A woman in medical scrubs with a swollen, bruised face walked into a truck stop outside Milwaukee just before 3 a.m. on June 16, 2017, and begged a driver to use his cellphone. She dialed 911 and said she’d been attacked by two men.
“They carjacked me, they beat me up and raped me,” she said.
The woman, a health care worker in her 30s, told police that, as she was driving home from her shift at a nearby hospital, a stranger had lunged into her open window at a highway exit. Armed with a box cutter and hammer, he made her drive off with him, then forced her to pull over and get into a dark-colored pickup truck, where he sexually assaulted her while an accomplice drove. Then they left her at the side of the road.
The odds of solving such a random crime seemed slim. The woman — who asked that she be identified only by her initials, M.D., to protect her privacy — was able to give a basic description of the rapist and his truck but that wasn’t enough to narrow the search. The attackers had taken her phone, but police could not track it because it had been turned off. “This was about as much of a whodunit as it gets,” Milwaukee police Detective Eric Draeger recalled.
But one detail drew his attention.
From the truck’s dimly lit backseat, as they’d passed General Mitchell International Airport, M.D. had glimpsed the glowing screen of a cellphone, a Samsung Galaxy, that was running Google Maps.
That got Draeger thinking. He conducts high-tech investigations for the Milwaukee Police Department, where he’d sought breaks in previous unsolved cases by using “cell tower dumps,” which compiled data from telecommunication companies to identify phones used near crime scenes. It was an expensive and arduous process and did not guarantee any usable results. But he might get results faster, and with more precision, if he went to a single source of highly precise location data: Google.
At a conference, Draeger had heard law enforcement officials discuss the possibility of asking Google for location data that could be used as a dragnet for a suspect’s phone. He didn’t know anyone who’d actually done it, but he pitched it to his supervisor.
“I don’t expect results necessarily, but let’s give it a shot,” Draeger recalled saying.
That request evolved into one of the earliest known examples of a “geofence warrant,” a type of digital data hunt that has since soared in popularity among police seeking help in all sorts of unsolved cases, from burglaries to murders. Secrecy around the technique makes it difficult to measure its effectiveness, but reported successes include finding the suspect in a series of bombings in Texas, and arrests in a Minnesota home invasion and a burglary in San Francisco.
With its spread, the technique has drawn criticism from defense lawyers and privacy advocates who say it makes it easier for the government to track unsuspecting people who’ve been near the scene of a crime, even if they had nothing to do with it. The searches have been challenged as unconstitutional in Virginia, rejected as dangerous in Illinois and targeted for prohibition in New York. In Florida last year, a geofence search placed suspicion on a man who had innocently ridden his bicycle past a burglarized home.
Milwaukee authorities were not restricted by those concerns in June 2017. Eager to arrest a violent predator, they turned to an innovative and untested method that would surprise them with its effectiveness — and help spark a new era in high-tech investigations.
A crucial memory
In the hours after the attack, M.D. hadn’t begun to process the trauma of her ordeal yet. It felt unreal. But one thing that she was able to focus on was talking to detectives. She spoke to them in person and on the phone, and rode with them as they retraced the route of her abduction.
“I tried to remember as much detail as I could, anything I thought was significant,” M.D. said. “I was hoping any little clue I gave would help them put pieces of the puzzle together.”
The police released a sketch of her attacker, based on her description, and detectives began searching surveillance camera video. They tried lifting fingerprints from her abandoned car and hoped they’d get a DNA profile of the suspect from the sexual assault kit. But they didn’t know if any of that would help. And they were worried that the attackers would strike again.
They had good reason to be concerned. Hours before the abduction, an 18-year-old woman had reported being followed by men in a dark pickup after she and a friend left a restaurant in nearby Kenosha. She said the truck tried to run her off the road, and one of the men approached her car with a baseball bat before she sped off. Police suspected the same two men in both incidents. The case became a top priority, with more than two dozen investigators and commanders involved.
For Draeger, the key detail from M.D. was that she had seen the rapist pull up Google Maps on his Samsung phone — and that it was still running when her attackers abandoned her on the side of the highway.
M.D. didn’t know whether those details would be helpful. “At the time I was just trying to process everything and to be really objective,” she said.
But for Draeger, the information was revelatory.
“She was that with it and had the presence of mind to remember details about the phone,” he recalled. “I was going, ‘Holy crap.’’’
The Samsung Galaxy phone ran on Google’s Android operating system, which requires users to link to their Google accounts and comes loaded with the company’s apps, including Google Maps, that collect detailed location data through Wi-Fi, GPS and Bluetooth signals.
Draeger decided to ask Google to use this data to identify the suspects in M.D.’s case. He'd never done it before and didn't know anyone who had, although the technique had been tried at least twice: Google says it received its first geofence warrant in 2016 from a law enforcement agency it did not name, and in March 2017 police in Raleigh, North Carolina, sought a geofence warrant in a murder case, according to documents obtained by Raleigh TV station WRAL, an NBC affiliate.
