Connect with us

News

US Supreme Court appears split over controversial use of ‘geofence’ search warrants

info

Published

on

Geofence keyword warrants.jpg

The U.S. Supreme Court on Monday heard arguments in a landmark legal case that could redefine digital privacy rights for people across the United States.

The case, Chatrie v. United States, centers on the government’s controversial use of so-called “geofence” search warrants. Law enforcement and federal agents use these warrants to compel tech companies, like Google, to turn over information about which of its billions of users were in a certain place and time based on their phone’s location.

By casting a wide net over a tech company’s stores of users’ location data, investigators can reverse-engineer who was at the scene of a crime, effectively allowing police to identify criminal suspects akin to finding a needle in a digital haystack.

But civil liberties advocates have long argued that geofence warrants are inherently overbroad and unconstitutional as they return information about people who are nearby yet have no connection to an alleged incident. In several cases over recent years, geofence warrants have ensnared innocent people who were coincidentally nearby and whose personal information was demanded anyway, been incorrectly filed to collect data far outside of their intended scope, and used to identify individuals who attended protests or other legal assembly.

The use of geofence warrants has seen a surge in popularity among law enforcement circles over the last decade, with a New York Times investigation finding the practice first used by federal agents in 2016. Each year since 2018, federal agencies and police departments around the U.S. have filed thousands of geofence warrants, representing a significant proportion of legal demands received by tech companies like Google, which store vast banks of location data collected from user searches, maps, and Android devices.

Chatrie is the first major Fourth Amendment case that the U.S. top court has considered this decade. The decision could decide whether geofence warrants are legal. Much of the case rests on whether people in the U.S. have a “reasonable expectation” of privacy over information collected by tech giants, like location data.

It’s not yet clear how the nine justices of the Supreme Court will vote — a decision is expected later this year — or whether the court would outright order the stop to the controversial practice. But arguments heard before the court on Monday give some insight into how the justices might rule on the case. 

‘Search first and develop suspicions later’

The case focuses on Okello Chatrie, a Virginia man convicted of a 2019 bank robbery. Police at the time saw a suspect on the bank’s security footage speaking on a cellphone. Investigators then served a “geofence” search warrant to Google, demanding that the company provide information about all of the phones that were located a short radius of the bank and within an hour of the robbery. 

In practice, law enforcement are able to draw a shape on a map around a crime scene or another place of significance, and demand to sift through large amounts of location data from Google’s databases to pinpoint anyone who was there at a given point in time.

In response to the geofence warrant, Google provided reams of anonymized location data belonging to its account holders who were located in the area at the time of the robbery, then investigators asked for more information about some of the accounts who were near to the bank for several hours prior to the job. 

Police then received the names and associated information of three account holders — one of which they identified as Chatrie.

Chatrie eventually pleaded guilty and received a sentence of more than 11 years in prison. But as his case progressed through the courts, his legal team argued that the evidence obtained through the geofence warrant, which allegedly linked him to the crime scene, shouldn’t have been used.

A key point in Chatrie’s case invokes an argument that privacy advocates have often used to justify the unconstitutionality of geofence warrants.

The geofence warrant “allowed the government to search first and develop suspicions later,” they argue, adding that it goes against the long-standing principles of the Fourth Amendment that puts guardrails in place to protect against unreasonable searches and seizures, including of people’s data.

As the Supreme Court-watching site SCOTUSblog points out, one of the lower courts agreed that the geofence warrant had not established the prerequisite “probable cause” linking Chatrie to the bank robbery justifying the geofence warrant to begin with. 

The argument posed that the warrant was too general by not describing the specific account that contained the data investigators were after.

But the court allowed the evidence to be used in the case against Chatrie anyway because it determined law enforcement acted in good faith in obtaining the warrant.

According to a blog post by civil liberties attorney Jennifer Stisa Granick, an amicus brief filed by a coalition of security researchers and technologists presented the court with the “most interesting and important” argument to help guide its eventual decision. The brief argues that this geofence warrant in Chatrie’s case was unconstitutional because it ordered Google to actively rifle through the data stored in the individual accounts of hundreds of millions of Google users for the information that police were looking for, a practice incompatible with the Fourth Amendment.

