What local cops learn, and carriers earn, from cellphone records

By Bob Sullivan
The war on drugs has gone digital; but is it also a war on cellphone users?

That’s just one of the questions raised by an msnbc.com investigation into use of cellphone tracking data by local police departments across the nation. Msnbc.com built a database of thousands of invoices issued by cellphone network providers to cities after cops asked for caller location and other personal information between 2009-2011. The invoices were first obtained by the American Civil Liberties Union and released to the public earlier this month.

While 200 cities responded to the ACLU, three cities -- Tacoma, Wash., Oklahoma City, and Raleigh N.C. – provided enough detail to paint a picture of how cellphone tracking data is being used in mid-sized police departments around the nation. Categorizing the thousands of pages of invoices supplied by the three municipalities provided some insight into why cops use cellphone locations and call records to investigate crimes and how much the carriers earn responding to these requests.

The tension between the war on drugs and privacy is most readily apparent in Tacoma, Wash., where the most frequent reason that police requested cellphone data over a two-year period was to investigate drug dealing, the analysis indicates.

The bills run up by local detectives requesting cellphone data aren’t small. Tacoma spent $17,496 checking cellphone records during that time span or nearly $1 for every 10 residents. Police in Oklahoma City spent $9,033 on cellphone records checks during one three-month stretch last year, according to the data compiled by msnbc.com. In Raleigh, officials made an average of one location “ping” request from just one carrier -- Sprint -- every three days during the second half of 2011.


“Location data for cops is like a kid in a candy store,” said Mark Rasch, former head of the Justice Department’s Computer Crime Unit. “It’s a wonderful investigative tool which is highly intrusive of personal liberty and our rules on privacy, and rules governing access to this are not only antiquated but confusing and conflicting. Add to that a profit motive by carriers, and lack of sufficient oversight on law enforcement access to the records, and you have a prescription for, at a minimum, violations of civil liberties.” Rasch is now a consultant with Virginia-based cyber security firm CSC.

The ACLU notes that much of the cellphone location data is obtained without a warrant, meaning no probable cause hearing before a judge is required. Many cops counter that subpoenas are always issued – and sometimes refer to these as court orders -- but Rasch said that’s a misnomer. They are often little more than a request form.

“Cops can have a pile of blank subpoenas in their desk drawer,” he said. Carriers normally consent to subpoena requests, but legally they don’t have to. If they refuse, a law enforcement agency is then required get a judge’s order to enforce the subpoena, a step that’s rarely taken, he said.

Tacoma officials deserve credit: Of the 200 cities that responded to the ACLU’s Freedom of Information Act requests, Tacoma’s documents provided the most detail and included an easy-to-read summary page. Research on other cities was far more laborious, and required sampling, which is why this report is limited to three months of Oklahoma City’s invoices from April to June of 2011, and six months of Raleigh’s invoices from July 1-Dec. 31, 2010. For consistency, the date used for all records indicates the date the invoice was filed, not the date of the crime or the date that police requested the data.

It’s important to note that many invoices did not include an amount. In Tacoma, about half the amount entries for the 139 requests were left blank. It’s unclear if that means the request was filled for free or if the data entry was incomplete. That means the dollar totals published here could be far lower than the actual amount paid by the city.

If Tacoma’s experience is typical – which isn’t clear – cellphone companies are earning millions of dollars fulfilling local law enforcement’s cellphone records requests. If Tacoma’s rate of nearly $1 per 10 citizens were extrapolated nationwide, cellphone companies would have billed local cops roughly $30 million from mid-2009 to mid-2011.

There are about 25,000 municipalities in the United States. Most have their own police force, and that total wouldn’t include county and state law enforcement agencies. If each one averaged $1,000 in requests – far less than Tacoma’s $17,496 – that would total $25 million. Cellphone companies, as we’ll see below, have real expenses associated with data lookups, and they often fulfill life-or-death requests for free. Still, with $2,500 invoices being sent to towns across the country, it’s clear there is real money being made.

“I think that this data confirms that cellphone trapping is a routine law enforcement practice, not only for serious crimes but for more routine crimes ,” said Catherine Crump, the ACLU lawyer who ran its investigation. “It is integrated into the law enforcement’s everyday arsenal, and that makes understanding what data law enforcement uses, and making sure that this complies with the Constitution, all the more important. … This is first look we have to see how pervasive this practice is.”

