How did the police know you were near a crime scene? Google told them

The suspects in an Eden Prairie home invasion last October wore gloves, dressed in black, and covered their faces with masks. But despite their efforts to remain unseen, a trail of evidence was left behind — not at the crime scene, but with Google.

Knowing the Silicon Valley giant held a trove of consumer mobile phone location data, investigators got a Hennepin County judge to sign a "reverse location" search warrant ordering Google to identify the locations of cellphones that had been near the crime scene in Eden Prairie, and near two food markets the victims owned in Minneapolis and St. Paul.

The scope of the warrant was so expansive in time and geography that it had the potential to gather data on tens of thousands of Minnesotans.

The technique has caught the attention of civil liberties lawyers who worry such warrants — deployed increasingly by police in the Twin Cities and around the country — are a digital dragnet ripe for abuse, and that judges may not realize the technical details or broad scope of the searches they're authorizing.

"What is so problematic is that it can scoop up completely innocent people who are in an area for legitimate reasons, and who should not be treated as suspects," said Teresa Nelson, legal director of the ACLU of Minnesota.

A reverse location search warrant differs from a traditional search warrant in that it doesn't identify a suspect and establish probable cause to ask for evidence of a suspect's crimes. Instead, it asks for information about everyone in an area at a certain time, working backwards to identify a suspect.

Law enforcement officials say it's a promising new technique, especially in cases involving strings of robberies or burglaries, and that the process has been crafted to preserve privacy.

Following news reports of use of the practice in North Carolina, Virginia, and Maine, police departments in Minnesota have followed suit, obtaining at least 22 reverse location warrants since August in cases ranging from aggravated robberies and shootings to the theft of $650 worth of tires in an overnight retail store break-in.

'Some judges would be alarmed'

Eden Prairie police officials won't talk about their use of the reverse location warrant in the home invasion case. But court documents show the broad scope of what they sought and how they pursued it.

Law enforcement responded to a 911 call last October from an Eden Prairie woman who had just been robbed in her home. Her husband, Oukham Oudavanh, 63, suffered a heart attack and died at the scene, and the suspects made off with $50,000 belonging to the couple's popular food markets, Shuang Hur in Minneapolis and St. Paul. 

Police wanted Google to identify all mobile devices in the area of the crime scene over a 6-hour time window. They also wanted location data for every cellphone in dense, urban areas surrounding the food market businesses over a 33-hour window.

On a map, it's easy to visualize how expansive this warrant request was. Anyone who passed through University and Dale avenues between Oct. 6 and 7 would be included.

But the judge wasn't given a map. 

The warrant application did not spell out plainly the area covered by the warrant, what was inside the targeted areas, or how the areas were related to the crime at all. It used only technical language, specifying geographical coordinates of the target areas, also called "geofences."

The judge approved the warrant application in about 10 minutes.

"Most human beings can't interpret large strings of numbers and GPS coordinates without a map to illustrate them, and judges are no exception," said Nathan Freed Wessler, an attorney for the national American Civil Liberties Union.

"Understanding how these geographical areas are targeted is completely central to determining whether these searches are constitutional," said Wessler, who argued a landmark cellphone location data case before the U.S. Supreme Court.

"In some cases, I think some judges would be alarmed if they were told exactly what they're signing off to here," said Ryan Pacyga, an attorney representing one of the accused defendants in the Eden Prairie home invasion case.

Police said privacy would be preserved through a two-step process where Google would first anonymously assign an identification number linked with each device's serial number when turning over the records. If a device's location, movement, or timing established probable cause, investigators could go back to court and get a second warrant ordering Google to reveal the name of the cellphone's owner.

Wessler says this process is better than nothing, but it's not a foolproof way to protect privacy, especially when a target area covers homes or offices.

"These kind of searches raise serious concerns about overbreadth, and affect the privacy rights of lots of people who live or work nearby," said Wessler.

Investigators reviewed the Google data and found a mobile device that appeared to be in the rear of the victims' home. The data showed the device then moved to locations "generally between 13-20 meters," roughly 42 to 65 feet, from the victims' Wi-Fi hotspot, before disappearing from the map as the 911 call came in. A judge then ordered Google to identify the device's owner, and provide a bigger data capture of the person's movements.

But by that point, police had already developed suspects without Google's help, based on vehicle descriptions and a confidential informant, they said in court filings. Three weeks after serving the second search warrant on Google, they arrested three suspects, who now face federal charges.

Police believe the suspects were responsible for a string of burglaries, so if the phone was one of the suspect's, police would now have months of location data from that Google account that would potentially place them at the scene of each one.

'Violating trust'

The Eden Prairie detectives knew what most Google users should: that in exchange for the use of Google's devices and free services, users agree to let Google look over their shoulders.

"[A] high percentage of the population regularly carries and uses a cellular phone," wrote a detective in one of these search warrant applications. "Google monitors its customers' activities and location through its free apps and services in order to provide more timely responses to queries and for targeted advertising ... [t]he services may be actively in use or running in the background on the device without the user's knowledge."

