Takeaways for Week 6

Geo locational privacy; GPS tracking; ALPR technology; Stingrays

-          Article: “U.S. Supreme Court: GPS Trackers Are a Form of Search and Seizure”

·         Placing a tracking device on a car or person is a search and is protected by the Fourth Amendment.

·         Grady, a sex offender, challenged the court’s ruling that he had to wear a tracking device at all times.

·         It’s unclear how the Fourth Amendment interacts with digital technology, and much has to be decided.

·         Wisconsin and North Carolina requires sex offenders to wear GPS tracking devices.

-          Catherine Crump TED Talk: The small and surprisingly dangerous detail the police track about you

·         ALPR technology could let police could know where you go, with whom, and when.

·         These cameras are placed all around America.

·         The technology records much more than data and numbers – it can discover intimate details about you.

·         It stores and collects data.

Class Discussion February 13th:

-          Government tracking reveals a lot more than the typical person would want.

-          GPS tracking is considered a search, and is not protected by the Fourth Amendment without a search warrant.

-          If the individual is a sexual predator, does the State – or society’s – protection trump the individual’s?

·         Should a sexual predator be required to wear ankle bracelets for life? Is this unreasonable?

·         Wisconsin has a law that required convicted sex offenders to wear ankle bracelets for their entire lives, and they determined that this was reasonable because the individuals are a threat to society.

-          There is no definitive ruling on the constitutionality of GPS tracking through ankle bracelets.

-          GPS Tracking of Cars

·         This violates the Fourth Amendment because it is searching the person’s property.

·         Rented cars pose a different argument (it’s not the person’s property, and so how is it a violation?)

-          GPS Phone Tracking

·         We don’t currently have a warrant for accessing phone contents

·         Without a warrant required, all individuals could be tracked.

·         Third Party Doctrine

§  The third party doctrine has been thought by some as outdated because the digital age we live in that requires so much information transfers via third parties.

-          Stingrays

·         Stingrays capture every cellphone within their region of influence; it cannot access only one cellphone at a time, it accesses the entire region.

·         Phones try to find the strongest signal, and mistake stingrays for cell-towers.

·         Stingrays can be avoided by turning off phones completely, but then how does a cellphone benefit you?

·         13 states – including Utah – have banned Stingrays unless you have search warrants.

Class Discussion February 15^th:

-          Question of the Week: Should the US Congress enact a federal law governing the use of ALPR technology? Class unanimously voted “yes.”

·         There has never been a case that directly answered this question.

·         “If there is no trespass, then it does not qualify as a search.” – Antonin Scalia.

·         Reasonable expectation of privacy vs. trespassing on property.

-          What does law enforcement use ALPR technology for?

·         Locates stolen vehicles, discovers traffic violation information, finds out if a person is wanted for a crime

-          What are the uses of ALPR technology where law enforcement is not concerned?

·         Parking management, surveillance cameras, lights, stop lights, restricted access, automatic ticketing, and repossession companies.

-          Creative use of technology

·         Texas has a law that equips police vehicles with credit card readers that allow instant payment of court fines.

·         You must pay on the spot, or be impounded.

·         Vigilant Solutions, a manufacturer of ALPR technology, is giving Texas police free ALPR readers and access to its database of plate images in exchange for a 25% “processing fee” when a person makes a payment. Vigilant gets 25% of the fine.

·         Privacy concern: A lot of smaller law enforcement agencies will know about warrants in other states because ALPR technology covers four to five states.

-          ALPR Class Exercise

·         The University of Utah has an ALPR system that it uses for parking management in lieu of parking passes or stickers.

·         Question: “Develop a policy regarding the use of the system. What privacy and data collection issues do you see, and how would your policy address them?”

§  Is the data kept, and for how long? How long is it retained? Is it shared?

§  Should teachers be allowed access to determine where a student is if he/she misses class?

§  Requirements: data must only be kept for a short period of time; it must be secured from hackers.

-          Utah’s ALPR Law

·         The law only applies to the government.

·         Collection of ALPR data is banned except for protecting public safety.

·         ALPR data is “protected” record.

·         ALPR data may not be preserved for more than 90 days absent court order.

·         The government may not obtain private ALPR data absent a search warrant.

A Little Perspective

This talk does a really good job of putting the things we're learning about into the perspective of our own lives. It's a little unnerving, so be forewarned!

https://www.youtube.com/watch?v=dNZrq2iK87k&t=7106s

QUESTION OF THE WEEK NO. 5

There is a growing privacy concern with the proliferation of automatic license plate readers primarily centering around the creation of massive databases that could be used for surveillance purposes.  ALPR devices are being used both by government and private businesses and several states, including Utah, have enacted laws regulating their use.  Should the U.S. Congress enact a federal law governing the use of ALPR technology? 

Group 2 Case Studies

Scenario 1:

1. Yes, we would give the ticket holders notice that they are being watched with facial recognition software by printing something on the back of a ticket and putting up signs around the stadium.
2. Holding and using the ticket gives implied consent due to the warning on the back and entering the stadium gives implied consent due to the warning signs.
3. For our policy, we will only store the information about the crowd for a max of 24 hours after the game. We will store the data in a secure manner and will not sell the information. And only a select group of security personnel will have access to the data.

Scenario 2:

    We only created a list of questions about the kiosk since we decided that questions, concerns, and issues are all very similar (you are concerned about an issue so you ask a question about it).

Questions:

Does it save pictures, how long?

What are the websites and programs the technology uses/queries?

Does it store information about what you buy?

Who has access to this information (just the drink company, the drink company and the store the kiosk is located in, or the drink company and every store that has a kiosk)?

How does the coupon system work?

Does the kiosk create a profile about users, and can one access the profile it creates about them?

Does the purchase history exclude prescriptions/sensitive items?

Can you opt out of the program and still be a frequent shopper?

How far is the range of the scanner?

Can you see what photos the program uses?

What kind of warnings or forms of consent are given to users?

Are customers allowed to send feedback on the coupon and kiosk?

Group 1 Case Studies

Scenario 1-

            Notice- In order to give notice to the public and inform them of facial recognition use, we would place signs around arena and also online when purchasing the ticket. When people purchase their ticket, as well as walk around the stadium, they will be informed of facial recognition features.  In depth information would be online.

            Consent- Those who come into the stadium or purchase tickets would imply consent.  Because it is such a public event, there would be no expectation of privacy.

            Policies-  We decided that  our footage would not be used for any reason other than security.  We would not sell the footage to ad companies or use it to pinpoint people at the game unless there was acceptable reason.  The footage would be kept in a safe database that is only accessible to security personnel for a month after the game and then it would be deleted.

Scenario 2- 

            Questions and Concerns- Intrusive because of social media use.  What are the benefits of connecting to social media? How accurate is the software and how does it prevent false positives?  What company is holding this information and who has access to it? Is consent given at kiosk or when you sign up for frequent shoppers? A very large invasion of privacy for such a little gain.

            Policy- Individuals information should not be stored, but can be put in bulk categories.  Give the shoppers a way to opt out of certain pieces of the program.  Other data brokers can only have access to the bulk information not individuals.

Dragnet Stingray Fishing

They say you can tell a lot about a woman by what’s in her purse. More generally, you can tell a lot about any person by what they always carry. In my case, I never leave the house without my keys, my wallet, and my cellphone. The keys are pretty self-explanatory – I’ve never left home without planning to get back in later – and my wallet is there so I can buy lunch. My phone, though, seems to just tag along to cause stress. Powered on, but idle, I wonder why it uses so much more battery than, say, a tablet. A partial answer to that question is that, several times per minute, my phone sends a small message to the cell tower¹. Much as I would love better battery life, this makes sense. Without that “ping” to the cell tower, my phone would have no way to know of, for example, incoming text messages.

Unfortunately, the procedure a cellphone uses to connect to the tower is completely unauthenticated, meaning so-named Man-in-the-Middle (MITM)² attacks are relatively easy to carry out. The basic idea of a MITM attack is very simple: Say I tell you I am someone I am not. For example, a police officer. You would probably want to see some identification for me to prove it. Many software systems do not ask for this identification, meaning they will just send data to anyone who asks for it.

