Tech instrument provides police ‘mass surveillance on a finances’


By GARANCE BURKE and JASON DEAREN

September 2, 2022 GMT

Native legislation enforcement companies from suburban Southern California to rural North Carolina have been utilizing an obscure cellphone monitoring instrument, at instances with out search warrants, that offers them the ability to comply with individuals’s actions months again in time, based on public information and inner emails obtained by The Related Press.

Police have used “Fog Reveal” to look lots of of billions of information from 250 million cellular units, and harnessed the information to create location analyses recognized amongst legislation enforcement as “patterns of life,” based on 1000’s of pages of information in regards to the firm.

Bought by Virginia-based Fog Information Science LLC, Fog Reveal has been used since a minimum of 2018 in felony investigations starting from the homicide of a nurse in Arkansas to tracing the actions of a possible participant within the Jan. 6 rebel on the Capitol. The instrument isn’t, if ever, talked about in court docket information, one thing that protection attorneys say makes it tougher for them to correctly defend their purchasers in instances through which the expertise was used.

The corporate was developed by two former high-ranking Division of Homeland Safety officers below former President George W. Bush. It depends on promoting identification numbers, which Fog officers say are culled from fashionable cellphone apps equivalent to Waze, Starbucks and lots of of others that concentrate on adverts based mostly on an individual’s actions and pursuits, based on police emails. That data is then bought to firms like Fog.

“It’s type of a mass surveillance program on a finances,” stated Bennett Cyphers, a particular adviser on the Digital Frontier Basis, a digital privateness rights advocacy group.

_____

This story, supported by the Pulitzer Heart on Disaster Reporting, is a part of an ongoing Related Press collection, “Tracked,” that investigates the ability and penalties of selections pushed by algorithms on individuals’s on a regular basis lives.

____

The paperwork and emails had been obtained by EFF via Freedom of Data Act requests. The group shared the information with The AP, which independently discovered that Fog bought its software program in about 40 contracts to just about two dozen companies, based on GovSpend, an organization that retains tabs on authorities spending. The information and AP’s reporting present the primary public account of the intensive use of Fog Reveal by native police, based on analysts and authorized specialists who scrutinize such applied sciences.

Federal oversight of firms like Fog is an evolving authorized panorama. On Monday, the Federal Commerce Fee sued a knowledge dealer known as Kochava that, like Fog, offers its purchasers with promoting IDs that authorities say can simply be used to search out the place a cellular machine consumer lives, which violates guidelines the fee enforces. And there are payments earlier than Congress now that, if handed, would regulate the trade.

“Native legislation enforcement is on the entrance traces of trafficking and lacking individuals instances, but these departments are sometimes behind in expertise adoption,” Matthew Broderick, a Fog managing associate, stated in an electronic mail. “We fill a niche for underfunded and understaffed departments.”

Due to the secrecy surrounding Fog, nonetheless, there are scant particulars about its use and most legislation enforcement companies received’t talk about it, elevating issues amongst privateness advocates that it violates the Fourth Modification to the U.S. Structure, which protects towards unreasonable search and seizure.

What distinguishes Fog Reveal from different cellphone location applied sciences utilized by police is that it follows the units via their promoting IDs, distinctive numbers assigned to every machine. These numbers don’t comprise the title of the telephone’s consumer, however might be traced to houses and workplaces to assist police set up pattern-of-life analyses.

“The potential that it had for mentioning simply anyone in an space whether or not they had been in public or at house appeared to me to be a really clear violation of the Fourth Modification,” stated Davin Corridor, a former crime knowledge evaluation supervisor for the Greensboro, North Carolina, Police Division. “I simply really feel indignant and betrayed and lied to.”

Corridor resigned in late 2020 after months of voicing issues in regards to the division’s use of Fog to police attorneys and town council.

Whereas Greensboro officers acknowledged Fog’s use and initially defended it, the police division stated it allowed its subscription to run out earlier this yr as a result of it didn’t “independently profit investigations.”

However federal, state and native police companies across the U.S. proceed to make use of Fog with little or no public accountability. Native police companies have been enticed by Fog’s reasonably priced value: It might begin as little as $7,500 a yr. And a few departments that license it have shared entry with different close by legislation enforcement companies, the emails present.

Police departments additionally like how shortly they will entry detailed location data from Fog. Geofence warrants, which faucet into GPS and different sources to trace a tool, are accessed by acquiring such knowledge from firms, like Google or Apple. This requires police to acquire a warrant and ask the tech firms for the precise knowledge they need, which may take days or perhaps weeks.

Utilizing Fog’s knowledge, which the corporate claims is anonymized, police can geofence an space or search by a particular machine’s advert ID numbers, based on a consumer settlement obtained by AP. However, Fog maintains that “we have now no means of linking indicators again to a particular machine or proprietor,” based on a gross sales consultant who emailed the California Freeway Patrol in 2018, after a lieutenant requested whether or not the instrument might be legally used.

