

Police Are Using Phone Tracking As A Routine Tool - gallerytungsten
http://www.nytimes.com/2012/04/01/us/police-tracking-of-cellphones-raises-privacy-fears.html?_r=1&hp&pagewanted=print

======
Lagged2Death
_...law enforcement officials said the legal questions were outweighed by
real-life benefits._

That's just what I was thinking last time I held up the local liquor store.
Who knew I had so much in common with the police!

~~~
mhurron
It's rare that you can have all the problems with something so well summed up
in a single statement, but there it is ; all the problems with law enforcement
agencies summed up in one statement.

~~~
tptacek
"All the problems with law enforcement agencies". I think this comment sounds
wittier than it actually is. Policing is a dangerous and often unrewarding job
and even the worst cops spend most of their time dealing with toxic situations
we rarely even imagine.

I'm a civil libertarian, but I've found that I'm saner and my perspective much
improved by remembering that the police are not an evil entity out to destroy
us all, but rather a typically clumsy and inept collection of human beings
trying to perform a vital task for society.

Seeing the police this way lets you pick out the difference between, for
instance, false-alerting drug dogs used to effect civil asset forfeitures on
interstate highways from situations like "active investigations aided by cell
tower locations".

~~~
psb217
Borrowing from Arthur C. Clarke, and shifting the often overgenerous
connotations of Hanlon's razor, I say that: "any sufficiently advanced
ineptitude or ignorance is indistinguishable from malice."

The rather "Up With People" connotations conveyed by Hanlon's Razor (i.e. "do
not ascribe to malice that which is adequately explained by stupidity") may be
preferable to the more cynical tone of my chosen phrasing when dealing with
inconsequential events. However, when effectively malicious incompetence and
lack of foresight occur within societal institutions capable of sufficient
influence, a perceived lack of malicious intent should not distract those
affected by the offending institution from aggressively rooting out the
sources of the incompetence.

I would also like to make a subtle point regarding the way in which you seem
to have associated the phrase "the police" with a collection of instances of
"police(wo)man". As suggested by my previous paragraph, I think it is worth
distinguishing between "the police" as a societal institution capable of
profoundly affecting those within its sphere of influence and those
individuals from which it is composed.

In particular, it seems that attributing systemic problems to the individuals
through whom they are expressed leads to a pair of difficulties. The first
difficulty is that which you encountered, in which one hesitates to apportion
any blame due to the perception that any assigned blame would correspond to an
attribution of evil/malicious intent to a fellow flesh-and-blood human. The
second difficulty is that pursuing solutions to a systemic capacity for
sustained malicious ignorance/incompetence/ineptitude through actions targeted
at the individuals through whom this capacity is expressed offers a potent
example of the potential futility of treating symptoms rather than causes.

Note that my view converges with (my interpretation of) yours in the sense
that I consider it important to avoid unnecessarily shifting blame earned by
an institution onto its constituents, as this is unlikely to ameliorate
systemic problems while generally producing negative consequences for those
onto whom blame is shifted.

~~~
tptacek
What you're saying here, I think, is that it's not fair to, in order to build
support for policy, cast about for sympathy for the specific police officers
who, for instance, get shot in the line of duty.

That's not what I'm doing.

I'm saying that adversarial encounters with the police are in the general case
far more likely to involve actual criminals than they do law-abiding people
being oppressed by malicious or busybody government entities.

I'm _not_ saying that in order to advocate for a specific policy. I support
increased oversight of the police. What I'm doing is objecting to sentences
like "this sums up the whole problem with law enforcement". That wording
clouds the issue. It makes it hard to distinguish between legitimate policing
interests and illegitimate ones.

------
tptacek
Worth noting: the FBI's GPS case turned on the fact that a person's vehicle is
an "effect" in the sense of the people's right to be "secure in their persons,
houses, papers, and effects, against unreasonable searches and seizures". The
word "effect"; it's right there in the 4th Amendment.

The court did _not_ find that people have a reasonable expectation to privacy
in public spaces (an argument made by the defense in that case). If you're out
and about in public, your location isn't private. This is obvious, because
it's clearly lawful for the police to simply follow you around in public.

(I'm happy if the police end up universally needing [easily obtained] court
orders to collect cell tower logs, but unlike most of HN, I don't see the
status quo as particularly outrageous).

~~~
barrkel
_If you're out and about in public, your location isn't private. This is
obvious, because it's clearly lawful for the police to simply follow you
around in public._

This isn't obvious to me at all. I think you're falling into a trap peculiar
to computer security in particular, generalizing from binary distinctions of
"secure" vs "insecure", or "anonymous" vs "authenticated" as if these things
were matters of Boolean logic, rather than of probabilities and degrees, in
arenas outside of the easily automated.

If you're being followed around in public, that is by itself obvious; it
normally affects your behaviour, it's stressful, and in fact prisons
(Panopticon) have been designed around the idea of being under constant
surveillance. The specific and explicit goal of such was "obtaining power of
mind over mind"; if you don't think those who literally seek power do not have
similar motives, you're naive.

The cost of following someone around means that it will only be applied in
cases where police value it highly; presumably, incentives up the chain of
command are aligned such that that level of investment is only made when the
public interest is high; similarly, the levels of manpower will mean that
conspiracy and persecution would be hard to hide.

When the effect of following someone around - knowing where they are at all
times - is automated and based on cheap technology - indeed, technology whose
cost is largely borne by those being followed, for phones - then the bar for
following is much lowered. Far more trivial cases can have this level of
intrusiveness applied to them; the public interest may not be so well served.
Furthermore, without appropriate controls, persecution by individuals is
enabled, without any need for a group conspiracy. For example, ex-husbands
with access may spy on the location of their ex-wives and further their own
corrupt, human goals.

