The Rockingham County Sheriff's Division in Wentworth, N.C., is among the many legislation enforcement businesses the AP discovered utilizing the Fog Reveal location monitoring software. AP Photograph/Allen G. Breed
Authorities businesses and personal safety corporations within the U.S. have discovered an economical technique to interact in warrantless surveillance of people, teams and locations: a pay-for-access internet software referred to as Fog Reveal.
The software allows legislation enforcement officers to see “patterns of life” – the place and when folks work and reside, with whom they affiliate and what locations they go to. The software’s maker, Fog Knowledge Science, claims to have billions of information factors from over 250 million U.S. cellular units.
Fog Reveal got here to gentle when the Digital Frontier Basis (EFF), a nonprofit that advocates for on-line civil liberties, was investigating location knowledge brokers and uncovered this system by a Freedom of Info Act request. EFF’s investigation discovered that Fog Reveal allows legislation enforcement and personal corporations to determine and monitor folks and monitor particular locations and occasions, like rallies, protests, locations of worship and well being care clinics. The Related Press discovered that almost two dozen authorities businesses throughout the nation have contracted with Fog Knowledge Science to make use of the software.
Authorities use of Fog Reveal highlights a problematic distinction between knowledge privateness legislation and digital surveillance legislation within the U.S. It’s a distinction that creates a kind of loophole, allowing monumental portions of private knowledge to be collected, aggregated and utilized in methods that aren’t clear to most individuals. That distinction is much extra essential within the wake of the Supreme Courtroom’s Dobbs v. Jackson Ladies’s Well being Group choice, which revoked the constitutional proper to an abortion. Dobbs places the privateness of reproductive well being info and associated knowledge factors, together with related location knowledge, in vital jeopardy.
The trove of private knowledge Fog Knowledge Science is promoting, and authorities businesses are shopping for, exists as a result of ever-advancing applied sciences in sensible units acquire more and more huge quantities of intimate knowledge. With out significant alternative or management on the consumer’s half, sensible gadget and app makers acquire, use and promote that knowledge. It’s a technological and authorized dilemma that threatens particular person privateness and liberty, and it’s a downside I’ve labored on for years as a practising lawyer, researcher and legislation professor.
Authorities surveillance
U.S. intelligence businesses have lengthy used know-how to interact in surveillance packages like PRISM, accumulating knowledge about people from tech corporations like Google, notably since 9/11 – ostensibly for nationwide safety causes. These packages sometimes are approved by and topic to the Overseas Intelligence Surveillance Act and the Patriot Act. Whereas there’s crucial debate concerning the deserves and abuses of those legal guidelines and packages, they function below a modicum of courtroom and congressional oversight.
Home legislation enforcement businesses additionally use know-how for surveillance, however typically with better restrictions. The U.S. Supreme Courtroom has dominated that the Structure’s Fourth Modification, which protects towards unreasonable search and seizure, and federal digital surveillance legislation require home legislation enforcement businesses to acquire a warrant earlier than monitoring somebody’s location utilizing a GPS gadget or cell web site location info.
Fog Reveal is one thing else fully. The software – made doable by sensible gadget know-how and that distinction between knowledge privateness and digital surveillance legislation protections – permits home legislation enforcement and personal entities to purchase entry to compiled knowledge about most U.S. cell phones, together with location knowledge. It allows monitoring and monitoring of individuals on an enormous scale with out courtroom oversight or public transparency. The corporate has made few public feedback, however particulars of its know-how have come out by the referenced EFF and AP investigations.
Fog Reveal’s knowledge
Each smartphone has an promoting ID – a collection of numbers that uniquely identifies the gadget. Supposedly, promoting IDs are nameless and never linked on to the subscriber’s identify. In actuality, that might not be the case.
Non-public corporations and apps harness smartphones’ GPS capabilities, which give detailed location knowledge, and promoting IDs, in order that wherever a smartphone goes and any time a consumer downloads an app or visits a web site, it creates a path. Fog Knowledge Science says it obtains this “commercially accessible knowledge” from knowledge brokers, allowing the software to comply with units by their promoting IDs. Whereas these numbers don’t include the identify of the telephone’s consumer, they will simply be traced to properties and workplaces to assist police determine the consumer and set up pattern-of-life analyses.
Fog Reveal permits customers to see {that a} particular cell phone was at a selected place at a selected time.
Digital Frontier Basis, CC BY
Legislation enforcement use of Fog Reveal places a highlight on that loophole between U.S. knowledge privateness legislation and digital surveillance legislation. The opening is so massive that – regardless of Supreme Courtroom rulings requiring a warrant for legislation enforcement to make use of GPS and cell web site knowledge to trace individuals – it’s not clear whether or not legislation enforcement use of Fog Reveal is illegal.
Digital surveillance vs. knowledge privateness
Digital surveillance legislation protections and knowledge privateness imply two very various things within the U.S. There are strong federal digital surveillance legal guidelines governing home surveillance. The Digital Communications Privateness Act regulates when and the way home legislation enforcement and personal entities can “wiretap,” i.e., intercept an individual’s communications, or monitor an individual’s location.
Coupled with Fourth Modification protections, ECPA typically requires legislation enforcement businesses to get a warrant based mostly on possible trigger to intercept somebody’s communications or monitor somebody’s location utilizing GPS and cell web site location info. Additionally, ECPA permits an officer to get a warrant solely when the officer is investigating sure crimes, so the legislation limits its personal authority to allow surveillance of solely critical crimes. Violation of ECPA is a criminal offense.
The overwhelming majority of states have legal guidelines that mirror ECPA, though some states, like Maryland, afford residents extra protections from undesirable surveillance.
The Fog Reveal software raises monumental privateness and civil liberties issues, but what it’s promoting – the power to trace most individuals always – could also be permissible as a result of the U.S. lacks a complete federal knowledge privateness legislation. ECPA permits interceptions and digital surveillance when an individual consents to that surveillance.
With little in the best way of federal knowledge privateness legal guidelines, as soon as somebody clicks “I agree” on a pop-up field, there are few limitations on personal entities’ assortment, use and aggregation of consumer knowledge, together with location knowledge. That is the loophole between knowledge privateness and digital surveillance legislation protections, and it creates the framework that underpins the large U.S. knowledge sharing market.
AP investigative journalist Garance Burke explains how she and her colleagues uncovered legislation enforcement use of Fog Reveal.
The necessity for knowledge privateness legislation
With out strong federal knowledge privateness safeguards, sensible gadget producers, app makers and knowledge brokers will proceed, unfettered, to make the most of sensible units’ subtle sensing applied sciences and GPS capabilities to gather and commercially combination huge portions of intimate and revealing knowledge. Because it stands, that knowledge trove might not be shielded from legislation enforcement businesses. However the permitted business use of promoting IDs to trace units and customers with out significant discover and consent may change if the American Knowledge Privateness Safety Act, authorized by the U.S. Home of Representatives Committee on Vitality and Commerce by a vote of 53-2 on July 20, 2022, passes.
ADPPA’s future is unsure. The app business is strongly resisting any curtailment of its knowledge assortment practices, and a few states are resisting ADPPA’s federal preemption provision, which may reduce the protections afforded through state knowledge privateness legal guidelines. For instance, Nancy Pelosi, speaker of the U.S. Home of Representatives, has stated lawmakers might want to handle issues from California that the invoice overrides the state’s stronger protections earlier than she is going to name for a vote on ADPPA.
The stakes are excessive. Current legislation enforcement investigations spotlight the real-world penalties that move from the shortage of strong knowledge privateness safety. Given the Dobbs ruling, these conditions will proliferate absent congressional motion.
Present member of IEEE-USA, serving on its AI Coverage Committee, and Co-Chair of its Privateness, Fairness, and Justice in AI Subcommittee.
Prior grant analysis work contains: funding from Nationwide Safety Company (NSA) as a part of the Nationwide Initiatives in Cyber Training to develop an open entry course, "Cyberlaw: Coverage & Operations" since revealed nationwide by NSA; and funding from U.S. Division of Justice's Workplace of Neighborhood Oriented Policing Providers to investigate, through revealed authorized memos, problems with privateness, Constitutional rights, and different authorized points in the usage of UAVs (drones) by home legislation enforcement.
