Just before 5 p.m. on May 20, a gunman walked into a bank in Midlothian, Virginia, forced a worker to open a safe and fled with $195,000. Security footage showed the man holding a cellphone to his ear just before the robbery, a detail that led police to attempt a surveillance technique that is growing in popularity among American law enforcement agencies.
When authorities had not identified the suspect a few weeks after the robbery, an officer got a warrant for Google's location data from all the cellphones that had been in the area of the Call Federal Credit Union bank during the heist. Starting from a list of 19 accounts, investigators narrowed their search to a 24-year-old Richmond man named Okello Chatrie, whom they eventually charged with armed robbery.
The demand for Google data, known as a geofence warrant, is a way for law enforcement authorities to take advantage of the company's collection of massive amounts of information on its customers. The orders allow police to track just about anyone using an Android device or a company app — such as Google maps or Gmail — to a particular place over a particular time period. As more police use such warrants, the method is raising concerns among privacy advocates, who say the government is gathering information from people in violation of the Fourth Amendment, which guards against unreasonable searches.
That is what Chatrie's lawyers are now arguing, in what may be the first case in which a defendant is fighting the use of a geofence warrant to charge him with a crime.
"It is the digital equivalent of searching every home in the neighborhood of a reported burglary, or searching the bags of every person walking along Broadway because of a theft in Times Square," Chatrie's lawyers said in an October court filing. "Without the name or number of a single suspect, and without ever demonstrating any likelihood that Google even has data connected to a crime, law enforcement invades the privacy of tens or hundreds or thousands of individuals, just because they were in the area."
Prosecutors say that the search was legal because Chatrie had opted into Google's location services, allowing his Android phone and the company's apps to track his movements. And they say police avoided collecting personal information from people unconnected to the robbery.
"The geofence warrant allowed them to solve the crime and protect the public by examining a remarkably limited and focused set of records from Google," prosecutors wrote in a response, filed Tuesday.
Chatrie has pleaded not guilty and is awaiting trial.
The use of geofence warrants seems to be increasing, according to defense lawyers and privacy advocates. There is no easy way to track them, but they have been documented in cases in North Carolina, Minnesota, Virginia, Arizona and elsewhere. Contractors now offer to help police looking to use the warrants.
Google said it only produces location-history data if served with a geofence warrant, and has fought attempts to get such information without one. The company did not provide information on how often it received those requests. Its transparency reports show that the number of search warrants sent to the company more than doubled in the past two years, to 19,046 from July 2018 to June 2019.
“We vigorously protect the privacy of our users while supporting the important work of law enforcement,” Richard Salgado, Google’s director of law enforcement and information security, said in a statement. “We have created a new process for these specific requests designed to honor our legal obligations while narrowing the scope of data disclosed and only producing information that identifies specific users where legally required.”
That process, according to court filings, was used in the Chatrie case. Google first provided location data, but no identifying information, for 19 devices in a 150-meter radius around the bank for a one-hour period that included the robbery. Police then picked out nine of those devices for more information, and Google gave location data on those devices covering two hours. Finally, police asked for — and received — subscriber information for three devices, including one that was in the bank during the robbery, left immediately after it, and followed a path matched by witness sightings. That information gave police Chatrie's email address and told them he used an Android phone and Google Location History, which tracks users' movements (and is viewable in Google Timeline).
Nathan Freed Wessler, an attorney with the American Civil Liberties Union who specializes in technology and privacy, said the argument over geofence warrants in Chatrie's case is relevant to all Americans, many of whom may have already had their location data swept up in a criminal investigation without their knowledge.
"Americans shouldn't have to rely on closed-door negotiations between a private company and a prosecutor to protect their data," Wessler said. "We need a court to step in to make sure rules are set so we don't end up in a society where police can get access to a lot of bystanders' information in the course of looking for a guilty person."
He added: "Cases like this aren't just about criminal defendants. It's about all of our rights under the Constitution."
The U.S. Supreme Court recently took on a similar issue: whether police need a warrant to get data from telecommunications companies, which track when someone's phone pings a cell tower. The high court ruled last year that such a search required a warrant because it could be used to monitor people's movements around the clock, beyond what's needed to investigate a crime.
Related
That decision was limited in scope, and did not contemplate other types of surveillance rooted in the ubiquity of cellphones. But Chatrie's lawyers drew elements of it into their arguments, saying that police access to Google location data "that can locate individuals quickly, cheaply, and retroactively is an unprecedented expansion of law enforcement power."
They noted that the geofence warrant in the Chatrie case asked for data in an area that included a large church and its parking lot.
Chatrie lawyer Michael Price declined to comment on the case. The U.S. Attorney's Office in the Eastern District of Virginia did not return messages seeking comment.
Andrew Crocker, a staff attorney for the Electronic Frontier Foundation, a nonprofit that advocates for digital privacy rights, said the concerns over geofence warrants will only grow as technology companies continue to amass vast amounts of data from consumers.
"I think we’re going to see more courts having to wrestle with this idea," Crocker said. "Can the government do this needle-in-a-haystack search? Can they go to companies that have these vast databases on individuals and say, 'Look through this and tell us who we should be suspicious of and go after?'"
