With increasing frequency, law enforcement has been using unconstitutional, suspicionless digital dragnet searches in an attempt to identify unknown suspects in criminal cases. Whether these searches are for everyone who was near a building where a crime occurred or who searched for a keyword like “bomb” or who shares genetic data with a crime scene DNA sample, 2021 saw more and more of these searches—and more attempts to push back and rein in unconstitutional law enforcement behavior.
While dragnet searches were once thought to be just the province of the NSA, they are now easier than ever for domestic law enforcement to conduct as well. This is because of the massive amounts of digital information we share—knowingly or not—with companies and third parties. This data, including information on where we’ve been, what we’ve searched for, and even our genetic makeup, is stored in vast databases of consumer-generated information, and law enforcement has ready access to it—frequently without any legal process. All of this consumer data allows police to, essentially, pluck a suspect out of thin air.
EFF has been challenging unconstitutional dragnet searches for years, and we’re now seeing greater awareness and pushback from other organizations, judges, legislators, and even some companies. This post will summarize developments in 2021 on one type of dragnet suspicionless search—reverse location data searches.
Reverse location searches allow the police to identify every device in a given geographic area during a specific period of time in the past as well as to track people’s paths of travel. Geographic areas can include city blocks full of people unconnected to the crime, including those living in private residences and driving on busy streets.
Unlike ordinary searches for electronic records, which identify a suspect, account, or device in advance of the search, reverse location searches essentially work backward by scooping up the location data from every device in hopes of finding one that might be linked to the crime. The searches therefore allow the government to examine the data from potentially hundreds or thousands of individuals wholly unconnected to any criminal activity and give law enforcement unlimited discretion to try to pinpoint suspect devices—discretion that can be deployed arbitrarily and invidiously.
Two main types of reverse location searches gained prominence in 2021: Geofence warrants and searches of location data generated by device applications and aggregated and sold by data brokers.
The first type of search, a “geofence warrant,” is primarily directed at Google. Through these warrants, police are able to access precise location data on the vast majority of Android device users and other Google account holders (including iPhone users). This data comes from wifi connections, GPS and Bluetooth signals, and cellular networks and allows Google to estimate a device’s location to within 20 meters or less. Using the data, Google can infer where a user has been, the path they took to get there, and what they were doing at the time. Google appears to be disclosing location data only in response to court-authorized warrants.
In 2021, we learned more about just how prevalent the use of geofence warrants has become. Over the summer, Google released a transparency report showing it had received approximately 20,000 geofence warrants between 2018 and 2020. The vast majority of these warrants (95.6%) came from state and local police agencies, with nearly 20% of all state requests coming solely from agencies in California. The report also shows that many states have ramped up their use of geofence warrants exponentially over the last couple years—in 2018, California issued 209 geofence warrant requests, but in 2020, it issued 1,909. Each of these requests can reveal the location of thousands of devices. Geofence requests now constitute more than a quarter of the total number of all warrants Google receives. This is especially concerning because police are continuing to use these warrants even for minor crimes. And, as The Markup discovered following Google’s report, agencies have been less than transparent about their use of this search technique—there are huge discrepancies between Google’s geofence warrant numbers and the data that California police agencies are disclosing to the state—data that they are explicitly required to report under state law.
In 2021, we also learned more about searches of aggregated app-generated location data. With this second type of reverse location search, the government is able to access location data generated by many of the applications on users’ phones. This data is purportedly deidentified and then aggregated and sold to various shady and secretive data brokers who re-sell it to other data brokers and companies and to the government. Unlike geofence warrants directed to Google, neither the data brokers nor the government seem to think any legal process at all is required to access these vast treasure troves of data—data that the New York Times described as “accurate to within a few yards and in some cases updated more than 14,000 times a day.” And although the data brokers argue the data has been anonymized, data like this is notoriously easy to re-identify.
In 2020, we learned that several federal agencies, including DHS, the IRS, and the U.S. military, purchased access to this location data and used it for law enforcement investigations and immigration enforcement. In 2021, we started to learn more about how this data is shared with state and local agencies as well. For example, data broker Veraset shared raw, individually-identifiable GPS data with the Washington DC local government, providing the government with six months of regular updates about the locations of hundreds of thousands of people as they moved about their daily lives. Ostensibly, this data was meant to be used for COVID research, but there appears to have been nothing that truly prevented the data from ending up in the hands of law enforcement. We also learned that the Illinois Department of Transportation (IDOT) purchased access to precise geolocation data about over 40% of the state’s population from Safegraph, a controversial data broker later banned from Google’s app store. For just $49,500, the agency got access to two years’ worth of raw location data. The dataset consisted of over 50 million “pings” per day from over 5 million users, and each data point contained precise latitude and longitude, a timestamp, a device type, and a so-called “anonymized” device identifier. We expect to find many more examples of this kind of data sharing as we further pursue our location data transparency work in 2022.
There is more and more evidence that data available through reverse location searches can be used to track protestors, invade people’s privacy, and falsely associate people with criminal activity. In 2021, we saw several examples of law enforcement trolling Google location data to identify people in mass gatherings, including many who were likely engaged in First Amendment protected political protests. The FBI requested geofence warrants to identify individuals involved in the January 6 riot at the U.S. Capitol. Minneapolis police used geofence warrants around the time of the protests following the police killing of George Floyd, catching an innocent bystander who was filming the protests. And ATF used at least 12 geofence warrants to identify people in the protests in Kenosha, Wisconsin following the police shooting of Jacob Blake. One of these warrants encompassed a third of a major public park for a two-hour window during the protests.
