Jennifer Valentino-DeVries

The requests, which the FBI says are critical to its counterterrorism efforts, have raised privacy concerns for years but have been associated mainly with tech companies. Now, records show how far beyond Silicon Valley the practice extends — encompassing scores of banks, credit agencies, cellphone carriers and even universities.

The demands can scoop up a variety of information, including usernames, locations, IP addresses and records of purchases. They don’t require a judge’s approval and usually come with a gag order, leaving them shrouded in secrecy. Fewer than 20 entities, most of them tech companies, have ever revealed that they’ve received the subpoenas, known as national security letters.

The documents, obtained by the Electronic Frontier Foundation through a Freedom of Information Act lawsuit and shared with The New York Times, shed light on the scope of the demands — more than 120 companies and other entities were included in the filing — and raise questions about the effectiveness of a 2015 law that was intended to increase transparency around them.

“This is a pretty potent authority for the government,” said Stephen Vladeck, a law professor at the University of Texas who specializes in national security. “The question is: Do we have a right to know when the government is collecting information on us?”

The documents provide information on about 750 of the subpoenas — representing a small but telling fraction of the half-million issued since 2001, when the Patriot Act expanded their powers.

The credit agencies Equifax, Experian and TransUnion received a large number of the letters in the filing. So did financial institutions like Bank of America, Western Union and even the Federal Reserve Bank of New York. All declined to explain how they handle the letters. An array of other entities received smaller numbers of requests — including Kansas State University and the University of Alabama at Birmingham, probably because of their role in providing internet service.

Other companies included major cellular providers such as AT&amp;T; and Verizon, as well as tech giants like Google and Facebook, which have acknowledged receiving the letters in the past.

Albert Gidari, a lawyer who long represented tech and telecommunications companies and is now the privacy director at Stanford’s Center for Internet and Society, said Silicon Valley had been associated with the subpoenas because it was more willing than other industries to fight the gag orders. “Telecoms and financial institutions get little attention,” he said, even though the law specifically says they are fair game.

The FBI determined that information on the roughly 750 letters could be disclosed under a 2015 law, the USA Freedom Act, that requires the government to review the secrecy orders “at appropriate intervals.”

The Justice Department’s interpretation of those instructions has left many letters secret indefinitely. Department guidelines say the gag orders must be evaluated three years after an investigation starts and also when an investigation is closed. But a federal judge noted “several large loopholes,” suggesting that “a large swath” of gag orders might never be reviewed.

According to the new documents, the FBI evaluated 11,874 orders between early 2016, when the rules went into effect, and September 2017, when the Electronic Frontier Foundation, a digital rights group, requested the information.

“We are not sure the FBI is taking its obligations under USA Freedom seriously,” said Andrew Crocker, a lawyer with the foundation. “There still is a huge problem with permanent gag orders.”

The Justice Department declined to comment.

National security letters, which the FBI has issued since the 1980s, have long been a point of contention in the debate over privacy and security. Initially, the bureau had to show “specific and articulable facts” indicating that the target was an agent of a foreign power. Now, the FBI must certify that the information is “relevant” to a terrorism, counterintelligence or leak investigation.

“NSLs are an indispensable investigative tool,” the Justice Department argued in the Freedom of Information Act case. The department has said in legal documents that the information gleaned from the letters is important to identifying subjects and their associates, while helping to clear the innocent of suspicion.

According to a 2007 report from the Justice Department inspector general, the FBI didn’t track how often information from the letters was used in criminal proceedings. But the report also said the letters had led to guilty pleas for arms trading, at least one conviction for material support of terrorism, and multiple charges of fraud and money laundering. The tool was also cited in efforts to investigate Russian meddling in the 2016 election.

Much of the concern about the letters has focused on the gag orders, which accompany nearly every request and prevent the recipient — typically indefinitely — from disclosing even the existence of the letter. The federal government has argued that the secrecy is necessary to avoid alerting targets, giving would-be terrorists clues about how the government conducts its surveillance or hurting diplomatic relations.

After a series of court rulings found that the gag orders violated First Amendment protections, Congress enacted the review requirements.

The documents obtained through the lawsuit include the number of orders reviewed, as well as redacted copies of 751 letters from the FBI informing companies and organizations their gag orders had been lifted. These so-called termination letters do not reveal the contents of the original national security letters, but indicate which entities received them.