~~~
tptacek
I'm not generalizing; I'm restating the opinion in the FBI GPS case.

But your logic doesn't work anyways. If it did, we wouldn't need "stalking"
laws. In stalking cases, defendants are guilty if the state (in this case,
Connecticut) can prove (1) intent to to cause fear for their physical safety,
(2) purposeful following not undertaken for lawful purposes, (3) willfulness,
(4) repetition, and (5) that the victim actually ended up fearing for their
safety. (That's paraphrased from CT model jury instructions).

Think about all the private following, observation, and even spying that this
_doesn't_ cover.

~~~
barrkel
I think the specifics of the FBI GPS case result is wrong. I'm also
uninterested in laws re stalking. I don't think your rebuttal has anything to
do with my argument.

I'm talking about the philosophical matter of generalizing from specific cases
of monitoring to mass surveillance, arguing that a justification for the
former is not a justification for the latter, because the two are different in
substance, not just quantity.

Case results follow from interpretation of laws; laws follow from
philosophical principles. I'm arguing the philosophical principles. I don't
accept counterarguments in the form of citations of specific laws, or
interpretation of those laws, as valid.

~~~
tptacek
_I don't accept counterarguments in the form of citations of specific laws, or
interpretation of those laws, as valid._

That sounds like a super fun debate to have, but, pass.

~~~
barrkel
Here's an interesting essay on precisely the kind of thing I'm talking about -
and it explains why binary thinking on this matter is a bad way to go about
it.

[http://www.theatlantic.com/technology/archive/2012/03/the-
ph...](http://www.theatlantic.com/technology/archive/2012/03/the-philosopher-
whose-fingerprints-are-all-over-the-ftcs-new-approach-to-privacy/254365/)

------
Nrsolis
The benefits of having an on-your-person radiolocation beacon are somewhat
muted by the possibility of having the government use that same technology to
undermine your Constitutionally protected privacy.

If there is anything that history can teach us, it's that law enforcement
agencies will work hard to keep us from knowing that this is going on and they
will fight to keep this tool because it makes it easier for them to do their
job. Ask any cop and they will tell you that they often view our "rights" as a
complete hinderance to their effectiveness.

One man's "civil rights and due process" is another man's "got off on a
technicality."

~~~
ChrisLTD
I think it's damning that the police go out of their way to hide they are
performing this kind of surveillance. It's as if they know it's wrong!

~~~
cdr
I doubt any officers think that it's wrong, but most are no doubt aware that
this thing that is making their jobs easier is unpopular with the public and
likely to be barred by courts when challenged. Best, then, to keep it as quiet
as possible.

~~~
tptacek
This, absolutely. The police have a dim view of virtually every restriction of
their powers. And that makes sense. The police know well that in the
overwhelming majority of the situations they work in, society wants and needs
the police to intervene. They're spending all day locking up bona fide
criminals, and, in urban areas, worrying about getting shot.

And all that means is that the police shouldn't be left to regulate
themselves. And, they aren't.

------
hack_edu
For what its worth, my phone was stolen last month and had Lookout Mobile
Security installed. It pinpointed the location down to a few meters. Still the
cops more-or-less said, "Oh, that's nice but we can't use that." They said
that civilian tracking apps that use the cell network are only usable down to
the tower, matter how exact it claims to be. This was in a big SF Bay Area
city with a well-funded, adequate, and tech savvy police force.

Your phone tracking software is non-binding and irrelevant in court. It says
so in the user agreements you click-through. That said, its nice to have the
ability to wipe and lock the device remotely.

~~~
tptacek
I was mugged in Chicago last summer and my phone was stolen. The phone and the
people who mugged me were in police custody _ten minutes later_ because of
cell tower phone tracking. The police asked questions about what tracking the
phone did; I have no doubt they'd have used that information too.

(Of course, this is a case in which I obviously would have consented to them
tracking my phone).

~~~
haberman
It took ten minutes for you to call the police, track your phone, give the
tracking information to police, and for the police to find and apprehend the
suspects? That seems astonishingly fast -- how did that all go down?

~~~
tptacek
I am being hyperbolic about the timing by about 2 minutes. I timed it from the
call to the police to pulling up in a squad car next to the fast food place
where the police detained the muggers and had me ID them.

It was crazy. I told my neighbors: the muggers asked for my bag, I said no, so
they settled for $12 and a device that tracked them from space.

------
JonnieCache
_"And in Arizona, even small police departments found cell surveillance so
valuable that they acquired their own tracking equipment to avoid the time and
expense of having the phone companies carry out the operations for them. The
police in the town of Gilbert, for one, spent $244,000 on such equipment."_

Anyone fancy taking a guess at what this might be?

