A Spike in Search Warrants

A judge granted the first warrant to search an iPhone just months after the device was unveiled. In August of 2007, the Secret Service obtained permission to search Joseph Siddon’s phone after he was caught with dozens of fake ID’s at a Buffalo airport.

Since then, federal judges have granted many more warrants for investigations that range from bank scams to drug trafficking. The federal court system PACER shows 50 cases listing “iPhone” as the “defendant” but this number is likely higher and does not include state court cases.

The search requests have also become more frequent. While the record lists five warrants for 2009, this screenshot shows that number has been surpassed already this year:

Starting last year, federal agents began directing warrants at iPads as well. The first of these popped up in Wisconsin after an officer told a judge that ”An Apple 16 GB iPad which is in the care and custody of the DEA” was likely to contain evidence about an illegal sports betting ring.

Since then, there have been at least five other federal warrants aimed at iPads.

Smartphones and the police’s data-sucking vampire

The uptick in iWarrants reflects the simple fact that seizing a smartphone or tablet can be as valuable to authorities as grabbing a crook’s hard drive.

In many cases, the payload may be even greater. Police can get not only emails and browsers histories but a also plethora of social data from apps like Twitter and Facebook — much of which is permanently baked into the device.

As law student Amanda Brill explains in a recent paper, companies like Cellbrite provide police with forensic tools that can:

“[D]ump the entirety of your phone…all of your text messages, emails, videos, and photos – even the ones you deleted – Google Map queries…web searches, passwords, call logs…your phone’s entire file system.” This information is “all timestamped, all geotagged, all providing a digital recreation of the way your physical existence projects itself into the cellular ether.”

The passage quotes tech site Gizmodo which described Cellbrite as “The Handheld Dracula that Sucks your entire life from your phone.”

Brill says the forensic technology can be deployed not only in a crime lab but “in the field” as well.

Fading Privacy rights

The reason we have search warrants in the first place is to ensure that the police and government must go through someone — a judge — before they can get into your stuff in the first place. The warrants also draw strict lines around what can and can’t be searched: Your car but not your house, for example, or your home but not your computer.

From this perspective, the surge in i-related warrants is actually a good thing. It shows that Fourth Amendment protections still exist for the places where, in the courts’ words, we have “a reasonable expectation of privacy.”

Unfortunately, those protections are not holding up so well in the bigger picture.

One big problem is a rule that lets police search without a warrant in the case of an arrest. This makes sense to ensure a suspect doesn’t have weapons or contraband but it is unclear why the exception should also let cops get into the contents of a smartphone. While some courts have put brakes on this practice, others have said it is fair game.

And in the cases where there is a warrant, courts are drawing no lines around which parts of the iPhone can be searched and which cannot. This is different from computer warrants which often set limits on what investigators can look for; police in a drug investigation, for example, might be able to search a hard drive for narcotics data but not for evidence of blackmail (unless there was probably cause for that too).

It may not make sense to allow police to search some parts of an iPhone but not others. But in age where our phones contain not just our own lives but those of our friends, it’s time to start redrawing some lines.

iPhone Search Warrant Example Copy

Photo courtesy of Shutterstock user [Everett Collection].

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Connected world: the consumer technology revolution
• Controversy, courtrooms and the cloud in Q1
• Mobile Q2: Smartphone growth surges; iPad’s rule continues

UDIDs are a unique string of numbers associated with a device that can let developers of apps track their apps. Or when passed between apps, UDIDs allow ad networks, for example, to build a profile noting user habits and preferences associated with that device, which allows them to more carefully target their ads.

The rejection of their use doesn’t seem to be completely universal just yet, however. TechCrunch says Apple’s process is happening like this: “Two of the 10 review teams started doing blanket rejections of apps that access UDIDs this week. Next week, that will rise to four [of] the ten teams, and keep escalating until all 10 teams are turning down apps that are still using UDIDs.”

This, of course, comes as Apple has gotten some negative attention for its handling of privacy violations — including approving apps for sale in its App Store that have violated Apple’s privacy guidelines by uploading users’ contacts to the app developers’ servers. Some members of Congress have been sniffing around this privacy issue and others, including a loophole in Apple’s software that allows the uploading of user photo libraries.

And it’s just a few days since the Federal Trade Commission made it known that it is concerned about comprehensive tracking when it comes to personal data, and that it wants to see “privacy by design” built into consumer web services and apps.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Controversy, courtrooms and the cloud in Q1
• Facebook’s IPO filing: ideas and implications
• NewNet Q4: Platform mania and social commerce shakeout

It’s not just Apple’s mobile software that has been caught with this loophole, but Google’s Android apps too — the Times followed up last week on its iOS story with another demonstration showing that Android apps could also access the user’s photos unbeknownst to them. Schumer wants the FTC to set its sights on Google in this case too.

Saying what most logical people are thinking, Schumer writes: “These uses go well beyond what a reasonable user understands himself to be consenting to when he allows an app to access data on the phone for purposes of the app’s functionality.”