Not this kind of Stingray…
(Source: http://eskipaper.com/stingray-4.html)

This basic security oversight is what makes Stingrays (otherwise known as IMSI-catchers or cell site simulators) so effective. The Stingray masquerades as a cell tower, your phone connects, your phone sends its authentication information to the Stingray, the Stingray authenticates to the real cell tower using your information, and passes data back and forth between your phone and the tower. The Stingray is now able to eavesdrop on everything your phone does.

This is bad for two reasons: First, whoever owns the Stingray can record calls, (SMS/MMS) messages, and any unencrypted data. Secondly, your phone can be requested to send triangulation data about other cell towers in range, making it possible to track location with very good accuracy in real-time³.

Neither of these things sound great for privacy but, as we’ve already talked about in class, we aren’t too uncomfortable when such aggressive tracking is used in a criminal case. Of course, this is where everything starts to get messy. The first problem is that these Stingrays are often used without a warrant¹, despite having precedent from other cases that real-time tracking amounts to a fourth-amendment search, and thus requires a warrant⁴. Added to this is that in cases where Stingrays are used, law enforcement often tries to conceal that fact, even going so far as to drop cases when they would potentially be forced to reveal the use of a Stingray.
The second privacy problem is that everybody’s cellphone within the Stingray’s range of operation is intercepted. This is by necessity – the way a Stingray works means it’s not possible to target an individual phone – but that doesn’t make it any less of an invasion of privacy. When court orders do authorize the use of Stingrays, there is often very little mention of what happens to the “collateral” data collected⁵. It may be immediately deleted, but it could also all be shoveled into some database. Given the secrecy surrounding law enforcement’s use of such devices, we have no real reason to choose one over the other. However, as the NSA was willing to collect massive amounts of data about American’s phone calls under the Patriot Act, it wouldn’t be unreasonable to believe that they collect and store information gathered by stingrays from unknowning citizens.
However, the worst news is yet to come. Although it would be, at best, questionably legal to own such a device, they are relatively easy to build and are available for purchase outside of the US⁶. This means that, quite aside from law-enforcement, it isn’t beyond belief that other individuals or organizations have the capability to perform mass surveillance by use of cell site simulators.

Given that, what can you do to protect yourself? Unfortunately, very little. The obvious answer is to switch your phone off and remove the battery. This is foolproof but impractical. Alternately, you could write to your cellphone provider and complain that they need to upgrade their security. This is not likely to be effective because it would cost the company money and because they would most likely have to retain the older, insecure system for backwards-compatibility.

Given the vast amounts of data it is possible to obtain using a Stingray, including live location information and calls, messages, and data, I think it is clear that law enforcement should require a warrant before using a Stingray, keeping in mind a plan for what to do with “collateral” data. However, this does not address the privacy concern that anyone can build a cell-site-simulator for $500⁷. Though a warrant should definitely be required to use this technology, the real problem is that cellular authentication and encryption are both totally broken and ought to be upgraded.

1https://www.eff.org/deeplinks/2012/10/stingrays-biggest-unknown-technological-threat-cell-phone-privacy

2Personal knowledge supported by https://en.wikipedia.org/wiki/IMSI-catcher

3https://www.eff.org/sls/tech/cell-site-simulators/faq#faq-What-data-can-a-cell-site-simulator-collect?-

4https://www.eff.org/deeplinks/2016/04/eff-and-aclu-expose-governments-secret-stingray-use-wisconsin-case

5https://www.eff.org/sls/tech/cell-site-simulators/faq#faq-If-I%E2%80%99m-not-a-target-of-a-criminal-investigation,-why-do-I-have-to-worry-about-cell-site-simulators?

6https://www.eff.org/sls/tech/cell-site-simulators/faq#faq-Who-else-uses-cell-site-simulators?

7https://hackaday.com/2016/04/08/build-your-own-gsm-base-station-for-fun-and-profit/

February 8 Case Scenarios: Group No. Three

Case Scenario No. One

Notice

Notice of the use of facial recognition technology, drones and video surveillance will be given to attendees before the game via a printed message on the back of their tickets (if ticket is available for viewing/printing online, it will be printed on that ticket as well as tickets distributed by the stadium). On the day of the game, there will be signs posted throughout the stadium (inside and outside the entry gates) stating that facial recognition, drones and video surveillance are being used. When attendees enter through the gates, an audio announcement will state that facial recognition, drones and video surveillance are being used. This audio announcement may also include other information, to be determined by the stadium or NFL (advertisements, general announcements or reminders, other security information, etc.). This should be a friendly announcement, in an informative tone so as not to detract from the festivities.

