PRIVACY ADVOCATES GO APOPLECTIC OVER POLICE TRACKING TACTICS

An accused bank robber claims the police broke the law when they used Google location data to track him down. Privacy advocates agree

By Mack DeGeurin

Insider
November 23, 2019

When, if ever, should police be able to gather up Google location data to track down a criminal suspect? That's one of the questions being posed by the lawyers of an alleged Virginia bank robber, who claims local police overstepped their bounds and committed privacy violations when they requested data from Google on him and 18 others near the vicinity of the crime. Privacy advocates say the implications of this case reach far beyond the alleged burglar and could affect the rights of millions of Americans using Google products.

The robbery took place this May at a Call Federal Credit Union. Surveillance footage of the robbery obtained by CBS 6 shows the burglar, armed with a handgun, charging into the bank. The Department of Justice alleges that 24-old Okello Chatrie made off with more than $195,000 dollars.

Google provided police with anonymous data of 19 people near the bank

To try and crack the case, Chesterfield police requested the location data of everyone in the vicinity of the bank within an hour of the robbery. Google complied and provided the police with anonymized data on 19 individuals within a 150-meter radius, according to NBC News. Then law enforcement started digging deeper.

Investigators narrowed down their search to nine suspects and asked Google for slightly more specific information. The search was then whittled down even further to four individuals. At this level police requested additional specific data that reportedly included user names, email addresses, and phone numbers.

With all the necessary data, police moved forward with arresting Chatrie on August 13 on charges of forced accompaniment and brandishing a firearm. Chatrie could face life in prison if convicted.

Chatrie's lawyer and privacy advocates object to the police's decision to target a geographic region rather than a given individual. This method of data collection, which has grown in popularity among law enforcement in recent years, is referred to as a "geofence warrant."

In theory, the geofence warrant attempts to take the idea of a physical crime scene and reimagine it for an internet-connected world. But that can lead to situations where innocent bystanders may have their personal information sucked up by police in wholesale ways that wouldn't have happened before the ubiquity of internet-connected smartphones.

"Individuals may be caught up in this search by merely using an Android phone, conducting an Internet search using Google, running a Google application such as Google Maps or YouTube, or even receiving an automatic weather update from an Android service," Chatrie's attorney, Michael Price, wrote in an October motion viewed by the Washington Post.

"Police have access to a completely new capability."

Chatrie's lawyer isn't the only only one with concerns. In an interview with Insider, ACLU staff attorney Nathan Wessler expressed concern over what appears to be a lack of accountability associated with geofence warrants.

"The issue in these cases is that Google is sitting on an incredible volume of user location data," Wessler said. "That information can reveal extraordinarily private details of people's lives. There's a real risk that without proper constraints, these requests will start to resemble the types of things the framers of the Fourth Amendment were so concerned about."

Those constitution questions persist, Wessler said, regardless of whether or not Chatrie is found guilty of robbing the bank.

Wessler also disagreed with the notion that the geographic data collection is synonymous with a physical crime scene.

"When police are searching a physical crime scene, they are looking for physical evidence left behind like blood samples," Wessler said. "What we are talking about here is a digital record held by a company [Google] that millions of Americans trust to take care of their most sensitive data. Police have access to a completely new capability without comparison in the history of policing."

Google weighs the privacy of its users with the requests of law enforcement

Google defended the way it handles geofence warrant requests by police. In a statement provided to NBC News, Google explained their methods for striking a balance between protecting the privacy rights of its customers and complying with law enforcement requests.

"We vigorously protect the privacy of our users while supporting the important work of law enforcement," Richard Salgado, Google's director of law enforcement and information security, the company said.

"We have created a new process for these specific requests designed to honor our legal obligations while narrowing the scope of data disclosed and only producing information that identifies specific users where legally required."

Issues surrounding personal data and law enforcement have increasingly gone to court. Last year, in what was viewed as a significant win for privacy advocates, the Supreme Court rule that police must first receive a warrant before requesting cell phone tower data on individuals from telecommunications companies. That ruling was limited to cell phone towers. Still, with an ever-increasing proportion of cell phones connected to major location service apps like Google Maps, many of those same principles may apply to tech companies as well.

Google's compliance with police demands marks a notable divergence from some of its top competitors. Apple, for example, has security features in places (like the blocking of access to an iPhone's Lightning port after an hour) that would make it more difficult for police to access the contents of a phone. In 2016, Apple made national headlines when it refused requests by the FBI to unlock an iPhone used by one of the shooters in the San Bernardino terrorist attack.

Wessler, the ACLU attorney, credited Google with trying to protect users, but said that there needed to be more official legislation written to ensure police don't overstep.

"At the end of the day Americans shouldn't have to be put in the position of having to trust negotiations between private companies and policies to protect our rights," Wessler said. "What we need is clear, strong rules from courts and lawmakers explaining what's appropriate and what's not appropriate for police to do."