Google's lengthy user agreement does specify that any data Google keeps may be provided to police in response to a legal demand. But the process by which a user consents to the data collection isn't always clear.

"Google is sitting on an incredible amount of highly sensitive location data about millions and millions of people," said the ACLU's Wessler. "Some of that location data people may understand they're sharing with Google. And other parts of it, people almost certainly do not."

Apple's iOS and Google's Android operating systems collect location information using built-in GPS chips, and by scanning for nearby Wi-Fi networks, cell towers, and Bluetooth signals to build a crowdsourced database of location information to help the devices quickly figure out where they are.

But while Apple's location data processing is anonymous, two hard-to-find settings— "Location History" and "Web and App Activity" — allow Google to keep track of everything their users search, and everywhere they go. It affects all Android users, and iPhone or iPad users with apps like Google Maps installed on their device.

An Associated Press investigation last year revealed that even with these settings disabled, Google continued to collect and store users' location data. 

Google is now facing a class action lawsuit from consumers who say the company intentionally complicates the opt-out process. The company filed a motion to dismiss the legal action, pointing to its user legal agreement.

Consumers use technology and generate location data because they want to have some useful service that an app or device is providing, not because they want to share that information with a third party or the government, said Jennifer Lynch, surveillance litigation director at the Electronic Frontier Foundation, a digital rights organization in San Francisco.

"Our democracy is based on the idea that you can engage in private activity without the government monitoring your every move," said Lynch. "It feels like what the government is doing here is violating the inherent trust that we have with our devices."

Wessler and other civil liberties experts are concerned that geolocation data in the hands of police could be easy to abuse, generating broad warrants the framers of the Constitution worried about when they wrote the Fourth Amendment, which protects against illegal searches and seizures.

"Courts haven't addressed whether these kinds of searches just sweep too far," said Wessler, "It's an open question whether the Fourth Amendment ever allows police to gather up information about an unknown, potentially large number of bystanders in an effort to identify one unknown suspect."

Asked about Google's handling of these types of warrants, and whether Google is clear enough with users in disclosing how data is stored and shared, Google's communications manager Genevieve Wong Park sent a link to a webpage noting that Google "frequently pushes back when requests are overly broad or don't follow the correct process." 

Court records do suggest Google resisted the scope of the Eden Prairie warrant before eventually complying, but the specifics aren't clear. 

Eden Prairie Police Captain Bill Wyffels said that "gathering digital evidence may include executing search warrants for location data possessed by Google or any one of the many other companies that store location data," but he declined comment on the home invasion case.  The Minnesota U.S. Attorney's Office, prosecuting the case, declined to comment on its investigative techniques.

Brooklyn Park has also tapped Google for location data. While the company rejected some early versions of the police department's warrants when they didn't agree with the language, "they've been really good to work with," said Mark Bruley, the city's deputy police chief.

Judges are the firewall

One Brooklyn Park case illustrates the difficulty judges face when analyzing these types of warrants.

Police got a reverse location search warrant last August to try to find a suspect in a string of March nighttime break-ins of a bar, hair salon, and gas station, all burglarized in a distinctive way. 

The geofences were quite narrow, and for a one-hour period of time. A judge signed the warrant, and Google complied.

There was a match, but not a great one. Police said it was near the gas station, but not the bar or hair salon, and the data point wasn't very accurate. 

"Google locations and their accuracies should not be used in a definite way," read a study from a team of forensic data scientists last year. The research found that while Google's data could usually place someone in the general whereabouts of an area, some conditions resulted in Google overestimating its accuracy 93 percent of the time.

In this case, Google told police the device was "within a 52 meter radius," roughly 170 feet, of the gas station.

With that large a circle, a judge would have no way to know for sure if the device was the burglar, someone buying fuel, the business owner's phone or tablet kept inside, or someone just driving down the road. Still, the device was spotted at 2:29 a.m. and 2:54 a.m., while the burglary was at 2:47 a.m. 

It presented a tough probable cause analysis, and police were asking for a lot: the identity of the phone's owner, billing information, phone numbers, and two months' of their web browsing history and location data. Google was also put under a non-disclosure order, restricted from telling the user that this information would be divulged for at least six months.

No map was provided in the application to illustrate the area or accuracy level to the judge. This warrant was also issued within about 10 minutes of the detective requesting it.

Google responded to the warrant, court records show. Earlier this week, more than two months after Google presumably identified that phone's owner, police said the case was still active, with no arrests. 

Asked earlier this week whether that suggests Brooklyn Park police got a data dump on the wrong person, Bruley cautioned against assuming that, saying that investigations take time. On Thursday, Bruley said police have closed the investigation, because Google ultimately could not track the data point.

"We got a warrant signed by a judge. The judge also believed that it was appropriate to the case," Bruley said. He noted that even if it did target the wrong person, "it doesn't mean they're going to get convicted or arrested, it just gives the detective a look at who could be involved."

Brooklyn Park appears to be the first agency in Minnesota to have used the reverse location search warrant method.

