Cell Phone Manufacturers Offer Carefully Worded Denials To Question Of Whether NSA Can Track Powered-Down Cell Phones
By Tim Cushing | Techdirt | November 13, 2013
Back in July, a small but disturbing detail on the government’s cell phone tracking abilities was buried inside a larger story detailing the explosive expansion of the NSA post-9/11. Ryan Gallagher at Slate pulled this small paragraph out and highlighted it.
By September 2004, the NSA had developed a technique that was dubbed “The Find” by special operations officers. The technique, the Post reports, was used in Iraq and “enabled the agency to find cellphones even when they were turned off.” This helped identify “thousands of new targets, including members of a burgeoning al-Qaeda-sponsored insurgency in Iraq,” according to members of the special operations unit interviewed by the Post.
Ars Technica reports that some security researchers are calling this statement into question and have contacted cell phone providers for statements on the NSA’s claim. Only a few have responded at this point, and their denials have been worded very specifically.
Google had this to say:
When a mobile device running the Android Operating System is powered off, there is no part of the Operating System that remains on or emits a signal. Google has no way to turn on a device remotely.
Google may not have a way, but that doesn’t mean the NSA doesn’t.
Nokia:
Our devices are designed so that when they are switched off, the radio transceivers within the devices should be powered off. We are not aware of any way they could be re-activated until the user switches the device on again. We believe that this means that the device could not be tracked in the manner suggested in the article you referenced.
Once again, we’re looking at words like “should” and “not aware.” This doesn’t necessarily suggest Nokia does know of methods government agencies could use to track phones that are off, but it doesn’t entirely rule it out either.
Samsung’s response is more interesting. While declaring that all components should be turned off when the phone is powered down, it does acknowledge that malware could trick cell phone users into believing their phone is powered down when it isn’t. Ericsson, which is no longer in the business of producing cell phones (and presumably has less to lose by being forthright), was even more expansive on the subject.
The only electronics normally remaining in operation are the crystal that keeps track of time and some functionality sensing on-button and charger connection. The modem (the cellular communication part) cannot turn on by itself. It is not powered in off-state. Power and clock distribution to the modem is controlled by the application processor in the mobile phone. The application processor only turns on if the user pushes the on-switch. There could, however, be potential risks that once the phone runs there could be means to construct malicious applications that can exploit the phone.
On the plus side, the responding manufacturers seem to be interested in ensuring a powered down phone is actually powered down, rather than just put into a “standby” or “hibernation” mode that could potentially lead to exploitation. But the implicit statement these carefully worded denials make is that anything’s possible. Not being directly “aware” of something isn’t the same thing as a denial.
Even if the odds seem very low that the NSA can track a powered down cell phone, the last few months of leaks have shown the agency has some very surprising capabilities — some of which even stunned engineers working for the companies it surreptitiously slurped data from.
Not only that, but there’s historical evidence via court cases that shows the FBI has used others’ phones as eavesdropping devices by remotely activating them and using the mic to record conversations. As was noted by c|net back in 2006, whatever the FBI utilized apparently worked even when phones were shut off.
The surveillance technique came to light in an opinion published this week by U.S. District Judge Lewis Kaplan. He ruled that the “roving bug” was legal because federal wiretapping law is broad enough to permit eavesdropping even of conversations that take place near a suspect’s cell phone.
Kaplan’s opinion said that the eavesdropping technique “functioned whether the phone was powered on or off.” Some handsets can’t be fully powered down without removing the battery; for instance, some Nokia models will wake up when turned off if an alarm is set.
While the Genovese crime family prosecution appears to be the first time a remote-eavesdropping mechanism has been used in a criminal case, the technique has been discussed in security circles for years.
Short of pulling out the battery (notably not an option in some phones), there seems to be little anyone can do to prevent the device from being tracked and/or used as a listening device. The responding companies listed above have somewhat hedged their answers to the researcher’s questions, most likely not out of any deference to government intelligence agencies, but rather to prevent looking ignorant later if (or when) subsequent leaks make these tactics public knowledge.