It was now about 3 p.m. on Friday, June 16, about 12 hours after M.D. had dialed 911. Draeger called Erin Karshen, an assistant district attorney who was familiar with high-tech investigations and who agreed to find a judge to hear their request. Draeger wrote up a warrant that asked a judge to order Google to provide information on any devices that ran a Google Maps search near the airport at the time of the abduction. Then he met Karshen and the judge at a restaurant near the courthouse, which had just closed for the weekend. The judge signed the warrant.
Draeger emailed it to Google, adding an “exigent circumstances” request that urged the company to respond quickly to prevent another attack. He didn’t know if he would get a response — and if he did, whether Google could help him.
About 20 minutes later, his phone rang.
A suspect revealed
An employee in Google’s legal compliance unit was calling. “I don’t even know if this can be done, but we really do want to help because this is everyone’s nightmare,” Draeger recalled her telling him.
Over the next few days, Google representatives helped Draeger update his warrant to allow the company to search beyond the airport, where hundreds of devices had been using the app at the time of the attack, and look for devices used in additional scenes linked to the crime, including the abduction point and a bar in Chicago where M.D.’s credit card was used the following night.
On June 20, the Google representative and her supervisor told Draeger there was only one phone in their records that met the search criteria.
“All of a sudden it shows up in my email, and I open it up and I’m staring at the screen, going, ‘I have a name and phone number for this dude we’ve been looking for for like five days,’” Draeger recalled.
Google representatives declined to speak on the record about the case, but pointed to statements the company has provided in response to past questions about geofence warrants.
"We vigorously protect the privacy of our users while supporting the important work of law enforcement,” Richard Salgado, director for law enforcement and information security at Google, said in one statement. “We developed a process specifically for these requests that is designed to honor our legal obligations while narrowing the scope of data disclosed."
For more of NBC News' in-depth reporting, download the NBC News app
Police searched public records and criminal databases and found out that the suspect, Jose Arevalo-Viera, an El Salvadoran national who was 28 at the time, had served prison time in Kentucky for a 2008 conviction for unlawful imprisonment, had twice been deported from the United States and was back in the country illegally. He now ran a carpentry business with family members in Louisville, traveling to jobs around the Midwest. Police asked his cellphone provider, T-Mobile, for an emergency tracking of his phone — which the company performs under certain circumstances — and watched in real time as he headed home, Draeger said.
Milwaukee investigators gave the tracking information to authorities in Kentucky, who pulled him over on a highway outside Louisville late at night on June 20. He fled into a roadside forest, hiding for more than an hour before he was found by a police dog, according to police. He was arrested on charges of sex assault, kidnapping, armed robbery and party to a crime.
The next day, police tracked down his accomplice, Grabiel Arias-Martinez, in Kentucky and charged him with kidnapping. He told investigators that the two men had been in Milwaukee on a construction job, according to court records. Police asked Google for Arevalo-Viera’s location history, showing where he’d been before and during the attack. They obtained surveillance video of Arevalo-Viera and Arias-Martinez from several of those places. They lifted a fingerprint from M.D.’s car and matched it with Arevalo-Viera. And they linked the men to the attempted abduction in Kenosha.
After the arrests, but before the suspects were brought back to Milwaukee to face charges, M. D. identified Arevalo-Viera as her rapist in a photo array, said Karshen, the assistant DA. A DNA analysis later found Arevalo-Viera’s genetic profile “consistent with” a partial profile obtained from M.D.’s rape kit, Karshen said.
When police called M.D. at home to tell her of the arrests, she took a deep breath: It was a relief, she said, to know that her alleged assailants were behind bars and unable to hurt her again — or anyone else.
“But I also knew this was just the beginning of the legal process, of what else was going to come,” she said.
The early experimentation with geofence warrants has opened new possibilities for police across the country, and as word has spread it has grown into a surge.
The technique has been used hundreds of times from North Carolina to Arizona, from Minnesota to New York. Last year, Google said in a court filing in Virginia that the number of geofence warrants from police had increased by more than 1,500 percent from 2017 to 2018, and by 500 percent from 2018 to 2019. The company declined to provide updated or more detailed data.
With the massive increase of requests, it can now take Google months to provide the answers investigators are seeking. Because of that lag, geofence warrants are often used as a last resort, when investigators feel they are unable to make progress using other methods.
Law enforcement authorities say geofence warrants are legal because Google users agree to have their location tracked. Both police and Google say they take steps in the geofence warrant process to protect people’s privacy, by first using anonymized data showing devices near a crime scene, and then getting more specific for devices that police believe belong to a suspect.
