To catch a thief, go to Google with a geofence warrant – and it will give you all the details

At 1030 on April 27, 2019, four unidentified individuals attempted to rob a Brinks armored truck parked outside of Michaels, an art supply and home decor store at the Point Loomis Shopping Center in Milwaukee, Wisconsin. To find out who they are, local authorities plan to ask Google. According to an affidavit [PDF] filed by …

[Sgt_Oddball]

Sooo....

The take home from this is to use to ye old 2G phones (now given an extended lease of life since 3G is getting bumped off first) and use them for your criminal activities. Nothing new there surely?

This does also assume that they crims definitely used Google's services and dranketh of the data slurp...

Also means that it'd be easier than ever to get an alibi since you could should now have two phones. A dumb one for illicit activities and a smart phone elsewhere attached to your dog or some such to move around periodically thus giving you room to claim "I wasn't there gov' honest. Check my phone".

[Anonymous Coward]

Re: Sooo....

Metadata. For the person with 2 phones, it's just a protection in depth. For everyone else, theres "that video of me with the president in front of a crowd certainly was not me" or "I never did it guv".

Nothing anywhere proves Googles data is concise or accurate. However, other factors, can be what does a criminal over.

[Anonymous Coward]

Re: Nothing anywhere proves Googles data is concise or accurate.

More it proves to be inaccurate many times.

Google asked me to review a local park. A park that I had no idea where it was. I looked it up and found I was across the street from it once for an hour or so.

Worse for Google example, I was asked to review several businesses in a small town. I know where the town is. At the time I had been driving by it a lot. But I was always 12+ miles away.

So how useful is the 25 meter geofence?

[Anonymous Coward]

Re: Nothing anywhere proves Googles data is concise or accurate.

I was sent the google tracking thing at the end of the year to show where i have been, It says i have been in various countries, which i have not or ever been to. So it is in no way accurate.

[doublelayer]

Re: Nothing anywhere proves Googles data is concise or accurate.

If they think you were in another country, not just somewhere you were near, it's possible someone else has access to your account. You might want to check the recent account accesses. While your there, close the account because they're trying to figure out where you are.

[Fruit and Nutcase]

Re: Nothing anywhere proves Googles data is concise or accurate.

Once a colleague did a google location history - it showed him in the UK followed by the US and back to the UK all within an improbably short time. The reason? He was using the company provided guest/employee Wi-Fi, which would route traffic out via the internal network - and that would at times exit out of either the UK or US as we had locations in both

[Anonymous Coward]

Re: Nothing anywhere proves Googles data is concise or accurate.

Nope, no one else, have 2fa also with authenticator.

[DBH]

Re: Nothing anywhere proves Googles data is concise or accurate.

I checked my location tracking thing one time after an email from Google invited me to have a look. I saw one day in particular I'd been at a motorsport event near the coast, I'd been in the same place all day. Except, according to Google, about an hour in the afternoon, when I jumped about 50 miles out to sea and back again. I must have not been paying attention because I definitely don't remember doing that

[Kicker of Metaphorical Cats]

Re: Nothing anywhere proves Googles data is concise or accurate.

That one is not Google's fault. You were in China, obviously.

[heyrick]

Re: Nothing anywhere proves Googles data is concise or accurate.

"Worse for Google example"

I changed the name of a local bar (they had the old name) and updated its hours.

Now I get emails every so often inviting me to manage the information on my business.

Uh...

[John H Woods]

Re:"updated its hours"

We had the opposite problem: despite being tenants of the pub and the opening hours being up to us and nobody else, Google would never accept our declared hours as authoritative!

[Anonymous Coward]

Re: updated its hours"

We have a similar problem: We are a well known name business. On Google maps, Google helpfully displays our HQ's address & phone number. Unfortunately, the location & phone number are wrong. We correct it, and then a week or two later it gets auto-corrected back.

[teknopaul]

Re: Nothing anywhere proves Googles data is concise or accurate.

