In what privacy experts say is part of a disturbing trend, the investigation into a recent string of armed robberies in the Portland area involved a sweeping FBI demand for Google user location data.
The court-approved demand, first reported by Forbes magazine, would have included sensitive personal data on every Google location services user in range of two or more robberies within 30 minutes of the crimes, including innocent bystanders. Despite being served with a search warrant, Google never complied with the demand.
The top legal expert at the American Civil Liberties Union’s Maine chapter said the broad nature of the FBI’s demand creates an “enormous privacy issue.”
“Law enforcement agencies seem intent on finding new ways to use our personal data against us,” said ACLU of Maine Legal Director Zachary Heiden.
The FBI’s New England spokeswoman, Kristen Setera, said the agency could not comment on the data demand because the serial robbery case is still pending in the courts. The perpetrator has pleaded guilty but has not yet been sentenced.
The Forbes article described the demand as “unprecedented,” but prosecutors would neither confirm nor deny that characterization.
This week, an investigation by the Associated Press found that many Google services on Android devices and iPhones store users’ location data even if they’ve chosen a privacy setting that is supposed to prevent Google from doing so.
U.S. Attorney’s Office spokesman Donald Clark indicated that the privacy issue surrounding the FBI’s demand is moot because investigators never received the user data from Google.
“The procedure followed here was to seek a warrant from a United States District Court judge, which was obtained,” Clark said. “And at the end of the day, no information was provided. So whatever privacy issues are implicated, were not.”
SERIAL ROBBER STRIKES PORTLAND
Earlier this year, local police and the FBI were investigating more than a dozen unsolved robberies of small businesses in the Portland area that occurred in March and April over a period of less than a month, including a cluster of four in the span of just over 24 hours.
The unusual rash of robberies alarmed small-business owners and their employees. Police increased their patrols and advised people to comply with the robber’s demands rather than try to resist. Still, some business owners were frustrated and defiant, and one put a loaded gun behind his convenience store counter when the robber hit a nearby shop.
According to a search warrant signed March 30 by Maine U.S. District Judge John A. Woodcock Jr., the FBI demanded that Google, the technology giant based in Mountain View, California, turn over data that would identify any person using Google location services on a mobile device near “two or more of the locations where the robberies occurred at the date and time the robberies occurred.”
Travis Card appears in court for his arraignment on April 17 in Portland. He now faces as much as 20 years in prison and a $250,000 fine for each of 11 robberies or attempted robberies.
The warrant sought comprehensive information on each user, including “full name, physical address, telephone numbers and other identifiers, records of session times and durations, the date on which the account was created, the length of service, the IP address used to register the account, log-in IP addresses associated with session times and dates, account status, alternative email addresses provided during registration, methods of connecting, log files, and means and source of payment, including any credit or bank account number.”
The warrant also included a gag order prohibiting Google from notifying customers about the FBI’s demand for their data.
According to the search warrant return filed with the court Aug. 6, the tech giant never turned over the data.
“Google did not provide information responsive to the warrant,” it says.
Google representatives did not respond Wednesday to a request for comment on why the company did not comply with the FBI’s court-approved demand.
Heiden, the ACLU attorney, said most mobile phone users aren’t even aware that the government wants to be able to use their phones to track their locations.
“We don’t buy these phones and pay the fees to these companies so that the police can track us,” he said.
OTHER MEANS TO CATCH A SUSPECT
A man suspected of being the robber eventually was caught. Westbrook resident Travis Card, 38, pleaded guilty Aug. 2 to 11 of the 14 robberies or attempted robberies. He now faces up to 20 years in prison and a $250,000 fine for each of the 11 crimes.
Card ultimately was identified and apprehended through other investigative methods.
Westbrook police arrested Card on William Clarke Drive on April 13 at 6:30 a.m. on his way to work. He had a family home in Windham but had been staying with his father in Westbrook. A search of the father’s apartment that day turned up a black pellet gun and a pair of work boots that matched footprints at one robbery, according to a prosecution document filed with the court.
The investigators used shoes, surveillance footage, DNA samples and other evidence to tie Card to the crimes. The prosecution document stated that Card robbed eight businesses in March and April: Riverton Gas Station in Portland on March 20; Lil’ Mart Gas Station in Falmouth on March 21; Good Things Variety in Westbrook on March 22; Express Mart in Cumberland on March 22; the Daily Grind in Westbrook on March 24; Subway in Westbrook on March 26; China Eatery in Old Orchard Beach on March 29; and Gulf Mart in Westbrook on April 6.
He left each business with sums of money ranging from $198 to $650, according to court records. The total amount stolen was nearly $3,000.
The prosecution document also states that Card attempted to rob three other businesses: China Taste in Portland on March 25; Aroma Joe’s in South Portland on March 27; and Moby Dick Variety in Old Orchard Beach on April 11. In those incidents, Card left with nothing. At China Taste, a language barrier prevented him from communicating his demands. The clerk at Aroma Joe’s locked herself in a bathroom, while an employee at Moby Dick Variety brandished a club.
During the robberies, Card brandished what appeared to be a firearm. The prosecution document identified it as a black pellet gun.
The investigation did not connect Card to similar robberies at businesses in Auburn, Topsham and Brunswick.
Heiden said it is incumbent upon companies such as Google that amass large amounts of sensitive customer data to ensure that information is protected from overly broad government searches.
The search in this case was extremely broad, he said, covering an area of about 45 hectares that encompasses much of the Portland-South Portland area.
“Having such a broad search means that more and more innocent people – people who have not done anything wrong – were going to have their personal data swept up and turned over to the government,” Heiden said.
Staff Writer Megan Doyle contributed to this report.
J. Craig Anderson can be contacted at 791-6390 or at:
Twitter: jcraiganderson
Send questions/comments to the editors.