Any powered up cell phone performs a lot of legwork for intelligence agencies, supplying a steady stream of location and communications data. If nothing else, the leaks have proven the NSA (and to a slightly lesser extent, the FBI) has an unquenchable thirst for data. If such exploits exist (and they seem to), it would be ridiculous to believe they aren’t being used to their fullest extent.
Federal Judge: Only Powered-Off Cell Phones Deserve Privacy Protections
By Chris Soghoian | ACLU | May 15, 2013
A federal magistrate judge in New York recently ruled that cell phone location data deserves no protection under the Fourth Amendment and that accordingly, the government can engage in real-time location surveillance without a search warrant. In an opinion straight from the Twilight Zone, magistrate judge Gary Brown ruled two weeks ago that “cell phone users who fail to turn off their cell phones do not exhibit an expectation of privacy.”
The case in question involved a physician who the DEA believed had issued thousands of prescriptions for pain killers in exchange for cash. In March of this year, the DEA had obtained a warrant for his arrest, and, not knowing where he was, sought an order from magistrate judge Brown forcing the phone company to provide real-time data identifying the location of the physician’s phone.
Although the DEA agents requested a search warrant and the judge found that there was probable cause to believe that the cell phone location data would assist in the location and apprehension of an individual for whom there was already a valid arrest warrant, the judge later published a 30-page opinion further stating that he didn’t think the government needed to seek a search warrant in the first place.
Don’t Want the Government Tracking You? Turn Your Phone Off
In his puzzling opinion, the judge squarely criticizes people naive enough to expect privacy while also leaving their cell phones on when they’re not using them.
Given the ubiquity and celebrity of geolocation technologies, an individual has no legitimate expectation of privacy in the prospective location of a cellular telephone where that individual has failed to protect his privacy by taking the simple expedient of powering it off.
…
As to control by the user, all of the known tracking technologies may be defeated by merely turning off the phone. Indeed—excluding apathy or inattention—the only reason that users leave cell phones turned on is so that the device can be located to receive calls. Conversely, individuals who do not want to be disturbed by unwanted telephone calls at a particular time or place simply turn their phones off, knowing that they cannot be located.
The Catch-22 here is that the only people who the judge believes would have any reasonable expectation of privacy are those whose phones are turned off (and thus, not generating any location data that the government could access, even with a warrant). And it ignores the necessity of keeping your cell phone turned on for communicating with family or for work.
That consumers are dumb enough to willingly share their location using the “Girls Around Me” app (which the judge specifically calls out by name, although the wrong one), only further justifies covert, warrantless government surveillance:
Given the notoriety surrounding the disclosure of geolocation data to retailers purveying soap powder and blue jeans to mall shoppers, the police searching for David Pogue’s iPhone and, most alarmingly, the creators and users of the Girls Around You app, cell phone users cannot realistically entertain the notion that such information would (or should) be withheld from federal law enforcement agents searching for a fugitive.
This is, in a word, ridiculous. There is a big difference between location information you knowingly share with a select group of friends (or, in fact, the world) and information collected about you without your knowledge or consent. Someone might be happy to share their location with a few friends by “checking in” using Foursquare while at a music festival, but not want law enforcement to access that same information. And, they would still reasonably expect that their location a week later while at an Alcoholics Anonymous meeting or abortion clinic should remain private. Sharing location data isn’t and shouldn’t be all or nothing.
We are also baffled by the judge’s willingness to tie a reasonable expectation of privacy to the use of a cell phone power button. We’re not sure if the judge has watched the Onion’s spoof news video describing a fictional “Google Opt Out Village” for people who don’t want to be tracked by the advertising company, but the logic in his opinion is consistent with the absurdity of that spoof. If you don’t want Google to track you, stop using all modern technology and move to a remote village. If you don’t want the government to covertly track your phone, turn it off and leave it off. What could be simpler, right?