Because so few gag orders have been reviewed and rescinded, it isn’t possible to say whether the companies that received the most termination letters also received the most national security letters. But given the overall secrecy around the program, the termination letters offer a rare glimpse into these subpoenas.

Equifax, Experian and AT&amp;T; received the most termination letters: more than 50 each. TransUnion, T-Mobile and Verizon each received more than 40. Yahoo, Google and Microsoft got more than 20 apiece. Over 60 companies received just one.

The underlying national security letters were not included in the documents, and it is unclear when most of them were issued and who the individual targets were.

Tech companies have disclosed more information about the letters they received than the major phone providers, which included general information about them in transparency reports.

“We have fought for the right to be transparent about our receipt” of national security letters, Richard Salgado, Google’s director of law enforcement and information security, said in a 2016 statement explaining why the company was releasing the subpoenas. “Our goal in doing so is to shed more light on the nature and scope” of the requests, he added.

Other companies have generally remained mum. In response to inquiries, a TransUnion spokesman would say only that the company “has not disclosed the receipt of any national security letters.” An spokesman for Equifax said it was “compliant with the national security letters process.”

Gidari, the former tech lawyer, attributed some of that lack of reporting to differences in company culture, noting that tech firms were more predisposed to openness, and financial institutions less likely to discuss any outside access to customer data. And most small companies, he said, don’t have the resources to keep long-term track of or challenge the subpoenas.

“That’s the problem with the Freedom Act: It procedurally pretended to solve the problem,” he said. “But the whole structure of this involves presumption in favor of the government for perpetual sealing.”

This article originally appeared in

Secret FBI Subpoenas Scoop Up Personal Data From Scores of Companies

The FBI has used secret subpoenas to obtain personal data from far more companies than previously disclosed, newly released documents show.

Though the new technique can identify suspects near crimes, it runs the risk of sweeping up innocent bystanders, highlighting the impact that companies’ mass collection of data can have on people’s lives.

Why does Google have this data?

The Sensorvault database is connected to a Google service called Location History. The feature, begun in 2009, involves Android and Apple devices.

Location History is not on by default. Google prompts users to enable it when they are setting up certain services — traffic alerts in Google Maps, for example, or group images tied to location in Google Photos.

If you have Location History turned on, Google will collect your data as long as you are signed in to your account and have location-enabled Google apps on your phone. The company can collect the data even when you are not using your apps, if your phone settings allow that.

Google says it uses the data to target ads and measure how effective they are — checking, for instance, when people go into an advertiser’s store. The company also uses the information in an aggregated, anonymized form to figure out when stores are busy and to provide traffic estimates. And those who enable Location History can see a timeline of their activities and get recommendations based on where they have been. Google says it does not sell or share the data with advertisers or other companies.

Does Google collect other forms of location data?

Yes. Google can also gather location information when you conduct searches or use Google apps that have location enabled. If you are signed in, this data is associated with your account.

The Associated Press reported last year that this data, called Web &amp; App Activity, is collected even if you do not have Location History turned on. It is kept in a different database from Sensorvault, Google says.

How can I see what data Google has on me?

To see some of the information in your Location History, you can look at your timeline. This map of your travels does not include all of your Sensorvault data, however.

Raw location data from mobile devices can be messy and sometimes incorrect. But computers can make good guesses about your likely path and about which locations are most important. This is what you see on your timeline. To review all of your Location History, you can download your data from Google. To do that, go to Takeout.Google.com and select Location History. You can follow a similar procedure to download your Web &amp; App Activity on that page.

Your Location History data will appear in computer code. If you can’t read code, you can select the “JSON” format and put the file into a text editor to see what it looks like.

Can I disable the data collection?

Yes. The process varies depending on whether you are on a phone or computer. In its Help Center, Google provides instructions on disabling or deleting Location History and Web &amp; App Activity.

How is law enforcement using the data?

For years, police detectives have given Google warrants seeking location data tied to specific users’ accounts.

But the new warrants, often called “geofence” requests, instead specify an area near a crime. Google looks in Sensorvault for any devices that were there at the right time and provides that information to the police.

Google first labels the devices with anonymous ID numbers, and detectives look at locations and movement patterns to see if any appear relevant to the crime. Once they narrow the field to a few devices, Google reveals information such as names and email addresses.

This article originally appeared in <a href="https://www.nytimes.com/2019/04/13/technology/google-sensorvault-location-tracking.html" id="7e9d66c4-015b-33ac-ad39-f8bb4854919e">The New York Times</a>.