Doesnt have to be accurate. They are looking for someone who stayed put for a long while. Probably checking a particular social media service and the local news quite regularly.

Does have to proove anything either. Once you find a getaway driver suspect all you have to do is ask him and his mum who the other perps are.

There arent that many people stupid enough to pull a stunt like this without the driver of the security van being involved.

[Dabooka]

Re: Nothing anywhere proves Googles data is concise or accurate.

Have an upvote.

I would suggest it is far to say that those who think the data is somehow going to be used as convicting evidence are somewhat wide of the mark and missing the point. The Feds will want a list of suspects who they can have their collar felt as being in that area; you know, shake the tree and see what falls out kind of thing.

It does kind of give the game away and make it easier to cover your tracks if you know what gets people caught, but I'm guessing we're not dealing with 'Raffles, the Gentleman Thief ' here and research will be somewhat sketchy. I mean some crims still leave finger prints behind FFS.

[holmegm]

Re: Sooo....

It's one piece of evidence, that can be used among many. It might not even be used at trial, but simply to give police a lead.

Anyway, that vast majority of criminals are not nearly as smart as TV makes them out to be. And even smart ones make mistakes. This is just one tool in the toolbox.

[AIBailey]

Re: Sooo....

The other take home is that if you need to kill time while waiting for your criminal mates to arrive, take a book to read rather than have a few games of Angry Birds.

[sketharaman]

Re: Sooo....

Hahaha...

On a side note, I accidentally clicked the link to the Search Warrant. Never thought it'd be such a great source of info about tech. But it is: (1) Crystal clear explanation of features (2) No hype since it's submitted under oath:)

[The Man Who Fell To Earth]

Dumb, dumb, dumb

1. Anyone who doesn't know by now that their phone is a tracking device, with the info subpoenable from carriers, OS makers & app makers, deserves to get caught for lack of planning.

2. Apple probably received a similar subpoena, as did the carriers. No reason to assume the phones were Android.

3. Modern cars also have communication gear usually communicating with cell systems in the background even if the owner does not subscribe to services offered. So vehicles are also game for this kind of info.

Bottom line - if you are going to do criminal activity like bank or armored car robbery, you should ditch all phones. If you need real-time communications anywhere near the location of the crime, probably best to use walkie-talkies with encryption.

[Anonymous Coward]

Re: Dumb, dumb, dumb

And just to emphasize the point, Apple, the ISPs, and the connected car providers will all offer up their data in response to what seems to be a perfectly reasonable, legal, and constrained warrant. Nothing to see here.

[Anonymous Coward]

Re: Dumb, dumb, dumb

Modern cars are tracked in cities with sensors/detectors that pick up the unique identifiers of your wireless tire pressure sensors. If you have modern car with tire pressure sensors you "disabled" or removed, then the the government cameras and those sensors/detectors will quickly ID YOU as owning the car that should have tire pressure sensors.

So, swap them out before a crime.

Track Cars with Wireless Tire Pressure Sensors, Hak5 1511.1

https://www.youtube.com/watch?v=TDYoo7TGNcw

[whoseyourdaddy]

Re: Dumb, dumb, dumb

A relative just finished several months of Grand Jury duty. Social media addiction solves crimes fast in Texas.

Just can't argue against saving time and money for law enforcement with a straight face.

[Anonymous Coward]

Re: Dumb, dumb, dumb

"Bottom line - if you are going to do criminal activity like bank or armored car robbery, you should ditch all phones."

A little extreme - temporary SIMs/cheap phones aren't hard to obtain.

Use them during the crime and bin them/burn them to make them of limited use to law enforcement.

[nekomoto]

Re: Dumb, dumb, dumb

No, the IMEI of the device does not change then - https://en.wikipedia.org/wiki/International_Mobile_Equipment_Identity

[Anonymous Coward]

Re: Dumb, dumb, dumb

"No, the IMEI of the device does not change then"

So?

The phone was switched on or after you began the crime and it's now a pool of melted glass, plastic and other bits. Yes, the phone can show the route they used while it was on and registered to the network which may help establish if there is any security camera footage of those involved, but this is likely to be available anyway. And don't take any other mobile devices...

[veti]

Re: Dumb, dumb, dumb

Who cares that they can identify the phone, if they have no way of telling who it belonged to?

[anonymous boring coward]

Re: Dumb, dumb, dumb

I think criminals should use their normal phones. And their own cars.

Don't see why I should wish they got better at crime?

[mark l 2]

Surely according to every Holywood movie about crimes, spies etc. They all use pre-paid 'burner phones' that they can just throw into the nearest river, down the drain or even just smash it up and chuck into the rubbish bin.

If they have been using their own devices well more fool them for not following the movies as at least doing that reduces the risk of being caught.

[Malcolm Weir]

You're assuming the primary goal of the intelligence is to identify the suspects. Sure, that would be nice, but a more likely outcome is to track the suspects to their next stop, and then start again with the video analysis to see who got out of the car and where they went next...

[NetBlackOps]

Records are kept of what stores got which phones by IMEI and the authorities will go pull the video even if you pay cash.

Ain't surveillance capitalism grand?

[Sgt_Oddball]

And this is why...

You don't buy a new phone but an old second hand one.

[bombastic bob]

Re: And this is why...

mine's a dumb phone. pre-paid cell that I rarely use. It's nearly always OFF. I have a droid slab for development work and e-mail when I'm at a remote site. And no GPS or other tracking in my 20+ year old car.

and I also put aluminum foil in my wallet so that the chips in the cards can't be read. The newer ones apparently have actual electrical contacts so it's less likely they'll be a problem but I think my driver's license is as insecure as any of them evar were...

but seriously, I would hope that none of this information would be given out without a proper warrant FIRST. We don't need any aggressive investigators investigating individuals, looking for a crime [rather than investigating a crime, looking for perpetrators].

[phuzz]

Re: And this is why...

"I would hope that none of this information would be given out without a proper warrant FIRST"

If you bother to read TFA you'll find a link in the first paragraph to their application for a warrant.

"I also put aluminum foil in my wallet"

You can buy wallets with that built in, that way you can save your tin-foil for your hat.

[Pascal Monett]

Wait a minute

What do we have here ?

A police inquiry that makes an official request for information to an organization that keeps GPS information far longer than any company should need to. The inquiry is legit, restricted to specific, determined area and backed by a judge. This is justice in motion and I have no problem with that.

If there is any issue, it is in the fact that fucking Google has the means to become an auxiliary of justice. Who gave Google the authority to store GPS data on its customers ? Who delegated to Google the means of recording the life of Joe Public ? How is it that we continue to accept that a commercial, for-profit company has the right to record and store more data about our lives than the government ?

One day there should be a reckoning about that, if we are to hope to preserve the privacy of our lives.

[Version 1.0]

Re: Wait a minute

Check the small print, if you are using Google services then you give them permission to store the data.

[John Brown (no body)]

Re: Wait a minute

But is it GDPR compatible informed consent and will it work if you say no?

[A.P. Veening]

Re: Wait a minute

But this is in United Surveillance of America, not Europe (and not even in California either).

[John Brown (no body)]

Re: Wait a minute

EU residents data is still covered, hence whatever the data transfer fig-leaf is called this month and the risk that Google et al with EU assets need to be a little careful. Hey, if the US can try to enforce it's laws extra-territorially, then why not the EU as well? :-)

[Doctor Syntax]

Re: Wait a minute

Of course this incident was in the US. If they're using the small print in the EU they're committing ongoing offences under GDPR.

[Malcolm Weir]

Re: Wait a minute

(Ditto Apple, of course)...

The problem I have with this viewpoint is that it's "just" picking on the largest players (Apple and Google). But the issue is generic: what about the CCTV, Wifi base stations, Bluetooth beacons... the latter at least potentially collecting metadata even from individuals that don't connect/pair (the mere fact that a device is in range is collectable).

