Our privacy is compromised by something we likely have with us right now. Our cell phones broadcast our location without pause, and without protection.

Approximately every seven seconds, our cell phones ping the nearest tower. Each ping is recorded and, through a simple process, our location information is triangulated, accurate to within ten meters, or about 33 feet for those of us who don’t measure in meters. The telecommunications company that maintains this information can store it indefinitely, and release it whenever and to whomever it pleases — including the police.

The information this real-time map of your movements can reveal is virtually unprecedented in its detail, and that is why we have introduced legislation (S-2403, H-7167) to establish limits on law enforcement’s access to it.

The oversight that our legislation would establish is both reasonable and necessary. Our phones are with us when we wake up, when we drive to work, when we take children to school, and when we go out for the evening. They can reveal the ages of our children, the status of our health, our commitment to our job, and with whom we are at any given moment in time, whether today or on a day forgotten months ago. Yet, despite the overwhelming potential for misuse of this information, Rhode Island law does nothing to keep our every move from being scrutinized by law enforcement on demand, and without a warrant.

Our information is not safe simply because we have done nothing wrong. During an investigation, law enforcement may do a “tower dump,” where all the cell phone information of every person who passed a particular tower is released. If we’ve been in the same vicinity, and not necessarily even at the same time, as a person under investigation, our information may be compromised.

Given the level of detail that cell phone location information can provide, it is an enticing tool for law enforcement, and one that, nationwide, is frequently used. In 2013, a federal inquiry by Sen. Ed Markey of Massachusetts determined that police requests for cell phone information had doubled over the last five years. Verizon alone reported 30,000 requests for cell phone location information, with more than 2,000 of those requests for cell phone tower dumps. In the same year, AT&T received more than a 100,000 requests for historical or real-time location information. With no laws in place to protect their privacy, Rhode Islanders may have already seen their location information quietly handed over for investigation.

Requiring a warrant in most circumstances before this information is turned over to police will not make it impossible for law enforcement to access our information; it will not even be particularly difficult. But it will ensure some oversight by a judge to confirm that if our information is up for grabs, it is for a good reason. We want law enforcement to have the tools they need to keep our neighborhoods safe, but that does not have to come at the price of our privacy.

That is why our legislation would require, except in emergency circumstances, law enforcement agencies to get a warrant before they can access our information. When there’s a life or death situation, law enforcement should not have to wait to be able to find us. But for run-of-the-mill investigations, Rhode Islanders should feel secure that their movements throughout the day are not up for scrutiny without any judicial oversight.

It’s time for Rhode Island to join the 11 other states that have passed laws requiring warrants for cell phone location information. Rhode Islanders deserve to know they are being kept safe without being kept under surveillance. Passage of this law will ensure police have the tools they need, while still protecting the privacy of residents. It is time for Rhode Island’s privacy laws to enter the 21^st century, and for cell phone location information to be protected from unwarranted access.

Cloud City Drones

Randall Rose, member of RICDHCR, said in a press release that, “Although drones do have legitimate and important uses, Rhode Islanders’ quality of life will suffer if inadequately regulated drones become widespread.  Except in an emergency, drones should not be allowed to collect personally identifiable or re-identifiable information on residents without their consent.  Drone manufacturers and makers of drone-related software should not be allowed to use data collected by consumer and law-enforcement drones, and should not transfer that information without the consent of the private individuals involved.  Drones should be safe, unarmed, and not able to do physical damage.  Law enforcement should acquire drones only after a full public hearing, and should use drones only subject to a court order.”

Cloud City Drones proprietor Chris Williams focused on the safety features of the drones he carries, which makes them unfit for spying.

A private detective came in looking for a drone for his business, said Williams, and he wanted to use the drone to peer over fences. “Spying means stealth,” said Williams, “and these things are not stealthy. It’ll sound like a weed whacker in your backyard. That’s number one. Number two, there’s flashing lights blinking all over the place.” A third reason is that you get about 20 minutes of flight time on a battery charge. “It’s not a good device for spying. You’d do way better using a telefocal lens or a telescope.”

Williams thinks drones will be primarily used by hobbyists, law enforcement, search and rescue, prison security and home inspection. In reality, the ideas for drones are just beginning, and he would like to see the market develop and legislation crafted carefully so as to not impact potential sales.

“We focus on drones that have all the safety features built into them.” said Williams, “For example, if you say, Chris, I’ll give you a million dollars right now I wouldn’t be able to fly this drone this close to an airport. There are ‘no-fly zones’ built into drone’s systems. Outside the five mile limit, drones can fly higher. As soon as a new no fly zone comes out, it’s instantly updated. So when Washington DC said no drone flying around the White house, that update was instant. Nobody can fly over it.”

