Mike Katz-Lacabe

Alameda County Sheriff to Get New Cell Phone Unlocking Tool

 Cell Phone Unlocking  No Responses »
Aug 142019
 

Although the Alameda County Sheriff already had a Cellebrite cell phone extraction device it purchased in 2018 for more than $200,000, the Sheriff was recently awarded $30,000 to acquire GrayKey, which has similar functionality.

GrayKey box, from MalwareBytes

The Paul Coverdell Forensic Science Improvement Program grant is funded by the National Institute of Justice, the research, development and evaluation agency of the U.S. Department of Justice. The grant requires that the money be spent by December 31, 2019.

Acceptance of the grant was approved by the Alameda County Board of Supervisors on July 9, 2019.

The grant lists $30,000 for the “GrayKey Forensic Encryption Bypass Tool.” GrayKey is a tool for obtaining access to iPhones that are locked with a passcode or password. GrayKey is a product of GrayShift, a company cofounded by a former Apple engineer.

A May 14, 2019, quote from GrayShift lists the price of the Gray Key device as $500 plus $36,000 for an annual offline license for unlocking an unlimited number of phones. A first-year discount of $500 and a $75 domestic shipping and handling charge brought the total to $36,075.

Since the Cellebrite Universal Forensic Extraction Device (UFED) can access locked iPhones running up to iOS 12.3, it’s not clear why the Alameda County Sheriff felt the need to buy an additional tool to access locked phones. One advantage of the GrayKey is that it’s substantially cheaper than the Cellebrite device.

According to logs provided by the Alameda County Sheriff, its Cellebrite UFED has been used 30 times to attempt to gain access to locked cell phones. Information about whether the attempts were successful was redacted from the logs. The logs also show that Alameda County used its Cellebrite to attempt to unlock phones for the Piedmont Police Department, the Albany Policy Department, the Pleasanton Police Department and the UC Berkeley Police Department.

The Alameda County Sheriff received a grant in 2016 for $219,000 under the California State Homeland Security Grant Program to update its existing Cellebrite device. In its sole source documentation, the Sheriff stated, ” The upgrade is essential to allow the Crime Lab to unlock cell phones for investigative and evidentiary purposes and to extract information used in planning and/or execution of criminal and/or terrorist activities.” The sole source request was approved by the California Office of Emergency Services in a letter dated August 24, 2018.

Cellebrite devices are commonly used by law enforcement agencies to extract data from cell phones and are known to be used by the Alameda County District Attorney, California Department of Justice, Oakland Police Department, and San Leandro Police Department.

Local Fusion Center Collecting 80 Million License Plate Records Annually

 License plate readers  No Responses »
Jun 112019
 

According to information released in response to a public records request, the Northern California Regional Intelligence Center collected more than 79.2 million license plate reader records from 32 local law enforcement agencies from June 2018 to May 2019.

Piedmont, a city with about 11,000 people, sent the most data to NCRIC, with more than 22.4 million license plate reader records, which include license plate numbers and photographs of vehicles and their surroundings. Piedmont has more than 30 stationary license plate readers that capture nearly all traffic coming into and out of Piedmont.

In calendar year 2018, Piedmont collected 21.6 million records from its license plate readers and reported 8,120 hits, when a record from a license plate reader matched a list of license plates that includes stolen vehicles, stolen license plates, wanted persons, etc. Using that information, 99.96% of the data collected by Piedmont’s license plate readers is from people who are not suspected of are charged with any crime. That closely matches a similar analysis in 2014 that showed 99.97% of the data collected from Piedmont’s license plate readers did not generate a hit.

Fremont, a city with about 230,000 people, sent 17.7 million records to NCRIC and Vallejo, a city of 120,000 people, sent 15.8 million records to NCRIC.

Other agencies sending more than a million records to the NCRIC each year include the Central Marin Police Authority (Larkspur, San Anselmo and Corte Madera), Daly City, San Francisco, Modesto, Alameda County Sheriff, San Leandro, and South San Francisco.

Other law enforcement agencies use license plate readers from Vigilant Solutions, a private company that collects data from law enforcement agencies and private companies. Data from 2017 indicates that Bay Area agencies in Danville sent 33.4 million license plate records to Vigilant, Pittsburg sent 31.4 million records, Brentwood sent 12.9 million records, and Alameda and Novato each sent 1.6 million records.

