

We're also supposed to "just trust them" that their secret AI Ethical Board, which can be replaced at any moment, also in secret, will do the right thing when things will go bad with its AI. They've already created the incentive to cheat by keeping that board secret.

gourou• 8 years ago

Google, now a defense contractor

They sold their stake in Boston Dynamics

https://www.bloomberg.com/news/articles/2016-03-17/google-is...

kodablah• 8 years ago

That's not their only defense contract. E.g. https://gizmodo.com/google-is-helping-the-pentagon-build-ai-...

alexandercrohde• 8 years ago

Well I'm sure this seems really neat, but criminals will simply not bring their phones and then be excluded from the search.

lopmotr3• 8 years ago

I used to wonder why New York subways were somehow a high crime area. I thought, surely they're such small closed places that if there's a crime, the police can just block the exits and check everyone leaving, or look at the CCTV footage to identify them. But then I found out that they don't do that! Americans are so concerned about privacy, they let themselves get robbed and murdered every day.

It's clear that they don't trust their own police. That's perhaps the real problem. If they could be made trustworthy like in many other countries, people would probably be happy to have murders solved through video footage, cellphone locations, etc. It amazes me that even one person on here thinks this is a bad idea. Real killers would have got away otherwise. This isn't some wild NSA anti-terrorism dragnet, it's just normal police work collecting normal evidence specific to the crime.

deathhand• 8 years ago

Why don't people trust cops?

Asset forfeiture, crooked cops, shoot first ask questions later, a strong union which protects their own, and their ability to spy on their personal rivals through NSA/FBI tools makes us a paranoid bunch.

The last part.. NYPD mis-used tools to track former lovers[1] and there was no reprocussion. How can we feel safe?

[1]https://nypost.com/2013/11/08/jealous-cop-admits-to-hacking-...

Erlangolem• 8 years ago

Plus things like: https://www.nytimes.com/2014/04/16/nyregion/police-unit-that...

Not to mention historical corruption on a grand scale.

thomasahle3• 8 years ago

Also, location data has a history of getting many people convicted innocently: https://www.economist.com/news/united-states/21615622-junk-s...

YaxelPerez• 8 years ago

https://www.google.com/maps/timeline

aiCeivi9• 8 years ago

But why Google? Shouldn't they ask mobile operators in first place?

Bizarro• 8 years ago

City and county officials say the practice is a natural evolution of criminal investigative techniques.

Ah yes, very "natural"

And they're carefully balancing civil rights with public safety.

and "carefully balancing"

Bureaucrats and their weasel words.

To find suspects, police quietly turn to Google

Related Stories