Mike Katz-Lacabe

Mar 302020
 

The Vallejo Police Department cited ferry terrorism as part of its $30,000 grant application for license plate readers, calling the ferry “a viable threat for a terrorist act.”

According to the grant application, the “Grant Funds will be utilized to establish an ALPR [Automated License Plate Reader] camera system for eastbound and westbound traffic lanes approaching the Ferry Terminal, Ferry Terminal Parking Structure and waterfront.”

Two 3M ALPRs on Glen Cove Road in VallejoThe Vallejo Police Department already has a network of license plate readers in locations around the city. Two of Vallejo’s ALPRs can be found on a pole on the west side of Glen Cove Road, at the Vallejo city line just south of Interstate 780. Two ALPRs are located in front of 4325 Sonoma Boulevard and two ALPRs are located on southbound Fairgrounds Drive at Gateway Drive. The six stationary ALPRs were installed in 2015, along with ALPRs on five police vehicles.

According to information provided to the California State Auditor, 102 of the police department’s 150 employees have access to license plate reader data. The Vallejo Police Department’s ALPRs send the collected images and data to the Northern California Regional Intelligence Center (NCRIC), which retains them for one year and makes it available to dozens of other agencies. In the six months from July 2019 to December 2019, Vallejo sent more than 5 million images collected from its ALPRs to NCRIC.

Vallejo Detective Lieutenant Fabian Rodriguez was listed as the applicant for the grant for the project, which was expected to begin on November 1, 2020 and completed by May 1, 2021.

The regional benefit was described as:

ALPR Cameras to Strengthen Information Sharing and Collaboration of data from Vallejo Ferry Terminal. The Ferry Terminal provides daily commuter transportation from Solano County to San Francisco, with commuters from Napa utilizing the ferry for daily transportation to the Bay Area.

The terrorism nexus was described as:

With thousands of commuters utilizing the Vallejo Ferry system each day to travel to San Francisco, the Ferry is a viable threat for a terrorist act. Installing an ALPR camera system in the area of the Ferry Terminal will assist with identifying potentially wanted terrorist suspect vehicles.

On March 12, 2020, the Bay Area UASI Approval Authority approved a $30,000 grant to the Vallejo Police Department for its “Vallejo PD ALPR” project. When we requested a copy of the grant application, the Vallejo Police Department responded that it has “no responsive documents.” The grant application was disclosed pursuant to a public records request to the Bay Area UASI.

Documents:

Mar 212020
 

On the consent agenda for the March 24, 2020, Vallejo City Council meeting is $766,018 to purchase a KeyW cell site simulator.Vallejo Police Department logo

If approved, Vallejo Police would become the fourth local Bay Area law enforcement agency with this device, after the San Francisco Police Department, San Jose Police Department, and the Alameda County District Attorney (which shares its device with the Oakland Police Department and Fremont Police Department). These other agencies own cell site simulators manufactured by Harris Corporation.

The agenda item includes implementation of a usage and privacy policy, but no policy was provided as part of the background material because the policy will be created at the direction of the Chief of Police, and not by the City Council. California’s Electronic Communications Privacy Act, which went into effect on January 1, 2016, requires that a search warrant be obtained before using a cell site simulator.

Policies in the City of Oakland and Alameda County require annual reporting on the usage of their shared cell site simulator. In 2017, the cell site simulator was used three times, in 2018, it was used four times, and it was used once in 2019. Without public input and city council oversight, Vallejo’s policy is unlikely to require any annual reporting.

A cell site simulator pretends to be a cell phone tower, to which cell phones connect in order to initiate a phone call. Once a cell phone connects to the cell site simulator, the cell phone’s IMSI number can be obtained and used to track the location of the cell phone.

According to the staff report, the cell site simulator will be used by the Crime Reduction Team, which is “tasked with the tracking and apprehension of serious violent offenders, covert surveillance during criminal investigations, human trafficking, and other plain clothes investigative operations…” The desire to obtain a cell site simulator appears to be motivated by an unnamed agency assisting Vallejo by using its own cell site simulator. “In November of 2019, an outside agency used a cellular site simulator for the Vallejo Police Department on several occasions.”

The staff report fails to note that cell site simulators can disrupt “the target cellular device (e.g., cell phone) and other cellular devices in the area might experience a temporary disruption of service from the service provider,” according to guidance from the US Department of Justice. In other words, it could interfere with normal operation of other cellular phones and devices near the cell site simulator, including emergency calls.

The staff report claims that “The equipment does not retain data and is not capable of intercepting and listening to calls, text messages, dialed numbers or any other such content.” However, other cell site simulators are able to eavesdrop on calls and messages and are limited only by the installed software, not the hardware’s capabilities.

