The case involved the police search of Alabama resident Bennie Dean Herring’s truck. After a local crime database indicated Herring was wanted for arrest in a neighboring county, police searched his truck, finding methamphetamines and and an illegal firearm. Minutes after the search, attempting to retrieve the original arrest warrant from the system, police realized that the warrant had expired five months earlier.

Herring later challenged his arrest in court, arguing that the exclusionary principle of the Fourth Amendment, which prevents evidence obtained in an illegal search from being presented in court, applied in his case.

In the Supreme Court ruling, the 5-4 majority held “When police mistakes leading to an unlawful search are the result of isolated negligence attenuated from the search, rather than systemic error or reckless disregard of constitutional requirements,the exclusionary rule does not apply.”

In their unsuccessful Amicus brief to the court, EPIC warned that in an age where the use of electronic databases is increasing, removing database errors from the exclusionary principle would extinguish a key motivation for accuracy.

To allow law enforcement agencies to rely on inaccurate data will exacerbate further a problem that implicates both the fairness of the criminal justice system as well as the design and operation of government information systems….to permit a good faith reliance on data that is inaccurate, incomplete, or out of date will actually exacerbate the problem and increase the likelihood of unfair treatment in the criminal justice system.

Tom Goldstein at SCOTUS Blog points out a key aspect of how the decision might impact police conduct:

The opinion has nothing to do with the fact that the error here is one of recordkeeping. It applies fully to negligence by police officers in their day-to-day determination whether there is probable cause to conduct a search. If the officer makes an objectively reasonable mistake - i.e., he is merely negligent - the exclusionary rule does not apply to whatever evidence he finds. Put another way, the Supreme Court today extended the good faith exception to ordinary police conduct….

The rubber will hit the road in cases in which the officers’ error is one of fact, not law. Herring is such a case - the officer is said to have reasonably relied on the information provided by a police warrant clerk. But what about the more common circumstance in which an officer, based on information not provided by anyone else, negligently but erroneously concludes that probable cause exists. For example, the officer believes that an individual is wanted for arrest but doesn’t call to confirm that fact, or the officer believes that a bag contains marijuana but a closer inspection would have shown otherwise. In the past, those cases would have automatically triggered the exclusionary rule - the Fourth Amendment violation required exclusion.

And the data about circumventing users is much more sensitive than the data about most ISP users. These are the histories of users browsing sites that are not only blocked (and therefore mostly sensitive in one way or another) but blocked by an authoritarian country with an active policy and practice of persecuting dissidents. The mere act of anyone, let alone projects proclaiming themselves for internet freedom, storing this data is very bad practice. Any data that is stored can be potentially be shared or stolen. The best way to make sure that dangerous data like this does not get into the wrong hands is not to store it in the first place.

Since the posting, both Peter Li, head of technology at GIFC and Bill Xia, CEO of DynaWeb, have stated that none of the partner sites sell individual user data. In a comment posted at Roberts’ blog, Li states:

We apologize for the confusion here. The anti-censorship ranking service is provided by one of the GIFC partners. It only publishes the popularity ranks of destination websites users visit through our anti-censorship tools. It is similar to alexa.com but is only limited to anti-censorship web traffic.

The ranking service is not authorized to access, nor can it access, the data users transmit on the wire. It is not authorized to release logs containing information on the websites any individual user visits either.

The FAQ for the ranking service was not written properly, as originally “user” there meant website owners who may be interested in getting detailed statistics on how their websites are visited through our anti-censorship tools. We apologize that we have overlooked the wording.

The GIFC partner who runs the ranking service, the World Gates’ Inc, has been notified, and that FAQ entry has been removed. Thank you for discovering the problem.

Given the solid reputations of the people involved, I have no cause to question or doubt this explanation. The entire incident, however, raises some important questions about anonymizing services and private VPNs and the danger of misplaced trust. It also leaves some questions unanswered about how user data is stored by these individual circumvention services and how such data might become accessible to state policing organizations at some future date. I agree with Roberts that the only way to ensure that data is not available is “not to store it in the first place.” To date, there are no laws in the US that require ISPs or web service providers to store user data, so such a service remains within the realm of possibility, at least for the time being.

