Policing

special to Drug War Chronicle by veteran investigative crime journalist Clarence Walker, cwalkerinvestigates@gmail.com

When the tech world news web site CNET published excerpts of a leaked DEA memo explaining how, during an investigation, the agency was unable to access the messages of drug dealers using the Apple iMessage system built into a Verizon cell phone, it ignited a media frenzy. "It is impossible to intercept iMessages between two Apple devices," even with a court order approved by a judge, DEA complained.

News stories and tech blogs nationwide highlighted the effectiveness of Apple's encryption protection from privacy invaders, particularly law enforcement. (See, for example, stories here and here.) Amidst the frenzy, what went little noted was that no one's private messages held by Apple's iMessage or any other cell phone service are actually immune from federal government snooping. Under the Stored Communications Act (SCA), if the DEA wants access to someone's messaging communications, all it has to do is get a warrant to review those messages.

Why most media accounts neglected to mention this basic fact is uncertain, but the failure to do so not only misled readers into believing their iMessage communications were secure from government spying, it also fed into and reinforced a narrative being constructed by federal law enforcement agencies -- that rapid advances in telecommunications technologies are leaving the government in danger of "Going Dark" when it comes to its ability to surveil its citizens, and something needs to be done to fix the "problem."

"Apple iMessage users should be aware that regardless of what they heard last week, their messages can be easily obtained by law enforcement pursuant to a warrant under the Electronic Communication Act [ECPA]," said Alan Butler, an in-house attorney with the Electronic Privacy Information Center (EPIC). "The ECPA provides in Title 111, commonly referred to as the Stored Communication Act, that a government entity may require the disclosure of electronic communications held by a provider electronic storage," Butler told the Chronicle by email. Even though the messages are encrypted by the phone company as they are sent by iMessage, Apple can decrypt messages and hand them over to law enforcement with a warrant!"

The case that inspired the DEA memo centers around a drug investigation in Texas back in February where it was unable to intercept iMessages even though a federal judge had issued a court order approving the DEA's interception of the suspects' discussions about drug deals. Although the Federal Wiretap Act allows real-time surveillance of a device or computer, the DEA discovered in the February case that most records obtained from Verizon -- the carrier of the suspect's device -- were incomplete.

Cell phone surveillance is a key tool for law enforcement in monitoring criminal activity. The New York Times reported last June that federal, state, and local officials nationwide had requested assorted cell phone data 1.3 million times in the previous year. But  iMessages can be sent through iPhones, iPads, and even Macs running the OS platform with the capability to bypass the text messaging services of a cell phone carrier. Apple revealed in January that it sees over 2 billion messages sent each day from a half-billion iOS and Mac devices that uses the iMessage to keep private conversations and text messages secure from snooping.

When iMessage was launched in 2011, company executives boasted about its "secure end-to-end" encryption, and some critics say the leaking of the DEA memo is a clever scheme by the feds to help convince lawmakers to mandate that all communication systems, including social media and internet messaging systems have a back-door mechanism to allow government access to the data. 

Cato's Sanchez explained why he was leery of the DEA memo and the motives for its leaking.

EPIC attorney Alan Butler

The DEA also complained "that iMessages between two Apple devices are considered encrypted communication and cannot be intercepted regardless of the cell phone service provider," even though in the same memo, it conceded that "sometimes the messages can be intercepted depending where the intercept is placed."

Was the DEA memo leak part of an ongoing campaign to revamp the federal laws governing surveillance of electronic communications? That's hard to prove, but showing that there is such a campaign is less difficult.

In February testimony to the House Judiciary Committee's Subcommittee on Crime, Terrorism, and Homeland Security, FBI General Counsel Valerie Caproni coined the term "Going Dark" to describe what she called federal law enforcement's rapidly diminishing ability to monitor high-tech communications products as technologies advanced over the past 10 to 15 years. Caproni singled out "social-networking sites, web-based email and peer-to-peer communications."

Other federal officials have been making similar noises.  

"The FBI simply can't keep up with criminals taking advantage of online communication to hide evidence of their actions," FBI lawyer Andrew Weissman said last month during a meeting with American Bar Association.

The FBI and other federal law enforcers claim there is a growing gap between the legal authority of federal and other law enforcement agencies to intercept electronic communications pursuant to court order or direct warrant under the Communications Assistance Law Enforcement Act (CALEA) and their ability to actually do so. And they want new legislation to fix that.