The government, however, has largely contended that Chatrie “affirmatively opted to allow Google to collect, store, and use” his location data and that the warrant “simply directed Google to locate and turn over the necessary information.” The U.S. solicitor general, D. John Sauer, arguing for the government prior to Monday’s hearing, said that Chatrie’s “arguments seem to imply that no geofence warrant, of any sort, could ever be executed.”

Following a split-court on appeal. Chatrie’s lawyers asked the U.S. top court to take up the case to decide whether geofence warrants are constitutional.

Justices appear mixed after hearing arguments

While the case is unlikely to affect Chatrie’s sentence, the Supreme Court’s ruling could have broader implications for Americans’ privacy.

Following live-streamed oral arguments between Chatrie’s lawyers and the U.S. government in Washington on Monday, the court’s nine justices appeared largely split on whether to outright ban the use of geofence warrants, though the justices may find a way to narrow how the warrants are used.

Orin Kerr, a law professor at the University of California, Berkeley, whose expertise includes Fourth Amendment law, said in a lengthy social media post that the court was “likely to reject” Chatrie’s arguments about the lawfulness of the warrant, and would likely allow law enforcement to continue using geofence warrants, so long as they are limited in scope.

Cathy Gellis, a lawyer who writes at Techdirt, said in a post that it appeared the court “likes geofence warrants but there may be hesitance to fully get rid of them.” Gellis’ analysis anticipated “baby steps, not big rules” in the court’s final decision.

Although the case focuses much on a search of Google’s location databases, the implications reach far beyond Google but for any company that collects and stores location data. Google eventually moved to store its users’ location data on their devices rather than on its servers where law enforcement could request it. The company stopped responding to geofence warrant requests last year as a result, according to The New York Times.

The same can’t be said for other tech companies that store their customers’ location data on their servers, and within arm’s reach of law enforcement. Microsoft, Yahoo, Uber, Snap, and others have been served geofence warrants in the past.

When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Business

NCC seek stronger cyber resilience as AI intensifies cyber threats

info

Published

on

The Nigerian Communications Commission (NCC) has called for stronger collaboration, improved digital security infrastructure and effective policies to address emerging cyber threats driven by Artificial Intelligence (AI).

Dr Aminu Maida, Executive Vice-Chairman of the NCC, made the call at the second edition of the International Cybersecurity Conference (ICSC), held on Tuesday in Abuja.

The theme of the conference was, “Cyber Resilience in the Age of AI: Defending Minds, Networks and Nation”.

Maida said AI had significantly increased the sophistication, speed and scale of cyberattacks, making cybersecurity a national imperative.

He said telecommunications infrastructure had become central to Nigeria’s digital economy, supporting financial transactions, communications, public services and business operations, thereby making its protection critical to national security.

He said cyber resilience went beyond preventing attacks to developing the capacity to anticipate, withstand and recover from disruptions while ensuring the continuity of essential services and economic activities.

According to him, emerging threats include AI-driven phishing, automated credential attacks, deepfakes designed to bypass authentication systems and malware capable of modifying itself to evade detection.

“The recent international cybersecurity incidents involving attacks on supermarket refrigeration systems in France and spyware targeting journalists and media personnel in the Middle East underscore the need for stronger digital defences.

“Section 4 of the Nigerian Communications Act, 2003, mandates the commission to protect consumer rights, safeguard national interests and promote the safety and efficiency of communications infrastructure.

“We have established the NCC Computer Security Incident Response Team (NCC-CSIRT) to monitor threats, facilitate intelligence sharing and coordinate responses to cybersecurity incidents across the telecommunications sector,” he said.

Maida said that the commission’s cyber resilience framework for the Nigerian communications sector provided common security standards for licensed operators and strengthened coordination with the national Computer Emergency Response Team, (ngCERT).

“There are three critical areas for strengthening cyber resilience. They include protecting human minds through cybersecurity awareness.

“There is also securing networks through robust security architecture, and defending the nation through collaboration among regulators, telecommunications operators, financial institutions and security agencies,” he said.

He urged telecommunications operators to adopt Zero Trust Architecture, which requires continuous verification of users and systems, while ensuring that AI models integrated into network operations were regularly assessed for vulnerabilities.