But the increasing use of geofence warrants has spurred pushback from defense attorneys, privacy advocates and some judges, who say such widely drawn dragnets are not necessary — and may violate people’s Fourth Amendment protections against unreasonable searches. The warrants could be used to track people going to church, an abortion clinic or political activities or protests — and mistakenly lead police to identify an innocent person as a suspect, the critics say.
This summer, a federal magistrate judge in Chicago rejected federal authorities’ requests for a geofence warrant in an investigation into stolen pharmaceutical drugs, citing the danger to “our collective sense of privacy and trust in law enforcement officials.”
In New York, state lawmakers have proposed a bill that would make it illegal for police to use geofence warrants.
Albert Fox Cahn, executive director of the New York-based Surveillance Technology Oversight Project, said that geofence warrants might sometimes solve a case, but at a steep cost. Some judges don’t even realize how many people’s information is scooped up in the searches, he said.
“When we look at horrible crimes and these extreme cases, it’s very easy to ignore the aggregate impact these tools have, and all the ways they get it wrong and put people at risk,” he said.
'It's something we need'
For two years, M.D. worked to rebuild her life: She returned to work, got trauma counseling, competed in triathlons, saw family and close friends and overcame her fear of going out in public. She relied on her boyfriend and dog for daily support.
The hardest thing, she said, was telling someone what had happened to her.
“Because they would no longer see me as me. They would see me as this victim or survivor of this horrific crime,” she said.
She kept in touch with prosecutors and a victim’s advocate, who updated her on each hearing and court motion. She wanted to testify against both men, but as the dates approached, she began to fear that a trial would shatter the stability she’d regained. The idea of sharing her experience in front of a jury of strangers — and her attackers — frightened her.
In February 2019, Arias-Martinez pleaded guilty to kidnapping and was sentenced to 25 years in prison. His lawyer declined to comment. But Arevalo-Viera, the accused rapist, denied the crime, and in June 2019 went to trial.
M.D. took the stand on a Wednesday afternoon. She looked out at the courtroom and saw Arevalo-Viera and began to cry, struggling to say her name as she was sworn in, she said. But then she took deep breaths, remembering the coping mechanisms her trauma counselor had taught her in preparation for this moment.
Then, in painful detail, she told the story of what she’d endured, from the moment Arevalo-Viera forced himself into her car and told her to drive, to the feel of a box cutter against her face, to the assaults in her car and his.
Her testimony lasted several hours and spanned two days.
When she finally stepped off the stand, she felt seen as the victim again. It made her angry and sad. But she also felt stronger.
“I kind of compare anything I have to do now that is difficult to when I had to go on the stand and talk about what this man did to me,” she said. “I pretty much think I can do anything.”
Karshen, who prosecuted Arevalo-Viera, called M.D. “an amazing witness.”
“To watch her go through methodically under direct examination every detail and to see how well she handled herself on cross examination, but also to see how painful it was — heart-wrenching is the only way to describe it,” Karshen said.
At another point in the trial, M.D. said she listened to Draeger explain to the jury how her description of her attacker’s phone — and her memory of places along the route of her ordeal — had been crucial to solving the case. She was grateful.
Geofence warrants “are just one of the tools that we have to make sure people are safe, that the community is safe,” M.D. said in a recent interview. “I don’t think it’s an intrusion of privacy or anything like that. It’s something we need.”
The jury convicted Arevalo-Viera of all seven charges related to the attack, and a judge sentenced him to more than 100 years in prison.
Arevalo-Viera’s trial lawyer said she did not challenge the use of Google location data and declined to comment further. Steven Zaleski, a lawyer representing Arevalo-Viera for a potential appeal, would not say whether he would challenge the use of geofence warrants. But he said in an email that the technique “raises serious privacy issues for all citizens. What is possible from a technological standpoint is not necessarily appropriate from a legal or constitutional standpoint.”
Before Arevalo-Rivera’s punishment was announced in August 2019, M.D. gave a statement, in which she said she’d regained her voice to confront her attacker one last time. “My spirit has been broken ever since that night over two years ago,” she said. “I have been lost, confused, embarrassed, angry, scared, helpless, all these terms that really are difficult to translate into reality, but I am trying to fix myself and remember things I love again.”
As word spread in the law enforcement community about Draeger’s use of Google data in the case, detectives from other agencies called to ask him how he did it and how they could use it. He was asked to give talks at law enforcement conferences. As one of the earliest uses of Google geofence warrants, the case contributed to the technique’s early growth.
Sometimes Draeger wonders how the investigation would have gone if police hadn’t gotten location data from Google. Arevalo-Viera and Arias-Martinez would have remained free for longer, potentially allowing them to attack others, he said.
“Without that information from Google, we were toast,” Draeger said. “They came through with information that gave justice to a woman who needed it.”