Full story at Secrecy News.

Even government officials responsible for administering these systems appear confused over terminology. During a 2006 Senate Judiciary Committee hearing, senator Patrick Leahy asked FBI director Robert Mueller if his agency’s Investigative Data Warehouse (IDW) system linked to the Automated Targeting System (ATS) run by the Department of Homeland Security (DHS). The conversation has a bit of a who’s on first quality:

LEAHY: Does the IDW database share information or otherwise interface with the ATS data- mining program?
MUELLER: The ATS data-mining program? I’m not familiar with what you’re referring to, sir.
LEAHY: Just talking about the ATS.
MUELLER: You mean DHS?
LEAHY: The DHS — well, they call it ATS. I realize we’re using acronyms, but this is the one that checks on everybody crossing our borders. And you have the Department of Homeland Security’s automated targeting system.
Does your database interface with that? Does it share information with it?
MUELLER: I do not believe so. But, again, I would have to go back and check. I do not believe so.

The most comprehensive effort to date to map the overall “domestic intelligence” system of the U.S. is this map produced by the RAND corporation as part of its 2008 monograph, “Reorganizing U.S. Domestic Intelligence.”

RAND Map of US Domestic Intelligence (pdf)

For hardcore surveillance wonks, this map is a true treasure trove. The map identifies and shows key connections between federal departments and agencies and their data systems — extant, proposed and decommissioned — as well as private sector entities.

As useful as this map is, it’s not without its weaknesses. Perhaps most importantly, the map gives no sense of hierarchy, suggesting that all data systems are somehow equal. Some systems have a higher “document gravity,” meaning that records from other systems tend to flow into them. A perfect example of this would be the Investigative Data Warehouse (IDW) which the FBI has claimed will store “all data than can be legally stored together.” One could imagine a map layout in which those systems with the highest document gravity appeared at the bottom, while those with the least gravity and narrowest topical coverage appeared at the top. This of course, might make it difficult to keep systems clustered within their respective institutions, but it would help journalist watchdogs and activists focus on the most important systems. Another problem with the map is that, although it shows explicit data sharing paths between systems, it obscures their developmental relationships.

The DOD’s decommissioned Threat and Local Observation Notice (TALON) reporting system, for example, is shown organizationally connected to the now defunct Counter-intelligence Field Activity (CIFA) and is linked as a data source for the also defunct Joint Protection Enterprise Network (JPEN) system (RAND’s map appears to have been produced before CIFA and JPEN were formally shut down, showing only TALON with an X through it). Although the precursor system to the DOD-wide standard TALON reports, the Air Force’s Eagle Eyes System, appears in the map, it is separated by six degrees, connected only via the DOD hub itself. A map that focused more on the evolution of the overall dossier system might show the Eagle Eyes system flowing into TALON/JPEN and then flowing into the FBI’s Guardian/eGuardian system, where DOD TALON reports are now filed. This case is particularly interesting because the basic threat reporting model adopted by the Department of Defense appears to have been transferred across institutional boundaries to the FBI. This is an excellent example of how former boundaries between record keeping systems and their parent institutions in the U.S. are disappearing, and how innovations within one agency can now more easily be adopted by other agencies due to a reduction in both policy and technological constraints.

With pride, he sees his company’s algorithms helping drive internet surveillance to perfection. “There are many different demands – early warning, policy support, competitive spying between government departments. In the end, this will create a whole industry.”

If this represents a shift, however, from targeting individual trouble makers to attempting to read and predict shifts in overall public opinion, I’m not sure how this is a step backward. Although the article is painfully short on details, a quick look at the company’s own web site suggests the technology, called InfoRadar, is much like that offered by Umbria, the social media analysis division of J.D. Power and Associates.

