Alexa, Can You Dial 911 While Recording My Murder? The Electronic Ear & The Law.

policeline

Unless you are living under the proverbial rock, I’m sure by now that you’ve heard of the criminal case in Arkansas which has the police subpoenaing Amazon for the cloud-maintained audio files that may have been recorder by  the alleged murderer’s IoT gadget, the personal electronic assistant known as Echo.

Case Background (as featured in Engadget):

Amazon’s Echo devices and its virtual assistant are meant to help find answers by listening for your voice commands. However, police in Arkansas want to know if one of the gadgets overheard something that can help with a murder case. According to The Information, authorities in Bentonville issued a warrant for Amazon to hand over any audio or records from an Echo belonging to James Andrew Bates. Bates is set to go to trial for first-degree murder for the death of Victor Collins next year.

Amazon declined to give police any of the information that the Echo logged on its servers, but it did hand over Bates’ account details and purchases. Police say they were able to pull data off of the speaker, but it’s unclear what info they were able to access. Due to the so-called always on nature of the connected device, the authorities are after any audio the speaker may have picked up that night. Sure, the Echo is activated by certain words, but it’s not uncommon for the IoT (Internet of Things) gadget to be alerted to listen by accident.

Police say Bates had several other smart home devices, including a water meter. That piece of tech shows that 140 gallons of water were used between 1AM and 3AM the night Collins was found dead in Bates’ hot tub. Investigators allege the water was used to wash away evidence of what happened off of the patio. The examination of the water meter and the request for stored Echo information raises a bigger question about privacy. At a time when we have any number of devices tracking and automating our habits at home, should that information be used against us in criminal cases?

Bates’ attorney argues that it shouldn’t. “You have an expectation of privacy in your home, and I have a big problem that law enforcement can use the technology that advances our quality of life against us,” defense attorney Kimberly Weber said. Of course, there’s also the question of how reliable information is from smart home devices. Accuracy can be an issue for any number of IoT gadgets. However, an audio recording would seemingly be a solid piece of evidence, if released.

Just as we saw with the quest to unlock an iPhone in the San Bernardino case, it will be interesting to see how authorities and the companies who make smart home devices work out the tension between serving customers, maintaining privacy and pursuing justice.

Update: An Amazon spokesperson gave Engadget the following statement on the matter:

“Amazon will not release customer information without a valid and binding legal demand properly served on us. Amazon objects to overbroad or otherwise inappropriate demands as a matter of course.”

As a refresher, Echo only captures audio and streams it to the cloud when the device hears the wake word “Alexa.” A ring on the top of the device turns blue to give a visual indication that audio is being recorded. Those clips, or “utterances” as the company calls them, are stored in the cloud until a customer deletes them either individually or all at once. When that’s done, the “utterances” are permanently deleted. What’s more, the microphones on an Echo device can be manually turned off at any time.

I think we will all find the ever-changing digital landscape an interesting venue for the evolution of electronic law. The ramifications of the anticipated ruling may change the way we view individual privacy forever.  If we don’t have a reasonable expectation of privacy in our own homes… where then?

We will be following this case with particular interest and will bring you updates as developments occur.

Until this case resolves, and if you own a digital personal assistant,  you might want to drop that habit of talking to yourself.  The walls literally have (electronic) ears.

BNI Operatives: Situationally aware.

As always, stay safe.

 

 

8 Ways That You Can Be Legally Tracked

 fb sub

“But don’t they have to have probable cause to search my email or get my Facebook records?”  I can’t tell you how many phone calls we’ve received with that question  – and as we tell each caller, “We are not attorneys, judges or the court or the police department. But, uh, what happened?” (Who doesn’t want to hear a good story??)

(Anyhow, for the purpose of this article,  “they” means law enforcement.)

Here are the situations and the applicable laws:

1. Phone Records: Calls you have made and received

How they get it

Wiretapping is illegal without a judge’s warrant, however, police only require a subpoena from a court to obtain your phone scrolls (outgoing and incoming calls).

A warrant requires showing probable cause, a subpoena needs only to be relevant to an investigation, a much lesser standard of evidence.

Applicable law: 

Smith v. Maryland, a Supreme Court ruling in 1979, which found that the Constitution’s Fourth Amendment protection against unreasonable search and seizure doesn’t apply to a list of phone numbers.

2.  Location: Your phone is a tracking device

How they get it

Cell towers.

Applicable Law: 

The federal Electronic Communications Privacy Act (EPCA) cited by the police for these records dictates that the data must contain “specific and articulable facts” related to an investigation – again, that lesser standard of evidence.

3.  IP Addresses: Which computers you use

How they get it

Email providers such as Google, Yahoo, MS, etc.  amass tremendous amounts of data about our digital journeys. A warrant is needed to access some emails (see below), but not for the IP addresses of the computers used to log into your mail account or surf the Web. According to the ACLU, those records are kept for at least a year.

Applicable law:

U.S. v. Forrester, is a case involving two men trying to set up a drug lab in California.  Prosecutors successfully argued that tracking IP addresses was no different than installing a tracking device to a phone to track each number dialed by a given phone (which is legal).   Police only need a court to sign off on a subpoena certifying that the data they’re after is relevant to an investigation — the same standard as required for cell phone records.

4. Emails

How they get it

Prior to Sen, Leahy’s bill introduced earlier this year, only recent email required a warrant; email aged over 180 days required only a court subpoena related to an investigation.