Raleigh, Oklahoma City details

Raleigh and Oklahoma City offered less complete data, but enough information to provide a glimpse of the kind of requests being made.

In Raleigh, we narrowed the study to one carrier – Sprint – for the last six months of 2010. Here’s what we found: Police made 59 requests, or about one every three days, and spent $2,300 over the six-month period, according to the data. Activity was most intense in the summer, with 17 requests in July costing $660. The vast majority of these requests were simple location “pings,” that cost $30 each, but there were some requests for voice mail and “picture mail” retrieval, which also cost $30. The Raleigh invoices included scant detail, with only one bill including a hand-written note that said, “att. Murder.”

“Other than noting that our investigative procedures comply with all applicable statutes, I don’t believe there’s anything I can add,” said Jim Sughrue, a spokesman for the Raleigh Police Department.

Oklahoma City police took the opposite approach, spending a lot on only a few requests. From April to June, 2011, the city received $9,033 in bills for data requests that went far beyond Raleigh’s location pings. One bill Oklahoma City received from Cox Communication totaled $2,500 for 60 days of “pen register/trap and trace” activity, which would ordinarily indicate police learned call details (but not call content) for every call placed to or from a target phone. That invoice, by the way, indicates a full wiretap costs $3,500 from Cox.

During this three-month span, the city made nine other requests for 24 days or longer of pen register/trap and trace data, including four additional requests for 60 days of data. Verizon billed the city $2,446 for five separate invoices dated May 13.

“In each of the cases in that document those were criminal investigation in which someone went before either a state or a federal judge to explain that case and the need to obtain that information … (and) to provide probable cause or reasonable suspicion,” he said.

The invoices indicate they are for subpoena compliance, but Nelson said carriers require a judge’s order to perform the more invasive pen register/trap and trace operation.

Nelson said he did not know if the invoices related to a single police investigation, or multiple investigations.

“Typically those are narcotics cases, or it could be robbery, or it could be homicide. It could be any number of different types of investigations,” he said.

One back-and-forth e-mail discussion found within the city’s invoices between T-Mobile and police officials over pricing for the records requests offers insight into the kind of negotiations that occur between cops and carriers over data cost.

“The fees set are $100 per day for this tracking tool, capped at 10 days charge, or $1,000 per month. This is substantially less that our competition charges for their ‘per-ping’ GPS-base system, and again, there is no charge for non-criminaI/E-911 emergency support,” Michael McAdoo, T-Mobile’s director of law enforcement relations, wrote to city officials on June 6, 2008.

When city officials complained that some emergency requests – such as a life-or-death request to find a lost hiker or a missing child – and other communications should be free, then city Communications Technology Manager Lucien Jones made his case with sarcasm in a June 8, 2009, email.

“Let me see if I understand this: If a guy has an argument with his wife, pushes her down and runs off with her cellphone, we can track that phone free,” he wrote. “But if an armed robber kills his victim and takes their cellphone, and continues to commit a string a robberies, then the attempt by dispatchers and patrol officers to correlate 911 data of the next robbery with cellphone location data constitutes an "investigation," and we gotta pay $100 bucks a day .... Oh, but if the killer develops shame and depression and threatens suicide, then it’s free.”
obtain that information … (and) to provide probable cause or reasonable suspicion,” he said.

The invoices indicate they are for subpoena compliance, but Nelson said carriers require a judge’s order to perform the more invasive pen register/trap and trace operation.

Nelson said he did not know if the invoices related to a single police investigation, or multiple investigations.

“Typically those are narcotics cases, or it could be robbery, or it could be homicide. It could be any number of different types of investigations,” he said.

One back-and-forth e-mail discussion found within the city’s invoices between T-Mobile and police officials over pricing for the records requests offers insight into the kind of negotiations that occur between cops and carriers over data cost.

“The fees set are $100 per day for this tracking tool, capped at 10 days charge, or $1,000 per month. This is substantially less that our competition charges for their ‘per-ping’ GPS-base system, and again, there is no charge for non-criminaI/E-911 emergency support,” Michael McAdoo, T-Mobile’s director of law enforcement relations, wrote to city officials on June 6, 2008.

When city officials complained that some emergency requests – such as a life-or-death request to find a lost hiker or a missing child – and other communications should be free, then city Communications Technology Manager Lucien Jones made his case with sarcasm in a June 8, 2009, email.

Article continued here
Red Tape - EXCLUSIVE: What local cops learn, and carriers earn, from cellphone records




: