Habeas Data_Privacy vs. The Rise of Surveillance Tech

by Cyrus Farivar

  At the tail end of Judge Smith’s ruling, he provided a caveat to watchful DOJ attorneys.

  “The court finds that the Government’s warrant request is not supported by the application presented,” he wrote. “This is not to say that such a potent investigative technique could never be authorized under Rule 41. And there may well be a good reason to update the territorial limits of that rule in light of advancing computer search technology. But the extremely intrusive nature of such a search requires careful adherence to the strictures of Rule 41 as currently written, not to mention the binding Fourth Amendment precedent for video surveillance in this circuit.”

  At the time Judge Smith was writing, Rule 41 required that in nearly all cases, magistrates only sign off on warrants within their own judicial district. This territoriality requirement helped provide two important bulwarks against government overreach: that the search or seizure is adequately relevant to the court authorizing it and that it helps protect against forum shopping—law enforcement seeking a warrant from judges that they know will be favorable.

  It was around this time that the DOJ heeded Judge Smith’s advice, and began formal efforts to change this rule. In September 2013, Mythili Raman, the acting assistant attorney general, sent a letter to the judge who headed the rules committee at that time, setting off a three-year process. Raman cited Judge Smith’s order.

  “There is a substantial public interest in catching and prosecuting criminals who use anonymizing technologies, but locating them can be impossible for law enforcement absent the ability to conduct a remote search of the criminal’s computer,” Raman wrote. “Law enforcement may in some circumstances employ software that enables it through a remote search to determine the true IP address or other identifying information associated with the criminal’s computer.”

  The DOJ had a real-world example of such a criminal enterprise in early 2015, when it seized a child porn website, Playpen. The site was only accessible through the Tor Browser, a specialized Web browser that uses a series of technical steps to anonymize one’s footprints online. As such, anyone who accesses a Tor-hidden site (designated by a .onion URL) is very difficult to find out.

  Playpen’s founder, David Lynn Browning, of Kentucky, was identified in 2015, initially by a foreign law enforcement agency as part of an investigation into yet another child porn website. His IP address was exposed when those overseas cops provided him a “hyperlink to a streaming video” (or, a NIT) configured to go around his Tor browser, which then exposed his true IP address. After realizing it was an American IP address, the foreign agency handed it over to the FBI.

  Eventually, the FBI located Browning in Kentucky, seized Playpen, and allowed it to continue operating for 13 days to further investigate the site’s American users. While under the FBI’s control, on Playpen’s login screen, each user’s computer was secretly hit with the NIT, which was designed to expose that person’s true IP address. With a real IP address, unmasking individuals was trivial—a simple subpoena to the Internet service provider would suffice.

  While most of the cases were successfully prosecuted or ended in plea deals, a handful of defendants succeeded in challenging their cases and getting the charges dropped. In all of the Playpen cases, a magistrate in Virginia authorized a NIT to be used against suspects not only across the United States, but across the world.

  For future cases, the government now won’t have to be as strict with the territoriality rule: the revision to Rule 41 went into effect on December 1, 2016. However, the government has generally done a poor job of publicly disclosing how many times NITs have been deployed, and what technical vulnerabilities they exploit. Unlike wiretaps, for example, which have to be disclosed in detail in annual reports, the DOJ has never disclosed how often NITs are sought or used. With little transparency in their use, it’s impossible to even attempt to evaluate their effectiveness.

  Just as was the case with stingrays, which began as a military tool, and then were brought home for law enforcement (largely in secret), it is only a matter of time before local police departments begin deploying NITs, if they haven’t already.

  CHAPTER TEN

  Why Privacy Needs All of Us

  We have to shape policies in case there is a Trump running every department.

