Habeas Data_Privacy vs. The Rise of Surveillance Tech Read online

  But what sold her on Katz-Lacabe was the fact that he had the wherewithal to file a public records request about himself.

  “He had actual evidence of this happening to him personally,” she added.

  What had happened to Katz-Lacabe was happening to millions of Americans nationwide, almost entirely without their knowing. The government was not only collecting data on who people were calling and when, but was also recording where people were driving—often for years on end.

  So, what provides the legal authority for law enforcement to routinely collect so much data? Proponents argue that a 1983 Supreme Court decision, United States v. Knotts, which found that there was no reasonable expectation of privacy in public, means that it’s OK for officers to observe a license plate in public. Even though this ruling was made at least a decade before LPR went mainstream, the practical effect is that everyone’s license plate can be scanned and potentially retained forever. In some ways, it’s just like how Judge Eagan ruled in 2013 in FISC Docket Number BR 13-109 that if the third-party doctrine in Smith v. Maryland applies to one person in one limited situation (a single robbery in Baltimore), then it also applies to everyone, everywhere, authorizing the National Security Agency’s metadata program.

  * * *

  Katz-Lacabe attended UC Berkeley in the late 1980s and early 1990s, where he studied environmental science. As a student, he became politically active, joining Amnesty International. Years later, he and his Argentine wife, Margarita Lacabe, founded Derechos Human Rights, one of the first online human rights organizations.

  As that work evolved, he became knowledgeable about the mechanics of filing a Freedom of Information Act request with federal authorities, or a similar request under the California Public Records Act. During the 1990s, he was the webmaster for School of the Americas Watch, an activist group dedicated to shutting down what was then called the School of the Americas. (The facility, based in Ft. Benning, Georgia, is now known as the Western Hemisphere Institute for Security Cooperation, or WHINSEC.) In 1961, during the Kennedy administration, the school was directed to “thwart armed communist insurgencies.” Katz-Lacabe filed for, received, and digitized records from the Department of Defense to obtain the names of Latin American soldiers who had received training at the infamous school. The facility included among its alumni dozens of men who went on to become infamous authoritarians (Manuel Noriega) and drug lords (the two founders of Los Zetas cartel), among others.

  In 2000, Katz-Lacabe and his wife moved from nearby Richmond to San Leandro. There, he threw himself into civic life, attending many public meetings, and eventually won a seat on the school board in 2006. Over time, his desire to understand the minutiae of government became insatiable. While in office, he went to numerous city council meetings. That was around the first time he heard the term “license plate reader.” By 2010, he’d filed a public records request.

  “I wonder what information they have on me,” he thought to himself, and without missing a beat, sent off a public records request to the San Leandro Police Department. A few months later, they sent him over 100 photos, shot all over town, with their LPR cameras. But the photos weren’t just of his license plate. Half of the photos were wide shots, of Katz-Lacabe’s car: one at a coffee shop, one at a friend’s house, among other places.

  “Seeing those images caused me to be a lot more curious and pay a lot more attention,” he said. “How long [was] the data retained? How [were] the images…captured? All sorts of stuff! And so I found out that my police department had no policy, or rather, their policy was to keep indefinitely.”

  Back at DEF CON, Katz-Lacabe kept his word to send the photo to Crump and to Valentino-DeVries. Albeit slightly blurry, it showed Katz-Lacabe and his two daughters getting out of his car in his driveway on November 14, 2009.

  A few months later, on September 29, 2012, Valentino-DeVries and her colleague Julia Angwin published a front-page story in the Wall Street Journal: “New Tracking Frontier: Your License Plates.”

  That article was the first time this photo of Katz-Lacabe and his daughters was published in a major media outlet. It was also the first time that anyone on the San Leandro City Council had ever heard of LPR, despite the fact that they had already been in use in the Bay Area town for nearly five years.

  * * *

  Sometimes, LPR misreads can even lead to a situation that results in guns being drawn.

