Tech tool offers police ‘mass surveillance on a budget’ – News-Herald
By GARANCE BURKE and JASON DEAREN
Local law enforcement agencies, from suburban Southern California to rural North Carolina, use an obscure cellphone tracking tool, sometimes without a search warrant, that gives them the power to track people’s movements back months, according to public records and internal emails obtained by The Associated Press.
Police used “Fog Reveal” to search hundreds of billions of records from 250 million mobile devices and mined the data to create location analytics known to law enforcement as “patterns.” of life,” according to thousands of pages of company records.
Sold by Virginia-based Fog Data Science LLC, Fog Reveal has been used since at least 2018 in criminal investigations ranging from the murder of a nurse in Arkansas to tracking the movements of a potential participant in the January 6 insurgency. at the Capitol. The tool is rarely, if ever, mentioned in court records, which defense attorneys say makes it harder for them to properly defend their clients in cases in which the technology has been used.
The company was developed by two former senior Department of Homeland Security officials under former President George W. Bush. It relies on advertising ID numbers, which Fog officials say are pulled from popular mobile apps like Waze, Starbucks and hundreds of others that target ads based on movement and movement. interests of a person, according to police emails. This information is then sold to companies like Fog.
“It’s kind of a mass surveillance program on a budget,” said Bennett Cyphers, special adviser at the Electronic Frontier Foundation, a digital privacy advocacy group.
This story, backed by the Pulitzer Center on Crisis Reporting, is part of an ongoing Associated Press series, “Tracked,” that investigates the power and consequences of decisions made by algorithms on people’s daily lives.
The documents and emails were obtained by EFF through Freedom of Information Act requests. The group shared the files with the AP, which independently discovered that Fog had sold its software in about 40 contracts to nearly two dozen agencies, according to GovSpend, a company that tracks government spending. The AP filings and reports provide the first public account of the extensive use of Fog Reveal by local police, according to analysts and legal experts who review such technologies.
Federal oversight of companies like Fog is an evolving legal landscape. On Monday, the Federal Trade Commission sued a data broker called Kochava which, like Fog, provides its clients with advertising IDs that authorities say can easily be used to find where a mobile device user lives, violating the rules applied by the commission. And there are now bills before Congress that, if passed, would regulate the industry.
“Local law enforcement is on the front lines of trafficking and missing persons cases, but these departments often lag behind in embracing technology,” Fog managing partner Matthew Broderick said in a statement. E-mail. “We fill a void for underfunded and understaffed departments.”
Due to the secrecy surrounding Fog, however, there are few details about its use and most law enforcement agencies will not discuss it, raising concerns among privacy advocates that it violates the Fourth Amendment to the US Constitution, which protects against unreasonable search and seizure. .
What sets Fog Reveal apart from other cell phone tracking technologies used by law enforcement is that it tracks devices by their Advertising IDs, unique numbers assigned to each device. These numbers do not contain the phone user’s name, but can be traced to homes and workplaces to help police conduct lifestyle analyses.
“The ability he had to elevate anyone in an area, whether in public or at home, struck me as a very clear violation of the Fourth Amendment,” said Davin Hall, a former supervisor of crime data analysis for Greensboro. , North Carolina, Police Department. “I just feel angry, betrayed and lied to.”
Hall resigned in late 2020 after months of raising concerns about the department’s use of Fog to police attorneys and the city council.
While Greensboro officials acknowledged Fog’s use and initially defended him, the police department said it allowed his subscription to expire earlier this year because he did not “independently benefit to investigations”.
But federal, state, and local law enforcement agencies across the United States continue to use Fog with very little public accountability. Local police departments have been won over by Fog’s affordability: it can start from $7,500 per year. And some departments that license it have shared access with other nearby law enforcement agencies, the emails show.
Law enforcement agencies also appreciate how quickly they can access Fog’s detailed location information. Geofence warrants, which leverage GPS and other sources to track a device, can be accessed by obtaining this data from companies such as Google or Apple. This requires police to obtain a warrant and ask tech companies for the specific data they want, which can take days or weeks.
Using Fog’s data, which the company says is anonymized, police can geolocate an area or perform a search using the ad ID numbers of a specific device, pursuant to an agreement with use obtained by AP. But Fog maintains that “we have no way of tying the signals to a specific device or owner,” according to a sales representative who emailed the California Highway Patrol in 2018, after a lieutenant asked if the tool could be used legally.
Despite these confidentiality safeguards, records show that law enforcement can use Fog’s data as a clue to finding identifying information. “There is no (personal information) tied to (advertising ID),” a Missouri official wrote of Fog in 2019. “But if we’re good at what we do, we should be able to determine the owner.”
Fog’s Broderick said in an email that the company does not have access to individuals’ personal information and relies on “commercially available data with no restrictions on use,” from data brokers “who buy rightfully data from applications in accordance with their legal agreements”. The company declined to share information on how many police departments it works with.
“We are confident that law enforcement has the responsible leadership, restraints and political guidance at the municipal, state and federal levels to ensure that any law enforcement tools and methods are used appropriately in accordance with the laws of their respective jurisdictions,” Broderick said. .
Prior to publication, Fog’s Broderick declined to say how the company obtained the data from Starbucks and Waze. But on Thursday, he said he didn’t know how data aggregators collected the information Fog Reveal pulls from, or the specific apps the data was pulled from.
“Search warrants are not required for the use of public data,” he said Thursday, adding that the data his product offers law enforcement is “primary data” and should not be used to establish probable cause.
AP National Writer Allen G. Breed contributed from Greensboro, North Carolina. Dearen reported from New York and Burke reported from San Francisco.
This report was produced in collaboration with researchers Janine Graham, Nicole Waddick and Jane Yang as well as the University of California, the Human Rights Center Investigations Lab and the Berkeley School of Law.
Follow Garance Burke and Jason Dearen on Twitter at @garanceburke and @jhdearen. Contact the AP Global Investigation Team at [email protected] or https://www.ap.org/tips/