Passed in 1994, CALEA law initially ordered phone companies to create a mechanism to have their systems conform to a wiretap in real-time surveillance. The Federal Communications Commission (FCC) extended CALEA in 2005 to apply to broadband providers, such as universities and Internet service providers, but messaging and social media services, such as Google Talk, Skype, Myspace, Yahoo and Facebook, as well as encrypted devices like Blackberry and Apple communications are not covered.

The FBI argues that "Going Dark" is a real and threatening possibility, with increased risk to national security and public safety. And the FCC has joined forces with the FBI by considering updating CALEA to require that digital products equipped with video or voice chats over the Internet, including Skype and Google Box Live, to rejigger their systems to allow the feds to monitor criminal activity as it happens in real time.

"We have noticed a massive upstick in the amount of FCC-CALEA inquiries within the last year, most of which are intended to address 'Going Dark' issues," said Chris Canter, a lead compliance counsel at Marashlian & Donahue , a law firm specializing in CALEA law. "This generally means that the FCC is laying the groundwork for regulatory action," he told the Chronicle.

"If we applied the FBI's logic to the cell phone carriers, it would state that every individual phone should be designed with built-in bugs," the Electronic Frontier Foundation said in a statement on CALEA. "Consumers would simply have to trust law enforcement or the phone companies not to activate those bugs without just cause."

EFF filed a Freedom of Information Act (FOIA) request with the FBI and other federal law enforcement agencies showing how the feds might try to justify forcing high-tech services to rewire their systems for expanded wiretapping purposes. The FOIA requested "information concerning the difficulties that the FBI and DOJ has encountered in conducting authorized electronic surveillance."

But so far, the Department of Justice has withheld the bulk of relevant information on the topic, provoking San Francisco US District Court Judge Richard Seeborg to order the feds to turn over the records. No court date scheduled for the feds to comply.

While law enforcement is calling for legislative changes to aid its work, critics insist that even if Congress refuses to pass laws to tackle the "Going Dark" problem, investigators can still obtain a special warrant allowing them to sneak into private residences and businesses to install a keystroke-logging system onto a computer or other devices to record passwords to unlock data they need to make a case.

The DEA adopted this same technique in the Texas case and another case where suspected drug dealers used PGP and the encrypted Web-email service identified in court records as Hushmail.com. Investigators can also send a malware to gain control of a targeted cell phone to extract the text messages, or as a last resort, obtain a warrant to seize the physical device and perform a traditional forensic analysis.

"New technologies frequently create uncertainty and the law is slow to adapt while leaving us to fight over how much surveillance we can tolerate in a free society," noted EPIC attorney Butler. "No one has quite figured out how to strike that balance in every case. However, the Fourth Amendment requires that our persons, houses, papers, and effects be protected from unreasonable search and seizures."

The battle between the imperatives of law enforcement and the privacy rights of Americans is never definitively won. Instead, it is better viewed as a never-ending series of skirmishes. And the contested terrain of this particular skirmish is your iPad.

Some Utah narcs are having a spotlight shined on them, an NYPD cop goes down for robbing drug dealers, and a Florida deputy gets caught buying pain pills on the street and stealing them from his aunt.Let's get to it:

In New York City, an NYPD officer was arrested last Wednesday on charges he was a member of a crew that robbed drug dealers of thousands of dollars in cash and drugs. Officer Jose Tejada, 45, is accused of taking part in three robberies or attempted robberies in 2006 and 2007, while he was assigned to Harlem and in uniform, according to federal prosecutors. He also supplied police uniforms, paraphernalia and police vehicles to crew members. He is charged with conspiracy to commit robbery, conspiracy to facilitate drugs, and unlawful use of a firearm. Tejada is the second NYPD officer charged in more than 100 robberies of drug dealers that began in 2001 and netted more than 250 kilograms of cocaine and a million dollars in cash. Former officer Emmanuel Tavarez was sentenced to 25 years in prison last May for his role in the same crew.

In Key West, Florida, a Monroe County Sheriff's deputy was arrested Saturday on charges he bought drugs from an informant and stole drugs from relatives. Deputy Jaime Miranda went down in a sting, buying fake oxycodone from an informant while on duty, in uniform and in his police cruiser. He was stopped shortly thereafter, and police found nine fake oxycodone tablets (he admitted eating the 10th as soon as he bought it), as well as hydromorphone tablets he admitted stealing from his aunt's house.  Miranda is charged with three felonies: conspiracy to purchase narcotics, possession of synthetic narcotics and possession of a controlled substance without a prescription. He made $12,000 bond Saturday night and is suspended without pay pending further investigation.

special to Drug War Chronicle by independent investigative journalist Clarence Walker, freelancewriter82@gmail.com

Blocked by a Supreme Court decision from using GPS tracking devices without a warrant, federal investigators and other law enforcement agencies are turning to a new, more powerful and more threatening technology in their bid to spy more freely on those they suspect of drug crimes. That's leading civil libertarians, electronic privacy advocates, and even some federal judges to raise the alarm about a new surveillance technology whose use has yet to be taken up definitively by the federal courts.