The $766,018 price includes the following:

  • $415,000 for the base station
  • $1,400 for two Shark Fin antennas
  • $40,000 for five-day on-site training
  • $60,000 for additional two-year warranty
  • $120,000 for standard vehicle integration (a 2020 Chevrolet Suburban)
  • $32,000 for a Trachea 2 device, a stand alone direction finding system
  • $15,000 for two Jugular 4 devices, a handheld direction finding system
  • $17,760 for two Jugular 4 field kits

The vehicle containing the cell-site simulator (a 2020 Suburban) will drive around to track a cell phone to a building or similar area. Then the handheld Jugular 4 or Trachea 2 devices can be used to track a cell phone to a specific apartment of room. Although little is known about these devices, an earlier version of the Jugular was detailed in a document obtained the Intercept. The Jugular 2 was capable of tracking GSM, CDMA, and UMTS cellular signals. The Jugular 4 and Trachea 2 are likely capable of tracking 4G cellular signals.

The Vallejo City Council meeting takes place on March 24, 2020, at 7pm via teleconference. Since there is no physical access for the public to the meeting, members of the public who wish to comment on the item are required to register to use Open Town Hall at http://www.opentownhall.com/8413.

Documents:

UPDATE: On March 24, 2020, the Vallejo City Council unanimously approved the cell site simulator purchase without discussing potential privacy issues or interruption of cell phone service. Oakland Privacy and the EFF have urged that the cell site simulator purchase be nullified because the Vallejo City Council failed to comply with California state law that requires approval of a privacy and usage policy by the local governing body.

Aug 142019
 

Although the Alameda County Sheriff already had a Cellebrite cell phone extraction device it purchased in 2018 for more than $200,000, the Sheriff was recently awarded $30,000 to acquire GrayKey, which has similar functionality.

GrayKey box, from MalwareBytes

The Paul Coverdell Forensic Science Improvement Program grant is funded by the National Institute of Justice, the research, development and evaluation agency of the U.S. Department of Justice. The grant requires that the money be spent by December 31, 2019.

Acceptance of the grant was approved by the Alameda County Board of Supervisors on July 9, 2019.

The grant lists $30,000 for the “GrayKey Forensic Encryption Bypass Tool.” GrayKey is a tool for obtaining access to iPhones that are locked with a passcode or password. GrayKey is a product of GrayShift, a company cofounded by a former Apple engineer.

A May 14, 2019, quote from GrayShift lists the price of the Gray Key device as $500 plus $36,000 for an annual offline license for unlocking an unlimited number of phones. A first-year discount of $500 and a $75 domestic shipping and handling charge brought the total to $36,075.

Since the Cellebrite Universal Forensic Extraction Device (UFED) can access locked iPhones running up to iOS 12.3, it’s not clear why the Alameda County Sheriff felt the need to buy an additional tool to access locked phones. One advantage of the GrayKey is that it’s substantially cheaper than the Cellebrite device.

According to logs provided by the Alameda County Sheriff, its Cellebrite UFED has been used 30 times to attempt to gain access to locked cell phones. Information about whether the attempts were successful was redacted from the logs. The logs also show that Alameda County used its Cellebrite to attempt to unlock phones for the Piedmont Police Department, the Albany Policy Department, the Pleasanton Police Department and the UC Berkeley Police Department.

The Alameda County Sheriff received a grant in 2016 for $219,000 under the California State Homeland Security Grant Program to update its existing Cellebrite device. In its sole source documentation, the Sheriff stated, ” The upgrade is essential to allow the Crime Lab to unlock cell phones for investigative and evidentiary purposes and to extract information used in planning and/or execution of criminal and/or terrorist activities.” The sole source request was approved by the California Office of Emergency Services in a letter dated August 24, 2018.

Cellebrite devices are commonly used by law enforcement agencies to extract data from cell phones and are known to be used by the Alameda County District Attorney, California Department of Justice, Oakland Police Department, and San Leandro Police Department.

Jun 112019
 

According to information released in response to a public records request, the Northern California Regional Intelligence Center collected more than 79.2 million license plate reader records from 32 local law enforcement agencies from June 2018 to May 2019.

Piedmont, a city with about 11,000 people, sent the most data to NCRIC, with more than 22.4 million license plate reader records, which include license plate numbers and photographs of vehicles and their surroundings. Piedmont has more than 30 stationary license plate readers that capture nearly all traffic coming into and out of Piedmont.