Cloud City Drones is on Jefferson Boulevard in Warwick, not far from the airport.

Randall Rose was clear that the RICDHCR action was not, “primarily aimed at criticizing this particular store, which has already drawn some controversy.  Instead, the purpose of the event is to draw attention to the failure of Rhode Island’s policymakers to pass much-needed legislation that will adequately regulate drones and other forms of surveillance.  Privacy advocates are well aware of the likelihood that some of the drones on the market will be used in harmful ways.”

So far, despite some interest on the part of the RI General Assembly, there has been no legislative action taken on limiting the use of drones or addressing privacy concerns.

Steven Brown, the executive director of the RI ACLU, issued a letter to Kelly J. Fredericks, the President of the RI Airport Corporation, asking that they cease their involvement in the program, and not support any such programs in the future.

“I am writing to express the ACLU of Rhode Island’s deep concerns about the Rhode Island Airport Corporation’s apparent decision last month, with no public input, to work with the Department of Homeland Security’s Transportation Security Administration (TSA) in field testing the expansion of a largely discredited program that attempts to identify travelers who might pose a potential security risk through questionable “behavior detection” techniques,” Brown wrote.

The field test, which is called “Centralized Hostile Intent,” will use actors to mimic behaviors that the TSA should be able to screen and identify. They will be asked to identify these behaviors through a video feed, rather than in person. Because actors will be used during the field test, the ACLU recognized that the effect on travelers’ privacy will be minimal, but they still opposed the overall intent of the study.

“But one cannot ignore what the ultimate goal of this project is- to make it easier and more routine to target innocent travelers for intrusive incursions on their privacy, all based on what have thus far been largely discredited “behavior detection” activities,” Brown wrote.

Brown also wrote that the current “behavior detection” patterns that officers look for are arbitrary and random at best, such as being late for a flight, excessive clock watching, strong body odor, sweaty palms, among other signs. These monitoring activities have been criticized since a 2013 report by the U.S. Government Accountability Office recommended that the TSA limit their funding for behavior detection, since there was no scientific evidence to prove whether or not these activities actually work. According to the report, “the human ability to accurately identify deceptive behavior based on behavioral indicators is the same or slightly better than chance.”

The program being tested at T.F. Green also seeks to develop a tracking algorithm so officers can follow on-camera anyone they believe to be suspicious, and identify those with them as well.

“The anticipated future applications of this project are disturbing, as they promise to be just as ineffective as TSA’s existing efforts. At bottom, this effort is junk science, but one with serious civil liberties and privacy implications,” Brown said. “We all want to ensure proper security measures are in place at our airports, but it is time to end, not expand, ineffective programs like this that use up limited resources, and that open the door to more intrusive privacy invasions and increased racial profiling, while doing little to keep us safe.”

The ACLU of Rhode Island on Tuesday sued the DMV for implementing its Uninsured Motorists Identification Database without first establishing any regulations to prevent the improper disclosure of drivers’ personal information, avoid mistaken registration revocations, or to otherwise ensure that the program is properly administered by the private out-of-state vendor contracted to run the program. The database is designed to compile information from insurance companies about the identities of insured drivers and information from the DMV about registered motor vehicles. The vendor matches the information to identify and notify vehicle owners who do not appear to have insurance. The lawsuit, filed by ACLU volunteer attorney Albin Moser, noted that insurance companies and the DMV had begun sending personal information about drivers to the vendor without any regulations whatsoever to address key issues over implementation of the database.

The ACLU’s successful settlement of this suit comes as the first wave of notices to drivers who purportedly didn’t have insurance was supposed to be sent out by the vendor. Residents must obtain or prove they have insurance within a specified period of time or else their registration will be revoked. Under this agreement, the DMV must now established regulations in accordance with the Administrative Procedures Act before any notifications are sent.

ACLU attorney Moser said: “Thanks to the ACLU’s analysis, the Superior Court and the DMV were made aware of several privacy and due process concerns that were best addressed by a public rulemaking process before the program’s implementation. The ACLU will be an active participant in that process in order to make sure that these concerns are adequately addressed.”

The lead plaintiff in the case, ACLU of RI policy associate Hillary Davis, added: “A number of questions remain about the implementation of the UMID, from ways to protect Rhode Islanders’ privacy to how drivers whose registrations are erroneously revoked may have them reinstated without punishment. We commend the DMV for recognizing the need to move forward on answering these questions, and look forward to testifying on the proposed rules.”