Google's Sensorvault Is a Boon for Law Enforcement. This Is How It Works.

Law enforcement officials across the country have been seeking information from a Google database called Sensorvault — a trove of detailed location records involving at least hundreds of millions of devices worldwide, The New York Times found.

The police told the suspect, Jorge Molina, they had data tracking his phone to the site where a man was shot nine months earlier. They had made the discovery after obtaining a search warrant that required Google to provide information on all devices it recorded near the killing, potentially capturing the whereabouts of anyone in the area.

Investigators also had other circumstantial evidence, including security video of someone firing a gun from a white Honda Civic, the same model that Molina owned, though they could not see the license plate or attacker.

But after he spent nearly a week in jail, the case against Molina fell apart as investigators learned new information and released him. Last month, the police arrested another man: his mother’s ex-boyfriend, who had sometimes used Molina’s car.

The warrants, which draw on an enormous Google database employees call Sensorvault, turn the business of tracking cellphone users’ locations into a digital dragnet for law enforcement. In an era of ubiquitous data gathering by tech companies, it is just the latest example of how personal information — where you go, who your friends are, what you read, eat and watch, and when you do it — is being used for purposes many people never expected. As privacy concerns have mounted among consumers, policymakers and regulators, tech companies have come under intensifying scrutiny over their data collection practices.

The Arizona case demonstrates the promise and perils of the new investigative technique, whose use has risen sharply in the past six months, according to Google employees familiar with the requests. It can help solve crimes. But it can also snare innocent people.

Technology companies have for years responded to court orders for specific users’ information. The new warrants go further, suggesting possible suspects and witnesses in the absence of other clues. Often, Google employees said, the company responds to a single warrant with location information on dozens or hundreds of devices.

Law enforcement officials described the method as exciting, but cautioned that it was just one tool.

“It doesn’t pop out the answer like a ticker tape, saying this guy’s guilty,” said Gary Ernsdorff, a senior prosecutor in Washington state who has worked on several cases involving these warrants. Potential suspects must still be fully investigated, he added. “We’re not going to charge anybody just because Google said they were there.”

It is unclear how often these search requests have led to arrests or convictions, because many of the investigations are still open and judges frequently seal the warrants. The practice was first used by federal agents in 2016, according to Google employees, and first publicly reported last year in North Carolina. It has since spread to local departments across the country, including in California, Florida, Minnesota and Washington. This year, one Google employee said, the company received as many as 180 requests in one week. Google declined to confirm precise numbers.

The technique illustrates a phenomenon privacy advocates have long referred to as the “if you build it, they will come” principle — anytime a technology company creates a system that could be used in surveillance, law enforcement inevitably comes knocking. Sensorvault, according to Google employees, includes detailed location records involving at least hundreds of millions of devices worldwide and dating back nearly a decade.

The new orders, sometimes called “geofence” warrants, specify an area and a time period, and Google gathers information from Sensorvault about the devices that were there. It labels them with anonymous ID numbers, and detectives look at locations and movement patterns to see if any appear relevant to the crime. Once they narrow the field to a few devices they think belong to suspects or witnesses, Google reveals the users’ names and other information.

‘‘There are privacy concerns that we all have with our phones being tracked — and when those kinds of issues are relevant in a criminal case, that should give everybody serious pause,” said Catherine Turner, a Minnesota defense lawyer who is handling a case involving the technique.

Investigators who spoke with The New York Times said they had not sent geofence warrants to companies other than Google, and Apple said it did not have the ability to perform those searches. Google would not provide details on Sensorvault, but Aaron Edens, an intelligence analyst with the sheriff’s office in San Mateo County, California, who has examined data from hundreds of phones, said most Android devices and some iPhones he had seen had this data available from Google.

In a statement, Richard Salgado, Google’s director of law enforcement and information security, said that the company tried to “vigorously protect the privacy of our users while supporting the important work of law enforcement.” He added that it handed over identifying information only “where legally required.”

Molina, 24, said he was shocked when the police told him they suspected him of murder, and he was surprised at their ability to arrest him based largely on data.

“I just kept thinking, You’re innocent, so you’re going to get out,” he said, but he added that he worried that it could take months or years to be exonerated. “I was scared,” he said.

While Molina was in jail, a friend told his public defender, Jack Litwak, that she was with him at his home about the time of the shooting, and she and others provided texts and Uber receipts to bolster his case.

