By GARANCE BURKE and JASON DEAREN
September 1, 2022 GMT
https://apnews.com/article/technology-police-government-surveillance-d395409ef5a8c6c3f6cdab5b1d0e27ef
Local law enforcement agencies from suburban Southern California to rural North Carolina have been using an obscure cell phone tracking tool, sometimes without search warrants, that gives them the power to track people’s movements months back in time, according to public records and internal emails obtained by The Associated Press.
Police have used “Fog Reveal” to search hundreds of billions of records from 250 million mobile devices and leveraged the data to create location analytics known to law enforcement as “life patterns,” according to thousands of pages of records about the company.
Sold by Virginia-based Fog Data Science LLC, Fog Reveal has been used since at least 2018 in criminal investigations ranging from the murder of a nurse in Arkansas to tracking the movements of a possible participant in the insurrection of January 6 in the Capitol. The tool is rarely, if ever, mentioned in court records, which defense attorneys say makes it more difficult for them to properly defend their clients in cases where the technology has been used.
The company was developed by two former high-ranking officials of the Department of Homeland Security under former President George W. Bush. It relies on advertising ID numbers, which Fog officials say are obtained from popular cellphone apps like Waze, Starbucks and hundreds of others that target ads based on movements and interests of one person, according to police emails. This information is then sold to companies like Fog.
“It’s kind of a mass surveillance program on a budget,” said Bennett Cyphers, special counsel to the Electronic Frontier Foundation, a digital privacy rights group.
_____
This story, supported by the Pulitzer Center for Crisis Reporting, is part of an ongoing Associated Press series, “Tracked,” that investigates the power and consequences of algorithm-driven decisions in people’s everyday lives .
____
EFF obtained the documents and emails through Freedom of Information Act requests. The group shared the files with The AP, which independently found that Fog sold its software in about 40 contracts to nearly two dozen agencies, according to GovSpend, a company that tracks government spending. The AP records and reports provide the first public account of the extensive use of Fog Reveal by local police, according to analysts and legal experts who examine the technologies.
Federal oversight of companies like Fog is an evolving legal landscape. On Monday, the Federal Trade Commission sued a data broker called Kochava that, like Fog, provides its clients with advertising identifiers that authorities say can easily be used to find where a mobile device user lives, violating rules that the commission applies. And now there are bills before Congress that, if passed, would regulate the industry.
“Local law enforcement is on the front lines of trafficking and missing persons cases, but these departments are often behind in technology adoption,” Matthew Broderick, Fog’s managing partner, said in an email . “We fill a gap for underfunded and understaffed departments.”
However, due to the secrecy surrounding Fog, there are few details about its use and most law enforcement agencies will not discuss it, raising concerns among privacy advocates that it violates the Fourth Amendment to the Constitution of the US, which protects against unreasonable search and seizure. .
What sets Fog Reveal apart from other cell phone tracking technologies used by police is that it tracks devices through their advertising identifiers, unique numbers assigned to each device. These numbers do not contain the name of the phone user, but can be traced to homes and workplaces to help police establish patterns of life.
“The ability he had to educate anyone in an area, whether in public or at home seemed to me to be a very clear violation of the Fourth Amendment,” said Davin Hall, a former crime data analysis supervisor for Greensboro . , North Carolina, Police Department. “I just feel angry and betrayed and lied to.”
Hall resigned in late 2020 after months of raising concerns about the department’s use of Fog to police attorneys and city council.
Although Greensboro officials acknowledged Fog’s use and initially defended it, the police department said it allowed its membership to expire earlier this year because it did not “independently benefit investigations.” .
But US federal, state and local police agencies continue to use Fog with very little public accountability. Local police agencies have been enticed by Fog’s affordability: it can start as low as $7,500 a year. And some departments that authorize it have shared access with other nearby law enforcement agencies, the emails show.
Police departments also like how quickly they can access Fog’s detailed location information. Geofence safeguards, which use GPS and other sources to track a device, are accessed by obtaining this data from companies such as Google or Apple. That requires police to get a warrant and ask tech companies for the specific data they want, which can take days or weeks.
Using Fog’s data, which the company says is anonymized, police can geosearch an area or search by the ad identification numbers of a specific device, according to a user agreement obtained by the AP. But Fog maintains that “we have no way of tying the signals to a specific device or owner,” according to a sales representative who emailed the California Highway Patrol in 2018, after a lieutenant asked if the tool could be used legally.
You may know that your mobile phone has a unique code that allows advertisers to target you for promotions. What you might not know: That same number could be helping the police surveil you without a warrant. (AP Video: Allen Breed, Haven Daley)
Despite these privacy assurances, records show that law enforcement can use Fog’s data as a lead to find identifying information. “There is no (personal information) linked to the (ad ID),” a Missouri official wrote about Fog in 2019. “But if we’re good at what we do, we should be able to figure out the owner.”
Fog’s Broderick said in an email that the company does not have access to people’s personal information and relies on “commercial data without usage restrictions” from data brokers “who legitimately acquire data of applications in accordance with their legal agreements”. The company declined to share information about how many law enforcement agencies it works with.
“We are confident that law enforcement has the responsible leadership, constraints, and policy guidance at the municipal, state, and federal levels to ensure that any law enforcement tools and methods are used appropriately in accordance with the laws of their respective jurisdictions,” Broderick said. in the email.
“No search warrants are required for the use of public data,” it added Thursday, saying the data its product provides is “lead data” and should not be used to establish probable cause .
___
Kevin Metcalf, the prosecutor for Washington County, Arkansas, said he has used Fog Reveal without a warrant, especially in “exigent circumstances.” In these cases, the law provides an exemption from warrants when a crime in progress endangers people or an officer.
Metcalf also leads the National Child Protection Task Force, a nonprofit organization that fights child exploitation and trafficking. Fog is listed on its website as a task force sponsor, and a company executive chairs the nonprofit’s board. Metcalf said Fog has been invaluable in solving cases of missing children and homicides.
“We push the boundaries, but we do it in a way that targets the bad guys,” he said. “Time is of the essence in these situations. We cannot wait for the traditional search warrant route.”
The fog was successfully used in the murder case of nurse Sydney Sutherland, 25, who was last seen jogging near Newport, Arkansas, before she disappeared, Metcalf said.
Police had little evidence to go on when they found his phone in a ditch, so Metcalf said he shared his agency’s access to Fog with the U.S. Marshals Service to find out what other devices had been nearby at the time she was killed. He said Fog helped lead authorities to arrest a farmer in Sutherland’s August 2020 rape and murder, but its use was not documented in court records reviewed by the AP.
Cyphers, who led EFF’s public records work, said there has been no previous record of companies selling this kind of granular data directly to local law enforcement.
“We’re seeing counties with less than 100,000 people where the sheriff is using this secretive, extremely invasive, high-tech surveillance tool to go after local crime,” Cyphers said.
One such client is the sheriff’s office in rural Rockingham County, North Carolina, population 91,000 and just north of Greensboro, where Hall still lives. The county bought a one-year license for $9,000 last year and recently renewed it.
“Rockingham County is small population-wise. It never ceases to amaze me how small agencies will collect tools they don’t need, and nobody needs,” Hall said.
Sheriff’s spokesman Lt. Kevin Suthard confirmed the department recently renewed its license, but declined to provide specifics about the use of Fog Reveal or how the office protects people’s rights.
“Because then it would be less effective, as criminals might be aware that we have the device and adjust their commission of crimes accordingly. Does that make sense?” Suthard said.
Fog has aggressively marketed its tool to police, even beta testing it with law enforcement, records show. The Dallas Police Department purchased a Fog license in February after…