Regardless of such privateness assurances, the information present that legislation enforcement can use Fog’s knowledge as a clue to search out figuring out data. “There isn’t any (private data) linked to the (advert ID),” wrote a Missouri official about Fog in 2019. “But when we’re good at what we do, we must always have the ability to work out the proprietor.”

Fog’s Broderick stated in an electronic mail that the corporate doesn’t have entry to individuals’s private data, and attracts from “commercially accessible knowledge with out restrictions to make use of,” from knowledge brokers “that legitimately buy knowledge from apps in accordance with their authorized agreements.” The corporate refused to share details about what number of police companies it really works with.

“We’re assured Regulation Enforcement has the accountable management, constraints, and political steerage on the municipal, state, and federal degree to make sure that any legislation enforcement instrument and technique is appropriately utilized in accordance with the legal guidelines of their respective jurisdictions,” Broderick stated within the electronic mail.

“Search warrants should not required for using the general public knowledge,” he added Thursday, saying that the information his product provides legislation enforcement is “lead knowledge” and shouldn’t be used to determine possible trigger.

___

Kevin Metcalf, a prosecutor in Washington County, Arkansas, stated he has used Fog Reveal with out a warrant, particularly in “exigent circumstances.” In these instances, the legislation offers a warrant exemption when a crime-in-process endangers individuals or an officer.

Metcalf additionally leads the Nationwide Youngster Safety Job Drive, a nonprofit that combats youngster exploitation and trafficking. Fog is listed on its web site as a job pressure sponsor and an organization government chairs the nonprofit’s board. Metcalf stated Fog has been invaluable to cracking lacking youngsters instances and homicides.

“We push the bounds, however we do them in a means that we goal the unhealthy guys,” he stated. “Time is of the essence in these conditions. We are able to’t wait on the standard search warrant route.”

Fog was used efficiently within the homicide case of 25-year-old nurse Sydney Sutherland, who had final been seen jogging close to Newport, Arkansas, earlier than she disappeared, Metcalf stated.

Police had little proof to go on once they discovered her telephone in a ditch, so Metcalf stated he shared his company’s entry to Fog with the U.S. Marshals Service to determine which different units had been close by on the time she was killed. He stated Fog helped lead authorities to arrest a farmer in Sutherland’s rape and homicide in August 2020, however its use was not documented in court docket information reviewed by AP.

Cyphers, who led EFF’s public information work, stated there hasn’t been any earlier report of firms promoting this type of granular knowledge on to native legislation enforcement.

“We’re seeing counties with lower than 100,000 individuals the place the sheriff is utilizing this extraordinarily excessive tech, extraordinarily invasive, secretive surveillance instrument to chase down native crime,” Cyphers stated.

One such buyer is the sheriff’s workplace in rural Rockingham County, North Carolina, inhabitants 91,000 and simply north of Greensboro, the place Corridor nonetheless lives. The county purchased a one-year license for $9,000 final yr and just lately renewed it.

“Rockingham County is tiny by way of inhabitants. It by no means ceases to amaze me how small companies will scoop up instruments that they only completely don’t want, and no person wants this one,” Corridor stated.

Sheriff’s spokesman Lt. Kevin Suthard confirmed the division just lately renewed its license however declined to supply specifics about using Fog Reveal or how the workplace protects people’ rights.

“As a result of it could then be much less efficient as criminals might be cognizant that we have now the machine and alter their fee of the crimes accordingly. Make sense?” Suthard stated.

Fog has aggressively marketed its instrument to police, even beta testing it with legislation enforcement, information present. The Dallas Police Division purchased a Fog license in February after getting a free trial and “seeing an illustration and listening to of success tales from the corporate,” Senior Cpl. Melinda Gutierrez, a division spokeswoman, stated in an electronic mail.

Fog’s instrument is accessed via an online portal. Investigators can enter a criminal offense scene’s coordinates into the database, which brings again search outcomes exhibiting a tool’s Fog ID, which relies on its distinctive advert ID quantity.

Police can see which machine IDs had been discovered close to the placement of the crime. Detectives or different officers may also search the placement for IDs going ahead from the time of the crime and again a minimum of 180 days, based on the corporate’s consumer license settlement.

The emails and Fog’s Broderick contend the instrument can really search again years, nonetheless. Emails from a Fog consultant to Florida and California legislation enforcement companies stated the instrument’s knowledge stretched again so far as June 2017. On Thursday Broderick, who had beforehand refused to handle the query, stated it “solely has a 3 yr attain again.”

Whereas the information doesn’t immediately establish who owns a tool, the corporate typically provides legislation enforcement data it wants to attach it to addresses and different clues that assist detectives work out individuals’s identities, based on firm representatives’ emails.