Months after his release, Molina was having trouble getting back on his feet. After being arrested at work, a Macy’s warehouse, he lost his job. His car was impounded for investigation and then repossessed.

The investigators “had good intentions” in using the technique, Litwak said. But, he added, “they’re hyping it up to be this new DNA type of forensic evidence, and it’s just not.”

This article originally appeared in <a href="https://www.nytimes.com/2019/04/12/us/google-location-tracking-police.html" id="72c1ece5-dd7f-33f6-a7df-31c6c9ba2a7c">The New York Times</a>.

Tracking Phones, Google Is a Dragnet for the Police

When detectives in a Phoenix suburb arrested a warehouse worker in a homicide investigation last December, they credited a new technique with breaking open the case after other leads went cold.

A Novel Approach

Detectives have used the warrants for help with robberies, sexual assaults, arsons and murders. Last year, federal agents requested the data to investigate a string of bombings around Austin, Texas.

Austin investigators obtained another warrant after a fourth bomb exploded. But the suspect killed himself three days after that bomb, as they were closing in. Officials at the time said surveillance video and receipts for suspicious purchases helped identify him.

An FBI spokeswoman declined to comment on whether the response from Google was helpful or timely, saying any question about the technique “touches on areas we don’t discuss.”

Officers who have used the warrants said they showed promise in finding suspects as well as witnesses who may have been near the crime without realizing it. The searches may also be valuable in cold cases. A warrant last year in Florida, for example, sought information on a homicide from 2016. A Florida Department of Law Enforcement spokeswoman declined to comment on whether the data was helpful.

The approach has yielded useful information even if it wasn’t what broke the case open, investigators said. In a home invasion in Minnesota, for example, Google data showed a phone taking the path of the likely intruder, according to a news report and police documents. But detectives also cited other leads, including a confidential informant, in developing suspects. Four people were charged in federal court.

According to several current and former Google employees, the Sensorvault database was not designed for the needs of law enforcement, raising questions about its accuracy in some situations.

Though Google’s data cache is enormous, it doesn’t sweep up every phone, said Edens, the California intelligence analyst. And even if a location is recorded every few minutes, that may not coincide with a shooting or an assault.

Google often doesn’t provide information right away, investigators said. The Google unit handling the requests has struggled to keep up, so it can take weeks or months for a response. In the Arizona investigation, police received data six months after sending the warrant. In a different Minnesota case this fall, it came in four weeks.

But despite the drawbacks, detectives noted how precise the data was and how it was collected even when people weren’t making calls or using apps — both improvements over tracking that relies on cell towers.

“It shows the whole pattern of life,” said Mark Bruley, the deputy police chief in Brooklyn Park, Minnesota, where investigators have been using the technique since this fall. “That’s the game changer for law enforcement.”

A Trove of Data

Location data is a lucrative business — and Google is by far the biggest player, propelled largely by its Android phones. It uses the data to power advertising tailored to a person’s location, part of a more than $20 billion market for location-based ads last year.

In 2009, the company introduced Location History, a feature for users who wanted to see where they had been. Sensorvault stores information on anyone who has opted in, allowing regular collection of data from GPS signals, cellphone towers, nearby Wi-Fi devices and Bluetooth beacons.

People who turn on the feature can see a timeline of their activity and get recommendations based on it. Google apps prompt users to enable Location History for things like traffic alerts. Information in the database is held indefinitely, unless the user deletes it.

“We citizens are giving this stuff away,” said Ernsdorff, the Washington state prosecutor, adding that if companies were collecting data, law enforcement should be able to obtain a court order to use it.

Current and former Google employees said they were surprised by the warrants. Brian McClendon, who led the development of Google Maps and related products until 2015, said he and other engineers had assumed the police would seek data only on specific people. The new technique, he said, “seems like a fishing expedition.”

Uncharted Legal Territory

The practice raises novel legal issues, according to Orin Kerr, a law professor at the University of Southern California and an expert on criminal law in the digital age.

One concern: the privacy of innocent people scooped up in these searches. Several law enforcement officials said the information remained sealed in their jurisdictions but not in every state.

In Minnesota, for example, the name of an innocent man was released to a local journalist after it became part of the police record. Investigators had his information because he was within 170 feet of a burglary. Reached by a reporter, the man said he was surprised about the release of his data and thought he might have appeared because he was a cabdriver. “I drive everywhere,” he said.

