Seattle, WA – In February, the Seattle Police Department announced it bought what’s called a “mesh network,” that will be used as a dedicated wireless network for emergency responders. What SPD did not say is that the network is capable of tracking anyone with a device that has a Wi-Fi connection.
“They now own a piece of equipment that has tracking capabilities so we think that they should be going to City Council and presenting a protocol for the whole network that says they won’t be using it for surveillance purposes,” said Jamela Debelak of the American Civil Liberties Union.
A spokesperson for Seattle Police said the network is not being used right now. A draft policy is being reviewed by the city attorney’s office and will eventually go before the City Council.
Aruba network’s ‘Mesh Network’ includes 160 wireless access points that are mounted on poles across Seattle. Every time a device looks for a Wi-Fi signal and the access point recognizes it, it can store that data. The manufacturer of the network points out in a manual that the mesh network can store IP addresses, device types, applications used by the devices, current location, and historical location. This information can be stored and connected for the last 1,000 times a person is connected with a specific device. The network shows up online in public places usually as intersections in the city such as, “4th&Pike,” “4th&University” and “3rd&Union.”
How accurately can it geo-locate and track the movements of your phone, laptop, or any other wireless device by its MAC address (its “media access control address”—nothing to do with Macintosh—which is analogous to a device’s thumbprint)? Can the network send that information to a database, allowing the SPD to reconstruct who was where at any given time, on any given day, without a warrant? Can the network see you now?
The SPD declined to answer more than a dozen questions from The Stranger, including whether the network is operational, who has access to its data, what it might be used for, and whether the SPD has used it (or intends to use it) to geo-locate people’s devices via their MAC addresses or other identifiers.
“Once these kinds of tools are in place, they don’t go away. Even if we assume that the mesh network was installed by good people for good reasons, there’s no reason to believe that the people controlling the network in the future will use it for the public good.” Brendan Kiley of The Stranger added, “We need to have a serious public conversation and establish some very clear rules about how new surveillance technologies should and shouldn’t be used — with very real penalties for breaking those rules.” Kiley first reported on the technology on Wednesday in The Stranger.
“We believe that people should be free to move about without having the government track their movements unless there really is reason to believe they’re engaged in some criminal activity,” said Debelak. Seattle police could not explain why the network appears to be online.
His answer is inadequate for other reasons as well. First, the city council passed an ordinance earlier this year stating that any potential surveillance equipment must submit protocols to the city council for public review and approval within 30 days of its acquisition and implementation. This mesh network has been around longer than that, as confirmed by Cascade Networks, Inc., which helped install it. Still, the SPD says it doesn’t have a policy for its use yet. Mayor McGinn’s office says it expects to see draft protocols sometime in December—nearly nine months late, according to the new ordinance.
Second, and more importantly, this mesh network is part of a whole new arsenal of surveillance technologies that are moving faster than the laws that govern them are being written. As Stephanie K. Pell (former counsel to the House Judiciary Committee) and Christopher Soghoian (senior policy analyst at the ACLU) wrote in a 2012 essay for the Berkeley Technology Law Journal:
The use of location information by law enforcement agencies is common and becoming more so as technological improvements enable collection of more accurate and precise location data. The legal mystery surrounding the proper law enforcement access standard for prospective location data remains unsolved. This mystery, along with conflicting rulings over the appropriate law enforcement access standards for both prospective and historical location data, has created a messy, inconsistent legal landscape where even judges in the same district may require law enforcement to meet different standards to compel location data.
Brian Magnuson of Cascade Networks, Inc., which helped install the Aruba system, explained the possible use of such a system: “A normal cell-phone network is a beautiful thing right up until the time you really need it—say you’ve just had an earthquake or a large storm, and then what happens? Everybody picks up their phone and overloads the system.” The network is most vulnerable precisely when it’s most needed. A mesh network could be a powerful tool for streaming video from surveillance cameras or squad car dash-cams across the network, allowing officers “real-time situational awareness” even when other communication systems have been overloaded, as Detective Moss explained in those community meetings.
But the Aruba mesh network is not just for talking, it’s also for tracking.
After reviewing Aruba’s technical literature, as well as talking to IT directors and systems administrators around the country who work with Aruba products, it’s clear that their networks are adept at seeing all the devices that move through their coverage area and visually mapping the locations of those devices in real time for the system administrators’ convenience. In fact, one of Aruba’s major selling points is its ability to locate “rogue” or “unassociated” devices—that is, any device that hasn’t been authorized by (and maybe hasn’t even asked to be part of) the network.
Council member Bruce Harrell pointed out the need for SPD to be able to collect some of this information. “While I understand that a lot of people have concerns about the government having access to this information, when we have large public gatherings like the situation like in Boston and something bad happens, the first thing we want to know is how are we using technology to capture that information,” said Harrell. He added that SPD needs to establish guidelines before it is used.
“The council made it crystal clear that before the ‘on’ button is turned on, before it’s being used they have to go to the public,” said Harrell.
The network was bought with a DHS grant for $2.6 million. A spokesperson for the city attorney’s office said a government affairs attorney is working with SPD to review the policy but there is no timeline as to when the review will be completed.