  —RAYMUNDO JACQUEZ

  OAKLAND PRIVACY ADVISORY COMMISSION (2017)

  There is one American city that is the furthest along in creating a workable solution to the current inadequacy of surveillance law: Oakland, California—which spawned rocky road ice cream, the mai tai cocktail, and the Black Panther Party. Oakland has now pushed pro-privacy public policy along an unprecedented path.

  Today, Oakland’s Privacy Advisory Commission (PAC) acts as a meaningful check on city agencies—most often, police—that want to acquire any kind of surveillance technology. It doesn’t matter whether a single dollar of city money is being spent—if it’s being used by a city agency, the PAC wants to know about it. The agency in question and the PAC then have to come up with a use policy for that technology and, importantly, report back at least once per year to evaluate its use.

  The nine-member all-volunteer commission is headed by a charismatic, no-nonsense 40-year-old activist, Brian Hofer. During the PAC’s 2017 summer recess, Hofer laid out his story over a few pints of beer. In the span of just a few years, he has become an unlikely crusader for privacy in the Bay Area.

  * * *

  In 1998, when Hofer left his hometown, Weed, California, at the age of 21, he transferred into the University of California, Berkeley. As the third-largest city in Siskiyou County, the town at the farthest northern extremes of California boasts about 3,000 residents.

  “There’s no young people in between 18 and 40 in Weed, there’s no jobs, there’s no education,” Hofer lamented to me.

  Hofer’s father is a Berean (an offshoot of mainstream Protestantism) reverend, and former official with the Siskiyou County Republican Central Committee. Growing up in the 1980s, Hofer remembered, there were two portraits side-by-side in the family’s home: President Ronald Reagan and Jesus.

  “I came from a place where the thing to do was to hang out at McDonald’s because there was no humanity around,” he said. “Half of our main street is abandoned, it’s a ghost town.”

  Hofer’s always followed politics—he’s voted in every election he’s been eligible for. “But I’m like every nine out of ten people, I just sat on the sidelines,” he said.

  After graduating with a BA in cconomics, Hofer bounced around, first getting a job as a paralegal in 2004, and eventually landing in law school at the University of San Francisco in 2008. By 2011, he’d graduated, and later joined one of the protest marches to the Port of Oakland as part of the broader Occupy movement. In June 2013, he read in horror about Edward Snowden and revelations of the National Security Agency’s (NSA) overreach. He was trying to figure out how to best channel his nascent political identity—a mix of Bay Area progressivism with an undercurrent of his rural libertarian roots. Hofer once attended a Berkeley City Council meeting, but found it baffling. It was often more crazed grandstanding than actual meaningful discussion.

  Then, in July 2013, when Snowden was still a fresh name, the City of Oakland formally accepted a federal grant to create something called the Domain Awareness Center (DAC). The idea was to provide a central hub for all of the city’s surveillance tools, including license plate readers (LPR), closed circuit television (CCTV) cameras, gunshot detection microphones, and more—all in the name of protecting the Port of Oakland, the third largest on the West Coast.

  Had the city council been presented with the perfunctory vote on the DAC even a month before Snowden, it likely would have breezed by without even a mention in the local newspaper. But because government snooping was on everyone’s mind, including Hofer’s, it became a controversial plan.

  After reading a few back issues of the East Bay Express in January 2014, Hofer decided to attend one of the early meetings of the
Oakland Privacy Working Group, largely an outgrowth of Occupy and other activists opposed to the DAC. The meeting was held at Sudoroom—then a hackerspace hosted amidst a dusty collective of offices and meeting space in downtown Oakland.

  Hofer, who didn’t know anyone at the meeting, walked in at the same time as an Oakland Police Department (OPD) detective, who may have been monitoring the group, through the building’s side door. Hofer sat down in the back and listened. There were various speakers and presentations, but nothing seemed to click.

  “How are these guys going to combat this crazy surveillance project that I’ve just heard of?” Hofer wondered to himself.

  The group was not organized. While well-intentioned, they had no clear plan as to how they were going to effectively provide political opposition to the DAC. At one point, Hofer piped up and asked the few who seemed to be running the meeting how many city council members they had met with. When they told him none, he stood up to go home.