Sources:

California Police Training Videos

 Police Training  No Responses »
Mar 172019
 

California Commission on POST training video DVD

The California Commission on Peace Officer Standards and Training (POST) produces training materials for law enforcement agencies in California. Videos are available in DVD format to law enforcement agencies for $99. Through the beauty of the California Public Records Act, below are some of the POST training videos and other police training videos.

Twenty-one training videos from the California Highway Patrol were withheld under California Government Code § 6254 (f) because they were “for Department and/or law enforcement viewing only.”

ICE Protests Highlight Contra Costa County Sheriff Drone Program

 Drones  2 Responses »
Aug 042018
 

Many protesters observed the use of multiple drones at the West Contra Costa County Detention Center on June 30, 2018, during a protest against ICE and its practice of family separation. Journalist Darwin BondGraham wrote about this in an East Bay Express article on July 3, 2018. Documents released in response to a public records request indicated that the drone was also flown over the June 26, 2018, protest at the same facility.

The Contra Costa County Sheriff’s drone (or unmanned aerial vehicle/system) program was started in 2016. The agency purchased its first drone on September 7, 2016, a DJI Phantom 4, from Fry’s Electronics on Willow Pass Road for $1,685.14. The drone was returned and exchanged for the same model on September 13, 2016.

Despite the purchase of a drone in 2016, the Contra Costa County Sheriff did not have a policy for drones (referred to as Small Unmanned Aircraft Systems) until January 5, 2017. The policy is “CCCSO General Policy and Procedure Section 1.06.84 – Small Unmanned Aircraft System (sUAS).”

Page 3 of the drone policy lists 10 “authorized missions” for drones, but none appear to cover the large peaceful protests at the West Contra Costa County Detention Center. Retention of data collected by the drones but not of evidentiary value is not detailed in the policy, but is the same as the “CCCSO General Policy and Procedure Section 1.06.82 – Mobile Audio and Body-worn Camera,” which states:

All video/audio recordings that are not booked into evidence in the form of a CD, DVD or other “hard” copy format, will be retained in storage for a period of two years, after which they will be deleted. Recordings relevant to on-going criminal proceedings must be retained for so long as the prosecution is pending.

However, a significant loophole allows indefinite retention of data collected by drones if the Special Operations Division Commander decides that it is useful for “training and development.”

A public records request for copy of any video or photos collected by drones during the June 30, 2018, protest received the following response from the Contra Costa County Sheriff:

With respect to your second and third requests for “All photos and video” taken on June 30, 2018 at the West County Detention Facility, such photos and video, to the extent that they exist or may exist, are subject to the exclusions set forth in the Public Records Act for “security procedures of … or any investigatory or security files compiled by any … local agency for correctional [or] law enforcement … purposes,” and accordingly are not subject to the Public Records Act (Government Code §6254(f)).

On January 10, 2017, Rocky Mountain Unmanned Systems invoiced the Contra Costa County Sheriff $16,574.75 for a DJI Inspire I drone, DJI Zenmuse XT (a thermal imaging camera), DJI Zenmuse Z3 integrated aerial zoom camera, and a variety of related supplies.

Shortly thereafter, on March 1, 2017, the Contra Costa County Sheriff logged its first drone mission, to inspect a landslide on Morgan Territory Road the occurred on February 24, 2017. The second drone mission was also on March 1, 2017, this time for a civil eviction on Byron Hot Springs Road “Due to a history of threats against the police and drug activity.”

The Contra Costa County Sheriff’s log of drone missions details 25 missions from March 1, 2017, to June 30, 2018. The log details DJI Inspire drone flights at the West Contra Costa County Detention Center on June 26 and June 30, 2018. Lt. David Cook requested and approved use of the drone on both days. Deputy Casey Tholborn was the pilot on June 26 and Deputy Hall was the pilot on June 30. The logs refer only to Drone 1, a DJI Phantom 4, and Drone 2, a DJI Inspire 1, despite the eventual purchase of a third drone.

The most recent drone purchase by the Contra Costa County Sheriff was a DJI Phantom 4 from B&H Photo for $899 on March 8, 2018.

Like body cameras, law enforcement agencies have complete control of any data gathered by the drones, so it is unclear how exactly drones are used for peaceful protests, such as the June 26 and June 30, 2018, protests at the West Contra Costa County Detention Center. Without any transparency regarding the use of drones, there will continue to be no oversight and accountability of law enforcement use of equipment that can be and has been used for surveillance.