It’s unclear how Fog makes these connections, however an organization it refers to as its “knowledge associate” known as Venntel, Inc. has entry to a fair better trove of customers’ cellular knowledge.

Venntel is a big dealer that has provided location knowledge to companies equivalent to Immigration and Customs Enforcement and the FBI. The Division of Homeland Safety’s watchdog is auditing how the places of work below its management have used industrial knowledge. That comes after some Democratic lawmakers requested it to analyze U.S. Customs and Border Safety’s use of Venntel knowledge to trace individuals with out a search warrant in 2020. The corporate additionally has confronted congressional inquiries about privateness issues tied to federal legislation enforcement companies’ use of its knowledge.

Venntel and Fog work carefully collectively to help police detectives throughout investigations, emails present. Their advertising brochures are practically equivalent, too, and Venntel workers has really useful Fog to legislation enforcement, based on the emails. Venntel stated “the confidential nature of our enterprise relationships” prevented it from responding to AP’s particular questions, and Fog wouldn’t touch upon the connection.

Whereas Fog says in its advertising supplies that it collects knowledge from 1000’s of apps, like Starbucks and Waze, firms should not at all times conscious of who’s utilizing their knowledge. Venntel and Fog can accumulate billions of information factors crammed with detailed data as a result of many apps embed invisible monitoring software program that follows customers’ habits. This software program additionally lets the apps promote personalized adverts which might be focused to an individual’s present location. In flip, knowledge brokers’ software program can hoover up private knowledge that can be utilized for different functions.

Previous to publication, Fog’s Broderick refused to say how the corporate bought knowledge from Starbucks and Waze. However on Thursday, he stated he didn’t understand how knowledge aggregators collected the knowledge Fog Reveal attracts from, or the precise apps from which the information was drawn.

For his or her half, Starbucks and Waze denied any relationship to Fog. Starbucks stated it had not given permission to its enterprise companions to share buyer data with Fog.

“Starbucks has not authorised Advert ID knowledge generated by our app for use on this means by Fog Information Science LLC. In our evaluation so far, we have now no relationship with this firm,” stated Megan Adams, a Starbucks spokesperson.

“We have now by no means had a relationship with Fog Information Science, haven’t labored with them in any capability, and haven’t shared data with them,” a Waze spokesperson stated.

___

Fog Information Science LLC is headquartered in a nondescript brick constructing in Leesburg, Virginia. It additionally has associated entities in New Jersey, Ohio and Texas.

It was based in 2016 by Robert Liscouski, who led the Division of Homeland Safety’s Nationwide Cyber Safety Division within the George W. Bush adminstration. His colleague, Broderick, is a former U.S. Marine brigadier basic who ran DHS’ tech hub, the Homeland Safety Operations Heart, throughout Hurricane Katrina in 2005. A Home bipartisan committee report cited Broderick amongst others for failing to coordinate a swift federal response to the lethal hurricane. Broderick resigned from DHS shortly thereafter.

In advertising supplies, Fog additionally has touted its capability to supply police “predictive analytics,” a buzzword typically used to explain high-tech policing instruments that purport to foretell crime hotspots. Liscouski and one other Fog official have labored at firms centered on predictive analytics, machine studying and software program platforms supporting synthetic intelligence.

“It’s able to delivering each forensic and predictive analytics and close to real-time insights on the each day actions of the individuals recognized with these cellular units,” reads an electronic mail saying a Fog coaching final yr for members of the Nationwide Fusion Heart Affiliation, which represents a community of intelligence-sharing partnerships created after the Sept. 11 assaults.

Fog’s Broderick stated the corporate had not invested in predictive functions, and offered no particulars about any makes use of the instrument had for predicting crime.

Regardless of privateness advocates’ issues about warrantless surveillance, Fog Reveal has caught on with native and state police forces. It’s been utilized in a variety of high-profile felony instances, together with one which was the topic of the tv program “48 Hours.”

In 2017, a world-renowned unique snake breeder was discovered useless, mendacity in a pool of blood in his reptile breeding facility in rural Missouri. Police initially thought the breeder, Ben Renick, may need died from a toxic snake chew. However the proof quickly pointed to homicide.

Throughout its investigation, emails present the Missouri State Freeway Patrol used Fog’s portal to seek for cellphones at Renick’s house and breeding facility and zeroed in on a cellular machine. Working with Fog, investigators used the information to establish the telephone proprietor’s id: it was the Renicks’ babysitter.

Police had been capable of log the babysitter’s whereabouts over time to create a sample of life evaluation.

It turned out to be a dead-end lead. Renick’s spouse, Lynlee, later was charged and convicted of the homicide.

Prosecutors didn’t cite Fog in an inventory of different instruments they used within the investigation, based on trial displays examined by the AP.

