Immigration and Customs Enforcement (ICE), Customs and Border Enforcement (CBP), and the Secret Service have illegally used location data harvested from smartphone apps to track people, according to the Department of Homeland Security (DHS).
The actions fly in the face of the Constitution’s Fourth Amendment protection against unreasonable searches and seizures.
An explosive Sept. 28 report from the agency’s Office of Inspector General (OIG) titled, “CBP, ICE, and Secret Service Did Not Adhere to Privacy Policies or Develop Sufficient Policies Before Procuring and Using Commercial Telemetry Data,” reveals the agencies “purchased access to commercial telemetry data (CTD) collected from mobile devices that included, among other things, historical device location.”
According to the report, “Applications running on mobile devices use an Advertising Identifier (AID) unique to each device that can be used to track and record the device’s historical location data and device information. The information collected may include time stamps, device type, operating system, and Global Positioning System coordinates.”
The OIG “identified one instance in which, unrelated to an investigation, a CBP employee used CTD inappropriately to track coworkers,” the partially redacted report states. “The individual told the coworkers that they had tracked their location using CTD.”
The ensuing complaint was “resolved administratively.”
“Use of information technology (IT) or data obtained from that technology, such as CTD, within the Federal Government is controlled by the E-Government Act 0/2002 (the 2002 Act),” the report explains. “Congress passed the 2002 Act to, among other reasons, ensure sufficient protections for the privacy of personal information. Under Section 208 of the 2002 Act, agencies are required to conduct a Privacy Impact Assessment (PIA) before developing or procuring IT that collects, maintains, or disseminates information in an identifiable form.”
“CBP, ICE, and Secret Service did not adhere to Department privacy policies or develop sufficient policies before procuring and using CTD,” the OIG’s audit revealed. “Specifically, the components did not adhere to DHS’ privacy policies and the 2002 Act by ensuring they had approved CTD PIAs.”
“This failure to adhere occurred because the components did not have sufficient internal controls to ensure compliance with DHS privacy policies and because DHS Privacy did not follow or enforce its own privacy policies and guidance,” according to the report.
Nate Wessler, deputy project director of the Speech, Privacy, and Technology Project at the American Civil Liberties Union (ACLU), called the report “disturbing.”
“It is disturbing that these agencies blithely ignored the federal law that requires serious assessment of the privacy impacts of exactly this kind of access to people’s private information,” he told 404 Media in a statement. “If these agencies had gone through the appropriate process before buying this sensitive data, they could have only reached one reasonable conclusion: the privacy impact is extreme.”
Electronic Frontier Foundation (EFF) is a non-profit organization dedicated to “defending civil liberties in the digital world.”
“The report makes it clear that DHS agencies have been playing it fast and loose with their acquisition of Americans’ location data,” EFF spokesperson Josh Richman told 404 Media. “Congress needs to explicitly bar law enforcement and intelligence agencies from purchasing data from private companies that they would have otherwise needed a warrant to acquire.”
“The report makes eight recommendations, chiefly concerning creating new procedures and implementing them,” reports Apple Insider. “Homeland Security has agreed to six of the recommendations. Most significantly, it has refused the report’s recommendation that use of all such location data be discontinued until new procedures are in place.”
“Non-concur,” the DHS responded. “CTD is an important mission contributor to the ICE investigative process as, in combination with other information and investigative methods, it can fill knowledge gaps and produce investigative leads that might otherwise remain hidden.”
“Accordingly,” DHS stated, “continued use of CTD enables ICE HSI to successfully accomplish its law enforcement mission.”