In addition to the lack of transparency, the federal government has expressed concerns about DJI (Da Jiang Innovations) providing “Critical Infrastructure and Law Enforcement Data to Chinese Government” and the US Army warned to “Discontinue Use of Dajiang Innovation (DJI) Corporation Unmanned Aircraft Systems” based on a May 25, 2017, report by the Army Research Laboratory entitled “DJI UAS Technology Threat and User Vulnerabilities” and a May 24, 2017, US Navy memo entitled “Operational Risks with Regards to DJI Family of Products.”

Alameda County District Attorney Has Cell Phone Unlocking Tool

 Cell Phone Unlocking  No Responses »
Jul 092018
 

The Alameda County District Attorney has had a tool for unlocking cell phones since at least 2016. The tool is made by Cellebrite, an Israeli company, that markets tools for extracting data from cell phones to governments, intelligence agencies, and law enforcement agencies.

Cellebrite UFED 4PC

According to a February 2018 Forbes article, Cellebrite can reportedly unlock iPhones up to and including the iPhone X running iOS 11.2.6. However, Apple introduced USB restricted mode in iOS 11.4.1 on July 9, 2018, which may impact Cellebrite’s ability to break into locked iPhones.

The difficulty of law enforcement in obtaining access to locked iPhones has been a regular complaint by the FBI for years. In 2016, Apple refused to create software to defeat the iPhone’s security in order to help the FBI obtain access to San Bernardino shooter Syed Rizwan Farook’s iPhone. The FBI reportedly paid an unknown company to obtain access to the iPhone’s content.

In April 2018, the Washington Post reported that the FBI’s claims that it could not gain access to 7,800 encrypted cell phones was wrong and that the number was likely between 1,000 and 2,000.

Two employees of the Alameda County District Attorney’s Office attended Cellebrite training courses in 2016 and 2017.

Cellebrite billed the Alameda County DA for $1,950 for “CBFL Single Unlock UFED [Universal Forensic Extraction Device]” in June 2017.

In October 2017, the Alameda County DA was billed $10,122.50 to upgrade its UFED Touch 1 to UFED 4PC.

Fremont: 14.5 million vehicles scanned in 11 months

 License plate readers  No Responses »
Jun 102018
 

3M P492 license plate readers on Fremont Bouldvard at Enea Terrace

License plate readers on Northbound Fremont Boulevard

According to data from the Northern California Regional Intelligence Center (NCRIC), the city of Fremont collected 14.5 million license plates and photos from license plate readers located throughout the city from December 2016 to October 2017.

The installation of stationary license plate readers was approved by the Fremont City Council on July 14, 2015, without any public comment or discussion during the meeting.

Of the 28 jurisdictions sending license plate reader data to NCRIC, Fremont collects the third-highest amount of data, behind Vallejo (21.7 million) and Piedmont (21.3 million). NCRIC is a regional fusion center that provides a license plate database where agencies can send their collected data. Other agencies, including the IRS, Department of Homeland Security, FBI, National Park Service, California Department of Insurance and others can access this database and search for license plate data.

The license plate reader on westbound Stevenson Boulevard near the entrance to northbound Interstate 880 generates the most data, collecting an average of 14,736 license plates and photographs each day during October 2017.

Although similar statistics are not available for Fremont, analysis of license plate reader data from other jurisdictions has found that 99.7% of the data collected by license plate readers is of people not suspected of or charged with any crime. For Fremont, that means 14,519,834 of the 14,563,525 photos and license plates collected during an 11-month period was of innocent people.

Click here for a map showing license plate reader locations and links to Google Street View images:

Eastbound Auto Mall Parkway at Christy (1): Google Street View

Westbound Mowry Avenue at entrance to Northbound 880 (1): Google Street View

Westbound Decoto Road at entrance to Northbound 880 (1): Google Street View

Southbound Ardenwood Boulevard to Westbound 84 (1): Google Street View

Westbound Stevenson Boulevard at entrance to Northbound 880 (1): Google Street View

Northbound Mission Boulevard at Washington Blvd (1): Google Street View

Southbound Mission Boulevard at Paseo Padre Parkway (2): Google Street View

Northbound Fremont Boulevard at Enea Terrace (2): Google Street View

Camera operated by Pacific Commons Shopping Center at Northbound Christy Street south of Auto Mall Parkway (1): Google Street View

Source documents:

NCRIC ALPR data from December 2016 to October 2017
NCRIC ALPR data from October 2017 to July 2018