  On March 30, 2009, a woman named Denise Green, a local bus driver, was driving her 1992 red Lexus southbound on Mission Street in San Francisco. She was headed home, just after having picked up her sister from the hospital and taking her to the nearby 24th St. BART station. It was just after 11 PM—having been roused from her bed, she was wearing a zip-up sweatshirt and a beanie.

  As she crossed the intersection of Highland and Mission Street, a police car appeared in her rearview mirror. She dutifully pulled over to allow the car to pass, but it followed her. Unsure of what to expect, Green simply waited. After just a minute, the police officer barked at her.

  “Put your hands up!”

  She did so, and then was promptly ordered to keep her hands up, open her window, open the door from the outside, and get out of the car. She did that, too. Other officers’ voices began to crescendo, and she saw guns drawn.

  “Don’t look at us!” one yelled. “Turn around!”

  The first officer demanded that she get on her knees—she thought about how they were already sore from being in bad shape. But again, she complied.

  Some of the men started searching her car, and one told her to stand up. She said she was too weak to stand, particularly while handcuffed. With the help of two officers, she eventually did stand up.

  “It’s not a seven? No, three five zero,” Green overheard one of the officers tell another. While waiting for the San Francisco cops to sort out what was going on, various of her fellow city bus drivers passed her while she stood, stunned, in handcuffs. Some were even local transit supervisor trucks, and she turned her back to them so they wouldn’t see her: she was mortified.

  Finally, one of the men came over to explain that a San Francisco Police Department vehicle equipped with an LPR had misread her license plate. Once they confirmed that her Lexus was not, in fact, stolen. She was free to go.

  Later, as part of her civil lawsuit, she and her attorneys determined that the LPR had misread her plate, reading 5SOW750—the stolen car—rather than 5SOW350, her actual plate. Some of San Francisco’s finest, however, had failed to check that what the machine read was actually the car that they observed with their own eyes. She sued the city and the officers in June 2010. When city lawyers attempted to get the case dismissed, Green’s claims were upheld on appeal in 2014, and the case eventually settled in November 2015.

  Green’s case is indicative of what can happen when law enforcement is too reliant on automated technology.

  Fourteen years after the FBI first began testing the technology, LPRs are now in use nearly everywhere across America. These are essentially specialized cameras that can scan license plates incredibly fast—60 plates per second. When mounted on a police patrol car, they can scan in multiple directions, capturing cars driving in front or parked perpendicular. LPRs use the same optical character recognition technology as modern-day desktop scanners. The software can read license plates, which have a standard size and format, and compare them against a “hot list” of stolen or wanted cars.

  If the LPR scans a “hot” car, the computer inside the police car will alert the officer, and she or he is typically supposed to verify that the scanned plate actually matches the wanted plate, and that it’s attached to the right make and model of car.

  The three largest vendors of LPR hardware and software are Elsag North America (a subsidiary of an Italian defense contractor), Xerox, and 3M (the LPR division was sold in June 2017 to a private equity firm). These companies routinely encourage local police agencies to apply for federal grants to make the purchase of these products more
palatable to budget-constrained localities.

  In 2014, for example, the Central Marin Police Authority, which governs portions of Marin County, north of San Francisco, successfully obtained a $132,000 federal grant to bolster its anti-terrorism efforts. However, there have never been any terrorist attacks in Marin County, nor have any terrorism suspects been caught. This money went towards purchasing three LPRs on Sir Francis Drake Boulevard, a major county thoroughfare.

  The result is that law enforcement agencies, ranging from small towns in Marin County to the FBI, are routinely scanning the license plates of ordinary citizens. Because local money is rarely used, there’s been relatively little scrutiny paid to how the devices are used in practice, who has access to the data collected, and how long it is kept.