In 2021, we also saw efforts to push back on the increasingly indiscriminate use of these search techniques. We called on Google to both fight geofence warrants and to be much more transparent about the warrants it’s receiving, as did the Surveillance Technology Oversight Project and a coalition of 60 other organizations. Both Google and Apple pushed back on shady location data aggregators by banning certain SDKs from their app stores and kicking out at least one location data broker entirely.
There were other efforts in both the courts and legislatures. While we are still waiting on rulings in two criminal cases involving geofence warrants: People v. Dawes, (we filed an amicus brief), and United States v. Chatrie (a case being litigated by the National Association of Criminal Defense Lawyers), judges in other parts of the country have been proactive on these issues. In 2021, a Kansas federal magistrate judge issued a public order denying a government request for a geofence warrant, joining several other judges from Illinois who issued a series of similar orders in 2020. All of these judges held that the government’s geofence requests were overbroad and failed to meet the Fourth Amendment’s particularity and probable cause requirements, and one judge chided the government publicly, stating:
[t]he government’s undisciplined and overuse of this investigative technique in run-of-the-mill cases that present no urgency or imminent danger poses concerns to our collective sense of privacy and trust in law enforcement officials.
We’re hoping the judges in Dawes and Chatrie follow these magistrate judges and find those respective geofence orders unconstitutional as well.
In the meantime, however, the Fourth Circuit Court of Appeals, sitting en banc, issued a great ruling over the summer in a case that could have ramifications for reverse location searches. In Leaders of a Beautiful Struggle v. Baltimore Police Department, the court held that Baltimore’s use of aerial surveillance that could track the movements of every person and vehicle across the city violated the Fourth Amendment. We filed an amicus brief in the case. The court recognized that, even if the surveillance program only collected data in “shorter snippets of several hours or less,” that was “enough to yield ‘a wealth of detail’ greater than the sum of the individual trips” and to create an “encyclopedic’” record of where those people came and went. Also, crucially, the court recognized that, even if people were not directly identifiable from the footage alone, police could distinguish individuals and deduce identity from their patterns of travel and through cross-referencing other surveillance footage like ALPR and security cameras. This was sufficient to create a Fourth Amendment violation. Like the reverse location searches discussed in this post, police could have used the Baltimore program to identify everyone who was in a given area in the past, so the ruling in this case will be important for our legal work in 2022 and beyond.
Finally, in 2021 we also saw legislative efforts to curb the use of reverse location search techniques. We strongly supported the federal “Fourth Amendment is Not For Sale Act,” introduced by Senator Ron Wyden, which would close loopholes in existing surveillance laws to prohibit federal law enforcement and intelligence agencies from purchasing location data (and other types of data) on people in the United States and Americans abroad. The bill has bipartisan support and 20 co-sponsors in the Senate, and a companion bill has been introduced in the House. We also supported a state bill in New York that would outright ban all reverse location searches and reverse keyword searches. This bill was reintroduced for the 2021-2022 legislative session and is currently in committee. We’re waiting to see what happens with both of these bills, and we hope to see more legislation like this introduced in other states in 2022.
The problem of suspicionless dragnet searches is not going away anytime soon, unfortunately. Given this, we will continue our efforts to hold the government and companies accountable for unconstitutional data sharing and digital dragnet searches throughout 2022 and beyond.
This article is part of our Year in Review series. Read other articles about the fight for digital rights in 2021.
In this guest post by the Coalition Against Stalkerware marking its second anniversary, the international alliance takes a look back on its achievements while seeing a lot of challenges ahead.Two years ago, in November 2019, the Coalition Against Stalkerware was founded by 10 organizations. Today, there are more than…
Washington, D.C.—The Electronic Frontier Foundation (EFF) today urged the Supreme Court today to review and reverse a lower court decision in United States v. Tuggle finding that police didn’t need a warrant to secretly record all activity in front of someone’s home 24 hours a day, for a…
In the first weeks of the COVID-19 pandemic, a location data broker called Veraset offered officials in Washington, DC full access to its proprietary database of “highly sensitive” device-level GPS data, collected from cell phones, for the entire DC metro area.The officials accepted the offer, according to public…
The Marin County Sheriff illegally shares the sensitive location information of millions of drivers with out-of-state and federal agencies, including Immigration and Customs Enforcement (ICE) and Customs and Border Protection (CBP). The Sheriff uses automated license plate readers (ALPRs)—high-speed cameras mounted on street poles or squad cars—to scan license…
San Francisco—Community activists in Northern California today sued Marin County Sheriff Robert Doyle for illegally sharing millions of local drivers’ license plates and location data, captured by a network of cameras his office uses, with hundreds of federal and out-of-state agencies—a practice that violates two California laws, endangers the…
The tech companies behind the so-called “sharing economy” have drawn the ire of brick-and-mortar businesses and local governments across the country. For example, take-out apps such as GrubHub and UberEats have grown into a hundred-billion-dollar industry over the past decade, and received a further boost as many sit-down restaurants…
EFF would like to thank former intern Haley Amster for drafting this post, and former legal fellow Nathan Sobel for his assistance in editing it.The Fourth Amendment requires authorities to target search warrants at particular places or things—like a home, a bank deposit box, or a cell phone—and only when…
San Francisco—The Electronic Frontier Foundation and the ACLU of Northern and Southern California today asked a federal appeals court to reinstate a lawsuit they filed on behalf of electric scooter riders challenging the constitutionality of Los Angeles’ highly privacy-invasive collection of detailed trip data and real-time locations and routes…
Back to top
Menu