Urban Shield Trust Fund paid for trips to Israel, parking tickets and paint jobs

 police militarization  3 Responses »
Mar 242018
 
On July 31, 2007, the Alameda County Board of Supervisors approved the establishment of “a cash fund in which to deposit donations, sponsorship and exhibitor fees and make payments for associated costs;” for Urban Shield.
Expenses and revenues for that trust fund were received in response to a public records request to the Alameda County Sheriff.
In 2008 and 2009, the Urban Shield trust fund lists $7,634 for legal expenses. However, the nature of those expenses was redacted by the Alameda County Sheriff.
Two round trip tickets to Israel were expended from the Urban Shield trust fund in 2008, but there was no information on who traveled to Israel. In 2010, nearly $75,000 was spent from the Urban Shield trust fund on travel to Israel and Jordan. Travelers included Undersheriff Rich Lucia, Assistant Sheriff Brett Keteles, and Assistant Sheriff Dennis Houghtelling. There was an additional expense of $1,076 for “presentation material for the King of Jordan.’
In March 2011, the Urban Shield trust fund paid for at least two parking citations in Oakland.
In October 2012, the Urban Shield trust fund paid $9,000 to paint humvees, probably the two Alameda County Sheriff humvees with mounted machine guns shown here:
San Francisco Police Department at Urban Shield in 2012
From 2010 to 2016, Urban Shield spent $112,723 on customized Urban Shield coins.
Urban Shield challenge coin
In 2016, the Urban Shield trust fund paid the $500 deductible for a car hit during Urban Shield.
Revenue for Urban Shield comes from vendors at the event and sponsors looking to sell their products to law enforcement.
The largest single contributor was defense contractor BAE with $120,000 in 2009.
Motorola has contributed $74,000 over the years. FLIR Systems has contributed $46,000 over the years.
Other large contributors include Verizon Wireless ($22k), Taser ($38k), Tactical Command Industries ($30k), Sig Sauer ($31k), San Francisco Police Credit Union ($34k), L.N. Curtis and Sons ($45k), Adamson Police Products ($30k) and Corizon ($24k), the controversial provider of health care services at Alameda County’s Santa Rita Jail.
Blackwater Training Center contributed $10k in 2008.
Facebook, which has been in the news recently for its leaks of data on millions of people, contributed a total of $20,000 in 2015 and 2016.
Sources:

Alameda County Sheriff Installed License Plate Reader at Highland Hospital Emergency Room Entrance

 License plate readers  No Responses »
Nov 222017
 

The Center for Human Rights and Privacy recently discovered that the Alameda County Sheriff installed a license plate reader at the entrance to Highland Hospital’s emergency room. The information was included in a list of 29 agencies that submit license plate reader to the Northern California Regional Intelligence Center (NCRIC), a local joint fusion center.

However, when the East Bay Times asked about its license plate readers in February 2017, the Alameda County Sheriff’s Office reported that it had about six license plate readers, mounted to patrol cars and didn’t mention the license plate reader at Highland Hospital.

Although the license plate reader was installed as part of an Alameda County General Services Agency project, it appears that the Alameda County Sheriff configured the license plate reader to send its images and data to NCRIC. The Alameda County Sheriff signed a Memorandum of Understanding with NCRIC in October 2014 regarding license plate reader data. According to NCRIC, the Alameda County General Services Agency did not have a MOU with NCRIC as of November 20, 2017.

The license plate reader has two cameras to capture images of vehicles and license plates as vehicles enter the emergency room drop-off area of Highland Hospital from E. 31st Street.

According to information from NCRIC, the license plate reader captured data from 293,148 vehicles from December 2016 to October 2017. Earlier data was not available. Once the information is submitted to NCRIC, it is made available to dozens of agencies, including Immigration and Customs Enforcement (ICE) and Homeland Security Investigations (HSI), which can use it to identify undocumented immigrants for deportation.

The license plate reader was installed as part of a project to replace the Acute Tower at Highland Hospital in 2014. According to a change order for the project, installation of the license plate reader cost $74,622. The license plate reader is from 3M and was previously known as the SpikeHD P382.

In addition to the photos below, the license plate reader can be seen in Google’s Street View.

Alameda Co. Sheriff license plate reader at Highland Hospital

 

Closeup of Alameda Co Sheriff license plate reader at Highland Hospital in Oakland

Coverage in the East Bay Express: Highland Hospital Surveillance Stirs Concerns

Solano County Sheriff Gets Initial Funding for Project Skynet

 License plate readers, Video surveillance  2 Responses »
Aug 052017
 

With a nod to Terminator’s self-aware computer network, the Solano County Sheriff in Northern California has applied for and received partial funding for Project Skynet, a network of surveillance cameras and automated license plate readers (ALPRs). Project Skynet would install 160 ALPRs and 124 surveillance cameras at 66 locations throughout Solano County. In its response to a request for public records, Daniel Wolk, Deputy County Counsel for Solano County noted, “this is at the proposal stage and specifics, including camera locations, have not been decided upon.”

