An Explosion in Geofence Warrants Threatens Privacy Across the US

Police around the country have drastically increased their use of geofence warrants, a widely criticized investigative technique that collects data from any user who was in a specified area within a certain time range, according to new figures shared by Google. Law enforcement has served geofence warrants to Google since 2016, but the company has detailed for the first time exactly how many it receives.

The report shows that requests have spiked dramatically in the last three years, rising as much as tenfold in some states. In California alone, law enforcement made 1909 requests last year, compared to 209 in 2018. Similarly, geofence warrants in Florida leapt from 81 requests in 2018 to more than 800 last year. In Ohio, requests rose from seven to 400 in that same time frame.

Across all 50 states, geofence requests to Google increased from 941 in 2018 to 11,033 in 2020, and now make up more than 25 percent of all data requests the company receives from law enforcement.

A single geofence request could include data from hundreds of bystanders. In 2019, a single warrant in connection with an arson resulted in nearly 1,500 device identifiers being sent to the Bureau of Alcohol, Tobacco, Firearms, and Explosives. Dozens of civil liberties groups and privacy advocates have called for banning the technique, arguing it violates Fourth Amendment protections against unreasonable searches, particularly for protestors. Now, Google’s transparency report has revealed the scale at which people nationwide may have faced the same violation.

“There’s always collateral damage,” says Jake Laperruque, senior policy counsel at the Constitution Project at the nonprofit Project on Government Oversight. Because of their inherently wide scope, geofence warrants can give police access to location data from people who have no connection to criminal activities.

“We vigorously protect the privacy of our users while supporting the important work of law enforcement,” Google said in a statement to WIRED. “We developed a process specifically for these requests that is designed to honor our legal obligations while narrowing the scope of data disclosed.”

Just this week, Forbes revealed that Google granted police in Kenosha, Wisconsin access to user data from bystanders who were near a library and a museum set on fire last August, during the protests that followed the murder of George Floyd. Google handed over the “GPS coordinates and data, device data, device IDs,” and timestamps for anyone at the library for a period of two hours; at the museum, for 25 minutes. Similarly, Minneapolis police requested Google user data from anyone “within the geographical region” of a suspected burglary at an AutoZone store last year, two days after protests began.

Laperruque argues that geofence warrants could have a “chilling effect,” as people forgo their right to protest because they fear being targeted by surveillance. Just this week, Kenosha lawmakers debated a bill that would make attending a “riot” a felony. Critics noted that such a bill could penalize anyone attending peaceful demonstrations that, because of someone else’s actions, become violent. Similarly, geofence data could be used as evidence of guilt not just by being loosely associated with someone else in a crowd, but by simply being there in the first place.

Geofence warrants work differently from typical search warrants. Usually, officers identify a suspect or person of interest, then obtain a warrant from a judge to search the person’s home or belongings.

With geofence warrants, police start with the time and location that a suspected crime has taken place, then request data from Google for the devices surrounding that location at that time, usually within a one to two hour window. If Google complies, it will supply a list of anonymized data about the devices in the area: GPS coordinates, the timestamps they were in the area, and an anonymized identifier, known as a Reverse Location Obfuscation Identifier, or RLOI.