If you’re a Sprint customer, you’ll want to pay attention to this:
A blogger named Christopher Soghoian has uncovered evidence that Sprint handed over customer GPS location data to law enforcement officials, not just once or even a few hundred times, but in millions of instances.
Soghoian unearthed audio of Paul Taylor, Sprint/Nextel's Electronic Surveillance Manager, talking about how the carrier gave GPS data of its wireless customers to authorities more than 8 million times. Says Soghoian, “The government routinely obtains customer records from ISPs detailing the telephone numbers dialed, text messages, emails and instant messages sent, web pages browsed, the queries submitted to search engines, and geolocation data, detailing exactly where an individual was located at a particular date and time."
That’s a lot of data, and in Sprint’s case, there’s a huge team to handle them — including three supervisors, 30 techs and 15 contractors, plus 70 other people dedicated to historical surveillance records. That’s a department of about 110 devoted to serving up subscribers’ personal info to the police. (Wow. Who knew the Pin-dropping network even had an electronic surveillance department?)
If the sheer volume of requests doesn’t surprise you, then maybe the method will: Sprint went the extra step to make it simpler and easier for law enforcement to obtain the data. It created a special web portal last year that serves up location and behavior data 24 hours a day, seven days a week, all without those millions of customers even knowing. This is what’s known. What’s unknown is whether the process requires pesky things, like probable cause, petitions or court orders — you know, lawful process. But regardless, the mere existence of an easy log-in system has naturally spurred on a surge of requests from authorities.
Obviously, the innocent have nothing to fear, but that’s not really the point. If this easy-access system doesn't require a lawful process — and it doesn't seem like it does, since there's been an increase of requests since its implementation — then privacy watchdogs could take this as a breach of civil liberties and basic rights. So chances are good, really good, that this won’t be the last we hear about this. I’m expecting an uproar and a demand for carrier policy and legislative changes to follow shortly.
But those of us who are into tech may be more jaded than that. We know how accessible data is, and that something as intangible as privacy can be hard to uphold. But even so, comments made by Taylor, the Electronic Surveillance Manager, still surprise me. He doesn’t seem at all bothered about the privacy issue, and instead, just focuses on the uptick in workload:
"[M]y major concern is the volume of requests. We have a lot of things that are automated but that's just scratching the surface. One of the things, like with our GPS tool. We turned it on the web interface for law enforcement about one year ago last month, and we just passed 8 million requests. So there is no way on earth my team could have handled 8 million requests from law enforcement, just for GPS alone. So the tool has just really caught on fire with law enforcement. They also love that it is extremely inexpensive to operate and easy, so, just [because of] the sheer volume of requests they anticipate us automating other features, and I just don't know how we'll handle the millions and millions of requests that are going to come in."
Millions and millions, eh? What a can of worms. If I were the gambling sort, I’d guess that the chances of all those requests having proper legal procedures backing them up are slim to none. And I probably wouldn’t bet that everyone who handles that easily gotten data — from internal staffers to police officers and feds — have completely honest intentions. But these are minor concerns compared to one department’s workload. (Sheesh.)