Related articles
California dad ‘begged for his life’ as police beat him to death – witnesses
RT | May 10, 2013
A California father of four died Wednesday shortly after a group of police allegedly beat him with batons as he lay defenseless on the sidewalk. Cops, before confiscating witness’ cameras, also reportedly unleashed a canine unit on him.
David Sal Silva, 33, allegedly resisted when police approached him to ask if he was who neighbors called about to complain of an intoxicated man in the area. The officers called for backup and, witnesses told the Bakersfield Californian, Silva was soon being beaten in the face and upper body by as many as nine policemen and their batons. At least one of the cops reportedly held a German Shepherd on a leash nearby.
Witnesses who had recorded the events on their cell phone cameras had the devices confiscated by officers, who claimed the footage was part of a police investigation that could yield evidence. The Sheriff’s Department has released the names of seven officers who were on the scene, but the identities of the California Highway Patrol police who were also there have not yet been made public.
“When I got outside I saw two officers beating a man with batons, and they were hitting his head so every time they would swing, I could hear the blows to his head,” said witness Ruben Ceballos, who told the Californian the noise was so loud it woke him up.
“His body was just lying on the street and before the ambulance arrived one of the officers performed CPR on him and another used a flashlight on his eyes but I’m sure he was already dead.”
Police have refused to comment, citing an ongoing investigation that could take years to complete, but relatives have demanded the cell phone footage be made public.
“My brother spent the last eight minutes of his life pleading, begging for his life,” said Christopher Silva, 31. “The true evidence is in those phone witnesses that apparently the sheriff deputies already took. But I know the truth will come out and my brother’s voice will be heard.”
An autopsy was completed Thursday but the cause of death’s release is pending a toxicology report and microscopic studies, the local coroner’s office told the Bakersfield Californian Friday.
The family has hired attorney David Cohn, who told reporters they plan to file a civil rights lawsuit in federal district court next week. He sent a letter formally requesting that law enforcement agencies do not tamper with the video evidence on the phones.
“We all know that a picture is worth a thousand words,” Cohn said. “And thank God we have concerned citizens who take video and pictures of incidents like this and who are ultimately policing the police … But we will get to the bottom of this and I ask the sheriff’s department once again, what are you hiding?”
Appeals Court Rules Fourth Amendment Does Not Protect Cell Phone Location Data
By Catherine Crump, ACLU Speech, Privacy and Technology Project | August 15, 2012
Yesterday the Sixth Circuit Court of Appeals issued an unfortunate and legally incorrect decision holding that the Fourth Amendment provides no protection against warrantless cell phone tracking. Although couched in language stating narrowly that the Constitution does not protect criminals’ “erroneous expectations regarding the undetectability of their modern tools,” the impact of the opinion sweeps far more broadly, holding that the innocent as well as the guilty lack Fourth Amendment protection in cell phone location information. This is wrong, for a number of reasons.
The defendant in the case is one Melvin Skinner, who was allegedly involved in a marijuana trafficking operation of epic proportions. After a complex investigation by the Drug Enforcement Administration, Skinner was busted while in possession of over 1,100 pounds of marijuana. The DEA tracked Skinner down in part by obtaining various kinds of location tracking data for the cell phone he was using: cell site information, GPS real-time location, and “ping” data. Law enforcement agents appear to have tracked Skinner’s movements using this information for about three days.
The ACLU has argued repeatedly that the Fourth Amendment provides protections against warrantless cell phone tracking, particularly continuous tracking over prolonged periods of time such as the three days at issue in Skinner’s case. The Fourth Amendment protects people’s reasonable expectations of privacy, and people reasonably expect that they will not be subject to this invasive form of surveillance. That is because location data is very sensitive, revealing private facts. As an appeals court has observed:
A person who knows all of another’s travels can deduce whether he is a weekly church goer, a heavy drinker, a regular at the gym, an unfaithful husband, an outpatient receiving medical treatment, an associate of particular individuals or political groups—and not just one such fact about a person, but all such facts.