The user’s guide for one of Aruba’s recent software products states: “The wireless network has a wealth of information about unassociated and associated devices.” That software includes “a location engine that calculates associated and unassociated device location every 30 seconds by default… The last 1,000 historical locations are stored for each MAC address.”
For now, Seattle’s mesh network is concentrated in the downtown area. But the SPD has indicated in PowerPoint presentations—also acquired by The Stranger—that it hopes to eventually have “citywide deployment” of the system that, again, has potential surveillance capabilities that the SPD declined to answer questions about. That could give a whole new meaning to the phrase “real-time situational awareness.”
ShotSpotter (SST) is the only company to deploy wide-area acoustic surveillance for gunshot detection – the most resource-efficient technology available for actionable intelligence and analysis of outdoor gunfire incidents, anytime and anywhere they occur.
Wide-area acoustic surveillance for gunshot detection is the deployment of multiple collaborative acoustic sensors throughout a coverage area to create a robust, redundant coverage array stretching from a single square mile up to 20 or more square miles. The sensors are paired with audio analysis software that identifies the unique signature of gunshots and other loud explosive sounds in real time.
When a gun goes off, the sensors and software immediately triangulate and pinpoint the precise location of each round fired. Not only does this information allow for a faster, safer and more effective response, this data is invaluable in forensic analysis and investigations, as evidence in court and for supporting intelligence-led policing initiatives.
While other gunshot detection systems or video surveillance cameras operate within a small radius (100-200 meters around a single sensor) and must have a clear line-of-sight the moment a gun is fired in order to provide useful information, only SST’s wide-area acoustic surveillance technology instantly detects and precisely locates incidents that occur anywhere within a large outdoor coverage area extending many square miles in size, regardless of visibility and at distances as far as one mile or more from individual sensors.
The Washington Post recently published a feature length article on gunshot detectors, known as ShotSpotter, which detailed how in Washington DC there are now, “at least 300 acoustic sensors across 20 square miles of the city,” microphones wrapped in a weather-proof shell that can detect the location of a sound down to a few yards and analyze the audio using a computer program.
While the systems are touted as “gunshot detectors,” as the New York Times reported in May 2012, similar technology is already installed in over 70 cities around the country, and in some cases it is being used to listen to conversations.
“In at least one city, New Bedford, Mass., where sensors recorded a loud street argument that accompanied a fatal shooting in December, the system has raised questions about privacy and the reach of police surveillance, even in the service of reducing gun violence,” states the report.
Aruba network’s next-generation wireless mesh-networks:
Police surveillance technologies come with a cost:
The ever-increasing adoption of digital surveillance technologies by local police departments may dramatically improve the efficiency of criminal investigations, but it also creates the opportunity for abuse and misuse, a University of Illinois expert in criminal law and information privacy says.
The widespread use of advanced surveillance technologies such as automatic license plate readers, surveillance cameras, red light cameras and facial recognition software by state and local police departments combined with a lack of oversight and regulation have the potential to develop into a form of widespread community surveillance, which ought to pose significant privacy concerns to law-abiding citizens, warns Stephen Rushin, a professor of law at Illinois.
“What’s worrisome to me is that the technologies could be harnessed to monitor not just one person, but an entire community,” he said. “For example, if police departments use license plate readers in concert with an extensive network of surveillance cameras, that means that they really do have the ability to monitor everyone all of the time. Legally speaking, that’s troubling.”
In 1997, about 20 percent of police departments in the U.S. used some type of technological surveillance. By 2007, that number had risen to more than 70 percent of departments, according to a paper Rushin wrote that will be published next month in the Brooklyn Law Review.
“This radical shift in policing is the beginning of what I call the ‘digitally efficient investigative state,’ where technological replacements for traditional investigations are used to dramatically improve the efficiency of surveillance,” Rushin said.
While much of the attention on surveillance in the media focuses on the National Security Agency, there’s not a lot of scrutiny on local domestic surveillance, Rushin said.
“I think that’s because it’s mostly local law enforcement that’s undertaking this type of surveillance, and we don’t tend to think of our local police force as being particularly scary, intimidating or worrisome,” he said.
While technologies that give the state an “extrasensory ability” may violate an individual’s reasonable expectation of privacy, technologies that merely improve the efficiency of otherwise permissible investigation techniques are presumptively permissible, Rushin said.
“Much of the Supreme Court’s previous treatment of police surveillance has rested on the belief that individuals have no expectation of privacy in public places, and that surveillance technologies that merely improve the efficiency of police investigations comport with the Fourth Amendment,” he said. “While officers must obtain a warrant before using some technologies, the courts generally do not regulate efficiency-enhancing technologies.”
Those assumptions have been workable in the past because of the limited use and capability of efficiency-enhancing technologies. But with the advent of automatic license plate readers and surveillance cameras with biometric recognition, the efficiency of the surveillance itself is becoming a constitutional issue, Rushin said.
“Since no one has a reasonable expectation of privacy when they’re in public, that means that a police officer can do whatever a normal person can do without any kind of special approval,” he said.
“They can observe your license plate and write it down on a piece of paper and run it through a database. But now they could also use an automatic reader to scan license plates in bulk – up to 1,800 license plates per minute, in fact. That will invariably vacuum up enormous amounts of data on innocent people, too.