[Infowarrior] - FBI vs. Google: The Legal Fight to Unlock Phones

[Richard Forno]

Updated September 6, 2012, 10:02 p.m. ET

FBI vs. Google: The Legal Fight to Unlock Phones

By JULIA ANGWIN

http://online.wsj.com/article/SB10001424052702303644004577524790015525450.html

A legal battle is brewing between technology companies and the U.S. government over whether law-enforcement agents have the right to obtain passwords to crack into smartphones of suspects.

Google Inc. GOOG +2.67% earlier this year refused to unlock an alleged pimp's cellphone powered by its Android software—even after the Federal Bureau of Investigation obtained a search warrant.

Google's unusual and controversial challenge to the search warrant indicates how murky the legal standards are for new technologies such as smartphones. Under the Supreme Court's so-called Third Party Doctrine, government agents can often obtain data stored with third parties without obtaining a search warrant.

But that standard doesn't take into account data as sensitive as a password—which can be the key to unlocking a larger trove of information such as emails, texts, calls and address lists.

Asking a third party for a password "is awfully new and aggressive," said Paul Ohm, associate professor at the University of Colorado Law School and former federal prosecutor. "Generally, we don't like the FBI to have access to our keys even with a warrant."

An FBI spokesman declined to comment about the agency's policies on cellphone unlocking.

Law enforcement agents often use forensic equipment to simply download the contents of a phone's memory, without attempting to unlock the phone.

But sometimes officers fail to break into a phone or the data they find is encrypted. In that case, they can send a grand jury subpoena to the cellphone owner asking them to turn over their password.

Those requests are legally tricky because the Constitution's Fifth Amendment protects people from self-incrimination. As a result, passwords—and the data protected by those passwords—obtained by grand jury subpoena often cannot be used for prosecution, says Adam Gershowitz, professor of law at William & Mary Law School.

Federal agents now appear to be turning to smartphone software makers such as Google and Apple Inc. AAPL +0.89% for help bypassing cellphone passwords. There is little public data about how many times such requests are made—but law enforcement documents recently obtained by Freedom of Information Act requests from the American Civil Liberties Union contained templates that officers can submit to Apple and Google for help in bypassing passwords.

Neither Apple or Google would comment about the documents or the prevalence of such requests. And since most such requests are not publicly available, it's difficult to determine how often it happens. Google releases a list of total requests it receives each year from law enforcement—but it doesn't provide details about the type of requests. Apple doesn't release a similar list.

"Right now, we cannot have a reasonable informed debate about this issue because we don't have any data," said Christopher Soghoian, the principal technologist with the ACLU's Speech, Privacy and Technology Project.

But it's clear that smartphone software makers are cautious about turning over smartphone passwords. An Apple spokeswoman said the company "won't release any personal information without a search warrant, and we never share anyone's passcode. If a court orders us to retrieve data from an iPhone, we do it ourselves. We never let anyone else unlock a customer's iPhone."

Spokeswomen for Microsoft Corp. MSFT +3.05% and Research In Motion Ltd. RIM.T +2.16% say their companies don't collect or store passwords, and hence can't provide them to the government even in the case of a warrant.

Marc Zwillinger, an attorney who practices Internet law, and has challenged governmental legal process on behalf of tech companies including Yahoo Inc. YHOO +0.13% and Myspace LLC, says that requests for account passwords are infrequent but that when companies get them, they should think carefully about whether to comply. 

"It creates a situation where a company could be viewed as helping law enforcement do an illegal wiretap if the device is in their possession and the account is still live," he says.

If a company receives a search warrant it doesn't agree with, it can challenge it in court or negotiate directly with law enforcement to narrow the request, Mr. Zwillinger said.

Google has a history of challenging government requests it views as over-reaching. In 2006, Google fought a subpoena from the Department of Justice that sought all the search queries it had received during a two-month period, and all the URLs that it had indexed at that time. Eventually, a judge ruled Google only had to turn over only 50,000 URLs and no search queries.

In that case, U.S. District Judge James Ware wrote that possibility that Google might be forced to turn over search strings such as "[user name] third trimester abortion san jose]…gives this Court pause as to whether the search queries themselves may constitute potentially sensitive information."

In the current Google case involving the alleged primp, FBI Special Agent Jonathan R. Cupina obtained a search warrant in March allowing him to request that Google provide "any and all means of gaining access, including login and password information, password reset, and/or manufacturer default code" for an Android phone—the Samsung Galaxy Exhibit— belonging to Dante Dears.

According to Mr. Cupina's affidavit, Mr. Dears is the founding member of the "Pimpin' Hoes Daily (PhD)" gang, and is on parole. He wears a GPS electronic monitor and has signed a waiver agreeing that his person and property can be searched without a warrant.

In May 2011, the FBI learned from a confidential source that Mr. Dears might be engaged in human trafficking activities. While conducting surveillance, the agents witnessed Mr. Dears "utilizing a cellular telephone frequently for a period of nearly six hours" despite having previously denied to his parole agent that he possessed a cellular  phone.

In his affidavit, Mr. Cupina states he suspected Mr. Dears had become something known as a "telephone pimp"—using cellular phones to arrange sexual services of prostitutes—because his electronic monitor limits his physical movements.

In January, the parole agent visited Mr. Dears at his residence in Chula Vista, Calif., and obtained the cellular phone. But Mr. Dears refused to allow the agent to access the phone or to answer any further questions—allegedly in violation of the terms of his parole.

On Feb. 13, Magistrate Judge William V. Gallo in U.S. District Court in the Southern District of California issued a warrant to let agents search the phone. The next day, FBI agents worked with computer forensics technicians to attempt to gain access to the contents of the phone, but they were unable to do so.

The agents say they were stumped by the "pattern lock" on the phone— which requires users to move their finger over the touch screen in a precise pattern.

Magistrate Judge Nita L. Stormes approved a search warrant in March to be issued to Google seeking access to the cellphone.

On March 26, the warrant was filed in court with a handwritten note from Mr. Cupina stating, "No property was obtained as Google Legal refused to provide the requested information."

Google didn't reveal its legal reasoning in filings made earlier this year in the U.S. District Court in the Southern District of California. A Google spokeswoman declined to comment, citing the need "to protect user privacy."

A person familiar with the company's legal views said that whenever possible, it seeks to narrow legal requests that are overly broad or that don't adequately notify a user.

A spokesman for the FBI in San Diego said the issue with Google has been resolved, but declined to elaborate citing the fact that aspects of the case were still pending. An attorney for Mr. Dears couldn't be located.

Write to Julia Angwin at julia.angwin at wsj.com

---
Just because i'm near the punchbowl doesn't mean I'm also drinking from it.