That is not to say that law enforcement agents can never obtain cell phone location data. The question, rather, is under what circumstances they are permitted to do so. Because of the privacy interests at stake, law enforcement should have to go to a judge and get a warrant, which involves proving that they have probable cause to believe that tracking location would turn up evidence of a crime. There are numerous police departments that get a warrant for cell phone tracking, and it’s the best way to ensure that law enforcement can do its job while also protecting Americans from having their privacy needlessly invaded.
Unfortunately, that is not the conclusion drawn by the Sixth Circuit. The majority practically scoffed at the idea that Melvin Skinner had any reasonable expectation of privacy in “data emanating” from his cell phone. This passage best captures the court’s view that Skinner’s claim to constitutional protection was the height of audacity:
The law cannot be that a criminal is entitled to rely on the expected untrackability of his tools. Otherwise, dogs could not be used to track a fugitive if the fugitive did not know that the dog hounds had his scent. A getaway car could not be identified and followed based on the license plate number if the driver reasonably thought he had gotten away unseen.
In other words, a person’s ignorant belief that he has made a clean getaway does not shield him from detection.
But this is not the right question. The mere fact that the police are capable of tracking someone doesn’t mean they’re entitled to do so without first getting a warrant, any more than the mere fact that it’s easy to break down someone’s front door or open their postal mail gives the police the right to take these steps without a warrant. The question, rather, is whether a police action invades a person’s reasonable expectation of privacy that society is prepared to recognize as reasonable. Because people reasonably expect privacy in their movements, as the D.C. Circuit explained in the passage above, the Fourth Amendment provides us with protection.
If a suspected criminal’s phone can be tracked without a warrant, then all of our phones become tracking devices that the government can use to monitor us for any reason or no reason at all.
The Sixth Circuit was able to reach the conclusion that it did by relying on a 25-year-old Supreme Court case dealing with a more primitive tracking technology known as a “beeper.” In the beeper case, United States v. Knotts, the police used a combination of visual surveillance and signals from the beeper to track an investigative target as he traveled on public roads. The Supreme Court approved the tracking in Knotts, and the Sixth Circuit found that the DEA’s tracking of Skinner was not meaningfully different:
Similar to the circumstances in Knotts, Skinner was traveling on a public road before he stopped at a public rest stop. While the cell site information aided the police in determining Skinner’s location, that same information could have been obtained through visual surveillance. There is no inherent constitutional difference between trailing a defendant and tracking him via such technology.
This is really the heart of the matter. The Sixth Circuit’s fundamental error is in believing that a technological change that makes it vastly more feasible to track us all in great detail, continuously, and at little cost is simply irrelevant. It is not irrelevant. It is highly significant. Physically tailing a person for days on end requires a mass commitment of resources, which in turn limits the possibilities for abuse. The police aren’t going to enlist huge numbers of people for a massive surveillance operation without a very good reason. But when a single police officer can achieve the same level of surveillance using GPS, all while sitting at his desk and flipping open a laptop, the situation is radically transformed. As the invasiveness of tracking and the ease of tracking increase, the supervision of courts applying meaningful constitutional standards become all the more important.
The Sixth Circuit is the first court of appeals to address the Fourth Amendment and cell phone tracking after the Supreme Court’s decision in United States v. Jones that when the police attach a GPS device to a car, that is a search under the Fourth Amendment. But Jones will be of little value if the police can simply track cell phones instead of cars and, with the Sixth Circuit’s decision holding that they can indeed do so, we’re off to a bad start. The Fifth Circuit is poised to consider the same issue later this year and has scheduled argument for October. Let’s hope that it’s more sensitive to the privacy interests at stake than its sister circuit.

