The Washington PostDemocracy Dies in Darkness

Alleged bank robber accuses police of illegally using Google location data to catch him

(Alex Wong/Getty Images)

It was a Monday afternoon in May when police say a man wielding a silver and black handgun ordered customers inside the Call Federal Credit Union in Midlothian, Va., to their knees and demanded the bank’s manager open the safe. The man fled with $195,000, witnesses said, and was long gone by the time authorities arrived.

After surveillance footage showed the assailant holding a cellphone before he entered the bank, police drafted a search warrant asking Google to provide location information from every user that was within the vicinity of the bank within the hour of the crime.

The results came back with 19 anonymized individuals.

Virginia police whittled down the list to nine users and then asked Google for additional data from an expanded time frame. According to court documents reviewed by The Washington Post, police contacted Google again: They wanted three users’ account details, including names, email addresses, subscriber information and phone numbers.

A month after the third request, on Aug. 13, Okello Chatrie was arrested.

Read: Defense’s motion to suppress evidence obtained through a geofence warrant

Read: Government’s response to motion to suppress evidence

The type of request made in Chatrie’s case, also known as a “geofence” warrant, is increasingly being sought by law enforcement across the country.

These warrants, which target a geographic area instead of an individual, compel technology companies to turn over location data from any user interacting with its technology in a specified time.

“Individuals may be caught up in this search by merely using an Android phone, conducting an Internet search using Google, running a Google application such as Google Maps or YouTube, or even receiving an automatic weather update from an Android service,” Chatrie’s attorney, Michael Price, wrote in an October motion.

Geofence warrants, he said, “ensnare anyone who uses Google services at specific times … sweeping up innocent individuals in an unconstitutional dragnet search.” Court documents noted that within the vicinity of the credit union was a major highway, a Ruby Tuesday restaurant, a Hampton Inn hotel, a storage facility, two apartment complexes and a church.

Calling the warrant an illegal search under the Fourth Amendment, Price asked the court to suppress any evidence obtained from it.

“No valid search warrant would permit the police to search every house in a neighborhood or pat down everyone in sight. Yet, with a Geofence warrant, law enforcement can do just that,” he continued, and “without ever demonstrating any likelihood that Google even has data connected to a crime.”

Chatrie, 24, has pleaded not guilty to the charges; if convicted, he faces up to life imprisonment.

Police think Amazon’s Alexa may have information on a fatal stabbing case

Prosecutors called the case the first of its kind, though the issue has come up in other states, including New York, North Carolina, Florida and Minnesota. Experts expect that geofence warrants will be the next big Fourth Amendment battle in digital privacy.

Geofence warrants raise two interesting legal questions, according to Andrew Ferguson, the author of “The Rise of Big Data Policing: Surveillance, Race, and the Future of Law Enforcement” and a visiting law professor at American University:

Do people have an expectation of privacy in their location revealed by digital clues? And do search warrants for overly broad collection run afoul of particularity concerns?

“For example, is a warrant for all the phones in a bank building particularized enough when you know you will be collecting information from innocent people? Does it matter if it is 19 innocent people or 190? Or 1,900?” Ferguson asked. “These are questions that police will need to resolve before seeking a warrant and judges will need to answer before signing a warrant.”

Google received enough reverse location history warrants that it developed a three-step process to respond: It provides an anonymized data set; if needed, it turns over additional location history; and for relevant devices, it produces basic subscriber information.

“We vigorously protect the privacy of our users while supporting the important work of law enforcement,” Richard Salgado, Google’s director of law enforcement and information security, told The Post. “We have created a new process for these specific requests designed to honor our legal obligations while narrowing the scope of data disclosed and only producing information that identifies specific users where legally required.”

Although the company said it turns over only historical location data when served with a search warrant, neither follow-up request in Chatrie’s case was court-ordered.

Google refused an order to release huge amounts of data. Will other companies bow under pressure?

Last year, the U.S. Supreme Court was tasked with deciding whether law enforcement needed a search warrant to compel service providers to hand over cell tower location records, which track a person’s minute-by-minute movements. The court held that they do.

But data in that case was collected nearly a decade ago. Since then, network technology and accuracy has advanced tremendously.

The location information stored in Google’s Sensorvault is even more precise than cell site location information: Court records mentioned that Google can pinpoint a person’s whereabouts to approximately 20 meters, while cell site location data is “a few thousand meters.”

The company’s software also permeates smartphone technology. According to the Pew Research Center, 96 percent of Americans own cellphones. Google Maps is the most-used navigation app, appearing on 67 percent of smartphones, according to the business site the Manifest, and its closest competitor is the Google-owned app, Waze. Android operating systems, developed by Google, control nearly 90 percent of the smartphone market share worldwide, according to the data firm IDC.

“This will become one of the most common legal battles in court,” Ferguson said. “Almost everything we do leaves little digital locational clues that are a warrant away from collection.”

Read more:

Google announces new political-ads policies that limit targeting but not all lies

Uber plans to start audio-recording rides in the U.S. for safety

Police can keep Ring camera video forever and share with whomever they’d like, Amazon tells senator