Sophos Cloud Optix
On Wednesday, Ontario Provincial Police (OPP) put out a news release about what they’re calling a “new investigative technique” to help find out the person(s) who recently murdered a hitchhiker.
Namely, they’ve used a court order to get their hands on the phone numbers of every person who was in the vicinity of where 65-year-old Frederick “John” Hatch was last seen alive, near the town of Erin, Ontario, on 17 December 2015.
The plan was to send two text messages to all those numbers on Thursday: one version in English, one in French.
The messages will request that recipients visit a website and voluntarily answer “a few simple questions” to hopefully help the OPP solve the murder.
OPP may call this technique “new,” but it’s old hat for many police departments.
The data demands are called “tower dumps.” It entails mass-slurping data by ordering phone companies to hand over personal information about thousands of mobile phone users.
The slurping is often done a) regardless of whether or not the slurpees are themselves under investigation, b) despite the fact that courts have grappled with its legality, c) regardless of phone companies finding it illegal, and d) without the consent of those the police plan to contact.
Australia’s done it, for one. In July 2014, the Sydney Morning Herald confirmed that both federal and state police were using tower dumps.
Tower dumps can give police the identity, activity and location of any phone that connects to targeted phone towers, generally within 1-2 hours.
However, the OPP says that its own data request didn’t include names or other contact information for registered cellphone owners.
Besides Australia, US police have also widely used this type of large-scale interception of mobile phone data. According to an investigation conducted by USA Today, about 1 in 4 law enforcement agencies had used the tower dump tactic by December 2013.
USA Today also reported at the time that at least 25 police departments owned a stingray: a surveillance device that sends powerful signals to trick cell phones – including those of bystanders – into transmitting their locations and their IDs.
The OPP said in its release that it obtained the phone numbers via a court process called a Production Order. Whoever responds to the text messages will have the option of providing their names and contact information when they answer a few simple questions.
Digital privacy lawyer David Fraser says that the Production Order is similar to a search warrant. It differs in that it orders a third party, such as a telco, to hand over relevant records.
Law enforcement would have had to convince a justice of the peace that they needed the information, similar to a magistrate judge in the US signing off on a warrant, and would have also had to convince the court that public interest in the investigation outweighs privacy concerns.
Fraser also noted that the OPP’s tower dump would have to be done in a manner consistent with guidelines that were drawn up by the court in a case from last year: that of R v Rogers and Telus.
In that case, a tower dump request from the police would have pulled in detailed information on some 43,000 people who had nothing to do with the crime, Fraser wrote at the time.
The judge in that case laid out guidelines that instructed such requests to minimize both privacy intrusions and the number of records requested in future tower dumps.
When speaking with Motherboard, Fraser suggested that there has to be a “a cut-off of severity” for when tower dumps are requested:
Are they going to do this after a bar brawl at a strip club? Imagine you’re sitting on the couch with your lovely spouse and your phone buzzes and your spouse looks and says, ‘Oh, it’s the police wondering if you were at the strip joint and if you saw anything?’
An unsolved murder case such as that of the hitchhiking Mr. Hatch may be one where the balance tips in favor of such a fishing expedition, Fraser told me, but he suggests that the big question will be, where will the police and the courts draw the line when they want to use this technique for other crimes?
Beyond potential for that type of overreach, there’s the problem of getting police to stick to guidelines that limit retention of data.
As it is, police in the US often store records on individual gadgets, such as tablets. Ensuring that data is scrubbed from such a disparate collection of storage devices has proved unwieldy, at best.
The retention rate under Canada’s new guidelines is 6 months. Will police scrub the data as required? Who will be responsible for ensuring that they do?
According to Fraser, we don’t know…
We have no insight into this [whether tower dumps will be used for fishing expeditions], and the police are not saying much.
We also have no insight into how long they plan to keep the data and if they propose to do anything else with it. For example, they may try to match the phone numbers with other cases. Or just put it in a database and use it in subsequent investigations.
The devil, he says, is in the detail.
well, google is tracking us. in the case of a violent crime (including kidnapping) I like this. but in terms of being tracked all the time I don’t. Such is the price of carrying a smart phone.
The lesson is not to murder someone with your phone turned on?
Just exactly how does this assist in the investigation? If I am targeted with one of these messages, and I fail to reply, do I automatically become a person of interest? If I committed the crime, what information could I possibly provide in the ‘few simple questions’ that could implicate me? Who is going to follow up with 43,000 phone users to determine that the number belongs to Sally, but Joe was using it that day? What if the phone is assigned to a business – are there different rules?
So many questions ….
If all that’s acquired are the numbers, and they’re spammed in a one-off attempt to appeal for witnesses, it’s not that different from doorstopping all the houses in the vicinity of a serious crime; or putting notices through people’s letterboxes; or putting a road sign next to where a fatal accident occurred and asking people to come forward (which is routine in the UK). In fact, you can argue that it’s better than doorstepping, because it’s a bit more private than answering the door where people who may have been involved in the crime can watch how you deal with the police.
I agree that there are serious privacy concerns here, but I think Mr Fraser’s suggestion that a “mass SMS spam” after a crime like a bar brawl at a strip joint would somehow identify you as having been in the strip joint is a touch disingenuous. Indeed, I’m thinking that it’s likely to be the evidence of people who were round and about, and who have no other connection with the incident, or with the strip joint, or the antagonists, that would be most useful in trying to get at the facts, or at least to confirm or deny the claims of those who were involved.
A “bar brawl” sounds like a fairly serious crime scene to me, especially if there is grievous injury or, even worse, an unlawful killing of some sort. (I am not an aficionado of bar fights, but to me the word “brawl” seems to imply a large-scale battle between two groups of rivals in which people get beaten with bottles, or glassed, or have other deadly weapons waved at them, rather than a bit of quickly-quelled fist-swinging between two out-of-order guests who are in a drunken disagreement about a pub quiz factoid.)
Duck beat me to it 🙂 But I’m going to go ahead and say that in terms of the police actually asking by text message, it doesn’t seem that different to me from going around and knocking on doors. The issue that I see is what comes beforehand, the police accessing a record of your location. Your address is a matter of public record, but your whereabouts at a given time are something quite different. They do have a warrant, though – and of course, phone locations are notoriously unreliable…
Citizens are also notorious for failing to pay attention to news. I wonder how many will have already forgotten about this by the time they send the messages, and take to Facebook or phone up the police in order to complain about ‘surveillance’ and ‘being treated like criminals’.
Any bets on how long it will be before scammers try to play off of these police messages?
We saw that you were around the scene of this crime. We will need your credit card information in order to resolve this matter.
Deleting the records after a certain time is a real good question here. On our own CBC news site this morning is a story about a woman pulled over by 3 police cars and ordered out of her car then handcuffed. When asked is she knew she was driving a stolen car, her reply was yes she knew. Her car was stolen last May but recovered in June. Apparently, the police forgot to remove her recovered car from the stolen vehicle reporting system.
According to the report, this is quite common these days. Scary thought!