In calendar year 2018, Piedmont collected 21.6 million records from its license plate readers and reported 8,120 hits, when a record from a license plate reader matched a list of license plates that includes stolen vehicles, stolen license plates, wanted persons, etc. Using that information, 99.96% of the data collected by Piedmont’s license plate readers is from people who are not suspected of are charged with any crime. That closely matches a similar analysis in 2014 that showed 99.97% of the data collected from Piedmont’s license plate readers did not generate a hit.

Fremont, a city with about 230,000 people, sent 17.7 million records to NCRIC and Vallejo, a city of 120,000 people, sent 15.8 million records to NCRIC.

Other agencies sending more than a million records to the NCRIC each year include the Central Marin Police Authority (Larkspur, San Anselmo and Corte Madera), Daly City, San Francisco, Modesto, Alameda County Sheriff, San Leandro, and South San Francisco.

Other law enforcement agencies use license plate readers from Vigilant Solutions, a private company that collects data from law enforcement agencies and private companies. Data from 2017 indicates that Bay Area agencies in Danville sent 33.4 million license plate records to Vigilant, Pittsburg sent 31.4 million records, Brentwood sent 12.9 million records, and Alameda and Novato each sent 1.6 million records.

Sources:

Mar 172019
 

California Commission on POST training video DVD

The California Commission on Peace Officer Standards and Training (POST) produces training materials for law enforcement agencies in California. Videos are available in DVD format to law enforcement agencies for $99. Through the beauty of the California Public Records Act, below are some of the POST training videos and other police training videos.

Twenty-one training videos from the California Highway Patrol were withheld under California Government Code § 6254 (f) because they were “for Department and/or law enforcement viewing only.”

Aug 042018
 

Many protesters observed the use of multiple drones at the West Contra Costa County Detention Center on June 30, 2018, during a protest against ICE and its practice of family separation. Journalist Darwin BondGraham wrote about this in an East Bay Express article on July 3, 2018. Documents released in response to a public records request indicated that the drone was also flown over the June 26, 2018, protest at the same facility.

The Contra Costa County Sheriff’s drone (or unmanned aerial vehicle/system) program was started in 2016. The agency purchased its first drone on September 7, 2016, a DJI Phantom 4, from Fry’s Electronics on Willow Pass Road for $1,685.14. The drone was returned and exchanged for the same model on September 13, 2016.

Despite the purchase of a drone in 2016, the Contra Costa County Sheriff did not have a policy for drones (referred to as Small Unmanned Aircraft Systems) until January 5, 2017. The policy is “CCCSO General Policy and Procedure Section 1.06.84 – Small Unmanned Aircraft System (sUAS).”

Page 3 of the drone policy lists 10 “authorized missions” for drones, but none appear to cover the large peaceful protests at the West Contra Costa County Detention Center. Retention of data collected by the drones but not of evidentiary value is not detailed in the policy, but is the same as the “CCCSO General Policy and Procedure Section 1.06.82 – Mobile Audio and Body-worn Camera,” which states:

All video/audio recordings that are not booked into evidence in the form of a CD, DVD or other “hard” copy format, will be retained in storage for a period of two years, after which they will be deleted. Recordings relevant to on-going criminal proceedings must be retained for so long as the prosecution is pending.

However, a significant loophole allows indefinite retention of data collected by drones if the Special Operations Division Commander decides that it is useful for “training and development.”

A public records request for copy of any video or photos collected by drones during the June 30, 2018, protest received the following response from the Contra Costa County Sheriff:

With respect to your second and third requests for “All photos and video” taken on June 30, 2018 at the West County Detention Facility, such photos and video, to the extent that they exist or may exist, are subject to the exclusions set forth in the Public Records Act for “security procedures of … or any investigatory or security files compiled by any … local agency for correctional [or] law enforcement … purposes,” and accordingly are not subject to the Public Records Act (Government Code §6254(f)).

On January 10, 2017, Rocky Mountain Unmanned Systems invoiced the Contra Costa County Sheriff $16,574.75 for a DJI Inspire I drone, DJI Zenmuse XT (a thermal imaging camera), DJI Zenmuse Z3 integrated aerial zoom camera, and a variety of related supplies.

Shortly thereafter, on March 1, 2017, the Contra Costa County Sheriff logged its first drone mission, to inspect a landslide on Morgan Territory Road the occurred on February 24, 2017. The second drone mission was also on March 1, 2017, this time for a civil eviction on Byron Hot Springs Road “Due to a history of threats against the police and drug activity.”