Applicable Law

Once again, the ECPA comes into play.  The Leahy bill would require a warrant to get all emails regardless of age.

5. Email drafts: drafts are different

How they get it

Communicating through draft emails, à la David Petreaus and Paula Broadwell, seems sneaky. But drafts are actually easier for investigators to get than recently sent emails because the law treats them differently.

Applicable Law:

The ECPA distinguishes between communications — emails, texts, etc. — and stored electronic data. Draft emails fall into the latter, which get less protection under the law. Authorities needs only a subpoena for them. The Leahy bill would change that by requiring a warrant to obtain them.

6. Text messages: As with emails, so with texts

How they get it

Investigators need only a subpoena, not a warrant, to get text messages more than 180 days old from a cell provider — the same standard as emails.

Applicable Law: 

Currently being challenged in several states otherwise, the ECPA applies.

7. Cloud data: documents, photos, and other stuff stored online

How they get it

Authorities typically need only a subpoena to get data from Google Drive, Dropbox, SkyDrive, and other services that allow users to store data on their servers (aka, cloud storage).  EXCEPT: If that data is shared. (see below).

Applicable Law:

The ECPA defines cloud data the same way it does draft emails – as storage – making a warrant unnecessary. However, shared files, such as a collaboration through Google Docs is considered “communication” so a warrant is required.

8. Social media: Too new to tell

How they get it

Read your social network’s Terms of Service and Privacy Policy. (Stop laughing.) When it comes to sites like Facebook, Twitter and LinkedIn, the social networks’ privacy policies outline how cooperative they are in handing over users’ data to law enforcement. Facebook states it requires a judge’s warrant to disclose a user’s “messages, photos, videos, wall posts, and location information.” But it will supply basic information, such as a user’s email address or the user’s IP addresses under a subpoena.

Applicable Law:

Too soon to tell but we’re know that a Manhattan Criminal Court judge upheld a prosecutor’s subpoena for information from Twitter regarding an Occupy Wall Street arrest on the Brooklyn Bridge in 2011, marking the first time a judge allowed prosecutors to use a subpoena rather than a warrant to get the information.

Bottom Line: Assume that everything you write can and will, if necessary, be read by law enforcement so don’t do whatever it is that you haven’t done.

BNI Operatives: Situationally aware.

As always, stay safe and stop typing your life online.

Yahoo and Google Data Availability to Law Enforcement & For Legal Process

email magnifying glass

 

As we’ve surmised by now, Lois Lerner’s missing emails exist – somewhere.  There’s also now the availability of cloud hosting, a method of saving your email on the net that allows you 24/7  access from any remote location.  So, do you really know what happens to all of your subscription information, emails, attachments, etc., once you shut down an email account?  What if your information is requested by law enforcement or in anticipation of litigation?   What is the legal process in such a case?

We’ve conducted research into data retention by the two major service providers: Yahoo and Google:

YAHOO

yahoo data save

Compliance With Law Enforcement:    PRESERVATION

Will Yahoo! preserve information?

Yahoo! will preserve subscriber/customer information for 90 days. Yahoo! will preserve information  for an additional 90-day period upon receipt of a request to extend the preservation.   If Yahoo! does not receive formal legal process for the preserved information before the end of the  preservation period, the preserved information may be deleted when the preservation period expires.

 

GOOGLE

What kinds of data do you disclose for different products?

To answer that, let’s look at four services from which government agencies in the U.S. commonly request information: Gmail, YouTube, Google Voice and Blogger. Here are examples of the types of data we may be compelled to disclose, depending on the ECPA legal process, the scope of the request, and what is requested and available. If we believe a request is overly broad, we will seek to narrow it.

Gmail
Subpoena:

  • Subscriber registration information (e.g., name, account creation information, associated email addresses, phone number)
  • Sign-in IP addresses and associated time stamps

Court Order:

  • Non-content information (such as non-content email header information)
  • Information obtainable with a subpoena

Search Warrant:

  • Email content
  • Information obtainable with a subpoena or court order
YouTube
Subpoena:

  • Subscriber registration information
  • Sign-in IP addresses and associated time stamps

Court Order:

  • Video upload IP address and associated time stamp
  • Information obtainable with a subpoena

Search Warrant:

  • Copy of a private video and associated video information
  • Private message content
  • Information obtainable with a subpoena or court order
Google Voice
Subpoena:

  • Subscriber registration information
  • Sign-up IP address and associated time stamp
  • Telephone connection records
  • Billing information

Court Order:

  • Forwarding number
  • Information obtainable with a subpoena

Search Warrant:

  • Stored text message content
  • Stored voicemail content
  • Information obtainable with a subpoena or court order
Blogger
Subpoena:

  • Blog registration page
  • Blog owner subscriber information

Court Order:

  • IP address and associated time stamp related to a specified blog post
  • IP address and associated time stamp related to a specified post comment
  • Information obtainable with a subpoena

Search Warrant:

  • Private blog post and comment content
  • Information obtainable with a subpoena or court order

Note about general Gmail retention:  Even if you Purge your Trash email or shut down your gmail account, your email remains available for recovery for 20 days beyond when the mail is deleted or the account closed.

Please feel welcome to contact us with more specific questions regarding data retrieval from these two major service providers (and lesser used ISPs w/unique data product.)

BNI Operatives: Street smart; info savvy.

As always, stay safe.

 

 

%d bloggers like this: