Monday, July 02, 2012

Study shows at least one entity can't obtain your cell phone records from carriers: you

Pro Publica, the non-profit organization that focuses on investigative journalism in the public interest, has discovered something interesting about all that data that we know is being collected from our mobile devices. The bottom line is, although it's ostensibly your data, you can't see it.

That's right, you can't see it. Law enforcement can see it, but you can't.

The organization sent out investigators to try to get their own cell phone data from the Big Four U.S. wireless carriers (Verizon, AT&T, Sprint, T-Mobile in order of size). They all failed. The refrain was consistent.

1. Verizon:

Verizon said they only shared data at the request of law enforcement officials. Thus, if you wanted to see your data, you'd have to have some law enforcement agency request it for you. You can't get it directly.

On the other hand, the company added that unless you, the customer, consents to the release of your information, or unless law enforcement certifies there is emergency involving danger of serious injury or death, "Verizon Wireless does not release information to law enforcement without appropriate legal process” (i.e. a warrant). Naturally, we would assume (and know, from past stories) the initials DHS make it easy to get around this.

A spokesman added that being more specific would “require us [Verizon] to share proprietary information.”

2. AT&T:

The nation's No. 2 wireless carrier was more to the point. In terms of giving you your own datea, they don't provide that service, period.

Law enforcement requests should require a court order or subpoena, though they did use those as "examples," saying that "We do share data with law enforcement as part of a valid legal process."

3. Sprint
Sprint said they don't release records to their customers because the data would include calls made or received, including calls made whose numbers are blocked. Now this actually makes sense. They added, "Because of an FCC rule requiring that we not disclose ‘blocked’ numbers, we only release this information to a customer when we receive a valid legal demand for it."

In terms of law enforcement, the nation's No. 3 wireless carrier was very detailed. They said, “If the government is seeking “basic subscriber information” (defined in 18 USC sec. 2701, et seq) it can obtain that information by issuing a subpoena. If the government is seeking Sprint records relating to our customers that go beyond “basic subscriber information” then the government must furnish Sprint with a court order based on specific and articulable facts. If the government is seeking customer’s content then it must obtain a warrant based on probable cause.”

4. T-Mobile

The company would not comment on its policies regarding releasing data to a customer, although they did say "no."

In terms of law enforcement, just as with the other Big Four carriers, they release data when compelled. That includes (but is not limited to) being "exigent circumstances" (folks that watch a lot of TV crime drama know what that means), subpoenas, search warrants, and court orders.

Past FUBARs such as Carrier IQ and the iOS "Location Tracking File" - and the heated public response - show that the public is extremely sensitive to these matters.

Despite that, the public apparently has no access to its own data.

Last year, German Green party politician, Malte Spitz went to court to obtain his records. The amount of data stored was shocking.

It's difficult to believe that our results would be any different. It's galling to know, also, that advertisers can see your data, albeit in anonymized form.

No comments: