Watchdog questions legality of using cellphone data without warrants

/in /by

Mon. Feb. 22, 2021 |By Chris Mills Rodrigo – The Hill |

Law enforcement agencies may be on shaky legal ground when purchasing cell phone location data without a warrant, according to a new Treasury Department watchdog report.

The agency’s inspector general said in the report reviewing the Internal Revenue Service’s use of a commercial platform, Venntel, to track devices that a 2018 Supreme Court case may block warrantless tracking using data from apps.

The Carpenter v. United States case holds that warrants must be obtained by law enforcement to get data from wireless carriers, and many government lawyers have argued that it does not apply to GPS data taken from apps.

The watchdog’s report, which came at the request of Sens. Ron Wyden (D-Ore.) and Elizabeth Warren (D-Mass.), suggests that that interpretation is flawed.

“I appreciate the IRS has committed to follow the recommendations of the inspector general and ensure any future warrantless surveillance is subject to a formal review by lawyers at IRS headquarters,” Wyden said in a statement to The Hill. “But I’m troubled agency lawyers were so cavalier about American’s privacy rights that they green-lit the warrantless purchase of location data with such minimal legal analysis. This shows again that Americans need strong new laws protecting our 4th Amendment rights to ensure government credit cards don’t replace court orders.”

The Wall Street Journal reported on the IRS inspector general report.

The IRS used Venntel’s services as an investigative tool starting in 2017 but ended the practice a year later.

The agency’s lawyers had argued “that data obtained from marketers of information like Venntel is not subject to a warrant because the data is collected by apps loaded on cellphones to which the phone users voluntarily granted access,” the watchdog report found.

The Supreme Court rejected a similar argument about location data compiled by wireless carriers in its Carpenter decision.

“The court’s rationale was that phone users do not truly voluntarily agree to share the information given the necessity of phones in our society,” the IRS inspector general wrote in the report. “Courts may apply similar logic to GPS data sold by marketers.”

There has been a wave of recent revelations that the government is buying cell phone location data collected by apps without warrants.

The Defense Intelligence Agency revealed in a memo made public last month that it accessed American location data five times in the past 2.5 years.

The Department of Homeland Security and Federal Bureau of Investigation have reportedly made similar purchases.

Read the full story here.

Ninth Circuit Considers Privacy Settlement Over Google Street View

/in /by

Thurs. Feb. 11, 2021 |By Maria Dinzo – Courthouse News|

The Ninth Circuit will likely uphold an award of $13 million against Google over data collected by Street View cars, while a federal judge ruled Thursday that cellphone users can pursue privacy claims related to location tracking through mobile apps.

SAN FRANCISCO (CN) — A Ninth Circuit panel signaled a strong reluctance to overturn a settlement that pays no direct money to Google users whose private data was swiped by Google’s Street View cars.

Nearly 10 years in the making, the $13 million settlement U.S. District Judge Charles Breyer approved last March gives $9 million to privacy rights groups, and forced Google to stop harvesting data through street-view vehicles.  Google also agreed to destroy all the data it collected and maintain websites to educate consumers about wireless security and data encryption. The rest of the settlement money went to attorneys’ fees and costs.

With a class numbering 60 million, Breyer reasoned that each would receive roughly 22 cents, and that is contingent on whether they could even be identified. Determining class membership would require sifting through 300 million frames of payload data acquired by Google and matching it to numbers on hardware that may no longer exist. The assumption is also that only 1% of the class will avail themselves of the 22 cent payment.

This type of settlement is known as cy pres, a French legal term meaning “as near as possible,” and is typically adopted when it is impractical to distribute money to a class. But one class member, musician David Lowery, still objected. He was joined by nine state attorneys general who filed an amicus brief claiming the settlement would unjustly require class members to “release their claims in exchange for nothing,” and mirrors relief 39 state attorneys general already obtained from Google under a separate agreement in 2013.

Class counsel Daniel Small of Cohen Milstein and Jeffrey Kodroff urged a three-judge panel of the Ninth Circuit panel to uphold the settlement at oral arguments Thursday. “Over 99 percent of the class is better off with the cy pres distribution, which gives them more real benefit,” Small said, adding that the settlement also extends by at least two years the terms Google agreed to in 2013.

Representing the objectors, attorney Adam Schulman with the Center for Class Action Fairness at the Hamilton Lincoln Law Institute said the settlement “drowns out meaningful class recovery” in favor of lesser recompense when class distribution becomes too burdensome.