Map of Phase I Camera/ALPR Locations

Map of Phase I Camera/ALPR Locations

Like the ring of stationary ALPRs around the City of Piedmont, the goal of the project is to capture images and video of all vehicles entering and exiting Solano County. According to a Microsoft PowerPoint presentation prepared by the Solano County Sheriff’s Office, the surveillance cameras would be capable of pan-tilt-zoom and data from the ALPRs and cameras would allow “real time information or years of past history.” The UASI grant application states, “In addition to the direct connection this project has with observing and locating terrorists, it also allows law enforcement to monitor human trafficking. I-80 is a major artery for drugs and human trafficking which are major funding sources for terrorism, from the west coast to the east.”

As with all grant applications to the Urban Areas Security Initiative, the project must have a nexus to terrorism. In its proposal for a Homeland Security Grant, the Solano County Sheriff writes, “We will be able to…locate persons and vehicles associated with terrorist threats, disrupt terrorist financing…” However, given that terrorism is extremely rare, this surveillance network is more likely to be used against pedestrian suspected criminal activity.

The PowerPoint document states, “There are 36 (666) locations, many of which are large freeways and near impossible to watch at once.” “666” is a police code for a county-wide emergency or be-on-the-lookout (BOLO). However, the grant application and approval documents cite 35 locations.

On July 13, 2017, the Bay Area Urban Areas Security Initiative (UASI) Approval Authority approved funding of $104,590 towards the $2 million total cost of Project Skynet.

Bay Area UASI Approval slide

The estimated $2 million cost for Project Skynet is broken down into phases with an estimated cost of $535,000 for Phase I, $568,000 for Phase II, and $895,000 for Phase III. Data from the ALPRs would be stored at the Northern California Regional Intelligence Center (NCRIC), the local joint fusion center that shares license plate reader data with dozens of local, state, and federal agencies.

The NCRIC stores license plate reader data for dozens of local law enforcement agencies and as of April 2015, stored 46.5 million records, which includes license plates and photographs of vehicles, including the occupants and surrounding area with geolocation data.

Harris’ Aerial Surveillance System Demonstrated at Urban Shield 2015

 Video surveillance  No Responses »
Oct 252016
 

Harris Corporation demonstrated its CorvusEye aerial surveillance system at the annual Urban Shield event organized by the Alameda County Sheriff’s Office in 2015. The aerial surveillance system was used as part of a water supply sabotage scenario at Dunsmuir Reservoir in Oakland.

The CorvusEye aerial surveillance system was developed by defense contractor Exelis, which Harris Corp. purchased in 2015. According to Harris’ web site, CorvusEye can provide continuous monitoring and tracking over a 2.7 square mile (7 square km) are during the day and 1.2 square miles (3.1 square km) at night.

Harris’ CorvusEye is a competitor to the system marketed by Persistent Surveillance Systems, which has been used to secretly monitor Baltimore and Compton, in Los Angeles County.

The surveillance footage provided by Harris Corp. to Urban Shield included Dunsmuir Reservoir, Interstate 580, Dunsmuir House and residential areas of Oakland and Sheffield Village. In an email dated September 9, 2015, a Harris Corporation marketing manager describes the video as “a live view of the reservoir showing 5 terrorists moving around on the reservoir.”

Harris CorvusEye

Click here for the video provided by Harris Corporation.

Harris also made a pitch for providing security for Super Bowl 50 at Levi’s Stadium:

Obviously, our team is interested in having CorvusEye help out with Super Bowl security. We’d love to sit down with him and his team to demo the footage we captured last month…is there any way you can make an introduction for us and perhaps set up quick 10-15 minute meeting to introduce him to CorvusEye?

A lieutenant from the Alameda County Sheriff’s Office responded with an offer of help:

I will do whatever I can to get you guys into the presentation on the Super Bowl. The folks from Santa Clara and Levi stadium will be at the VIP dinner Friday night. I will be there as well. Although I have not met these folks myself, let’s team up and track them down for a conversation! I have your back!

The details of how the CorvusEye surveillance systems works are explained in this video, produced by Exelis:

The annual Urban Shield event is an opportunity to introduce weapons, technology, and products developed for military and intelligence application to local law enforcement agencies.

Source material: Emails between Harris Corporation and Alameda County Sheriff’s Office

 

 Older Entries  Newer Entries