Bruley said detectives learned about the potential value of the practice and how to write the warrant applications at an August training seminar held by ZetX, an Arizona-based company that teaches police about cellphone investigations, and sells software called TRAX that generates legal documents and maps cellphone data to assist in analysis. The company holds trainings all across the country.

Material from the U.S. Department of Justice was presented, said Bruley, including suggested language for use in these types of warrants.

When Google provides location data in response to one of these warrants, police "put that location data into the software and then map out a 'profile of life' of where they go, where they travel, and where they were the night of the crime," Bruley said.

The week after detectives attended the ZetX training in the Twin Cities, they wrote up their first three reverse location search warrants. By the next month, they had a dozen, each ordering Google to turn over information on devices located in the vicinity of crimes.

Brooklyn Park police provided case records indicating that an arrest was made in just one of the cases which used a reverse location search warrant. The complaint said they ultimately identified the burglary suspect through a fingerprint match on a door handle.

The agency also began using the practice to look for suspects in older cases, obtaining a search warrant last September to order Google to examine location data in a 2013 shooting homicide. So far, the case remains open.

Over the past month, Eden Prairie and Brooklyn Park police have used the warrants in cases to find suspects who stole a pickup truck, broke into a Fleet Farm store to steal tires, robbed a restaurant at gunpoint, and to attempt identifying the suspect of a sexual assault.

Edina police also obtained one such warrant, seeking to identify a suspect who lured a pizza delivery driver into a dead-end neighborhood before robbing him. 

About four minutes after the detective signed the application — which included no map of the targeted area — the judge approved it. Google provided the data on Dec. 12, but the case remains open with no arrests.

In recent cases, judges appear to have authorized police to skip the second step of judicial review, allowing investigators to pick the map points they considered "relevant to the investigation," and go back to Google directly.

Civil liberties experts interviewed for this story all agreed that judges are the crucial firewall in this process. 

That means it's important judges understand what they are signing.

Of the 22 reverse location search warrants issued in Hennepin County, only three times did the warrant applications include map demonstrating the geographic area being targeted by the warrant. And yet, the time difference between an officer signing a warrant request, and a judge approving it, was sometimes just a few minutes.

The Fourth Judicial District Court, serving Hennepin County, was given the details of this story and asked about its warrant approval procedures.

"Judges cannot comment on their decisions or orders outside of the official court record," said Spenser Bickett, the district court's communications specialist, who worked with Chief Judge Ivy Bernhardson to respond to this story.

When asked about the warrant signature timestamps, Bickett responded, "The previous statement is our response to your questions."

Bernhardson authorized five of the warrants referenced in this story.

Technology outruns the law?

At the state level, there are worries that the law simply can't keep pace with the speed of technology change.

"State law doesn't really contemplate granting a broad warrant for every electronic device that has been in an area where a crime has been committed," the Minnesota ACLU's Nelson said.

In 2014, the Minnesota Legislature passed a law prohibiting state and local agencies from obtaining the location information of an electronic device without a "tracking warrant." 

While a tracking warrant is used to broadly follow where one person goes, Bruley said reverse location search warrants are "a bit of a fishing expedition to look at and capture potential suspects that [visited a location] at a very specific and narrow time." 

Don Gemberling, an attorney who managed data practices issues at the Minnesota Department of Administration for more than 30 years, pointed to another consequence of these data sweeps: once the investigation is closed, all the data law enforcement collects become public information. 

"That's probably something that we're going to have to navigate in the near future," said Bruley. He said all the data are saved as part of case files.

Wessler also expressed concern about law enforcement holding on to data irrelevant to the crime. "There should be a total prohibition on police dipping back into that data in any future investigations," he said.

Rep. John Lesch, DFL-St. Paul, chair of the Minnesota House Judiciary Finance and Civil Law Division, and Rep. Peggy Scott, R-Andover, who chaired the Legislative Commission on Data Practices last year, were surprised to hear about these types of warrants.

"The capabilities of technology are getting such that I don't know how the average legislator can track it, and keep up with it," said Scott.

She said she wants law enforcement to catch criminals, but that the government use of these types of technologies is "teetering on the line of our constitutional rights."

Lesch said the topic should be discussed at the Legislature, and he expressed frustration regarding law enforcement's use of new technologies and practices before legislators could set boundaries.

"I suspect even if we forged a coalition of folks with enough concerns to put forth some alternative, that the technology is going to change in five years," said Lesch, "But it doesn't mean we don't try."

Bruley, whose department has used reverse location search warrants more than any Minnesota agency so far, acknowledged the privacy concerns are real and that law enforcement must work with lawmakers to balance the needs of community members and police.

"Those protections should exist. We strongly support them, and furthering the conversation makes sense," said Bruley, "This does appear to be a great tool for us to use at the moment, but it does have to be used correctly."

• Eden Prairie location area warrant

• Eden Prairie warrant targeting specific phone

• Eden Prairie restaurant robbery search warrant

• Brooklyn Park burglary device warrant

More on tech and privacy

• What else are you curious about? Ask MPR News here