“Payments to class members are categorically superior to cy pres payments,” he told the panel. “The cy pres option arises only if it isn’t possible to put the funds to the best use.”

“With this case there’s a problem with even trying to identify the class members,” U.S. Circuit Judge Morgan Christen, an Obama appointee, pointed out. “It’s going to be horrendously time consuming and expensive. There’s a strong record here that approach would have been very impractical and inefficient.”

Schulman said it wasn’t impossible, likening the case to Fraley v. Facebook, where U.S. District Judge Richard Seeborg ordered parties to go back to the drawing table on a settlement that offered no direct payments to nearly 125 million users who claimed their names and likenesses were used for promotional purposes without permission for a new ad feature called “Sponsored Stories.”

The revised settlement allowed users to apply for a cash payment of up to $10 each, to be paid from a $20 million settlement fund. It would award remaining funds cy pres to court-approved nonprofits.

Christen said Street View cases pose a unique set of difficulties, as it would be nearly impossible to link individuals to the data Google collected.

“I still don’t see how any of these folks can self identify,” she said.

“It’s almost certain it will cost more than 20 cents to distribute that money,” noted U.S. Circuit Judge Marsha Berzon, a Bill Clinton appointee. “If you’re trying to benefit the class as a whole, there’s no way to do it.”

She said the class members might actually prefer to see the $9 million “go to some useful purpose.”

In other Google news, a federal judge will allow cellphone users to pursue a privacy class action claiming the company secretly tracked and stored their location data without their consent.

The lawsuit alleges that mobile apps like Google Maps, Google Search and Google Hangouts continuously gather data on users, even when their location tracking is turned off, and even when users are not interacting with the apps.

“Google’s alleged collection and storage of location data creates a detailed and comprehensive record of a users’ individual movements over time,” U.S. District Judge Edward Davila wrote in a Thursday ruling that upheld users’ intrusion upon seclusion and constitutional right to privacy claims. “The court, therefore, finds that plaintiffs’ allegations that Google collected and stored comprehensive location data without plaintiffs’ consent are sufficient to show that plaintiffs had a reasonable expectation of privacy in the sum of that data.”

Davila also found they had stated a valid claim for unjust enrichment, though he dismissed their breach of contract claim since Google’s terms of service is non-binding, and merely explains how to adjust privacy settings.

Read the full story here.

Long Island Rail Road workers plead not guilty to overtime fraud

/in /by

Wed. Feb. 10, 2021 |By Stephen Rex Brown – New York Daily News|

They’ve been working on the rail road — or have they?

Five current and former Long Island Rail Road employees pleaded not guilty Wednesday to federal charges of claiming more than $1 million of overtime on taxpayers’ dime that they didn’t actually work.  The five high-ranking workers — Frank Pizzonia, Thomas Caputo, Joseph Ruzzo, John Nugent and Joseph Balestra — allegedly plotted to cover each others’ backs, explaining their fellow fraudsters’ absence should anyone ask questions.

Assistant U.S. Attorney Paul Montelioni said evidence in the case largely consisted of LIRR time card records documenting hours worked, along with cell site information showing the location of the accused overtime cheats’ cell phones.  Caputo, Ruzzo, Nugent and Balestra were arrested in December, along with NYC Transit worker Michael Gunderson, who was also charged with overtime fraud but was not included in Thursday’s conspiracy charges.

Last week, a fifth LIRR worker was added to the case, Frank Pizzonia, whose father was a Gambino hit man. In one egregious example, prosecutors say Caputo claimed he was working on Manhattan’s West Side when in reality he was participating in bowling league games on Long Island.  The busts — aided by investigators for the MTA’s inspector general — highlighted out-of-control expenses at the agency reeling from historic budget shortfalls due to the coronavirus expenses.

Read the full story here.

Colorado agent [and our very own Scott Eicher] details texts between Keslie Schelling and Donthe Lucas

/in /by

Monday, February 8, 2020 | by Zach Hillstrom – The Pueblo Chieftain |

The homicide trial of Donthe Lucas, accused of first-degree murder in the 2013 disappearance of his pregnant girlfriend, Kelsie Schelling, resumed Monday with the testimony of Colorado Bureau of Investigation Agent Kevin Torres.

Torres, continuing his testimony from Friday, began the fourth day of the trial by detailing alleged text exchanges between Lucas and Schelling on the night of Feb. 3 and the day of her disappearance Feb. 4, breaking them down minute-by-minute and hour-by-hour as the conversation unfolded.

The texts exchanged indicate Lucas and Schelling were constantly arguing throughout the night of Feb. 3, both in text and in short phone conversations in which Schelling seemed to continually hang up on Lucas.

Lucas appears to have asked Schelling to come down to Pueblo after she got off work the evening of Feb. 3, and expresses disappointment she will not drive down.

In the texts, Lucas implies Schelling had asked him to come to her OBGYN appointment the following day – the day of her disappearance – saying he wanted to go with her and noting it “seemed like” Schelling wanted him to go.

Schelling replied that she did want Lucas to accompany her to the doctor “until I realized that’s the last place you wanted to be.”

The argument between Schelling and Lucas, according to the exchanged texts as recounted by Torres, continued into the early morning hours of Feb. 4.

At 1:28 a.m., Schelling tells Lucas, “I won’t tell you anything about the baby. I won’t tell you about my appointment. We won’t speak of it again. Forget I’m pregnant, seriously.”

Just before 3 a.m., according to Torres’ testimony, Schelling texted Lucas, “You don’t have to be in a relationship with me. You don’t have to marry me. You don’t have to have a happy little family with me. You don’t have an obligation to me. You’re good. Don’t worry. Goodnight.”

Torres said Lucas replied, “Oh I know all of that …  thanks for stating it for me.”

Their argument continued through texts beyond 4 a.m.

Later that morning, Torres read texts from Schelling to Lucas that said, “I’m sorry for hanging up on you over and over. That was dumb and I apologize. I just get mad and I don’t want to fight with you. I love you very much and you know it. I’m sorry for hanging up on you … I truly am. Love you Donthe.”

Lucas and Schelling continue to exchange texts throughout the day of Feb. 4, beginning before her OBGYN appointment.

Schelling tells Lucas at 11:21 a.m. that she’s finished her appointment. He reportedly asks what the doctors told her and she replies that everything looked good and that her due date was Sept. 13.

Lucas, according to Torres’ recap of the text exchange, replied, “Cool,” then said he wished Schelling didn’t have to work that evening. He asks her to skip work and come to Pueblo to get him and they continue to argue.

Schelling tells Lucas, “I’m not going to come get you so we can fight all day.”

He responds: “I don’t want to fight at all I want to give you this.”

“Give me what?” Schelling asks.

“Just wait and see for yourself,” Lucas allegedly says in the texts.

“You probably wouldn’t believe me if I told you anyway so you can see for yourself.”

Lucas and Schelling seem to allude to a trip Lucas was planning on taking that day, seemingly to Kansas, on which he asked Schelling to accompany him.

Lucas tells her to, “Just stop wasting time and come.”

Schelling tells him she has responsibilities and can’t just skip work.

Torres detailed a text from Lucas to Schelling just before noon that said, “Um, yeah you can if you weren’t scared to get fired. I told you I’d give you everything you need when you get here so u don’t need that job.”

Schelling goes to work that evening and she and Lucas continue to argue over text.

Before 6 p.m., Torres said Schelling texted Lucas, “Then step up and make a relationship with me work. Stop acting like you can’t do it. Either make things work with me or walk away.”

“OK. I plan to make things work. Are you still coming (down to Pueblo) after work? I’m not going today,” Lucas allegedly responded.

Torres said texts showed Schelling eventually agreed to come to Pueblo. Former FBI agent and cellular software expert Scott Eicher testified Friday that cell phone records showed Schelling’s movements that night — her phone, Eicher said, left the area of her employment in Denver, traveled south on Interstate 25 and eventually arrived in Pueblo.

Schelling texted Lucas at 8:50 p.m., saying, “I’m coming now. So be ready.”

At 9:19 p.m., Schelling texts Lucas to say that she’s in Monument. At 9:56 p.m., she texts again, saying, “Almost there. Where do I go?”

Lucas, according to Torres, directs her to go to Walmart. She texts him at 10:20 p.m., saying she’s arrived and Lucas replies that he’ll be there shortly.

But at 11:10 p.m., Lucas had still not arrived at Walmart. At 11:14 p.m., he changes plans and tells Schelling to meet him, “where you usually do,” seemingly referring to an intersection near his grandmother’s home where Schelling had picked him up on previous occasions.

She texts him at 11:18 p.m., saying she has arrived at the meeting spot. She texts again at 11:24 p.m., saying “Where are you? I’ve been here for over an hour just waiting.”