The Contra Costa County Sheriff’s log of drone missions details 25 missions from March 1, 2017, to June 30, 2018. The log details DJI Inspire drone flights at the West Contra Costa County Detention Center on June 26 and June 30, 2018. Lt. David Cook requested and approved use of the drone on both days. Deputy Casey Tholborn was the pilot on June 26 and Deputy Hall was the pilot on June 30. The logs refer only to Drone 1, a DJI Phantom 4, and Drone 2, a DJI Inspire 1, despite the eventual purchase of a third drone.

The most recent drone purchase by the Contra Costa County Sheriff was a DJI Phantom 4 from B&H Photo for $899 on March 8, 2018.

Like body cameras, law enforcement agencies have complete control of any data gathered by the drones, so it is unclear how exactly drones are used for peaceful protests, such as the June 26 and June 30, 2018, protests at the West Contra Costa County Detention Center. Without any transparency regarding the use of drones, there will continue to be no oversight and accountability of law enforcement use of equipment that can be and has been used for surveillance.

In addition to the lack of transparency, the federal government has expressed concerns about DJI (Da Jiang Innovations) providing “Critical Infrastructure and Law Enforcement Data to Chinese Government” and the US Army warned to “Discontinue Use of Dajiang Innovation (DJI) Corporation Unmanned Aircraft Systems” based on a May 25, 2017, report by the Army Research Laboratory entitled “DJI UAS Technology Threat and User Vulnerabilities” and a May 24, 2017, US Navy memo entitled “Operational Risks with Regards to DJI Family of Products.”

Jul 092018
 

The Alameda County District Attorney has had a tool for unlocking cell phones since at least 2016. The tool is made by Cellebrite, an Israeli company, that markets tools for extracting data from cell phones to governments, intelligence agencies, and law enforcement agencies.

Cellebrite UFED 4PC

According to a February 2018 Forbes article, Cellebrite can reportedly unlock iPhones up to and including the iPhone X running iOS 11.2.6. However, Apple introduced USB restricted mode in iOS 11.4.1 on July 9, 2018, which may impact Cellebrite’s ability to break into locked iPhones.

The difficulty of law enforcement in obtaining access to locked iPhones has been a regular complaint by the FBI for years. In 2016, Apple refused to create software to defeat the iPhone’s security in order to help the FBI obtain access to San Bernardino shooter Syed Rizwan Farook’s iPhone. The FBI reportedly paid an unknown company to obtain access to the iPhone’s content.

In April 2018, the Washington Post reported that the FBI’s claims that it could not gain access to 7,800 encrypted cell phones was wrong and that the number was likely between 1,000 and 2,000.

Two employees of the Alameda County District Attorney’s Office attended Cellebrite training courses in 2016 and 2017.

Cellebrite billed the Alameda County DA for $1,950 for “CBFL Single Unlock UFED [Universal Forensic Extraction Device]” in June 2017.

In October 2017, the Alameda County DA was billed $10,122.50 to upgrade its UFED Touch 1 to UFED 4PC.

Jun 102018
 

3M P492 license plate readers on Fremont Bouldvard at Enea Terrace

License plate readers on Northbound Fremont Boulevard

According to data from the Northern California Regional Intelligence Center (NCRIC), the city of Fremont collected 14.5 million license plates and photos from license plate readers located throughout the city from December 2016 to October 2017.

The installation of stationary license plate readers was approved by the Fremont City Council on July 14, 2015, without any public comment or discussion during the meeting.

Of the 28 jurisdictions sending license plate reader data to NCRIC, Fremont collects the third-highest amount of data, behind Vallejo (21.7 million) and Piedmont (21.3 million). NCRIC is a regional fusion center that provides a license plate database where agencies can send their collected data. Other agencies, including the IRS, Department of Homeland Security, FBI, National Park Service, California Department of Insurance and others can access this database and search for license plate data.

The license plate reader on westbound Stevenson Boulevard near the entrance to northbound Interstate 880 generates the most data, collecting an average of 14,736 license plates and photographs each day during October 2017.

Although similar statistics are not available for Fremont, analysis of license plate reader data from other jurisdictions has found that 99.7% of the data collected by license plate readers is of people not suspected of or charged with any crime. For Fremont, that means 14,519,834 of the 14,563,525 photos and license plates collected during an 11-month period was of innocent people.

