LOCATION DATA. Location information from mobile devices is typically obtained using the following:

Transcription

1 LOCATION DATA Location information from mobile devices is typically obtained using the following: 1. Cell PING (Triangulation) 2. Stingray device 3. Wi-Fi, Bluetooth tracking 4. Apps and Web browsing 5. Global Positioning System (GPS) 6. Malware 7. Historic call detail records Toolbox Page 1 of 13

2 CELL PING TRIANGULATION The Federal Communications Commission has mandated that the E911 System must be accurate to within 100 meters for 67 percent of calls and 300 meters for 90 percent of calls. Using this system an operator can ping a device and calculate where a particular subscriber's phone is located whenever the phone is powered on and registered with the network. The ability to do this result from the way the mobile network is built, and is commonly called triangulation. A cell phone s signal will often be received simultaneously by more than one cell site when operating in areas with a high concentration of cell sites and overlaps in coverage. When this occurs, a mathematical process called triangulation may determine the phone s location if either: (1) three points receiving the signal are known; or (2) two points receiving the signal are known, along with the direction in which the cell site received the signal. Accuracy One way the operator can do this is to observe the signal strength that different towers observe from a particular subscriber's mobile phone, and then calculate where that phone must be located in order to account for these observations. The accuracy with which the operator can figure out a subscriber's location varies depending on many factors, including the technology the operator uses and how many cell sites they have in an area. Very often, it is accurate to about the level of a city block, but in some systems it can be more accurate. There is no way to hide from this kind of tracking as long as your mobile phone is powered on and transmitting signals to an operator's network. Although normally only the mobile operator itself can perform this kind of tracking, a government could force the operator to turn over location data about a user (in real-time or as a matter of historical record). Tower Dump Another related kind of government request is called a tower dump. In this case, a government asks a mobile operator for a list of all of the mobile devices that were present in a certain area at a certain time. Toolbox Page 2 of 13

3 MOBILE SIGNAL TRACKING IMSI CATCHER (STINGRAY) Federal and state law enforcement entities across the country are using a powerful cell phone surveillance tool commonly referred to as a StingRay. These devices are capable of locating a cell phone with extraordinary precision, but to do so they operate in dragnet fashion, scooping up information from a target device, as well as other wireless devices in the vicinity. In addition, these devices can be configured to capture the content of voice and data communications. StingRay technology is sold by the Harris Corporation. Other Harris cell site simulator models include the TriggerFish, KingFish, and Hailstorm. The more generic term for the technology is IMSI catcher, in reference to the unique identifier or international mobile subscriber identity of a wireless device. The equipment consists of an antenna, an electronic device that processes the signals transmitted on cell phone frequencies and a laptop computer that analyzes the signals and allows the agent to configure the collection of information. It can be carried by hand or mounted on vehicles or even drones. If the government knows a suspect s location, it can use the device to determine the unique numeric identifier associated with that cell phone The IMSI catcher needs to be taken to a particular location in order to find or monitor devices at that location. Toolbox Page 3 of 13

4 Constitutional Concerns First, use of an IMSI catcher triggers Fourth Amendment scrutiny because it constitutes both a search and a seizure within the meaning of the Fourth Amendment. Second, there is a strong argument that IMSI catchers can never be used consistent with the Fourth Amendment because they engage in the electronic equivalent of a general search. Third, law enforcement must at least obtain a warrant; a statutory order does not suffice. Fourth, even if law enforcement obtained a warrant, it is likely invalid because the data obtained through stingrays may not be disclosed to the defense, because the federal government contends that stingrays are a secret national security technology, and (2) that the orders authorizing the use of stingrays may be sealed, in some cases effectively permanently. Toolbox Page 4 of 13

5 Constitutional Concerns The government s omission of information about new surveillance technology from a warrant application prevents courts from exercising their constitutional oversight and would render a warrant invalid. A warrant that fails to disclose the government s intended use of an IMSI catcher is predicated on a material omission. Currently there is no reliable defense against IMSI catchers A defendant is entitled to a Franks hearing. A warrant that accurately describes the IMSI catcher s capabilities would be facially invalid. Toolbox Page 5 of 13

6 WI-FI/BLUETOOTH TRACKING These signals are transmitted with less power than a mobile signal and can normally be received only within a short range (such as within the same room or the same building), although sometimes using a sophisticated antenna allows these signals to be detected from unexpectedly long distances. MAC Address Both of these kinds of wireless signals include a unique serial number for the device, called a MAC address, which can be seen by anybody who can receive the signal. The device manufacturer chooses this address at the time the device is created and it cannot be changed. MAC address can be observed in wireless signals even if a device is not actively connected to a particular wireless network Unfortunately, the MAC address can be observed in wireless signals even if a device is not actively connected to a particular wireless network, or even if it is not actively transmitting data. Whenever Wi-Fi is turned on on a typical smartphone, the smartphone will transmit occasional signals that include the MAC address and thus let others nearby recognize that that particular device is present. Accuracy These forms of tracking can be a highly accurate way to tell when a person enters and leaves a building due to the limited range. Wi-Fi network operators can also see the MAC address of every device that joins their network, which means that they can recognize particular devices over time, and tell whether you are the same person who joined the network in the past (even if you don't type your name or address anywhere or sign in to any services). Toolbox Page 6 of 13