  Depending on the retention policy of the agency, police might keep that data for minutes, days, weeks, months, or even years. In New Hampshire, LPRs were banned outright until the state passed a 2016 law restricting data collection to three minutes, unless it was part of an arrest, citation, or another such limited circumstance. By contrast, the California Highway Patrol retains the data for 60 days. There are just 14 states nationwide that have some sort of regulation on LPRs—the rest leave it up to local jurisdictions. Police in Oakland, California, had no retention policy until their absurdly small 80GB hard drive filled up with LPR data in 2015.

  While many people might feel that they have nothing to hide, or that their lives are so boring that it doesn’t matter if the police keep a record of their movements, press a little and that viewpoint becomes a bit harder to defend. After all, LPRs don’t just record your drives to and from work, but they also may collect information about your activities that you may not want the government to keep a record of: where you slept last night, what gun stores you go to, what mosque you attend, what doctor you visit, what sex-toy shop you like, what marijuana dispensary you frequent, or what gay bar you prefer.

  To be fair, the snapshot that an LPR collects is not the same as pervasive tracking that can be performed through GPS or cell phone surveillance, and law enforcement are typically well-aware of this distinction. Most people have no idea what an LPR camera even looks like, much less where they are mounted. Police typically place them on patrol cars, but sometimes—as is the case in Piedmont, California, a small wealthy enclave surrounded by Oakland; and Tiburon, California, a well-to-do small town north of San Francisco—cities sometimes mount them in a stationary location along the only roads in and out of the city as a way to know who is coming and going. (In Piedmont’s case, its 30 readers generate between 1 and 1.4 million records a month, according to Katz-Lacabe.)

  “The collection itself and the retention of that information is a violation of norms in a free society,” Kade Crockford, an activist with the ACLU of Massachusetts who has studied LPRs for several years, told me. “The basic norm [is] that [if] you are not engaged in unlawful activity and the government has no reason to believe that you’re engaged in unlawful activity, the police should not be monitoring what you’re doing. It’s none of the government’s business.”

  LPR collection is undoubtedly useful: there are numerous stories, often touted by the agencies and equipment vendors themselves, that provide easy anecdotes of how LPRs help investigate crimes. On its website, Elsag touts the February 2017 story of a burglar who was stealing from churches and who was ultimately stopped because police in Leawood, Kansas, were notified when he turned up at a church. In 2015, in a higher-profile example, LPRs were used to find Vester Lee Flanagan, the man who shot two Virginia television reporters while on the air.

  However, these success stories overwhelmingly remain the exception rather than the rule. Katz-Lacabe’s own research has repeatedly shown that nearly all of the data collected by LPRs does not off-set the “hot plate” trigger. In fact, more than 99 percent of all plates scanned are of innocent, law-abiding people, according to 2013 research spearheaded by Catherine Crump.

  * * *

  The Knotts case is reminiscent of the cast of characters in the hit television series Breaking Bad: a group of Minnesota men conspire to create amphetamine. There was Leroy “Tuffy” Knotts and Daryl Petschen, plus the group’s chemist, a man named Tristan Armstrong.

  According to court filings, Armstrong worked as a chemical technician for many years at 3M in St. Paul, and had an academic interest in the creation of the drug. Armstrong, who had previously served in the US Army, was financially in dire straits. Armstrong and Petschen first met each other through a mutual friend in April 1978.

  Petschen took Armstrong to his small house on a leafy street near the campus of Macalester College, where they had scoped out a possible lab site in the basement. Petschen led the operation, and took charge of the distribution of their product.

  “Leave it to me,” Petschen told Armstrong, adding that Armstrong should watch his back for surveillance, and that if he were caught, he should say nothing and request a lawyer immediately.

  By the summer though, the operation had moved 20 miles out of town to Stillwater, Minnesota, along the banks of the St. Croix River, which forms the border with Wisconsin. (Later, however, they moved again to a new location back in St. Paul.) Much of the equipment and the chemical precursor phenylacetone were stolen by Armstrong from 3M. When 3M finally caught wind of this in early 1979, the company promptly fired Armstrong.

