Sprint fed customer GPS data to cops over 8 million times

[MikeWB]

If you have Sprint as your carrier, maybe you should get off... quickly!

Sprint fed customer GPS data to cops over 8 million times
A blogger has released audio of Sprint's Electronic Surveillance Manager describing the carrier's cooperation with law enforcement. Among the revelations are that Sprint has so far filled over 8 million requests from LEOs for customer GPS data.

By Jon Stokes | Last updated December 1, 2009 5:38 PM

Christopher Soghoian, a graduate student at Indiana University's School of Informatics and Computing, has made public an audio recording of Sprint/Nextel's Electronic Surveillance Manager describing how his company has provided GPS location data about its wireless customers to law enforcement over 8 million times. That's potentially millions of Sprint/Nextel customers who not only were probably unaware that their wireless provider even had an Electronic Surveillance Department, but who certainly did not know that law enforcement offers could log into a special Sprint Web portal and, without ever having to demonstrate probable cause to a judge, gain access to geolocation logs detailing where they've been and where they are.

Through a mix of documents unearthed by Freedom of Information Act requests and the aforementioned recording, Soghoian describes how "the government routinely obtains customer records from ISPs detailing the telephone numbers dialed, text messages, emails and instant messages sent, web pages browsed, the queries submitted to search engines, and geolocation data, detailing exactly where an individual was located at a particular date and time."

The fact that federal, state, and local law enforcement can obtain communications "metadata"—URLs of sites visited, e-mail message headers, numbers dialed, GPS locations, etc.—without any real oversight or reporting requirements should be shocking, but it isn't. The courts ruled in 2005 that law enforcement doesn't need to show probable cause to obtain your physical location via the cell phone grid. All of the aforementioned metadata can be accessed with an easy-to-obtain pen register/trap & trace order. But given the volume of requests, it's hard to imagine that the courts are involved in all of these.

Soghoian's lengthy post makes at least two important points, the first of which is that there are no reliable statistics on the real volume and scope of government surveillance because such numbers are either not published (sometimes in violation of the legally mandated reporting requirements) or they contain huge gaps. The second point is that the lack of reporting makes it difficult to determine just how involved the courts actually are in all of this, in terms of whether these requests are all backed by subpoenas.

Underlying both of these issues is the fact that Sprint has made it so easy for law enforcement to gain access to customer data on a 24/7 basis through the use of its Web portal and large compliance department. Regarding the latter, here's another quote from Paul Taylor, the aforementioned Sprint/Nextel Electronic Surveillance Manager:

"In the electronic surveillance group at Sprint, I have 3 supervisors. 30 ES techs, and 15 contractors. On the subpoena compliance side, which is anything historical, stored content, stored records, is about 35 employees, maybe 4-5 supervisors, and 30 contractors. There's like 110 all together."

All of those people are there solely to serve up customer data to law enforcement, and other comments by Taylor indicate that his staff will probably grow. Sprint only recently made the GPS data available through the Web portal, and that has caused the number of requests to go through the roof. The company apparently plans on expanding the menu of surveillance options that are accessible via the Web. Taylor again:

"[M]y major concern is the volume of requests. We have a lot of things that are automated but that's just scratching the surface. One of the things, like with our GPS tool. We turned it on the web interface for law enforcement about one year ago last month, and we just passed 8 million requests. So there is no way on earth my team could have handled 8 million requests from law enforcement, just for GPS alone. So the tool has just really caught on fire with law enforcement. They also love that it is extremely inexpensive to operate and easy, so, just [because of] the sheer volume of requests they anticipate us automating other features, and I just don't know how we'll handle the millions and millions of requests that are going to come in."

I'm sure they'll find some way to deal with the "millions and millions" of warrantless surveillance requests, and no one will bother to even curb the practice, much less stop it. I've been reporting on this exact metadata/surveillance issue for years now, and it just gets worse. The stressed, jobless, indebted public doesn't care, and Congress doesn't either. If I'm still on this beat in 5 years, I'm sure I'll still be rewriting this same story for the thousandth time.

[sullivan]

Its quite likely that AT&T, T-Mobile and the others have similar deals, so there's little point seeking an alternative operator. If one does it, you can be sure all do it.

I'm wondering is this really GPS data (which would require a mobile to communicate its position to a base station), or is it triangulation data, which computes the position of a device using distances from three or more base stations. Very few mobile handsets have GPS built-in.

[§N9sh2bj]

just more panicky b.s.

if you have a phone, it's not yours. by implied and unrebutted contract, your body is property of the corporation (in this case the GOVERNMENT corporation). By extension then, anything you use is also their property. Additionally, the piece of plastic and metal is worthless without a contract, and since you don't run the service; and given the forgoing, it's also reasonable to conclude you have no rights unless declared. For instance, a UN declaration on 'human rights' has no meaning for you unless claimed, because you are not a signatory to the document.

[§N9sh2bj]

Why not print the original source URL?

http://arstechnica.com/telecom/news/2009/12/sprint-fed-customer-gps-data-to-leos-over-8-million-times.ars