~~~
uncoder0
So I looked into this and found a case in Fort Worth where a 'Cell Phone
Tracker' was purchased and it looks like it is marketed and produced by Harris
Corporation.[1]

I found their product list if you want to dig through it. [2]

[1] [http://www.wfaa.com/news/local/Fort-Worth-buys-cell-phone-
tr...](http://www.wfaa.com/news/local/Fort-Worth-buys-cell-phone-tracker-
without-considering-privacy-rights-140052293.html) [2]
[http://publicintelligence.net/harris-corporation-
amberjack-s...](http://publicintelligence.net/harris-corporation-amberjack-
stingray-stingray-ii-kingfish-wireless-surveillance-products-price-list/)

~~~
JonnieCache
Hmm so I'm guessing basically it's a software-defined radio that can predict
the frequency hopping algorithms in phones to distinguish an individual
handset's communications. Someone showed something like that at some hacker
conference in the last few years, but that was reverse engineered. I'm
guessing these guys have access to restricted knowledge from the
networks/manufacturers.

The actual triangulation of the position once you can do that is pretty
trivial I'd imagine, perhaps with some algorithms for compensating for
physical obstructions between you and the target.

------
javajosh
This is so terrible, and yet, apart from giving money to the ACLU it's not
clear what I can do about it. Theoretically people are supposed to get upset
and at least vote to change the policy next election: but who do you even vote
for that would change policy?

And why isn't this practice challenged in court by defendants? It seems like a
clear violation of the 4th Amendment, and should result in acquittal.

~~~
tptacek
In what sense is this a clear violation of the 4th Amendment? There are
numerous contexts in which the police can _literally search your physical
person and surroundings_ without a peep from the court. How is diagnostic
logging from cell towers worse than that?

It's possible that, as happened with the FBI GPS case, the police are going to
end up needing court orders to get this information in the future. But are you
aware of the evidentiary requirements to get similar court orders? They're
minimal. The police will get these court orders _whenever they ask for them_ :
the history of recorded locations of subjects in active investigations is
certainly going to be considered legitimate enough to outweigh the privacy
expectations here.

I'm happy if the police end up needing court orders for this, but I'm also
happy the police have access to this facility.

~~~
Duff
The court order is important, because it shines a light into a dark corner.
Like cockroaches, bureaucrats engaged in behavior that they believe to be
wrong always avoid the light.

Court involvement means court supervision and ultimately a more consistent
application of justice. The courts are more trustworthy than a faceless police
agency. I agree that it's a good thing that the police have access to this
sort of technology -- but someone needs to watch the watchers.

~~~
tptacek
Is there specific evidence in this story or any other story that you can find
that the police are engaging in actual, specific behavior that is wrong? I'm
not asking "are they behaving as if they're doing something wrong". I mean,
has someone actually alleged harm from cell tower spying?

I ask because the police appear to be using this capability in _actual
investigations_. They have a subject, they want to follow the subject. It's
not a dragnet kind of thing.

~~~
Duff
I don't know if it matters whether there is a bona fide investigation or not.
The police have broad authority to identify subjects of investigations.

The NYS Department of Labor and the NYS Office of the Inspector General placed
GPS devices on the personal vehicles of an employee who was being investigated
for timecard abuse. ([http://www.aclu.org/technology-and-liberty/nyclu-files-
suit-...](http://www.aclu.org/technology-and-liberty/nyclu-files-suit-
challenging-gps-tracking-state-employees-personal-car))

This isn't exactly the same, but I think the issues are similar enough for
discussion purposes. Police do have the ability to have investigators follow
someone to learn about their behavior. But the costs associated with doing
this, both in dollars and investigative resources, are high enough that police
do not follow subjects 24x7 often -- certainly not to investigate some state
employee's time card issues. How low does the bar go? Will the cops track me
if I'm suspected of illegally obtaining fireworks? Jump a subway turnstile?
Shoplift a candy bar?

This relatively new technology lowers the cost curve so much that the barrier
to entry is trivally low. And that is a problem that must be moderated by some
power external to the police.

Is anyone harmed? I don't know how you could argue that having the authorities
systematically track someone's movements isn't harmful. Even people as
irrational as crazy ex-boyfriends track the movements of their ex's to
intimidate. How would you feel personally if you found a GPS tracker on your
car? Or discovered that your phone was tapped? I would feel sick -- whether I
was a criminal or not!

~~~
tptacek
In all three of the cases you cited, you've broken a law. In one of the three
cases, you broke a pretty serious law. Why am I supposed to worry that the
police are collecting evidence against you if you're actually breaking the
law? Who disagrees with those particular laws?

As for your last sentence, the police have needed warrants to tap your phone
since the 1950s, and need a warrant to place a GPS tracker on your car, so I'm
not sure what the point of those examples is either.

