In 2014, Aaron Harvey, a 26-year-old studying for his real estate license, was met by U.S. Marshals outside his Las Vegas, Nevada, residence. Not until three weeks after his arrest did Harvey learn he would be charged with crimes in connection with nine murders in San Diego, California, and if convicted could face up to 56 years in state prison.

But prosecutors already knew what Harvey had been insisting to the police—that he wasn’t involved in any killings.

Instead of participating in the homicides, Harvey’s only “connection” to the crimes was that his name was in California’s obscure CalGang database. The reason was not that he belonged to a criminal enterprise, but because he appeared in a photo on Facebook wearing a shirt with green on it and lived in a neighborhood rife with gang activity. Under California law and thanks to the database, it did not matter that Harvey had no tangible connection with the crimes.

Nor did it matter that he had no knowledge of the commission of a crime. Under California Penal Code Section 182.5 anyone having knowledge of—or who would plausibly “benefit” from—criminal gang activity is considered having committed gang conspiracy. It is the ultimate guilt-by-association statute, though it runs against the state’s traditional criminal conspiracy statute requiring that an individual “promote, further, or assist in the commission of that particular substantive offense.”

Willing to invoke the “benefit” clause, prosecutors at Harvey’s criminal trial argued that he benefited from the San Diego murders because they would have boosted his social standing.

The CalGang database has played a key role in operationalizing the state’s broad interpretation of culpability for gang activity. Administered by the State of California Department of Justice, and with regionally operated databases under its umbrella, it is available to law enforcement across the state. Police officers can add anyone they suspect of gang membership. Neither an arrest nor an investigation is required for entering a person into the shared database. The entered data, which is stored for future retrieval, is rarely cleared.

Harvey never belonged to a gang, but the authorities’ qualifying threshold for a gang member is subjective enough to include nearly anyone. One of the standards is to use a ten-point system; meeting any two of the ten conditions could be sufficient to enter someone as a gang member. Among them are “wearing gang dress” and “having been seen frequenting gang areas.”

The implication is startling enough to warrant repeating: Simply wearing a color associated with a gang (virtually all the colors on the wheel have been claimed by a gang somewhere) or living or working in an area with gang activity could land a person on California law enforcement’s list of gang members.

In preparation for his hearing, Harvey also learned he was not the only one on the hook: 14 others were also arrested. With 543 individuals labeled by law enforcement as Lincoln Park Bloods, San Diego County’s district attorney belabored the point that 543 different people could be held criminally responsible for the nine murders.

One of Harvey’s co-defendants was childhood friend and San Diego hip-hop performer Brandon Duncan, a.k.a. “Tiny Doo.” The rapper was charged with conspiracy to commit murder based on lyrics from one of his albums. Deputy District Attorney Anthony Campagna said, “We’re talking about a CD [cover depicting] a revolver with bullets.” The prosecution argued Tiny Doo was also a “beneficiary” of the shootings by virtue of increased album sales and social standing among gang members. The album in question was, in fact, a free digital download.

Harvey and Tiny Doo’s charges were eventually dropped, in 2019, but only after the two men had been jailed for seven months. Years after they were arrested, the CalGang database is still used with little public scrutiny, let alone any major overhaul in the name of criminal justice reform.

The problem is worrisome not only because many of the database entries are groundless, but also because news reports have raised the possibility that police have falsified CalGang records. Even infants and toddlers have been classified as gang members. A California State Auditor’s report in 2016 noted that upwards of seventy percent of minors included on the database were not notified that they were listed in the database. Not only does a failure to inform minors of their police designation deny them a possibility of contesting their inclusion in the database, but such a failure is in direct violation of state law.

In their review of the CalGang system, Camille Ochoa and Dave Maass of the Electronic Frontier Foundation concurred with the state audit, writing that, “CalGang violates people’s rights, operates with no oversight, is chock full of unsubstantiated information and data that should have been purged, and has diminished value in protecting public safety.”

In this time of dialogue on possible law enforcement reforms, changes to the CalGang database should be part of the discussion. At minimum, increased transparency and regular audits of CalGang should be required. Municipal police can opt out of the database as the Los Angeles Police Department did in June. In addition, Penal Code Section 182.5 should be amended so that a prosecutor’s subjective sense of “benefiting” from criminal gang activity cannot be an element of criminal conspiracy. The injustice is too great to let stand.

 * * *

Dominick Van Cleve is a paralegal from the San Diego area.

The post Police Reformers Should Demand Overhaul of CalGang Database  appeared first on The Beacon.

“Yes, compelling someone to reveal information on how to decrypt data is compelling testimony from that person. But obtaining information from a person’s mind is not what happens when agents pick a finger to apply to the sensor.”

—Judge Edmond E. Chang, qtd. in In re A white Google Pixel

2019 began with digital privacy activists rejoicing an apparent victory with a decision handed down by the United States District Court of Northern California. The case concerned whether or not law enforcement had the authority to compel a person to unlock a seized phone.

Police had applied for a search and seizure warrant for an Oakland residence in connection with two suspects of an extortion scheme. The warrant application asked to seize various electronic devices including cell phones and computers. Police also requested the ability to compel any individual in the vicinity to use any biometric feature, like a finger or thumbprint, facial recognition, or iris detection to unlock any devices subject to the warrant found in the residence at the time of the search.

Denying the search warrant application, the judge found that even with a warrant, police cannot force suspects to unlock electronic devices. The court held that unlocking a phone with a fingerprint is “fundamentally different” than taking a suspect’s fingerprint, for instance. This is partially due to the risk of identifying who has access to the phone, thereby potentially implicating the owner.

More shocking, the court argued that since biometric access is effectively a substitute for a password, the compulsory production of a fingerprint constitutes a compelled testimony, a violation of the 5th Amendment protection against self-incrimination. By giving police access to the phone’s contents, the individual who is subject to the search effectively becomes a witness against themselves. This 5th Amendment violation thereby makes the search unreasonable in terms of the 4th Amendment.

The conclusion of the case was applauded by privacy activists not only for stopping police from forcing people to open their phones for the government but for also narrowing what police could seize to only devices that were reasonably believed to be owned by suspects. The decision was a promising development after a string of defeats. Up until the Northern California District Court’s ruling, the only cases of note, State v. Diamond (2018) and In re the Search Warrant Application for [redacted] (2017) allowed police compel a person to use a fingerprint to unlock a seized cell phone.

However, the sentiment of victory was short lived. In a recent case heard by David Nye of the United States District Court for Idaho, Judge Nye took direct issue with the aforementioned Northern District of California ruling. The Idaho case, though similarly about a warrant application and phone search incident to arrest, decidedly gave great leeway to law enforcement to compel the unlocking of a phone.

Police in the state of Idaho initially applied for a warrant as part of a child pornography investigation. The provisions of the warrant application included permission to seize “mobile phones” if the phones could be used as evidence of the commission of the crime. The warrant application was authorized and upon execution, police seized a Google Pixel 3 XL from the bathroom of the suspect’s residence.

It was soon discovered that the phone required a swipe pattern or a fingerprint to unlock the screen to display its digital contents. The government again applied for an additional warrant to “press any finger and/or thumb of any hand against the sensor of the fingerprint reader used to unlock the...phone.”

Denying the additional warrant, the magistrate judge echoed the Northern California District ruling and stated that approving the application would have been a 5th Amendment violation by virtue of compelling the individual to produce self-incriminating testimony. On review, the U.S District Court Judge vacated the magistrate’s order denying the warrant.

The rationale behind the decision is that body parts, or “physical characteristics” should not be counted as “testimony”. The Supreme Court in the past has drawn a similar distinction. The principle issue in Doe v. United States (1988) concerned what constituted “testimony”. In Doe, the court specified that a testimony was a disclosure of the contents of the suspect’s mind.

The U.S District Court of Idaho recalled this differentiation, saying:

In [Doe v. United States, 487 U.S. 201 (1988)], the United States Supreme Court made a comparison between being compelled to surrender a key to a strongbox or safe containing incriminating documents (and how that would not be a testimonial act), and being compelled to reveal the combination to a safe (which would be a testimonial act)...The Court explained that whether an act was testimonial — and therefore unconstitutional — revolved around whether the act forced the defendant to ‘disclose the contents of his own mind.’

A conclusion from the Idaho case is that police forcing a person to turn over their passcode would be impermissible. But because applying a finger to a sensor is not a disclosure of the contents of the mind, the court did not see a Constitutional violation.

Riana Pfefferkorn of the Center for Internet and Society at Stanford Law School eloquently made the point that the court decided to “hinge a core constitutional right of all smartphone users—three-quarters of Americans—on how they use their phone’s UI.”

In short, if a person uses a password to unlock their phone they may be protected by the law. However, if they use biometrics, which is functionally equivalent in terms of gaining access to the phone, this reasoning says that there is no legal protection with respect to the 5th Amendment.

This deals a blow to those that use biometrics as part of their 2-factor authentication login or encryption management. Moreover, it jeopardizes cell phone users as many smartphones today bypass passcode requirements if a valid fingerprint is supplied by the user. This grants police the ability to circumnavigate the spirit of privacy laws and effectively renders constitutional protections of passwords useless.

While other courts have yet to weigh in, the direction of the case law is discouraging. However, the discordance between the Northern California and Idaho ruling is worth continuing to watch in the future as both districts are in the 9th Circuit.

* * *

This piece was originally published under a different title in The Startup (12/13/19). For more on privacy rights, see American Surveillance: Intelligence, Privacy, and the Fourth Amendment, by Anthony Gregory.

The post Court Hinges Privacy Rights on Smartphone Settings appeared first on The Beacon.

Supporters of the bill viewed it as necessary to safeguard civil liberties because facial recognition technologies currently available to law enforcement produce high rates of false positives, meaning that innocent people are too often misidentified as criminal suspects. In addition, they say that facial recognition could result in racially biased policing.

So far, concerns about racial bias have been well justified. Studies have found that facial recognition technology is less accurate at identifying individuals with darker skin, especially women of color. A July test of a facial recognition algorithm used by Idemia—a France-based vendor to the U.S. Customs and Border Protection—found that black women were falsely identified 10 times more often than white women.

Another study tested how well Amazon’s “Rekognition” image analysis software could distinguish members of Congress from criminal suspects in a mugshot database and found it lacking. The American Civil Liberties Union concluded that the software misidentified 28 members of Congress, including a disproportionate number of Congressional Black Caucus members.

This finding, however, has not deterred Amazon from pitching Rekognition to federal agencies, nor has it slowed down government agencies contracting with facial recognition software vendors. Instead, Amazon retorted that the ACLU’s experiment was flawed because the software was set to the default 80 percent confidence level as compared to the 99 percent level that Amazon recommended for law enforcement. This response, however, was inadequate.

As the ACLU pointed out, Amazon does not ask users how they plan to use its facial recognition technology. If there are no guidelines regulating police use of the technology, there is nothing to prevent law enforcement from using a low threshold for success. Without safeguards for an imperfect technology, false positives are inevitable.

Skeptical of the trade-offs, municipalities across the country have been cautious of facial recognition technology, with some cities proposing outright bans. California lawmakers, however, consider the state’s new prohibition to be only a temporary measure until the technology becomes more reliable. The ban signed by Newsom is set to expire in 2023.

Assembly member Phil Ting, cosponsor of the bill, has said that the ban’s sunset clause was designed to allow legislators to reconsider the prohibition if the technology improves sufficiently – in other words, it becomes more accurate at identifying minorities. Despite the apparent failings of current facial recognition tech, the National Institute of Standards and Technology reported that the best systems improved by a factor of 25 between 2010 to 2018. At this rate, it seems that “nearly perfect” facial recognition software could be available in a year or two.

Technological improvements, however, would not ensure that the threat to personal liberty will be going away. To the contrary, the negative effects may become more problematic when the government becomes more effective in its surveillance capabilities. First, more accuracy means more data and more discriminate targeting.

When a government can flawlessly track individuals, the state becomes efficient at singling out its opponents. Given a track record of laws such as black codes, the Sedition Act, or the Japanese Internment Bill, the imperfections of surveillance can mitigate the unjust consequences of bad laws. A perfect surveillance state, however, would ensure a dystopian future for marginalized people.

Second, if surveillance technology becomes widely adopted by government agencies, law-abiding people may change their behavior out of a sense of self-consciousness or caution. This can have a serious chilling effect on freedom of expression and is a key reason why facial recognition poses a unique challenge to civil liberties.

Minority communities and dissident groups may be the first to feel the pressure. In 2018, the city of Berkeley, ground zero for the free-speech movement of the 1960s, used facial recognition technology to watch participants in an anti-Marxist protest. Once a bastion of the counterculture, Berkeley followed the growing trend of police departments employing facial recognition.

The contemporary Chinese surveillance state may provide a bleak glimpse of the West’s future. An estimated 40,000 facial recognition cameras watch over the region of Xinjiang, a historic epicenter for political secessionist movements and home to the Uyghur ethnic minority. The Uyghurs, a predominately Muslim population, have been involved in a prolonged civil conflict with the majority Han Chinese. Armed with facial recognition tech, the Chinese state creates detailed records on specific individuals, even recording their purchases with the goal of instilling fear and deterring critics of the Chinese Communist Party.

With the Chinese government reportedly detaining upwards of over a million people in Xinjiang in political “re-education camps”, the main worry is not about wrongfully implicating an individual in a crime they did not commit because of misidentification. Rather, the larger problem is that the government is able to discriminately identify individuals because it considers a group a threat to state interests.

This is not to say that there is never a place for innovative commercial facial recognition technology. However, if there are stunted safeguards, including poor transparency requirements, deficient collection standards, and non-existent data retention limits, the public can have no assurance that their civil liberties are protected when the government gets their hands on these tools.

The post Civil Libertarians Worry that Facial Recognition Tech Is Inaccurate, but Fears May Worsen After It’s Perfected appeared first on The Beacon.