[iron]

Re: Wait a minute

Don't forget Alexa and the Ring door bell, two of the most insidious pieces of the state surveillance society.

[Anonymous Coward]

Re: Wait a minute

Who gave Google the authority to store GPS data on its customers ?

I'm pretty sure you meant "users", not "customers". The customers are the people buying this data.

But to answer your question: The people who clicked "I Agree".

Who delegated to Google the means of recording the life of Joe Public ?

The people who clicked "I Agree".

How is it that we continue to accept that a commercial, for-profit company has the right to record and store more data about our lives than the government ?

I mean, yes. Sure, google are recording and storing ridiculously intrusive data on billions of people. But on the other hand, cat videos! And you can watch them anywhere! It sure beats interacting with other humans.

Yeah, I don't understand it either.

Yes, many people don't realise just how much data google has on them, and some would be horrified to find out that google has the complete history of everywhere they've been for the last decade. But most people I talk to do understand that google is spying on them in every way they can think of, and they simply don't care. They think I'm paranoid because I don't want to share the intimate details of my life with google. The same applies to facebook: they've been caught doing seriously creepy stuff on multiple occasions and people still don't uninstall that crap. They just don't care.

Yeah, I don't understand it either.

[Anonymous Coward]

Re: Wait a minute

And often it threatens to reveal secrets that aren't even yours to reveal

e.g. "Do you want to check in at [List X site]?"

[Venerable and Fragrant Wind of Change]

Re: Wait a minute

Certain companies are required by governments to store data.

In the case of google, what they have is of uncertain value. It may or may not help police in this particular investigation. Telcos and ISPs doubtless receive comparable requests from time to time.

Shouldn't you be more concerned about the companies who collect data with the explicit purpose of using it to affect your life, perhaps adversely? Like those that compile "credit ratings" and hold lots of data often more sensitive than anything google has.

[Barry Rueger]

It gets worse

My new BlueTooth equipped furnace air filter also demands access to location data before its app will work.

Which I guess would be useful if my furnace was stolen....

[jason_derp]

Re: It gets worse

Thanks. Now I've got a new thing to have crippling panic attacks about: my furnace being stolen.

[Anonymous Coward]

Re: It gets worse

Accessing bluetooth or scanning for WiFi requires location access permissions because a few years ago it was realised that you could amass a database of location info which could be cross-referenced to give a location from the identifiers of the bluetooth/wifi devices in range.

Who would do such a thing? Well, do you remember the Google street view car fiasco?

[jason_derp]

This seems kind of reasonable?

Like, Google shouldn't be allowed to hold this much data on us, there should be more choices in the market, we're users not customers, there's questionable legality in EULAs, opt-in instead of opt-out, etc. All very good things worth taking about, but wow. I'm kind of impressed that the request for this data and its strictly defined amount and use is like, transparent and reasonable. Or at least somebody put in the effort to make it seem that way.

[Arthur 1]

Re: This seems kind of reasonable?

Definitely my take too. This should actually be held up as an example of very reasonable police practice (assuming they have an intelligent way of determining which phones they care about from the anonymized ones). The fact that Google has the data on offer... is another matter.

[doublelayer]

Re: This seems kind of reasonable?

Reasonable, yes. I agree that, from everything they've said, they have a good reason to ask for the data, are handling it responsibly, and there isn't much capacity for abuse. However, when you look into the details, there's little but bad possibilities in future.

There are some obvious ones, such as requesting a much larger radius. For example, asking for the IDs of every device in a neighborhood and cross-listing that against historical data. Or requesting the full histories of certain IDs, with or without a warrant. There are some subtler possibilities though. If any of this data is wrong, it could result in people being wrongly pursued or people being ignored by the system. If a person involved in this crime were inaccurately placed by their device, they could go unnoticed. For reasons such as this, location data cannot be used as the primary tactic to catch criminals. It is far too unreliable and prone to tampering.