These searches also raise constitutional questions. The Fourth Amendment says a warrant must request a limited search and establish probable cause that evidence related to a crime will be found.

Warrants reviewed by The Times frequently established probable cause by explaining that most Americans owned cellphones and that Google held location data on many of these phones. The areas they targeted ranged from single buildings to multiple blocks, and most sought data over a few hours. In the Austin case, warrants covered several dozen houses around each bombing location, for times ranging from 12 hours to a week. It wasn’t clear whether Google responded to all the requests, and multiple officials said they had seen the company push back on broad searches.

Last year, the Supreme Court ruled that a warrant was required for historical data about a person’s cellphone location over weeks, but the court has not ruled on anything like geofence searches, including a technique that pulls information on all phones registered to a cell tower.

Google’s legal staff decided even before the 2018 ruling that the company would require warrants for location inquiries, and it crafted the procedure that first reveals only anonymous data.

“Normally we think of the judiciary as being the overseer, but as the technology has gotten more complex, courts have had a harder and harder time playing that role,” said Jennifer Granick, surveillance and cybersecurity counsel at the American Civil Liberties Union. “We’re depending on companies to be the intermediary between people and the government.”

In several cases reviewed by The Times, a judge approved the entire procedure in a single warrant, relying on investigators’ assurances that they would seek data for only the most relevant devices. Google responds to those orders, but Kerr said it was unclear whether multistep warrants should pass legal muster.

Some jurisdictions require investigators to return to a judge and obtain a second warrant before getting identifying information. With another warrant, investigators can obtain more extensive data, including months of location patterns and even emails.

Mixed Results

Investigators in Arizona have never publicly disclosed a likely motive in the killing of Joseph Knight, the crime for which Molina was arrested. In a court document, they described Knight, a 29-year-old aircraft repair company employee, as having no known history of drug use or gang activity.

Detectives sent the geofence warrant to Google soon after the homicide and received data from four devices months later. One device, a phone Google said was linked to Molina’s account, appeared to follow the path of the gunman’s car as seen on video. His carrier also said the phone was associated with a tower in roughly the same area, and his Google history showed a search about local shootings the day after the attack.

After his arrest, Molina told officers that Marcos Gaeta, his mother’s ex-boyfriend, had sometimes taken his car. The Times found a traffic ticket showing that Gaeta, 38, had driven that car without a license. Gaeta also had a lengthy criminal record.

While Molina was in jail, a friend told his public defender, Jack Litwak, that she was with him at his home about the time of the shooting, and she and others provided texts and Uber receipts to bolster his case. His home, where he lives with his mother and three siblings, is about 2 miles from the homicide scene.

Litwak said his investigation found that Molina had sometimes signed in to other people’s phones to check his Google account. That could lead someone to appear in two places at once, though it was not clear whether that happened in this case.

Gaeta was arrested in California on an Arizona warrant. He was then charged in a separate California homicide from 2016. Officials said that case would probably delay his extradition to Arizona.

A police spokesman said “new information came to light” after Molina’s arrest, but the department would not comment further.

Politics

Local

World

News

Celebrities

Music

Movies

Entertainment

Sports 

Fashion

Beauty & Health

Relationships & Weddings

Food & Travel

Lifestyle

Domestic

International 

Business

Explore categories

Checkout our authors for the latest content across entertainment, sports, business and more. Be first to receive exclusive updates with your free subscription straight to your phone |  Pulse Uganda

Authors | Pulse Uganda

| Pulse Uganda

Read the latest news across entertainment, sports, business and more. Be first to receive exclusive updates with your free subscription straight to your phone | Pulse Uganda

Breaking News & Top Stories | Pulse Uganda

Read the latest news across entertainment, sports, business and more. Be first to receive exclusive updates with your free subscription straight to your phone. 

Pulse Uganda

Search for the latest content across entertainment, sports, business and more. Be first to receive exclusive updates with your free subscription straight to your phone | Pulse Uganda

Search Results | Pulse Uganda

Watch the latest videos across entertainment, sports, business and more. Be first to receive exclusive updates with your free subscription straight to your phone | Pulse Uganda

Jennifer Valentino-DeVries

Articles written by the author

Secret FBI Subpoenas Scoop Up Personal Data From Scores of Companies

Google's Sensorvault Is a Boon for Law Enforcement. This Is How It Works.

Tracking Phones, Google Is a Dragnet for the Police

Tracking Phones, Google Is a Dragnet for the Police