  Before walking out, Hofer was pulled aside by Eddan Katz, a local tech-minded attorney and one of the co-founders of Sudoroom, trying gently to stop Hofer from leaving. Hofer, frustrated, tried to point out that their street theater efforts were unlikely to result in meaningful change. Still, Katz asked Hofer a few basic questions: “Do you want to meet with the city council? How can you not, with the people voting on the project? What’s your strategy?”

  Katz impressed upon him the motto of Sudoroom and other hacker-spaces like it: it’s an anarchist collective, yes, but it’s also a do-ocracy. If you want something done, do it. Hofer decided to take him up on the offer. Amazingly, it worked. Within weeks, Hofer, who had no political connections whatsoever, had meetings scheduled with city council members and other local organizations. By September 2014, Hofer was named as the chair of the Ad Hoc Privacy Committee. In January 2016, a city law formally incorporated that Ad Hoc Privacy Committee into the PAC—each city council member could appoint a member of their district as representatives. Hofer was its chair, representing District 3, in the northern section of the city. Hofer ended up creating the city’s privacy watchdog, simply because he cared enough to do so.

  * * *

  On the first Thursday of every month, the PAC meets in a small hearing room, on the ground floor of city hall. Although there are dozens of rows of theater-style folding seats, more often than not, there are more commissioners in attendance than citizens. While occasionally a few local reporters and concerned citizens are present, most of the time, the PAC plugs away quietly. Turns out, the most ambitious local privacy policy in America is slowly and quietly made amidst small printed name cards—tented in front of laptops—one agenda item at a time.

  Its June 1, 2017, meeting was called to order by Hofer. He was flanked by seven fellow commissioners and two liaison positions, who do not vote. (At the time, the seat for the commissioner associated with District 2, in North Oakland, was vacant.)

  The PAC was comprised of a wide variety of commissioners: a white law professor at the University of California, Berkeley; an African-American former OPD officer; a 25-year-old Muslim activist; an 85-year-old founder of a famed user group for the Unix operating system; a young Latino attorney; and an Iranian-American businessman and former mayoral candidate. (One commissioner, Clint M. Johnson, declined to be interviewed for this book.)

  Professor Deirdre Mulligan, who as of September 2017 announced her intention to step down from the PAC pending a replacement, is probably the highest-profile member of the commission. She too was recruited by Eddan Katz—her former student—who initially was slated to serve on the PAC, but had to bow out. Mulligan is a veteran of the privacy law community: she was the founding director of the Samuelson Clinic, a Berkeley Law clinic that focuses on technology-related cases.

  “The connection between race and surveillance and policing has become more evident to people,” she told me. “It seemed like Oakland was in a good position to create some good examples. To think about how the introduction of technology would affect not just privacy, but equity and fairness issues.”

  For his part, Robert Oliver tends to sit back—his eyes toggling between his black laptop and whoever in the PAC happens to be speaking. As the only Oakland native in the group, an Army vet with a computer science degree from Grambling State University, and a former OPD cop, Oliver comes to the commission with a very unique perspective. When uniformed OPD officers come to speak before the PAC, Oliver doesn’t underscore that he served among them from 1998 until 2006. But he understands what a difficult job police officers are tasked with, especially in a city like Oakland, where, in recent years, there have been around 80 murders annually.

  “From a beat officer point of view, who doesn’t have the life experience—and of course they’re not walking around with the benefit of case law sloshing around in their heads—they’re trying to make these decisions on the fly and still remain within the confines of the law while simultaneously trying not to get hurt or killed,” he told me over beers.

  The way he sees it, Riley is a “demarcation point”—the legal system is starting to figure out what the appropriate limits are. Indeed, the Supreme Court does seem to understand in a fundamental way that smartphones are substantively different from every other class of device that has come before.

