[Infowarrior] - Feds push for tracking cell phones

[Richard Forno]

  February 11, 2010 4:00 AM PST
Feds push for tracking cell phones
by Declan McCullagh

http://news.cnet.com/8301-13578_3-10451518-38.html
Two years ago, when the FBI was stymied by a band of armed robbers  
known as the "Scarecrow Bandits" that had robbed more than 20 Texas  
banks, it came up with a novel method of locating the thieves.
FBI agents obtained logs from mobile phone companies corresponding to  
what their cellular towers had recorded at the time of a dozen  
different bank robberies in the Dallas area. The voluminous records  
showed that two phones had made calls around the time of all 12  
heists, and that those phones belonged to men named Tony Hewitt and  
Corey Duffey. A jury eventually convicted the duo of multiple bank  
robbery and weapons charges.

Even though police are tapping into the locations of mobile phones  
thousands of times a year, the legal ground rules remain unclear, and  
federal privacy laws written a generation ago are ambiguous at best.  
On Friday, the first federal appeals court to consider the topic will  
hear oral arguments (PDF) in a case that could establish new standards  
for locating wireless devices.

In that case, the Obama administration has argued that warrantless  
tracking is permitted because Americans enjoy no "reasonable  
expectation of privacy" in their--or at least their cell phones'-- 
whereabouts. U.S. Department of Justice lawyers say that "a customer's  
Fourth Amendment rights are not violated when the phone company  
reveals to the government its own records" that show where a mobile  
device placed and received calls.

Those claims have alarmed the ACLU and other civil liberties groups,  
which have opposed the Justice Department's request and plan to tell  
the U.S. Third Circuit Court of Appeals in Philadelphia that  
Americans'  privacy deserves more protection and judicial oversight  
than what the administration has proposed.

"This is a critical question for privacy in the 21st century," says  
Kevin Bankston, an attorney at the Electronic  Frontier Foundation who  
will be arguing on Friday. "If the courts do side with the government,  
that means that everywhere we go, in the real world and online, will  
be an open book to the government unprotected by the Fourth Amendment."

Not long ago, the concept of tracking cell phones would have been the  
stuff of spy movies. In 1998's "Enemy of the State," Gene Hackman  
warned that the National Security Agency has "been in bed with the  
entire telecommunications industry since the '40s--they've infected  
everything." After a decade of appearances in "24" and "Live Free or  
Die Hard," location-tracking has become such a trope that it was  
satirized in a scene with Seth Rogen from "Pineapple Express" (2008).

Once a Hollywood plot, now 'commonplace'
Whether state and federal police have been paying attention to  
Hollywood, or whether it was the other way around, cell phone tracking  
has become a regular feature in criminal investigations. It comes in  
two forms: police obtaining retrospective data kept by mobile  
providers for their own billing purposes that may not be very  
detailed, or prospective data that reveals the minute-by-minute  
location of a handset or mobile device.

Obtaining location details is now "commonplace," says Al Gidari, a  
partner in the Seattle offices of Perkins Coie who represents wireless  
carriers. "It's in every pen register order these days."

Gidari says that the Third Circuit case could have a significant  
impact on police investigations within the court's jurisdiction,  
namely Delaware, New Jersey, and Pennsylvania; it could be persuasive  
beyond those states. But, he cautions, "if the privacy groups win, the  
case won't be over. It will certainly be appealed."

CNET was the first to report on prospective tracking in a 2005 news  
article. In a subsequent Arizona case, agents from the Drug  
Enforcement Administration tracked a tractor trailer with a drug  
shipment through a GPS-equipped Nextel phone owned by the suspect.  
Texas DEA agents have used cell site information in real time to  
locate a Chrysler 300M driving from Rio Grande City to a ranch about  
50 miles away. Verizon Wireless and T-Mobile logs showing the location  
of mobile phones at the time calls became evidence in a Los Angeles  
murder trial.

And a mobile phone's fleeting connection with a remote cell tower  
operated by Edge Wireless is what led searchers to the family of the  
late James Kim, a CNET employee who died in the Oregon wilderness in  
2006 after leaving a snowbound car to seek help.


"This is a critical question for privacy in the 21st century. If the  
courts do side with the government, that means that everywhere we go,  
in the real world and online, will be an open book to the government  
unprotected by the Fourth Amendment."
--Kevin Bankston, attorney, Electronic Frontier Foundation
The way tracking works is simple: mobile phones are miniature radio  
transmitters and receivers. A cellular tower knows the general  
direction of a mobile phone (many cell sites have three antennas  
pointing in different directions), and if the phone is talking to  
multiple towers, triangulation yields a rough location fix. With this  
method, accuracy depends in part on the density of cell sites.

The Federal Communications Commission's "Enhanced 911" (E911)  
requirements allowed rough estimates to be transformed into precise  
coordinates. Wireless carriers using CDMA networks, such as Verizon  
Wireless and Sprint Nextel, tend to use embedded GPS technology to  
fulfill E911 requirements. AT&T and T-Mobile comply with E911  
regulations using network-based technology that computes a phone's  
location using signal analysis and triangulation between towers.

