A day in the life of the surveillance state
Often, the discussion on government surveillance in the US is all about the NSA or the FBI. But the feds aren’t the only ones spying on you. Local law enforcement has been getting in on the action, and it’s not good.
If you’re planning on dressing up and enjoying yourself this weekend, you might think that a layer of paint and a wig is enough to make you unrecognizable. Unfortunately, that’s just not the case. Government spending on surveillance technologies for domestic law enforcement—like IMSI catchers, biometrics, and cameras of all kinds—has increased exponentially in recent years, despite the fact that in the last 20 years, crime rates in the United States have steadily and significantly declined (PDF).
Invasive street level surveillance technologies are popping up in towns across the US—and around the globe. A Halloween costume is no match for these technologies when it comes to protecting your privacy. Here are a few of the disturbing surveillance technologies that local law enforcement is increasingly adding to its arsenal, and how you might encounter them on a typical day. As we walk through these technologies, try to imagine what you’d have to do to go a single day without surveillance.
Social Media Monitoring
Did you RSVP to any Halloween parties on Facebook? Maybe tweet about your plans? Posted an Instagram of your costume? These days, when you’re reading tweets or looking at your friends’ photos, you might be joined by cops.
That’s right. It’s not just the NSA or FBI looking at your Facebook. Local law enforcement does extensive monitoring of social media too, and so do private companies working for the government—all without even reasonable suspicion of wrongdoing. Officials engage in fishing expeditions on social media, gathering data about your location and who’s there with you—just as they’ve done to Black Lives Matter activists and protests.
And don’t assume that marking a post as “private” will keep it from law enforcement. Officers have created fake accounts and even pressured friends of people they’re keeping tabs on to share their login credentials. In a highly-publicized New York case, the DEA had to pay a woman $134,000 for creating a fake Facebook account using her identity.
There is some good news on the social media front. With a few common sense steps, you can make yourself a lot harder to spy on.
Automated License Plate Readers
Once you get in your car, get ready to be tracked, no matter how well your face is disguised. Law enforcement agencies all over the country use ALPRs (automated license plate readers) to track drivers’ locations and activities. ALPRs are cameras—mounted on police cars or placed in stationary locations like light poles—that detect when a car passes, capture a picture of that car, and record its license plate number. Accumulated location data creates a history of drivers’ movements that can provide private and intimate details on people’s lives, like where they work, where they live, where they worship, where they go throughout their day, and who they associate with. Law enforcement agencies like the NYPD have used ALPRs in exactly this way, trying to map out the entire Arab and Muslim community of New York and Newark. The Los Angeles Police Department and the LA County Sheriff's Department scan three million plates every week.
The privacy implications of ALPRs alone are shocking, but the way they’ve been implemented poses even further security risks. EFF recently discovered that many law enforcement agencies hadn’t taken basic steps to secure the feeds. Some can be accessed publicly over the web, without any passwords or other basic security measures—placing the location information of thousands of people at risk.
EFF has been trying to find more information about how and where law enforcement agencies use ALPRs, but our attempts are often stymied by the courts. Along with the ACLU, we recently asked the California Supreme Court to overturn a lower court ruling that ALPR data could be withheld from the public.
Automatic Toll Readers
Speaking of driving, do you go through any tolls on your commute? Many cities have switched to electronic tolls, either via an RFID chip in your car or via an account tied to your license plate number. In 2013, we noted that the San Francisco Bay Area had switched to all electronic tolls, making it functionally impossible to cross the Golden Gate Bridge without authorities knowing about it. And the Bay Area isn’t alone; other major urban areas like New York and even some states, like Washington, have moved to all (or nearly all) electronic tolling.
You could take public transportation to avoid the privacy threats when driving—but don’t buy your ticket with a credit card. Transit agencies in the US, Canada, and South Africa “hand over private information about travelers gathered by electronic ticketing systems to law enforcement agencies on a voluntary basis.”
Surveillance Cameras
You may escape tracking by not driving and by purchasing a transit ticket in cash, but you’ll still be captured by ubiquitous surveillance cameras. In many US cities, there are now surveillance cameras on every block. In San Francisco, you could appear on security cameras dozens of times in one day. In New York, “[t]he NYPD can tap into roughly 6,000 street cameras, two-thirds of which are privately owned. There are another 7,000 in public housing and more than 4,000 in the city’s subway stations.”
These cameras are a mix of private and government owned, but in some cities, law enforcement asks private owners for access—or even to register their cameras so that law enforcement knows who to ask for footage from any particular camera.
Biometrics
You’ve probably noticed that Facebook recognizes yourself and your friends in your photos. A mask might not be enough, though: facial recognition technology has gotten so good that Facebook can even recognize the back of your head.
But that’s just the tip of the iceberg in biometrics, a growing field in identifying people based on every aspect of their appearance and behavior. Even if you succeed in hiding your face from all those surveillance cameras, you can give yourself away with your voice, the way you walk (PDF), the shape and size of your hands, and even the way you type. And if you have any visible scars or tattoos, it’s privacy game over.
IMSI Catchers
Planning on using your cell phone today? The police don’t need an NSA-style agreement with the phone company to know where you are. They can just use an IMSI catcher.
International Mobile Subscriber Identity catchers (commonly known as Stingrays, after a popular brand of catcher) trick cell phones into revealing their locations by masquerading as cell phone towers. When your phone connects to a Stingray, officers know that you’re near it. While law enforcement says it uses IMSI catchers to locate suspects, they can sweep up the signals of people in a wide radius—for example, at a demonstration.
There’s good news. As of September, federal law enforcement agents can no longer use IMSI catchers without a warrant. And in California, recently passed bills SB 741 and CalECPA limit the acquisition and use of IMSI catchers. Unfortunately, most states treat them as fair game for local enforcement.
Speak Out
As scary as all these tactics are, there’s a bright side: unlike the lawmakers that have failed to oversee the NSA, local lawmakers are often more responsive to pressure. When people speak out, local governments listen. Just a few weeks ago, California passed one of the best digital privacy laws in the United States, largely thanks to pressure from voters. And at the city and county level, we’ve seen communities successfully fight aggregated surveillance cameras, IMSI catchers, drones, and more.
EFF has a new online hub called Street Level Surveillance (SLS) to help activists do just that. SLS unites our past and future work on domestic surveillance technologies into one portal. It has information on how surveillance technologies work and how you can fight back. If you’re spooked by pervasive surveillance of your every move, we hope you will.