Consent

No express consent is required. Consent is implied upon purchase of a ticket as well as entry to the stadium. Attendees do not have a reasonable expectation of privacy at this event, due to the size, the number of people in attendance, the fact that it is televised and the close proximal relationship of attendees. If a person or group has issue with the use of facial recognition, drones or video surveillance, the event is being televised and they may view it through alternate means.

Policies

The database(s) used should be only through official sources (law enforcement agencies, DMV, watch lists and an NFL--and stadium, if available--database of people they have previously had problems with). Images and information will not be connected to Facebook; the system should not have access to Facebook.

Known convicts or people on watch lists will be “flagged” and the areas they occupy will be in constant video surveillance through the use of drones or video cameras. Security personnel or law enforcement may only get involved if a disturbance occurs. People who are flagged will not be immediately removed unless security personnel or law enforcement deem it necessary. Areas occupied by people who are not flagged will still be surveilled. Security personnel or law enforcement may only get involved if a disturbance occurs in this situation as well.

The information/data collected from the surveillance on game day will be stored for a month after game day. This allows time for people to come forward after the game, in case something happened that they would like to be investigated further. Law enforcement agencies may request longer storage of certain data if it is needed for a criminal investigation. The implementation of this technology is for security. The information/data collected may not be sold or distributed except in the case of criminal investigation.

Case Scenario No. Two

Concerns

1. There ought to be an option to opt-out of being in the database.
2. A person should consent to having their face scanned each time a scan is attempted.
3. A person should consent to what information is being viewed and used by the kiosk.
4. This beverage company sells products that may not be suitable for children and products that are illegal for persons under the age of 21 to consume. What will keep the kiosk from providing coupons and advertising of these products to young people?

Policy

1. Since the kiosk technology is connected to the frequent shopper program (which requires the submission of a photo), signing up for the frequent shopper program automatically puts one’s face in the kiosk’s database. In order to opt-out of being in the database, a person would be required to not join the frequent shopper program.
2. When signing up for the frequent shopper program, there should be a notice stating that signing up for the frequent shopper program automatically gives consent to have one’s photo included in the kiosk’s database. One must provide express consent (by checking a box or providing a signature) to have their photo included in the kiosk’s database.
3. When signing up for the frequent shopper program, there should be an option to choose what the kiosk’s database has access to. One must provide express consent for the database to access Facebook (by checking a box, circling something, or providing a signature). If the company or store would like for the database to have access to any other information, this should be expressed when signing up for the frequent shopper program. The use of one’s photo and shopper history is already part of the frequent shopper program and will automatically be used by the kiosk. If a person signs up for the frequent shopper program, they do not have to provide additional consent for their photo and shopper history to be used by the kiosk.
4. Because the information in the kiosk is connected to the frequent shopper program, a person must be a member of the frequent shopper program in order to use the kiosk and receive a coupon. Minors will be automatically excluded from the use of the kiosk because they will not be members of the frequent shopper program.

Questions

What is the incentive for the consumer to use this product (kiosk)? 
Is there any incentive beyond the coupon, the potential to find a product they may enjoy and the interactive experience of new technology?

What is the incentive for the store to use this product? 
Does the store collect the information collected by the database and use that for the future?

What is the incentive for the company to use this product?
Besides advertisement and immediately attempting to determine a consumer’s preferences based upon their shopper history and/or Facebook profile, does the company receive any other benefits from this product? Do they store and use the information collected to find statistics of potential and current consumers? If this is the case, they should probably record what coupons were given to certain consumers and whether or not these coupons were used.

How long is information stored and used? 
We assumed that the information collected through the kiosk and frequent shopper program are probably stored for an indefinite amount of time. It will probably be used by the store and companies in order to provide relevant promotions of items a particular person will most likely find useful.