He adds:

Smartphone makers should be required to put in place safety measures to ensure third party applications are not able to violate a user’s personal privacy by stealing photographs or data that the user did not consciously decide to make public … When someone takes a private photo, on a private cell phone, it should remain just that: private.

It’s good to know our elected officials are paying attention. Though this call for investigation could fall into the category of “too little, too late” since Apple is rumored to be working on a fix.

Apple did not respond to a request for comment, and it has not said anything publicly despite the brouhaha that’s broken out over the photo libraries — though it would be just like Apple to not say a word, and just issue a fix.

Google also appears to know this is a problem and has made noises that it’s time to think about an update.

Photo from Sen. Schumer’s official Flickr feed.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Connected world: the consumer technology revolution
• Controversy, courtrooms and the cloud in Q1
• Opportunities and challenges for mobile deals

The Bavarian State Authority for Data Protection, a German data regulator, sent a letter to Apple on Friday requesting that the iPhone maker provide more details about the software and its use, according to a Bloomberg interview with the regulator organization’s chief, Thomas Kranig.

Apple said in its statement on the matter that its use of Carrier IQ was limited to diagnostic information and was opt-in only. If you’ve recently set up an iOS 5 device, you may remember the request made during the setup process to allow your device to send diagnostic and usage information to Apple. You can check if you’re sending data by navigating to General > About > Diagnostics & Usage in your iOS device’s Settings app and either opt in or opt out. On this screen, Apple says it uses the information to “improve its products and services.” Apple further stated that Carrier IQ has been removed for most devices in iOS 5 and will be taken out completely in future updates.

Kranig says that “if Apple decided to cease the use [of Carrier IQ], all the better,” but the organization is still seeking more information. Senator Al Franken (D-Minn.) also called (PDF) for Carrier IQ to release details to the public about why exactly its software tracks and records the information that it does. Franken previously pursued Apple and Google for more information about how customers’ personal location information was being gathered and used on iOS and Android devices.

This Carrier IQ situation could result in another round of scrutiny by regulators in the U.S. and abroad, and I doubt that Apple has seen the worst of it yet.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Opportunities and challenges for mobile deals
• Connected world: the consumer technology revolution
• Controversy, courtrooms and the cloud in Q1

In a statement, the company said:

We stopped supporting CarrierIQ with iOS 5 in most of our products and will remove it completely in a future software update. With any diagnostic data sent to Apple, customers must actively opt-in to share this information, and if they do, the data is sent in an anonymous and encrypted form and does not include any personal information. We never recorded keystrokes, messages or any other personal information for diagnostic data and have no plans to ever do so.

Sprint has admitted to receiving data from CarrierIQ’s software, but it denies using it to track its customers, as has AT&T, which says it uses the information for network management. Verizon, on the other hand, has denied using the software, as has Google on any of the Android phones it makes.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• CES 2012: a recap and analysis
• 2012: Data, spectrum and the race to LTE
• Connected world: the consumer technology revolution

For example, if you were surfing a number of sites in Safari before you quit, those windows will return when you reopen the program. Some windows we may not want to share with others. I’m not talking just “adult” items, but, for example, a job search or dating site. Most Mac OS customers are used to having the more obvious digital debris of their life excised upon quitting an app. Unfortunately, in Lion, any application that supports resume (including most system apps, iWork and many more on the way) could unearth some embarrassing secrets.

There are a few quick solutions. When possible, close the Safari window or tab you’d rather keep private before you quit the application. Additionally, if you hold down the option key while choosing Quit from the application menu, or hold down Command+Option+Q, that will “Quit and Discard Windows” for this particular session.

If you forgot to do that and find yourself needing to close those open windows without launching the app, you can remove this information manually. To do this, first choose “Go to Folder” from the Go menu. Type ~/Library/Saved Application State/ and that will take you to the folder that contains your saved windows. If you want Lion to forget the last windows left open in Safari, look for com.apple.Safari.savedState and then delete that folder. That will remove the last session’s windows and tabs.

If you decide you really don’t like applications automatically remembering previously open windows and tabs, you can turn this feature off system-wide by opening the System Preferences application, and under “General” making sure “Restore windows when quitting and re-opening apps” is unchecked.

So the next time you go shopping for that wedding ring, remember that the next person who opens Safari might see the window and ruin the surprise. These tips should keep you out of hot water. And if you’re surfing for something else on your computer, the next person who has to use or repair it will thank you for keeping your private info private.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• How cloud computing plus Facebook might mean the end of personal privacy
• Building a better paywall: strategies for monetizing news content

The lawyer in question, Kim Hyung-suk, won the decision in South Korean court in May, and the funds were reportedly withdrawn from Apple Korea’s bank account by the court after the company refused to voluntarily comply. Kim now has 27,000 signatures on a web-based petition seeking co-complainants for a class-action suit in South Korea designed to “protect privacy” rights, according to the AP. Of that number, 26,691 are now listed as plaintiffs in the civil suit filed by Kim’s firm on Wednesday, and 921 are minors and are seeking parental consent before being added to the list.

The iPhone’s locally stored database of nearby cell towers, along with a bug that continued to gather location information even with location services turned off resulted in both Kim’s successful suit and a three-million-won fine ($2,808 U.S.) from the South Korean communications regulator earlier this month. Apple has since released a software update that resolves the issues cited by Kim and security researchers who discovered the problem.

Even with nearly 27,000 thousand plaintiffs, the total cost of a ruling against Apple would only amount to around $24.6 million, which is barely a dent in the company’s $75.9 billion in cash reserves. But Apple is already facing multiple lawsuits in the U.S., too, and it probably doesn’t want this sort of thing to catch on.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• U.S. Wireless Data Market: Q4 and Year-End 2008

iPad passcode configuration

Even though it isn’t 100 percent foolproof, securing your iPad with a passcode is a good first step for security. On my iPad 2, I configured security to use the longer alphanumeric passcode, and I make sure that it will lock the iPad immediately when the cover is closed by doing the following:

1. Open Preferences and navigate to the General settings.
2. Set Auto-Lock to 2 minutes.
3. Turn the Passcode on and set Require Passcode to “Immediately.”
4. Turn the Simple Passcode off.
5. Turn Erase Data On to wipe the iPad after 10 failed logon attempts.

After you sync your passcode protected iPad with your Mac, you should notice that any user account on that Mac can still access the data on your iPad using any of the following methods. Attach that same iPad to any other Mac that has not accessed any data on that iPad in the past, and you will get an error indicating that the device is protected with a passcode.

Protecting your data in the real world

You may be surprised at how easy it is to access your iPad’s information even after you’ve set up a passcode when it’s connected to a Mac.  If you really don’t want others to have access to your information, there isn’t much you can do short of setting a hands-off policy. You may want to sync your iPad to a dedicated Mac which only you have access to. Anyone with access to both your iPad and the Mac it syncs with can see all of your data. You can avoid potential theft worries by keeping the iPad and Mac in separate cases, and by disabling the guest account on your Mac so that a user has to know your passcode to login.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Mobile Q1: All Eyes on Tablets, T-Mobile and AT&T
• A Media Tablet Forecast, 2011 – 2015

Legislators put together the hearing, named “Protecting Mobile Privacy: Your Smartphones, Tablets, Cell Phones and Your Privacy,” in response to consumer concerns over the use of data shared via their mobile devices. Apple garnered the most recent attention surrounding the issue when researchers publicized the fact that Apple’s iOS devices were keeping a record of users’ general locations.

Senator Al Franken (D-Minn.) issued a public letter calling for answers regarding the company’s privacy practices surrounding location services, and Apple issued an official response shortly thereafter answering said questions. The Mac-maker also noted that it looked forward to the opportunity to clarify these issues by testifying before lawmakers. Apple then released an update earlier this week that makes location information stored on devices more secure, and also changes the cache size so that less data is stored.

Like Apple, Google also makes use of anonymized location data transmitted from Android devices, the company revealed after Apple’s location storage practices came to light. Google will also testify before the Senate committee, via Google Public Policy Director Alan Davidson.

Also in attendance will be Sen. Franken, who will preside over the hearing, as well as Jessica Rich, deputy director of the FTC’s Bureau of Consumer Protection; and Jason Weinstein, deputy assistant attorney general of the Criminal Division of the U.S. Dept. of Justice, who will act as the hearing’s first panel. Apple and Google will be on the second panel, along with Justin Brookman, director of the Center for Democracy and Technology’s Project on Consumer Privacy; Ashkan Soltani, an independent consultant; and Jonathan Zuck, president of the Association for Competitive Technology.

Apple’s representative Bud Tribble has been with Apple since near the very beginning, having helped design the Mac OS and user interface. He left Apple with Jobs and worked at NeXT as VP of Software Development, and returned to Apple in 2002 after spending some time at Sun Microsystems and Eazel. He is arguably the Apple employee with the most history with Jobs.

As is often the case, technology ran ahead of regulation and clearly defined limits when it comes to location services and other mobile private data concerns. This hearing could be the first step in the creation of regulations or legislation that specifically address those concerns. Apple, Google and others in the industry will be keen to participate in the process in order to attempt to allay lawmaker concerns and keep the space as self-regulated as possible.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Connected Consumer Q1: The Over-the-Top vs. Pay TV Battle Heats Up
• Smart Grid Apps: Six Trends That Will Shape Grid Evolution
• Infrastructure Q1: IaaS Comes Down to Earth; Big Data Takes Flight

• The location database will no longer be backed up to iTunes.
• The location database cache, and thus the number of days logged, will be reduced.
• When Locations Services are off, the database will be deleted.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• A Media Tablet Forecast, 2011 – 2015
• Mobile Q1: All Eyes on Tablets, T-Mobile and AT&T
• A Global Mobile Handset Platform Forecast, 2011 – 2015