7 LOCATION INFORMATION FROM APPS AND WEB BROWSING Modern smartphones provide ways for the phone to determine its own location, often using GPS and sometimes using other services provided by location companies (which usually ask the company to guess the phone's location based on a list of cell phone towers and/or Wi-Fi networks that the phone can see from where it is). Apps can ask the phone for this location information and use it to provide services that are based on location, such as maps that show you your position on the map. Some of these apps will then transmit your location over the network to a service provider, which, in turn, provides a way for other people to track you. Some smartphones will give you some kind of control over whether apps can find out your physical location; a good privacy practice is to try to restrict which apps can see this information, and at a minimum to make sure that your location is only shared with apps that you trust and that have a good reason to know where you are. Co-Traveler The Washington Post reported in December 2013 on NSA location-tracking tools that collect massive amounts of information on the whereabouts of cell phones around the world, mainly by tapping phone companies' infrastructure to observe which towers particular phones connect to. A tool called CO-TRAVELER uses this data to find relationships between different people's movements (to figure out which people's devices seem to be traveling together, as well as whether one person appears to be following another). Co-Traveler uses this data to find relationships between different people's movements Toolbox Page 7 of 13

8 GLOBAL POSITIONING SYSTEM GPS The Global Positioning System (GPS) lets devices anywhere in the world figure out their own locations quickly and accurately. GPS works based on analyzing signals from satellites that are operated by the U.S. government as a public service for everyone. The GPS satellites only transmit signals. The satellites do not receive or observe anything from your phone, and the satellites and GPS system operators do not know where any particular user or device is located or even how many people are using the system. This is possible because the individual GPS receivers (like those inside smart phones) calculate their own positions by determining how long it took the radio signals from different satellites to arrive. Toolbox Page 8 of 13

9 Usually, this tracking is done by apps running on a Smartphone. They ask the phone's operating system for its location (determined via GPS). Then the apps are able to transmit this information to someone else over the Internet. There are also tiny GPS-receiving devices that can be surreptitiously hidden in someone's possessions or attached to a vehicle; those receivers determine their own location and then actively retransmit it over a network, usually the mobile phone network. In a landmark 2012 decision, the court held that GPS tracking is a search under the Fourth Amendment. Toolbox Page 9 of 13

10 MALWARE Phones can get viruses and other kinds of malware (malicious software), either because the user was tricked into installing malicious software, or because someone was able to hack into the device using a security flaw in the existing device software. As with other kinds of computing device, the malicious software can then spy on the device's user. Malware can read private data and activate the device's sensors. For example, malicious software on a mobile phone could read private data on the device (like stored text messages or photos). It could also activate the device's sensors (such as microphone, camera, GPS) to find where the phone is or to monitor the environment, even turning the phone into a bug. A further concern is that malicious software could theoretically make a phone pretend to power off, while secretly remaining turned on (and showing a black screen, so that the user wrongly believes that the phone is turned off). This concern has led to some people physically removing the batteries from their devices when having very sensitive conversations. Precautions based on powering off phones could be noticed by a mobile operator; for example, if ten people all travel to the same building and then all switch off their phones at the same time, the mobile operator, or somebody examining its records, might conclude that those people were all at the same meeting and that the participants regarded it as sensitive. This would be harder to detect if the participants had instead left their phones at home or at the office. Toolbox Page 10 of 13

11 HISTORIC CALL DETAIL RECORDS Carrier based location data is collected by obtaining historical call detail records for a particular phone from the cellular carrier along with a listing of the cell tower locations for that carrier. This data is then analyzed for the purpose of generally placing a cell phone in a location on a map. Often historical cell site records only indicate the date, time and duration of calls, whether calls are inbound or outbound, and show the originating and terminating cell sites for calls received or placed on the phone. Usually, cellular companies record the cell site to which a phone connects for benign purposes, such as determining whether roaming charges apply and tracking call volume by location. Recently, however, law enforcement has begun using cell site data to track the location of cell phones. Traditional view of cell site location information has been (1) that the subscriber has no privacy interest in it, because it is voluntarily shared with the service provider in the course of using cell phone service; These records can only narrow location to the geographic coverage area of the originating and terminating cell sites. (2) that law enforcement access to such information is therefore regulated principally by the Stored Communications Act, 18 U.S.C et seq., rather than the Fourth Amendment; and (3) that because location data are non-content records, they are available under the SCA through a court order based on a showing of specific facts providing reasonable grounds to believe that the data are relevant and material to a criminal investigation. See 18 U.S.C. 2703(c)-(d). Toolbox Page 11 of 13

12 At best, these records can only narrow location to the geographic coverage area of the originating and terminating cell sites, rather than pinpoint the specific location of the cell phone. It cannot be determined that the cell phone was closest to the site processing the call because factors other than geographic location can affect signal strength. A better theory on which to offer historical cell site data is not to prove where the phone user was at a specific time, but to prove where he or she could not have been. Reliability of principles and methodology even if an expert is qualified, a party can still object to the reliability of methods used by the expert to draw conclusions. Toolbox Page 12 of 13

13 At least two federal courts have held Daubert hearings to assess the reliability and relevance of expert testimony based on historical cell site interpretation 1. Procedural Issues - A party against whom cell site evidence is offered should consider bringing a motion in limine to exclude it on grounds of admissibility. 2. Otherwise, a party should timely raise an objection at trial on Daubert grounds to preserve the right to object to scientific or technical evidence and preserve the issue on appeal. There are no published set of principles or methods governing the estimation of cell site coverage area. Digital Evidence Toolbox For more information regarding location information and call detail records, see the section: Call Detail Records For more information on social media and internet evidence, call now and speak with a certified expert. is available 24 hours in emergency cases. Toolbox Page 13 of 13