Photo, ID required in Beijing Internet cafes

When Zhang Lihong entered Suosi Internet cafe in Xicheng District, Beijing Oct. 16, she noticed something new on the counter- a machine with a digital camera and scanner.

“Please have your photo taken, and your ID card scanned here,” the clerk stood up and said.

Zhang was confused and wanted to know why she had to do this. The clerk explained that authorities are trying to crack down on Internet misuse in the city.

The 24-year-old’s photo and a copy of her resident identity card were sent to the Municipal Law Enforcement Agency of Beijing and placed in a file.

Zhang was then given a four-digit password, escorted to a computer, and told to enter her information on an interface to activate the computer.

“You don’t need to go through the same process again when you visit Internet cafes like us,” the clerk explained. “By providing your ID number, you can check in after we verify your filed information.”

Zhang smiled as she started to surf the Internet.

“This is a reasonable measure. You spend two minutes and you can enjoy a healthier virtual world,” she said. “Today, there are many hackers, net rumors being spread around and people sending erotic content. Now that users have their images taken, they dare not do bad things.”

A spokeswoman from the Municipal Law Enforcement Agency of Beijing said 1,500 Internet cafes in 14 districts and counties of the city have the same device. It is called the Beijing Internet Cafe Customer Registration Device.

“By the middle of December, Internet cafes in another four districts and counties of Beijing will receive these devices,” said the spokeswoman who wanted to remain anonymous.

“The new device annoyed me a lot at first,” said Li Yunfei, the manager of Suosi Internet Cafe. “80% of my customers just went away when they saw the device. My cafe was like an empty classroom.”

After a month, people become used to it, however, and Li’s turnover recovered.

“After all, I need to use it, or I will be fined and will lose my reputation,” Li said.

Jia Fei, the manager of Hailetong Internet Cafe, a chain with more than 500 computers, believes the new system makes his work more efficient.

“Now I can easily track the exact online time of my customers and when they switch to other computers,” Jia said. “If someone commits Internet crimes, I can help the police to pin him.”

Ma Zhengnan expressed relief when she heard about the new devices outside an Internet cafe near her 18-year-old son’s high school.

“This can keep students away from indulging in computer games,” Ma said.

However, some netizens dislike the law enforcement initiative.

“I will not go to Internet cafes any more,” said Li Weiwei. “Who knows if my personal information is being exposed to people with bad motives.”

(Xinhua News Agency October 17, 2008)

Will governments be able to subpoena server log data after it is anonymized? Will anonymized data still be able to identify an individual user by cookie or IP address? Google does comply with valid legal process, such as search warrants, court orders, or subpoenas seeking personal information. Logs anonymization does not guarantee that the government will not be able to identify a specific computer or user, but it does add another layer of privacy protection to our users’ data.

Will this policy change make it more difficult for law enforcement to prevent and detect crime or child exploitation? No, current laws allow the government to request that companies preserve user data. We regularly comply with such laws.

What happens to the logs at the end of the expiration date? Are they deleted? At the end of the expiration date we will still keep server logs but they will be anonymized.

At the time, the process of anonymization involved deleting the first four digits of the IP address and altering associated individual cookie data in an unspecified way. With the new 9 month policy, Google states that it might do something different. The only thing that this policy means is that your search logs data older than nine months will not be used for services like “automatic search correction,” which corrects typos on the fly based on your prior search patterns, or to serve you ads. It does not mean that your personal search behavior older than 9 months won’t be accessible to state policing organizations.

Instead of joining the Tor network directly, thereby revealing your intention, you first connect to a computer set up by your friends or colleagues, who then introduce you to the Tor network (a “virtual bridge”, they call it). Because the Chinese cannot know in advance who these friends of yours will be (technically speaking, their IP address), they cannot pre-empt by blacklisting. Once you do connect through the bridge to the Tor network, it is almost impossible for surveillance agencies to know that you are using Tor.