However Missouri officers appeared happy with Fog’s capabilities, regardless that it didn’t immediately result in an arrest. “It was fascinating to see that the system did choose up a tool that was completely within the space that day. Too unhealthy it didn’t belong to a suspect!” a Missouri State Freeway Patrol analyst wrote in an electronic mail to Fog.

In one other high-profile felony probe, information present the FBI requested state intelligence officers in Iowa for assist with Fog because it investigated potential contributors within the occasions on the U.S. Capitol on Jan. 6.

“Not definitive however nonetheless ready to speak issues over with a FOG rep,” wrote Justin Parker, deputy director of the Iowa Division of Public Security, in an electronic mail to an FBI official in September 2021. It was unclear from the emails if Fog’s knowledge factored into an arrest. Iowa officers didn’t reply and the FBI declined to remark.

___

Metcalf, the Arkansas prosecutor, has argued towards congressional efforts to require search warrants when utilizing applied sciences like Fog Reveal.

He believes People have given up any cheap expectation of privateness once they use free apps and likens EFF’s objections to tech like Fog to a “cult of privateness.”

“I feel individuals are going to should decide on whether or not we would like all this free expertise, we would like all this free stuff, we would like all of the selfies,” he stated. “However we are able to’t have that and on the identical time say, ‘I’m a personal individual, so you’ll be able to’t take a look at any of that.’ That simply appears loopy.”

Though he’s not an official Fog worker, Metcalf stated he would step in to steer coaching classes together with the instrument for federal prosecutors, federal companies and police, together with the Chicago Police Division, the emails present.

That type of hands-on service and word-of-mouth advertising in tight-knit legislation enforcement circles appears to have helped improve Fog’s recognition.

The Maryland State Police is among the many many companies which have had contracts for Fog Reveal, and information present investigators believed it had a whole lot of potential.

“Corporations have receptors throughout. Malls, purchasing facilities, and many others. They’re throughout you,” wrote Sgt. John Bedell of the Prison Enforcement Division, in an electronic mail to a colleague. The company bought a yr of entry to Fog in 2018.

“Image getting a suspect’s telephone then within the extraction having the ability to see everyplace they’d been within the final 18 months plotted on a map you filter by date ranges,” wrote Bedell. “The success lies within the secrecy.”

Elena Russo, a spokesperson for the company, confirmed it had a Fog license beforehand however that it had lapsed. “Sadly, it was not useful in fixing any crimes,” she wrote in an electronic mail.

Nonetheless, as extra native policing companies join Fog, some elected officers stated they’ve been left at nighttime. A number of officers stated there wasn’t sufficient data to know what companies Fog really offers.

“Who is that this firm? What are the observe information? What are the privateness protections?” requested Anaheim council member Jose Moreno, remembering his confusion about Fog throughout a 2020 council assembly. “That evening our chief had little or no data for us.”

In Anaheim, the Fog license was paid for by a federal “City Space Safety Initiative,” DHS grants that assist localities fund efforts to forestall terrorism. A police spokesman stated the division has not used it.

Protection attorneys fear there are few authorized restrictions on legislation enforcement’s use of location knowledge.

It’s a niche police companies exploit, and infrequently don’t disclose in court docket, stated Michael Value, litigation director of the Nationwide Affiliation of Prison Protection Legal professionals’ Fourth Modification Heart.

“(Fog) is exceedingly uncommon to see within the wild as a result of the cops typically don’t get warrants,” stated Value.

“Even for those who do ask for (data) typically they are saying ‘We don’t know what you’re speaking about.’”

Privateness advocates fear Fog’s location monitoring might be put to different novel makes use of, like holding tabs on individuals who search abortions in states the place it’s now unlawful. These issues had been heightened when a Nebraska girl was charged in August with serving to her teenage daughter finish a being pregnant after investigators bought maintain of their Fb messages.

Authorities’s use of location knowledge remains to be being weighed by the courts, too. In 2018, the Supreme Court docket dominated that police typically want a warrant to have a look at information that reveal the place cellphone customers have been.

Practically two years after strolling off the crime knowledge supervisor job with the Greensboro police pressure, Corridor nonetheless worries about police surveillance in neighboring communities.

“Anybody with that login data can do as many searches as they need,” Corridor stated. “I don’t consider the police have earned the belief to make use of that, and I don’t consider it must be authorized.”

___

AP Nationwide Author Allen G. Breed contributed from Greensboro, North Carolina. Dearen reported from New York and Burke reported from San Francisco.

___

This reporting was produced in collaboration with researchers Janine Graham, Nicole Waddick and Jane Yang in addition to the College of California, Berkeley’s Human Rights Heart Investigations Lab and College of Regulation.

___

Comply with Garance Burke and Jason Dearen on Twitter at @garanceburke and @jhdearen. Contact AP’s international investigative crew at Investigative@ap.org or https://www.ap.org/ideas/





Supply hyperlink