The National Security Adviser (NSA), Malam Nuhu Ribadu, said that digital development and national security could no longer be treated as separate priorities.

Ribadu was represented by Prof. Gerald Ilukwe from the Office of the National Security Adviser (ONSA) .

He said that AI presented opportunities for strengthening cyber defences but could also enable criminals to develop sophisticated scams, clone voices and spread false information.

He urged Nigerians to verify identities and authenticate suspicious requests before taking action.

“There is a need to secure digital supply chains, including AI models, data services and third-party technology providers.

“Vulnerabilities within one organisation can compromise other institutions and critical national infrastructure.

Ribadu said that the ONSA, through the National Cyber Security Coordination Centre, was strengthening coordination among relevant institutions and providing tools, laboratories and cyber ranges to analyse threats, investigate incidents and test response capabilities.

He said that a review of the National Cybersecurity Policy and Strategy, last updated in 2021, was underway to address emerging challenges, including AI-enabled fraud, supply-chain vulnerabilities, workforce development and international cooperation

“Recommendations from the conference will contribute to the ongoing review. The revised strategy will establish measurable priorities, promote accountability and strengthen the country’s capacity to respond to cyber incidents,” he said.

Rep. Ayodeji Stanley, Chairman, House of Representatives Committee on ICT and Cybersecurity, described cybersecurity as a moving target that required continuous innovation, adaptable legislation and international cooperation.

Stanley drew on his experience working on complex information technology systems in the United States.

He said the transition from traditional computing to cloud technologies had introduced new security challenges, requiring continuous improvements in protection mechanisms.

He urged policymakers, security experts and technology practitioners to develop forward-looking solutions that would protect critical systems across sectors, including food security.

Stanley said that cyberattacks could have consequences beyond the disruption of digital services.

He called for a collective global response to cyber threats, saying countries must work together to develop effective policies and innovative approaches capable of addressing the rapidly changing cybersecurity landscape.

(NAN)

The post NCC seek stronger cyber resilience as AI intensifies cyber threats appeared first on Business Today NG.

Continue Reading

News

Upwind raises $400M after walking away from Datadog acquisition offer

info

Published

on

GettyImages 1197780051.jpg

Upwind, a San Francisco startup that uses AI to secure cloud infrastructure, has raised a $400 million Series C round at a $3.8 billion valuation led by Bessemer Venture Partners, with participation from existing backers including Greylock Partners and Craft Ventures.

The round comes nine months after Upwind closed its previous $250 million financing at a $1.5 billion valuation.

The fresh funding, which has been in the works for months, nearly fell apart after Datadog attempted to buy the company, according to a person familiar with Upwind. Datadog is a publicly traded company that sells tools for monitoring how software runs, known as observability. It didn’t offer a premium above the $3.8 billion valuation set by venture capital investors, the person said, so Upwind decided to stay independent.

Four-year-old Upwind has grown rapidly amid rising AI-driven cybersecurity threats. The startup has been adding $20 million to $30 million in annualized recurring revenue (ARR) each quarter and is projected to end the year at roughly $90 million, according to a person familiar with Upwind’s financials. That means that VCs and Datadog valued the startup at more than 40 times its forecast ARR, a common yardstick for pricing software companies. The high multiple is also well below the 80x ARR fetched by Cyera, another fast-growing cybersecurity startup, according to TechCrunch reporting from earlier this year.

Cybersecurity is poised to be the third big wave of AI software that companies will pay for after AI coding tools and customer support, Theory Ventures general partner Tomasz Tunguz recently wrote in his widely read blog.

By walking away from an acquisition offer, Upwind clearly believes that the company will ultimately be worth more than the $3.8 billion that Datadog was ready to pay for it. However, given how few cybersecurity companies have gone public in recent years, an eventual sale remains the most likely outcome for the startup.

Upwind continues to draw acquisition interest, according to a person familiar with the company.

The startup was founded by Amiram Shachar, who sold his previous company, the cloud spend management startup Spot.io, to NetApp for $450 million. Upwind calls its approach to thwarting threats “runtime” security, which means it alerts and remedies attacks and vulnerabilities in active services in real time.

TechCrunch has reached out to both Upwind and Datadog for comment.

When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.

Continue Reading

Trending