  Amazingly, upon questioning, Armstrong agreed to speak with agents from the Minnesota Bureau of Criminal Apprehension (BCA), a state law enforcement agency. But he lied to them, saying that he had sold the stolen chemicals to a fictitious person. When Petschen learned of Armstrong’s unmasking, he halted production. However, the two men changed tactics—they created companies, including Tandem Chemical Company and Research Ombudsman, to legally buy the chemicals and related equipment outright.

  Minnesota authorities were still suspicious of Armstrong after their interview with him, and they continued to monitor his behavior. By June 1979, Petschen and the others had pulled out of the third lab location on 1698 Leone Avenue in St. Paul. Later, investigators found “tubing, hosing, glassware, and other lab-related items” at the abandoned location.

  As summer turned into fall and then winter, local law enforcement continued to monitor the men. They watched them pick up boxes and move them around the region. On February 28, 1980, knowing that Armstrong was set to retrieve an order from Hawkins chemical company in Roseville, Minnesota, the police, with permission from the company, installed a beeper on a chemical drum of chloroform that he’d ordered.

  This beeper—a low-range FM radio transmitter about three inches long and weighing half a pound—allowed the police to follow Armstrong’s movements electronically while they also followed him in person. Notably, the police did not have a warrant to install this tracking device on the drum.

  Armstrong took the drum to Petschen’s small two-bedrom house at 1498 Albany Avenue in St. Paul. The pair then took some boxes and the chloroform drum and moved them into Petschen’s vehicle, and Petschen then took off for Shell Lake, Wisconsin, approximately 100 miles away. According to court records, police lost sight of Petschen twice—once on purpose, when the agent following him pulled back, afraid that Petschen was aware that he was being surveilled. Court records also show that the police lost “total contact” (including via the beeper) for “approximately one half to one hour.”

  But Petschen’s loss of the police tail was short-lived. After bringing in a helicopter to track down the beeper’s signal once again, the police determined that Petschen was at a remote and isolated cabin near Shell Lake, and they set up a team to watch the comings and goings. The following day, February 29, authorities saw Petschen leave the cabin with Knotts in his car.

  Four days later, on March 3, 1980, at 5:30 AM, Wisconsin police executed a search warrant of the cabin, where they found evidence implicating the men in the drug operation: especially a “fully operable laboratory located behind some moveable paneling.” Chemists from the Minneso
ta BCA and the Drug Enforcement Administration (DEA) both determined that with the gear found in the cabin, the men would have been nearly ready to make methamphetamine.

  Quickly, all three men were arrested. Armstrong pleaded guilty and testified against his former partners. Petschen and Knotts were charged with conspiracy to manufacture controlled substances.

  As Mark Peterson, who served as one of Knotts’ lawyers, explained, beepers were still a relatively new technology.

  “Back then the monitoring capabilities were nothing close to what they are now,” he said.

  Before trial, the defendants’ lawyers attempted to suppress the evidence found in the cabin due to the warrantless use of the beeper.

  “That was really the only issue,” Peterson added. “There was no question that they were guilty of what they were accused of, the question was whether they had a Fourth Amendment issue that was viable.”

  The judge ruled against Petschen and Knotts. The men were found guilty after a jury trial concluded on July 23, 1980, and were sentenced to five years on September 26, 1980.

  Less than two weeks later, on appeal to the 8th US Circuit Court of Appeals, defense lawyers pursued a strategy based entirely on the notion that without the use of the beeper, police would never have found the cabin.

  “Resolution of this contention must commence with consideration of the seminal privacy-expectation case, Katz v. United States,” Petschen and Knotts’ attorneys wrote in their brief to the court.

  The government, in its responding brief, immediately cited both Katz and Smith, saying that because the beeper was installed with the company’s permission before Armstrong took possession of it, “there is no violation of Fourth Amendment rights.” That is, the chemical company is here analogous to the phone company, with whom the defendants did not have a reasonable expectation of privacy.