Click here for a map showing license plate reader locations and links to Google Street View images:

Eastbound Auto Mall Parkway at Christy (1): Google Street View

Westbound Mowry Avenue at entrance to Northbound 880 (1): Google Street View

Westbound Decoto Road at entrance to Northbound 880 (1): Google Street View

Southbound Ardenwood Boulevard to Westbound 84 (1): Google Street View

Westbound Stevenson Boulevard at entrance to Northbound 880 (1): Google Street View

Northbound Mission Boulevard at Washington Blvd (1): Google Street View

Southbound Mission Boulevard at Paseo Padre Parkway (2): Google Street View

Northbound Fremont Boulevard at Enea Terrace (2): Google Street View

Camera operated by Pacific Commons Shopping Center at Northbound Christy Street south of Auto Mall Parkway (1): Google Street View

Source documents:

NCRIC ALPR data from December 2016 to October 2017
NCRIC ALPR data from October 2017 to July 2018

Mar 242018
 
On July 31, 2007, the Alameda County Board of Supervisors approved the establishment of “a cash fund in which to deposit donations, sponsorship and exhibitor fees and make payments for associated costs;” for Urban Shield.
Expenses and revenues for that trust fund were received in response to a public records request to the Alameda County Sheriff.
In 2008 and 2009, the Urban Shield trust fund lists $7,634 for legal expenses. However, the nature of those expenses was redacted by the Alameda County Sheriff.
Two round trip tickets to Israel were expended from the Urban Shield trust fund in 2008, but there was no information on who traveled to Israel. In 2010, nearly $75,000 was spent from the Urban Shield trust fund on travel to Israel and Jordan. Travelers included Undersheriff Rich Lucia, Assistant Sheriff Brett Keteles, and Assistant Sheriff Dennis Houghtelling. There was an additional expense of $1,076 for “presentation material for the King of Jordan.’
In March 2011, the Urban Shield trust fund paid for at least two parking citations in Oakland.
In October 2012, the Urban Shield trust fund paid $9,000 to paint humvees, probably the two Alameda County Sheriff humvees with mounted machine guns shown here:
San Francisco Police Department at Urban Shield in 2012
From 2010 to 2016, Urban Shield spent $112,723 on customized Urban Shield coins.
Urban Shield challenge coin
In 2016, the Urban Shield trust fund paid the $500 deductible for a car hit during Urban Shield.
Revenue for Urban Shield comes from vendors at the event and sponsors looking to sell their products to law enforcement.
The largest single contributor was defense contractor BAE with $120,000 in 2009.
Motorola has contributed $74,000 over the years. FLIR Systems has contributed $46,000 over the years.
Other large contributors include Verizon Wireless ($22k), Taser ($38k), Tactical Command Industries ($30k), Sig Sauer ($31k), San Francisco Police Credit Union ($34k), L.N. Curtis and Sons ($45k), Adamson Police Products ($30k) and Corizon ($24k), the controversial provider of health care services at Alameda County’s Santa Rita Jail.
Blackwater Training Center contributed $10k in 2008.
Facebook, which has been in the news recently for its leaks of data on millions of people, contributed a total of $20,000 in 2015 and 2016.
Sources:
Nov 222017
 

The Center for Human Rights and Privacy recently discovered that the Alameda County Sheriff installed a license plate reader at the entrance to Highland Hospital’s emergency room. The information was included in a list of 29 agencies that submit license plate reader to the Northern California Regional Intelligence Center (NCRIC), a local joint fusion center.

However, when the East Bay Times asked about its license plate readers in February 2017, the Alameda County Sheriff’s Office reported that it had about six license plate readers, mounted to patrol cars and didn’t mention the license plate reader at Highland Hospital.

Although the license plate reader was installed as part of an Alameda County General Services Agency project, it appears that the Alameda County Sheriff configured the license plate reader to send its images and data to NCRIC. The Alameda County Sheriff signed a Memorandum of Understanding with NCRIC in October 2014 regarding license plate reader data. According to NCRIC, the Alameda County General Services Agency did not have a MOU with NCRIC as of November 20, 2017.

The license plate reader has two cameras to capture images of vehicles and license plates as vehicles enter the emergency room drop-off area of Highland Hospital from E. 31st Street.

According to information from NCRIC, the license plate reader captured data from 293,148 vehicles from December 2016 to October 2017. Earlier data was not available. Once the information is submitted to NCRIC, it is made available to dozens of agencies, including Immigration and Customs Enforcement (ICE) and Homeland Security Investigations (HSI), which can use it to identify undocumented immigrants for deportation.

The license plate reader was installed as part of a project to replace the Acute Tower at Highland Hospital in 2014. According to a change order for the project, installation of the license plate reader cost $74,622. The license plate reader is from 3M and was previously known as the SpikeHD P382.

In addition to the photos below, the license plate reader can be seen in Google’s Street View.

Alameda Co. Sheriff license plate reader at Highland Hospital

 

Closeup of Alameda Co Sheriff license plate reader at Highland Hospital in Oakland

Coverage in the East Bay Express: Highland Hospital Surveillance Stirs Concerns