Habeas Data_Privacy vs. The Rise of Surveillance Tech Page 17

  On November 7, 2012, less than two weeks after the Supreme Court heard oral arguments in Jardines, the secretary of corrections for the Kansas Department of Corrections issued an absconder’s warrant for the arrest of Steven Denson. It took months before state authorities were able to locate him in Wichita. On February 27, 2013, a team of five agents arrived at a duplex on Hillside Street to arrest him.

  At about 8:30 AM on that cold winter morning, one of the agents physically surveilled the building for 20 minutes, and saw nothing. At some point, some of the agents, moved towards the back of the unit, their boots crunching in the snow, while others stayed towards the front. One man, identified in court documents as Special Enforcement Officer Brandon Bansemer, stood at the front door and knocked for a while. When no one answered, US Marshals deputy Joshua Moff decided to go back to his car and retrieve a Doppler device.

  Nearly a year later, during a court hearing, Moff described the handheld device as something that emits a Doppler radar signal, and “when it comes back, it will tell you if it’s picking up somebody’s breathing. Then it will tell you if that person is moving or if they’re stationary.”

  Despite the fact that the Doppler did indicate that a person was in the house, prosecutors took the painstaking step of pointing out in court filings that “the government is not using this information to form the requisite reasonable belief that the defendant or any other person was inside the house at the time that the officers entered the residence.” Though admitting, essentially, that the use of the Doppler may have been improper, they justified the search of the home by the fact that the electrical meter was running rapidly and that there were fresh footprints leading to the house.

  In any case, Bansemer and Moff knocked on the front door.

  “Police! Come to the door!” they shouted as loudly as they could, their breath visible in the air.

  Finally, they decided to bang even harder, which had the effect of knocking a small piece of wood off of the outer door—and still no one came to the door. They decided to reach in and unlock the door anyway, and let themselves inside. In short order, they discovered Denson in bed. The officers roused him, handcuffed him, and sat him down on the couch with Officer Bansemer standing guard while the other officers, who entered from the back, began to sweep the house.

  Deputy Moff quickly found a 12-gauge shotgun and a .22 long rifle in a bedroom closet. Eventually, Denson was charged with unauthorized possession of a firearm while being a felon, in addition to absconding from his parole for a previous charge.

  As the case progressed through the court system, Denson’s attorneys attempted to suppress the search of the house, and the found guns, on the grounds that the entry of the house did not reach to the level of “reasonable suspicion.” The judge did not find Denson’s attorney’s argument convincing and denied the motion to suppress.

  Ultimately, the case was appealed up to the 10th US Circuit Court of Appeals, which did not rule on the issue of whether the use of the Doppler was improper or not. Instead, it found that the “totality” of the other circumstances (the footprints, that there was a utility account in his name, the whirring electrical meter, the fact that he had absconded, that he had no known source of income) in which Denson was found made it such that it did not even need to consider the use of the Doppler.

  “Unlawful searches can give rise not only to civil claims but may require the suppression of evidence in criminal proceedings,” then circuit judge Neil Gorsuch wrote for the 3–0 opinion.

  “We have little doubt that the radar device deployed here will soon generate many questions for this court and others along both of these axes. At the same time, in a criminal proceeding like ours the government is free to rely on facts gleaned independently from any Fourth Amendment violation.”

  In other words, while there might be a case in the future that will deal with whether a Doppler radar device had been used properly—this wasn’t it.

  * * *

  That 10th Circuit opinion was issued December 30, 2014, at a time when most court watchers were on winter holidays. However, by the time that Brad Heath, a USA Today investigative reporter, got back to work on Monday, January 5, 2015, at his suburban Washington, DC, office, he had noticed the court’s opinion.

  Roughly midway through his 20-year career as a journalist, Heath decided to pursue a part-time degree in law at Georgetown University. In 2011, he passed the Virginia bar exam, but has never practiced law. However, he continues to use his legal training as part of his journalism that focuses on criminal justice issues: he likes to listen to appellate oral arguments on his smartphone while folding laundry or doing other household chores.

  Heath read the opinion and decided to take a closer look at this almost discarded section of the appellate ruling. After reporting for a couple of weeks, he concluded that “at least 50” federal law enforcement agencies, “including the FBI and the U.S. Marshals Service, began deploying the radar systems more than two years ago with little notice to the courts and no public disclosure of when or how they would be used. The technology raises legal and privacy issues because the U.S. Supreme Court has said officers generally cannot use high-tech sensors to tell them about the inside of a person’s house without first obtaining a search warrant.”

  This was the first time that many civil liberties groups had even heard of these devices, despite the fact that they apparently had been first deployed in 2013, with seemingly little, if any, public discussion on their acquisition or use.

  “The idea that the government can send signals through the wall of your house to figure out what’s inside is problematic,” Christopher Soghoian, then the American Civil Liberties Union’s principal technologist, told USA Today. “Technologies that allow the police to look inside of a home are among the intrusive tools that police have.” (As of January 2018, Soghoian was hired to be a senior technologist for the offices of Senator Ron Wyden, an Oregon Democrat.)