Deputy District Attorney Kyle McCarthy then skipped ahead to the communications exchanged the following day and asked Torres to read from texts that allegedly were exchanged between Donthe Lucas and his mother, Sara Lucas.

At 11:29 a.m. on Feb. 5, Torres said Lucas texted his mother, “Going to make sure she didn’t leave anything in the house. Then you can take her back home.”

Sara Lucas allegedly responded: “What happened?” and, “Are you OK?” to which Lucas responded, “Yeah. Great now.”

Sara Lucas asked Donthe, “She’s not pregnant?”

He responded: “Nothing. Just had to make sure I was right. Apparently she had a miscarriage yesterday.”

“Oh my god,” Torres said Sara Lucas replied.

“All lies,” Donthe said.

“I’m 100 percent positive.”

“OK. Love you,” Sara Lucas said. “You ready for a smoke and a pancake?”

“Hell yeah. Lol,” Torres said Donthe replied. “Let me get her out of here. Love you, too.”

Around the same time, texts were also being exchanged from Lucas and Schelling’s phones.

“If it’s really what happened I’m so sorry you had to go through that alone,” Lucas said in a text to Schelling.

“Wish you would have told me you knew it was very likely to happen so I could be prepared. Didn’t expect to feel like this now.”

While this text was being sent, Torres said Schelling’s phone was pinging off of a cell tower within the area of Canon National Bank, where Donthe Lucas was seen on camera withdrawing $400 from Schelling’s bank account while driving her 2011 Chevy Cruze.

Torres said in the surveillance video showing the cash withdrawal, Schelling cannot be seen in the vehicle.

Shortly before noon, other texts are exchanged between Lucas and Schelling’s phones, which the prosecution alleges were not actually sent by Schelling.

Using cell phone data from Lucas and Schelling’s phones, the prosecution believes both phones were in the same location as the texts were being exchanged.

One text from Schelling’s phone to Lucas’ at 11:56 a.m., said “After u get that money pick me up and stay out of my life!”

Another, sent at 11:59 a.m., said, “You can bring my car to Denver tonight. I have to go to the doctor. I don’t feel right. You can use the money and fill the car up…”

round that time, Torres said, is when Schelling’s car was parked at the South Side Walmart, as evidenced by surveillance video of the parking lot. The car was moved from that location the following morning, then showed up at St. Mary-Corwin Medical Center Feb. 9.

At 1:10 p.m., Lucas texts Schelling, saying that he will drop off her vehicle and asks if he should, “leave the keys in the visor?”

At 1:34 p.m., Lucas sends another text saying, “sorry again about the loss,” telling Schelling he will soon be going up to Denver to drop off her car.

Torres said Lucas never took the car to Denver. Her phone, according to Torres and Eicher, was also never recorded as having left Pueblo.

Read the full story here.

Minneapolis Police used geofence warrant at George Floyd protests

/in /by

Sat. Feb. 6, 2021 |By Zack Whittaker – TechCrunch |

Police in Minneapolis obtained a search warrant ordering Google to turn over sets of account data on vandals accused of sparking violence in the wake of the police killing of George Floyd last year, TechCrunch has learned.

The death of Floyd, a Black man killed by a white police officer in May 2020, prompted thousands to peacefully protest across the city. But violence soon erupted, which police say began with a masked man seen in a viral video using an umbrella to smash windows of an auto-parts store in south Minneapolis. The AutoZone store was the first among dozens of buildings across the city set on fire in the days following.

The search warrant compelled Google to provide police with the account data on anyone who was “within the geographical region” of the AutoZone store when the violence began on May 27, two days after Floyd’s death.

These so-called geofence warrants — or reverse-location warrants — are frequently directed at Google in large part because the search and advertising giant collects and stores vast databases of geolocation data on billions of account holders who have “location history” turned on. Geofence warrants allow police to cast a digital dragnet over a crime scene and ask tech companies for records on anyone who entered a geographic area at a particular time. But critics say these warrants are unconstitutional as they also gather the account information on innocent passers-by.

TechCrunch learned of the search warrant from Minneapolis resident Said Abdullahi, who received an email from Google stating that his account information was subject to the warrant, and would be given to the police.

But Abdullahi said he had no part in the violence and was only in the area to video the protests when the violence began at the AutoZone store.

The warrant said police sought “anonymized” account data from Google on any phone or device that was close to the AutoZone store and the parking lot between 5:20pm and 5:40pm (CST) on May 27, where dozens of the people in the area had gathered…

Read the full story here.