Google Hands Feds 1,500 Phone Locations In Unprecedented ‘Geofence’ Search
Google keeps historical locations of users, and police are taking advantage to find all kinds of criminals. ALEXANDER POHL/NURPHOTO VIA GETTY IMAGES
Two dead dogs and more than $50,000 in damaged property were just some of the casualties of arsons carried out across Milwaukee, Wisconsin, throughout 2018 and 2019.
To find the perpetrators, officers from the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) demanded Google supply records of user devices in the respective locations at the times the arsons took place, Forbes has learned. Though federal agents had used the technique before, they’d never received such a data haul back from Google.
The requests, outlined in two search warrants obtained by Forbes, demanded to know which specific Google customers were located in areas covering 29,387 square meters (or 3 hectares) during a total of nine hours for the four separate incidents. Unbeknownst to many Google users, if they have “location history” turned on, their whereabouts are stored by the tech giant in a database called SensorVault.
In this case, Google found 1,494 device identifiers in SensorVault, sending them to the ATF to comb through. In terms of numbers, that’s unprecedented for this form of search. It illustrates how Google can pinpoint a large number of mobile phones in a brief period of time and hand over that information to the government. Previous Forbes reporting has shown searches across far wider areas.
To investigators, this kind of “geofence” demand is useful, allowing them to go through the data trove provided by Google, look for devices of interest such as a known suspect’s phone and ask for more personal information on the user of that mobile.
Privacy concerns
But it’s also the kind of search that’s been making pro-privacy folk anxious over the last year. Such data grabs, also referred to as “reverse location searches,” see the police give Google a timeframe and an area on Google Maps within which to find every Google user within. Google then looks through its SensorVault database of user locations, taken from devices running the tech giant’s services like Google Maps or anything that requires the “location history” feature be turned on. The police then look through the list, decide which devices are of interest to the investigation and ask for subscriber information that includes more detailed data such as name, email address, when they signed up to Google services and which ones they used.
It’s unclear whether or not Google handed over any identifying information, but to Jerome Greco, a public defender in the Digital Forensics Unit of the Legal Aid Society, it’s a sign that geofence warrants are overly broad and endanger user privacy.
“The number of phones identified in that area shows two key points,” he tells Forbes. “One, it demonstrates a sample of how many people’s minute-by-minute movements Google is precisely tracking.
“Two, it shows the unconstitutional nature of reverse location search warrants because they inherently invade the privacy of numerous people, who everyone agrees are unconnected to the crime being investigated, for the mere possibility that it may help identify a suspect.”
The ATF, which filed the search warrants in Wisconsin, said it couldn’t comment on ongoing investigations. Neither of the two suspects named in the warrants have been charged in federal court at the time of publication. As for its use of Google geofence searches, a spokesperson said: “To ensure the safety of our special agents and other law enforcement partners with whom we work, ATF does not release information regarding certain law enforcement techniques to the public.”
Richard Salgado, Google director of law enforcement and information security, said the company had processes to look through government requests and ensure customer privacy was protected. “We only produce information that identifies specific users when we are legally required to do so,” said Salgado.
A bank heist investigation
Forbes obtained another search warrant that indicates Google is trying to fight back against overly broad government requests, but still appears to be handing over innocent people’s information as well as legitimate suspect data.
In another a previously unknown geofence search, federal officers wanted Google to share information on devices in the vicinity of a bank robbery in Allenton, Wisconsin, in April this year. Initially, Google deemed the area the government wanted it to search too wide. By pushing back, Google convinced investigators to reduce the search area from a 400 meter radius, to 50 meters.
Google then returned phone identifiers for six devices. The government asked for personal details of the individual users for all six, which the tech giant duly provided, including name, email and other Google account use data. Only two suspects, who are currently awaiting trial for that robbery and two others in the state, have been named, indicating innocents’ personal data was disclosed.
Guilty until proven innocent?
That geofence warrants scoop up innocents’ data has now been proven beyond doubt. In one previous case detailed by the New York Times an innocent man was falsely imprisoned for a week, in part because of the data provided by Google.
But Orin Kerr, a professor at Berkeley Law, says that use of innocents’ information is going to be inherent in investigations. Video footage of bank robberies, for instance, will contain images of innocents there at the time, Kerr adds. “Presumably, most people who are on that video are innocent.”
If you’re concerned about being caught up in any dragnet, it’s possible to opt out of Google’s historic location database. To do this, users can go to their My Activity page in their Google account and click on Activity Controls. From there, you can toggle the location history feature off.