  Unlike an infrared scanner, which reads the heat emitted by a person or object, a Doppler sends out an electromagnetic wave, which bounces off the target and is returned. By calculating how fast the signal comes back, the device can determine instantaneously how far away something is.

  According to an October 2012 report prepared by the DOJ’s National Institute of Justice, “through-the-wall-sensors allow for enhanced situational awareness during operations when knowledge of the presence of individuals behind opaque barriers would be of benefit, during law enforcement operations requiring forced entry, in hostage situations, in building sweeps by firefighters or when locating individuals in rubble during search-and-rescue operations.”

  These devices have been commercially available to domestic law enforcement since at least 2009, and to military units going back years before that. Like with so many surveillance technologies, something that starts out in the hands of the military will likely make its way to domestic law enforcement within just a few years. However, unlike American service members deployed overseas, local police are restrained by the US Constitution, in addition to state and local law.

  According to Heath’s reporting, in early 2015, L-3 Communications, the Orlando-based firm that made the Range-R device used in Wichita, had sold around 200 devices nationwide. The ubiquity of such technology means that they are likely in use on a daily basis. Few, if any of them, have been subject to substantial legal challenges.

  If it hasn’t happened already, these sensors will be attached to aerial and terrestrial drones for use without any short-range human interaction at all.

  Recall, in the case of Kyllo, it took a smart lawyer around a decade before the case finally made its way up to the Supreme Court. In the meantime, thousands of people were likely subjected to ever-more-sophisticated thermal imaging devices. How are local legislative bodies supposed to make informed judgments about the appropriate use of such devices if they don’t even know that they exist?

  Waiting for the courts to adequately understand the ever-accelerating a
bilities of these kinds of sensors will take quite some time indeed.

  * * *

  So, if using a thermal imager aimed at someone’s house from close range without a warrant is a search, and bringing a drug-sniffing dog to someone’s door without a warrant is also a search, what about something potentially even more physically invasive? Can DNA be collected from a criminal suspect and then analyzed against a DNA database?

  This was the question facing the Supreme Court on February 26, 2013.

  In 2003, a man broke into a woman’s home in Salisbury, Maryland, and raped her. Based on the information provided, local authorities were unable to arrest anyone in connection with the crime, but they were able to gather a DNA sample for an unknown male assailant.

  Six years later, Alonzo King was arrested in the same Maryland county and charged with felony assault. As part of the booking process, the inside of his cheek was swabbed to obtain a DNA sample, consistent with state law at the time. However, the sample was not used to merely identify that the person in state custody was, in fact, Alonzo King. Rather, the DNA sample was run against a DNA database of unsolved crimes.

  King’s DNA matched that of the unknown assailant in the 2003 crime. In Maryland v. King, King was charged, tried, and convicted for the Salisbury rape. King appealed, on the grounds that the DNA sample collected in 2009 was an “unreasonable search.” The Maryland Court of Appeals found that the parts of the Maryland DNA Collection Act that allowed routine genetic sample collection were unconstitutional. The State of Maryland then appealed to the Supreme Court, posing the question: Does the Fourth Amendment allow the states to collect and analyze DNA from people arrested and charged with serious crimes?

  Unlike a license plate number, or nearly any other numerical identifier, DNA is immutable—it can never be changed. The notion of having a permanent record of one’s genetic material, particularly when it might be cross-referenced with location information, is potentially disturbing. It’s not difficult to imagine a near future where police capture all naturally discarded hair (containing a person’s DNA) and record its GPS location, much in the same way license plate readers capture vehicular data today.

  However, in this case, law enforcement was not employing a DNA dragnet.

  In the end, the Supreme Court found that the answer was yes.

  “A suspect’s criminal history is a critical part of his identity that officers should know when processing him for detention,” Justice Anthony Kennedy wrote in the majority 5–4 opinion.

  In other words, the fact that a suspect’s DNA might already be in a state database for an unrelated crime is relevant to establishing the broad identity of a person.

  However, for a notable four-justice minority—led by Justice Scalia—this case was leaning too far in the direction of a general warrant abhorred by the Founders. Just as kicking in everyone’s doors surely would turn up evidence of more crime, that is a line we do not want to cross in a democratic society.

  Scalia felt that the logical extension of the majority opinion was the inevitable expansion of DNA collection.

  “Make no mistake about it: As an entirely predictable consequence of today’s decision, your DNA can be taken and entered into a national DNA database if you are ever arrested, rightly or wrongly, and for whatever reason,” Scalia wrote.

  As he continued:

  Today’s judgment will, to be sure, have the beneficial effect of solving more crimes; then again, so would the taking of DNA samples from anyone who flies on an airplane (surely the Transportation Security Administration needs to know the “identity” of the flying public), applies for a driver’s license, or attends a public school. Perhaps the construction of such a genetic panopticon is wise. But I doubt that the proud men who wrote the charter of our liberties would have been so eager to open their mouths for royal inspection.

  While the Supreme Court arrived at the correct result in Kyllo, Scalia’s “not in general use” line may remain a pesky thorn. In the intervening years, the use of this technology has now become so common that FLIR Systems, one of the largest such thermal imaging companies, released a short-range iPhone add-on in 2014, available for $350. (As of this writing in late 2017, the newest version of that product costs just $200.) Does this mean that the police can simply buy an inexpensive add-on for their iPhones and use it, circumventing the Kyllo decision? The answer remains elusive.

  CHAPTER SIX

  Why (Amazingly) E-mail Providers Won’t Give Up Messages Without a Warrant, Even Though the Supreme Court Has Never Ruled on the Issue

  The ability to store everything makes storage the greater privacy threat.

  —PROFESSOR ORIN KERR

  “THE NEXT GENERATION COMMUNICATIONS PRIVACY ACT”

  UNIVERSITY OF PENNSYLVANIA LAW REVIEW 162 (2013)

  May 24, 2013

  Dallas, Texas

  Dressed in a tank top and shorts, 31-year-old Ladar Levison had one thing on his mind on this warm Friday evening: playing volleyball. It had been a long week. As he was getting ready to head out, there was a loud, repeated knock at his door. Levison silently fumed as he walked to open it.

  Levison owned and operated a small e-mail business out of his fifth-floor apartment: Lavabit. Most weeks, he put in 70 or 80 hours to service his privacy-minded e-mail provider—over 370,000 people used it. Although he didn’t know it at the time, one of his customers was Edward Snowden (edsnowden@lavabit.com), who was about to become a household name.

  Looking through his peephole, Levison was surprised to see two men in suits at his door. Upon opening it, they identified themselves as special agents of the FBI, and showed their badges.

  The current standard requiring law enforcement to get a warrant before Internet service providers (ISPs) turn over the contents of e-mail has come about as a result of an important appellate court decision, Warshak v. United States—effectively, because tech companies, armed with high-powered lawyers, were willing to say to the government that this was the standard, and they were willing to litigate it.

  But Lavabit was no ordinary e-mail provider. Levison knew the law and took extraordinary steps to protect his users’ privacy. But how far would he be willing to go once federal agents were literally at his doorstep?

  Levison invited the FBI agents in to sit down. He introduced them to his tiny dog, Princess. The agents cordially explained that they were there to conduct a background check, and they needed to learn more about who he was and about what Lavabit was all about. In order to present him with a classified court order from the Foreign Intelligence Surveillance Court (FISC), he had to be given a clearance. The first step in obtaining a clearance is an in-person interview.

  The special agents didn’t even know who the target of the FISC order was—they were simply acting on behalf of their colleagues in Washington, DC.

  Still in his volleyball outfit, Levison patiently explained how he had set up Lavabit, with digital security in mind. For a select group of paying customers (roughly 10,000 at the time), Levison offered an encrypted e-mail feature.

  As an e-mail provider, Levison was primarily worried about being served with a national security letter (NSL), which would force him to act as a government agent and conduct secret surveillance of one of his users. Worse than that, Levison wouldn’t be able to tell anyone—not his own lawyer, and certainly not the target of the investigation—about what was actually going on.

  As he wrote on Lavabit’s website in 2013:

  Lavabit believes that a civil society depends on the open, free and private flow of ideas. The type of monitoring promoted by the PATRIOT Act restricts that flow of ideas because it intimidates those afraid of retaliation. To counteract this chilling effect, Lavabit developed its secure e-mail platform. We feel e-mail has evolved into a critical channel for the communication of ideas in a healthy democracy. It’s precisely because of e-mail’s importance that we strive so hard to protect private e-mails from eavesdropping.

  Levison further explained, both on
his website and to the agents, that to protect stored e-mails, Lavabit used elliptical curve cryptography, a mechanism that enables public key and private key encryption. In essence, as applied to Lavabit’s setup, this meant that incoming messages were encrypted before they were saved to the Lavabit servers. This was related to, but distinct from, Pretty Good Privacy (PGP) encryption. It would be as if the post office put each letter and package into a locked safe before delivering it to your front door.

  In short, if the user had paid for the extra security features, even he, as Lavabit’s owner, might not be able to access the e-mails.

  Initially, Levison didn’t think much of the agents’ visit—he tried to answer the agents’ questions during their two-hour chat. He didn’t even think to get a lawyer.

  On June 10, 2013, Levison received a d-order for a name that he initially read as “Snowman.” A court in the Eastern District of Virginia ordered him to turn over subscriber information and send it back. He did, via First Class mail.

  “They weren’t paying me so I wasn’t going to spend $30 to overnight it so I put a stamp on it and sent it,” he told me.

  The d-order required that Levison turn over the user information, including name, address, “records of session time and durations, and the temporarily assigned networks addresses,” length of service, means of payment, and other data, on the paying customer: Edward Snowden.

  But Levison hadn’t put together that the user data that he had gathered together in a slapdash fashion, and whom he still thought was Snowman, was, in fact, the world’s most-wanted man.

  * * *

  The d-order Levison received was named for 18 United States Code § 2703(d), a portion of the 1986 Stored Communications Act (SCA), or Title II of the 1986 Electronic Privacy Communications Act (ECPA).