StingRay cell phone spying device (US Patent photo)

When a suspect makes a phone call, the StingRay tricks the cell into sending its signal back to the police, thus preventing the signal from traveling back to the suspect's wireless carrier. But not only does StingRay track the targeted cell phone, it also extracts data off potentially thousands of other cell phone users in the area.

Although manufactured by a Germany and Britain-based firm, the StingRay devices are sold in the US by the Harris Corporation, an international telecommunications equipment company. It gets between $60,000 and $175,000 for each Stingray it sells to US law enforcement agencies.

[While the US courts are only beginning to grapple with StingRay, the high tech cat-and-mouse game between cops and criminals continues afoot. Foreign hackers reportedly sell an underground IMSI tracker to counter the Stingray to anyone who asks for $1000. And in December 2011, noted German security expert Karsten Nohl released "Catcher Catcher," powerful software that monitors a network's traffic to seek out the StingRay in use.]

Originally intended for terrorism investigations, the feds and local law enforcement agencies are now using the James Bond-type surveillance to track cell phones in drug war cases across the nation without a warrant. Federal officials say that is fine -- responding to a Freedom of Information Act (FOIA) request filed by the Electronic Freedom Foundation (EFF) and the First Amendment Coalition, the Justice Department argued that no warrant was needed to use StingRay technology.

"If a device is not capturing the contents of a particular dialogue call, the device does not require a warrant, but only a court order under the Pen Register Statute showing the material obtained is relevant to an ongoing investigation," the department wrote.

The FBI claims that it is adhering to lawful standards in using StingRay. "The bureau advises field officers to work closely with the US Attorney's Office in their districts to comply with legal requirements," FBI spokesman Chris Allen told the Washington Post last week, but the agency has refused to fully disclose whether or not its agents obtain probable cause warrants to track phones using the controversial device.

And the federal government's response to the EFF's FOIA about Stingray wasn't exactly responsive. While the FOIA request generated over 20,000 records related to StingRay, the Justice Department released only a pair of court orders and a handful of heavily redacted documents that didn't explain when and how the technology was used.

The LA Weekly reported in January that the StingRay "intended to fight terrorism was used in far more routine Los Angeles Police criminal investigations," apparently without the courts' knowledge that it probes the lives of non-suspects living in the same neighborhood with a suspect.

Critics say the technology wrongfully invades technology and that its uncontrolled use by law enforcement raised constitutional questions. "It is the biggest threat to cell phone privacy you don't know about," EFF said in a statement.

ACLU privacy researcher Christopher Soghoian told a Yale Law School Location Tracking and Biometrics Conference panel last month that "the government uses the device either when a target is routinely and quickly changing phones to thwart a wiretap or when police don't have sufficient cause for a warrant."

"The government is hiding information about new surveillance technology not only from the public, but even from the courts," ACLU staff attorney Linda Lye wrote in a legal brief in the first pending federal StingRay case (see below). "By keeping courts in the dark about new technologies, the government is essentially seeking to write its own search warrants, and that's not how the Constitution works."

Lye further expressed concern over the StingRay's ability to interfere with cell phone signals in violation of Federal Communication Act. "We haven't seen documents suggesting the LAPD or any other agency have sought or obtained FCC authorization," she wrote.

StingRay pricing chart (publicintelligence.net)

Advocates also raised alarms over another troubling issue: Using the StingRay allows investigators to bypass the routine process of obtaining fee-based location data from cell service providers like Sprint, AT&T, Verizon, T-Mobile and Comcast. Unlike buying location data fro service providers, using StingRay leaves no paper trail for defense attorneys.

Crack defense attorney Stephen Leckar who scored a victory in a landmark Supreme Court decision over the feds' warrantless use of a GPS tracker in US v. Jones, a cocaine trafficking case where the government tracked Jones' vehicle for weeks without a warrant, also has concerns.