A state law enacted in 2013 established the database, designed to compile information from insurance companies about the identities of insured drivers and information from the DMV about registered motor vehicles. A third party vendor matches the information in order to identify and notify vehicle owners who do not appear to have insurance. Residents must obtain or prove they have insurance within a specified period of time or else their registration will be revoked. Despite being explicitly required to do so under the statute, however, the DMV has proposed no regulations whatsoever to address key issues over implementation of the database.

Today’s lawsuit, filed by ACLU volunteer attorney Albin Moser, notes that while insurance companies and the DMV are already sending personal information about Rhode Island drivers to the third party contractor, the DMV has yet to draft, publicly share, or hold a public hearing to discuss regulations establishing privacy safeguards, notification procedures, and other necessary procedures. The failure to establish these regulations is a violation of the Administrative Procedures Act and the state law that established the database, according to the complaint. The suit asks the court to stop the implementation of the Uninsured Motorists Identification Database until appropriate regulations are adopted with public input.

The ACLU will be seeking a temporary restraining order this week against implementation of the program, as the first wave of notices to drivers who purportedly don’t have insurance is supposed to be sent out by the contractor as soon as next week.

The lead plaintiff in the case is ACLU of RI policy associate Hillary Davis, who often testifies on state regulations and civil liberties issues relating to privacy and technology. She said: “Any use of personal information must be thoughtfully and publicly examined. That the DMV has failed to engage in a public rule making process about this database, flouting the responsibility put upon them by the General Assembly, is alarming in its carelessness. Though the impact on Rhode Island drivers can be tremendous, the only discussions as to the database’s use and security precautions have been between the DMV, the insurance companies, and the third-party vendor that stands to profit from the use of Rhode Islanders’ personal information. This oversight must be corrected before the program goes into effect, not after Rhode Islanders find their information compromised or their vehicle registrations revoked.”

ACLU attorney Moser added: “The DMV needs to explain to Rhode Island residents how it and the private contractor are going to keep residents’ personal information secure.  The DMV also needs to explain to how it and the contractor are going to manage the program so that it is accurate and does not result in residents’ motor vehicle registrations being jeopardized by administrative error.”

The ACLU’s concerns about implementing the program without any public standards are not without justification, as it has sued the DMV a number of times in the past over regulatory lapses that have adversely affected motorists. In 2012, for example, the ACLU successfully sued the DMV after it refused to reinstate a person’s driver’s license based on a “policy” that appeared nowhere in the agency’s rules and regulations. In 2010, the ACLU successfully settled another case after the DMV advised thousands of motorists that their license and registration would be suspended due to alleged unpaid fines that were the result of incidents occurring on “00/00/0000.”

The authorization to do so is contained in an otherwise non-controversial bill known as the “Kelsey Smith Act,” which is designed to help police more quickly locate individuals who are missing or are being kidnapped.  (H-5456, S-284)

Although the bill provides for the release of cell phone tracking information to police upon request in certain emergency situations, a separate section of the bill goes further to broadly provide that:

“Notwithstanding any other provision of law to the contrary, nothing in this section prohibits a wireless telecommunications carrier from establishing protocols by which the carrier could voluntarily disclose device location information.”

In other words, voluntary disclosure of tracking information is not, in fact, limited to emergencies.

The geographic location of cell phones is tracked whenever the devices are turned on, and the information is often retained by phone companies for at least a year. This can reveal strikingly personal information. As a federal judge wrote, a person’s location data might disclose “whether he is a weekly church goer, a heavy drinker, a regular at the gym, an unfaithful husband, an outpatient receiving medical treatment, an associate of particular individuals or political groups — and not just one such fact about a person, but all such facts.” In short, phone metadata can sometimes reveal almost as much as the content of the phone calls themselves.

The goal of the Kelsey Smith  bill is a laudable one. But it is one thing for phone companies and police to share private location tracking information when an individual is at risk of serious harm, and another matter entirely to give them carte blanche authority to share that information about anyone for any reason.  Yet this bill is quietly making its way through the legislative process with virtually no objection.

The revelations this past week about the secret tracking of phone calls by the federal government should give us all pause. It would be extremely unfortunate if, despite these revelations, Rhode Island actually gave the government the formal authority to do the same thing for cell phone tracking records. General Assembly members should be strongly urged to eliminate this dangerous provision from the bill before its passage.