Perhaps the worst possibility though is legitimization of the collection of this data and its availability to law enforcement. The companies shouldn't have it, and in most cases nobody should have access to any collection their may be. If this warrant is used as a reason not to ban the companies from collecting the data, or if it allows other less trustworthy law enforcement (China's, for example) to access it, it may be incredibly harmful.

[holmegm]

Re: This seems kind of reasonable?

On the one hand, I sympathize with this position.

On the other hand, if you can't trust your police, you have problems way beyond this. It's more of a political problem than a problem to be solved with technology.

[Graham Cobb]

Re: This seems kind of reasonable?

No, it is a matter of providing reasonable levels of trust, combined with oversight and notification to people investigated.

As an example, there are numerous cases of police being over-zealous in (for example) pursuit of political protesters. Or other political campaigners. Individual police officers may be trying to do the best they can, but make mistakes and, like all of us, sometimes take shortcuts or can't see the wood for the trees. Just because someone at a protest was violent does not mean that it is legitimate to track down and interview all the protesters, let alone record that they were at the protest.

There need to be tools for careful oversight, and for finding mistakes or problems and fixing them.

[doublelayer]

Re: This seems kind of reasonable?

That's exactly the point. I trust my police only some of the time. The best way to ensure that I can trust them is to keep them honest. That means limiting the powers, because I and everyone else knows that power corrupts.

Take an extreme example: if we allow police to search places without a warrant, what would happen? In many cases in democratic countries, they'd use it when they have to and keep things limited. They would improve their rates of successfully preventing crimes and bringing criminals to justice. But it takes only one corrupt officer with a grudge, a bias, or an interest in what someone's doing to start abusing that system, and once that happens, more people will start to do it. Then some people who run policing organizations will start to set up more organized methods of using that new power for the benefit of themselves or some political belief they think is important enough. Within a few years, the country has turned into a police state. That's why we don't let them do that; not because we distrust them now, but because we need to limit their powers now and for the future.

[Anonymous Coward]

Invasive or what?

Lots of things on my android phone don't work because I turned off everything I could find to do with google. Is there any way to get my camera to work again, for example? Or how about being able to store contacts on the phone?

[IGotOut]

Re: Invasive or what?

F-droid is your friend for this, but no guarantee but will do the job if you've disabled to much.

[jason_derp]

Re: Invasive or what?

"F-droid is your friend for this"

Your comment is what prompted me to finally check out (and subsequently install and begin using) F-droid after hearing about for so long. Thank you!

[Barry Rueger]

Re: Invasive or what?

Or how about being able to store contacts on the phone?

I don't know about the camera, but Nextcloud handles my contacts and calendar just fine.

Getting Android apps to (mostly) default to non- Goigle sources was a challenge*, but worth it in the end.

* "challenge" meaning "pain in the ass."

[Anonymous Coward]

UK: Let's see ...

At a public protest meeting, they can now link up phone GPS with Police Facial Recognition camera footage with UK Border Face Scans with Facial Recognition with alleged Terrorists from GreenPeace, Extinction Rebellion and Football Supporters ...

[GruntyMcPugh]

Re: UK: Let's see ...

@AC: "Extinction Rebellion"

Once I heard that Extinction Rebellion had been included on the list of 'Extremist Ideologies' by the CTPSE, I changed my FB profile pic to their flag and liked their page.

[Steve Davies 3]

Doh!

What about those short range Walkie-talkies? Could they not be the ideal things for the robbers to use. Harder for the Police to jam them.

To assume that only Google phones would be used in a Robbery is just silly.

Now where is the semaphore flag icon?

[Anonymous Coward]

Re: Doh!

"To assume that only Google phones would be used in a Robbery is just silly."

To assume that Google are the only ones to have received such a request is just silly.

I'm sure Apple will have received a copy. They probably didn't bother with Microsoft's phone department though.

['s water music]

Re: Doh!

They probably didn't bother with Microsoft's phone department though.

I run a WinPho rental agency for all your communication needs whilst out committing crimez.

Very reasonable rates

You ain't seen me right?--------------------->

[chivo243]

The missus

Just watched this movie on Netglitch with Ben Affleck! Although I think it took place in Baaston. I was twiddling bits, didn't pay much attention to it.

[Anonymous Coward]

Well if privacy or lack thereof is affecting the crims...

If the invasion of privacy and the proliferation of the abuse and exploitation of data and metadata will be taken notice of by the lowest of society (politicians violent criminals etc), then others might start taking this matter seriously.

[John 110]

Smokescreen

Does no-one else remember Bob Shaw's "Light of Other Days" where the authorities know who committed the crime due to mass surveillance, but didn't want to admit to that, so they ask a sleuth to solve the crime for them.

They already know who did it, they just don't want to admit how they know, so...blame Google...

[John Brown (no body)]

Re: Smokescreen

"They already know who did it, they just don't want to admit how they know, so...blame Google..."

Isn't this already happening with the security services? Wasn't there cases where the FBI really didn't want to explain how they knew the accused did it such that they either got off, took lower charges and thus smaller sentence etc or had to find "alternative" evidence?

[Anonymous Coward]

Re: Smokescreen

Didn't they have to shut down a tip-line in one of the southern states a few years ago, as it was mainly used by the police/security services themselves? They were able to arrest criminals without revealing sources by ringing the anonymous line with information such as "a car travelling north on such-and-such road has lots of drugs in. Here is the license plate number." One nice neat traffic stop later, and the villain is bang to rights for possession, with no inconvenient examination in court of how the evidence to stop the car was obtained.

[a_yank_lurker]

Clueless Wonders

While using Google tracking data is a newish wrinkle, location data from carriers and camera footage has been used to break alibis and track people by the authorities from many years now. If you carry your phone with you at a minimum the carrier knows your approximate location at any time. The refinement of using GPS for a more accurate fix is just a new wrinkle to the technique. GPS has a smaller margin of error than a cell tower pinging. In a more remote area, using a GPS will likely not get more than a couple of innocent people entangled. Given that many phone services rely on a relatively accurate location fix for them to be useful which GPS does do, this means your typical user will have GPS enabled and active.

The other issue these mental midgets have not figured out is the high probability of there being security cameras. Since the security cameras are owned by obviously innocent third parties the police often can get access to the video by simply asking and when necessary a copy. If the police have a solid reason to believe you were at point X at approximately time T they can go hunting for security cameras to see what they recorded.

In both cases, there is a data retention time frame that needs to be discussed of how long this data can or should be kept. This is especially true of GPS data.

[Reginald Onway]

Fee or Free?

"Google reportedly has a database called Sensorvault in which it stores location data for millions of devices going back almost a decade."

Which I presume is accessible for a fee. Or, do they just give it away?

[tiggity]

Only thing that bothers me

.. is the small area covered by the warrant, knowing how notoriously inaccurate location data can be, would have expected a larger area to have been requested

Seems a legit request

[sum_of_squares]

XKeyscore is so 2013

Consider the following:

The Geo Database tells them where you (physically) are. Gmail tells them what you think. Their search databases tell them what you do on the internet (today you can predict further information by analyzing search behaviour, up to the point that you know people have a disease before they do).

So the question is not: "What do they know?" but instead: "How long will it take until they connect the dots?" and: "Will the US government stop them or encourage them?". But since the TLAs have a sad history of using whatever they can, we should assume the worst.

Oh and isn't Google that very company who owns the biggest AI company in the world? Even if they don't have a "black ops" program already it's simply a matter of time. I can't stand the thought that all that is protecting us from those nightmare scenarios is the very gouvernment that would profit the most of abusing it. How long will the structures of democracy withstand? Principal-agent problem, anyone?

The future looks bright.