T-Mobile, for instance, uses a GSM technology called Uplink Time  
Difference of Arrival, or U-TDOA, which calculates a position based on  
precisely how long it takes signals to reach towers. A company called  
TruePosition, which provides U-TDOA services to T-Mobile, boasts of  
"accuracy to under 50 meters" that's available "for start-of-call,  
midcall, or when idle."

A 2008 court order to T-Mobile in a criminal investigation of a  
marriage fraud scheme, which was originally sealed and later made  
public, says: "T-Mobile shall disclose at such intervals and times as  
directed by (the Department of Homeland Security), latitude and  
longitude data that establishes the approximate positions of the  
Subject Wireless Telephone, by unobtrusively initiating a signal on  
its network that will enable it to determine the locations of the  
Subject Wireless Telephone."

'No reasonable expectation of privacy'
In the case that's before the Third Circuit on Friday, the Bureau of  
Alcohol, Tobacco, Firearms and Explosives, or ATF, said it needed  
historical (meaning stored, not future) phone location information  
because a set of suspects "use their wireless telephones to arrange  
meetings and transactions in furtherance of their drug trafficking  
activities."

U.S. Magistrate Judge Lisa Lenihan in Pennsylvania denied the Justice  
Department's attempt to obtain stored location data without a search  
warrant; prosecutors had invoked a different legal procedure.  
Lenihan's ruling, in effect, would require police to obtain a search  
warrant based on probable cause--a more privacy-protective standard.

Lenihan's opinion (PDF)--which, in an unusual show of solidarity, was  
signed by four other magistrate judges--noted that location  
information can reveal sensitive information such as health  
treatments, financial difficulties, marital counseling, and extra- 
marital affairs.

In its appeal to the Third Circuit, the Justice Department claims that  
Lenihan's opinion "contains, and relies upon, numerous errors" and  
should be overruled. In addition to a search warrant not being  
necessary, prosecutors said, because location "records provide only a  
very general indication of a user's whereabouts at certain times in  
the past, the requested cell-site records do not implicate a Fourth  
Amendment privacy interest."

The Obama administration is not alone in making this argument. U.S.  
District Judge William Pauley, a Clinton appointee in New York, wrote  
in a 2009 opinion that a defendant in a drug trafficking case, Jose  
Navas, "did not have a legitimate expectation of privacy in the cell  
phone" location. That's because Navas only used the cell phone "on  
public thoroughfares en route from California to New York" and "if  
Navas intended to keep the cell phone's location private, he simply  
could have turned it off."

(Most cases have involved the ground rules for tracking cell phone  
users prospectively, and judges have disagreed over what legal rules  
apply. Only a minority has sided with the Justice Department, however.)

Cellular providers tend not to retain moment-by-moment logs of when  
each mobile device contacts the tower, in part because there's no  
business reason to store the data, and in part because the storage  
costs would be prohibitive. They do, however, keep records of what  
tower is in use when a call is initiated or answered--and those  
records are generally stored for six months to a year, depending on  
the company.

Verizon Wireless keeps "phone records including cell site location for  
12 months," Drew Arena, Verizon's vice president and associate general  
counsel for law enforcement compliance, said at a federal task force  
meeting in Washington, D.C. last week. Arena said the company keeps  
"phone bills without cell site location for seven years," and stores  
SMS text messages for only a very brief time.

Gidari, the Seattle attorney, said that wireless carriers have  
recently extended how long they store this information. "Prior to a  
year or two ago when location-based services became more common, if it  
were 30 days it would be surprising," he said.

The ACLU, EFF, the Center for Democracy and Technology, and University  
of San Francisco law professor Susan Freiwald argue that the wording  
of the federal privacy law in question allows judges to require the  
level of proof required for a search warrant "before authorizing the  
disclosure of particularly novel or invasive types of information." In  
addition, they say, Americans do not "knowingly expose their location  
information and thereby surrender Fourth Amendment protection whenever  
they turn on or use their cell phones."

"The biggest issue at stake is whether or not courts are going to  
accept the government's minimal view of what is protected by the  
Fourth Amendment," says EFF's Bankston. "The government is arguing  
that based on precedents from the 1970s, any record held by a third  
party about us, no matter how invasively collected, is not protected  
by the Fourth Amendment."

Update 10:37 a.m. PT: A source inside the U.S. Attorney's Office for  
the northern district of Texas, which prosecuted the Scarecrow Bandits  
mentioned in the above article, tells me that this was the first and  
the only time that the FBI has used the location-data-mining technique  
to nab bank robbers. It's also worth noting that the leader of this  
gang, Corey Duffey, was sentenced last month to 354 years (not months,  
but years) in prison. Another member is facing 140 years in prison.


Declan McCullagh is a contributor to CNET News and a correspondent for  
CBSNews.com who has covered the intersection of politics and  
technology for over a decade. Declan writes a regular feature called  
Taking Liberties, focused on individual and economic rights; you can  
bookmark his CBS News Taking Liberties site, or subscribe to the RSS  
feed. You can e-mail Declan at declan at cbsnews.com.