  Meanwhile, Reem Suleiman stands out, as she is both the youngest member of the PAC and the only Muslim. A Bakersfield, California, native, Suleiman has been cognizant of what it means to be Muslim and American nearly her entire life. Since September 11, shes known of many instances where the FBI or other law enforcement agencies would turn up at the homes or workplaces of people she knew.

  “It felt like a prerequisite as a Muslim in America,” she told me at a downtown Oakland coffee shop.

  After leaving home, Suleiman went to the University of California, Los Angeles, to study, where she also became a board member of the Muslim Student Association. After graduation and moving to the Bay Area, she got a job as a community organizer with Asian Law Caucus, a local advocacy group. She quickly realized that a lot of people, including her own father, take the position that if law enforcement comes to your door, you should help out as much as possible, presuming that you have nothing to hide.

  But what most people don’t realize, Suleiman said, is that even though most law enforcement officers are “very friendly,” it’s still a “crime to lie” to them—even when it’s unintentional.

  “It’s your word against theirs—you may misremember something,” she said, recalling what she would tell people.

  “Never speak with them without an attorney. Ask for their business card and say that your attorney will contact them. People didn’t understand that they had a right to refuse and that they [weren’t required] to let them enter without a warrant. It could be my father-in-law. It could be my dad, it was very personal.”

  This background was her foray into how government snooping could be used against Muslims like her.

  “The surveillance implications aren’t even in the back of anybody’s heads,” she said. “I feel like if the public really understood the scope of this they would be outraged.”

  In some ways, Lou Katz is the polar opposite of Suleiman: he’s 85, Jewish, and male. But they share many of the same civil liberties concerns. In 1975, Katz founded USENIX, a well-known Unix users’ group that continues today—he’s the nerdy, lefty grandpa of the Oakland PAC. Throughout the Vietnam era, and into the post-9/11 timeframe, Katz has been concerned about government overreach.

  “I was a kid in the Second World War,” he told me over coffee. “When they formed the Department of Homeland Security [DHS], the bells and sirens went off. ‘Wait a minute, this is the SS, this is the Gestapo!’ They were using the same words. They were pulling the same crap that the Nazis had pulled.”

  Katz got involved as a way to potentially stop a local government program, right in his own backyard, before it got out of control.

  “It’s hard to imagine a technology whose actua
l existence should be kept secret,” he continued. “Certainly not at the police level. I don’t know about at the NSA or CIA level, that’s a different thing. NSA’s adversary is other nation states, the adversaries in Oakland are, at worst, organized crime.”

  Serving alongside Katz is Raymundo Jacquez, a 32-year-old attorney with the Centro Legal de la Raza, an immigrants’ rights legal group centered in Fruitvale, a largely Latino neighborhood in East Oakland. Jacquez’ Oakland-born parents raised him in nearby Hayward with an understanding of ongoing immigrant and minority struggles. It was this upbringing that eventually made him want to be a civil rights attorney.

  “This committee has taken on a different feel post-Trump,” he said. “You never known who is going to be in power and you never know what is going to happen with the data. We have to shape policies in case there is a Trump running every department.”

  Rounding out the group is Saied Karamooz, an Iranian-American entrepreneur who unsuccessfully ran for mayor in 2014. He said he first became aware of government surveillance issues in the wake of Snowden. In addition to wanting to help the city, Karamooz wanted to better understand how such issues are worked out at the grassroots level.

  “It might be a lost cause—trying to fight the privacy battle,” he said. “Because it’s a slippery slope that is perpetuated by people who have a vested interest and are dedicated to their cause and their personal pursuits and aspirations, and the people who are trying to fend them off are volunteers and activists.”

  Karamooz, 53, who spent a career working as a top-level executive for CallidusCloud and Accenture, has now devoted himself to his and his wife’s West Oakland beauty products company. He still has an eye towards public service and may run for mayor again.