"Anytime the government refuses to disclose the ambit of its investigatory device, one has to wonder, what's really happening," he told the Chronicle. "If without a warrant the feds use this sophisticated device for entry into people's homes, accessing private information, they may run afoul of a concurring opinion by Justice Alito, who ruled in US v Jones whether people would view unwarranted monitoring of their home or property as Constitutionally repugnant."

Leckar cited Supreme Court precedent in Katz v. US (privacy) and US v. Kyllo (thermal imaging), where the Supreme Court prohibited searches conducted by police from outside the home to obtain information behind closed doors. Similar legal thinking marked February's Supreme Court decision in a case where it prohibited the warrantless use of drug dogs to sniff a residence, Florida v. Jardines.

The EFF FOIA lawsuit shed light on how the US government sold StingRay devices to state and local law enforcement agencies for use specifically in drug cases. The Los Angeles and Fort Worth police departments have publicly acknowledged buying the devices, and records show that they are using them for drug investigations.

"Out of 155 cell phone investigations conducted by LAPD between June and September 2012, none of these cases involved terrorism, but primarily involved drugs and other felonies," said Peter Scheer, director of the First Amendment Center.

The StingRay technology is so new and so powerful that it not only raises Fourth Amendment concerns, it also raises questions about whether police and federal agents are withholding information about it from judges to win approval to monitor suspects without meeting the probable cause standard required by the Fourth. At least one federal judge thinks they are. Magistrate Judge Brian Owsley of the Southern District of Texas in Corpus Christi told the Yale conference federal prosecutors are using clever techniques to fool judges into allowing use of StingRay. They will draft surveillance requests to appear as Pen Register applications, which don't need to meet the probable cause standards.

"After receiving a second StingRay request," Owsley told the panel, "I emailed every magistrate judge in the country telling them about the device. And hardly anyone understood them."

In a earlier decision related to a Cell-site Simulator, Judge Owsley denied a DEA request to obtain data information to identify where the cell phone belonging to a drug trafficker was located. DEA wanted to use the suspect's E911 emergency tracking system that is operated by the wireless carrier. E911 trackers reads signals sent to satellites from a cell phone's GPS chip or by triangulation of radio transmitted signal. Owsley told the panel that federal agents and US attorneys often apply for a court order to show that any information obtained with a StingRay falls under the Stored Communication Act and the Pen Register statute.

DEA later petitioned Judge Owsley to issue an order allowing the agent to track a known drug dealer with the StingRay. DEA emphasized to Owsley how urgently they needed approval because the dealer had repeatedly changed cell phones while they spied on him. Owsley flatly denied the request, indicating the StingRay was not covered under federal statute and that DEA and prosecutors had failed to disclose what they expected to obtain through the use of the stored data inside the drug dealer's phone, protected by the Fourth Amendment.

"There was no affidavit attached to demonstrate probable cause as required by law under rule 41 of federal criminal procedures," Owsley pointed out. The swiping of data off wireless phones is "cell tower dumps on steroids," Owsley concluded.

But judges in other districts have ruled favorably for the government. A federal magistrate judge in Houston approved DEA request for cell tower data without probable cause. More recently, New York Southern District Federal Magistrate Judge Gabriel Gorenstein approved warrantless cell-site data.

"The government did not install the tracking device -- and the cell user chose to carry the phone that permitted transmission of its information to a carrier," Gorenstein held in that opinion. "Therefore no warrant is needed."

In a related case, US District Court Judge Liam O'Grady of the Northern District of Virginia ruled that the government could obtain data from Twitter accounts of three Wikileakers without a warrant. Because they had turned over their IP addresses when they opened their Twitter accounts, they had no expectation of privacy, he ruled.

"Petitioners knew or should have known that their IP information was subject to examination by Twitter, so they had a lessened expectation of privacy in that information, particularly in light of their apparent consent to the Twitter terms of service and privacy policy," Judge O'Grady wrote.

A federal judge in Arizona is now set to render a decision in the nation's first StingRay case. After a hearing last week, the court in US v. Rigmaiden is expected to issue a ruling that could set privacy limits on how law enforcement uses the new technology. Just as the issue of GPS tracking technology eventually ended up before the Supreme Court, this latest iteration of the ongoing balancing act between enabling law enforcement to do its job and protecting the privacy and Fourth Amendment rights of citizens could well be headed there, too.

Illicit opium poppy production cultivation in Afghanistan is on the increase this year, the Afghan Ministry of Counternarcotics said Monday. The increase comes despite efforts to target traffickers and to provide alternate development opportunities for farmers.

Afghan opium poppy fields bloom (UNODC)