“Anonymity is a shield from the tyranny of the majority,” wrote Supreme Court Justice John Paul Stevens in a 1995 ruling affirming Americans’ constitutional right to engage in anonymous political speech.
That shield has weakened in recent years due to advances in the surveillance technology available to law enforcement. What used to be a manual process is becoming increasingly automated, making mass deanonymization of protesters, even those taking active steps to hide their identities, possible.
Controversies about facial recognition and masking may dominate the news, but there are a plethora of surveillance methods that law enforcement can deploy to gain insight into peoples’ identities, communications, and purchases. Almost everyone in modern life, and that includes protesters, continuously oozes data that reveals sensitive aspects of their life. Everything from social media posts, to metadata about phone calls, to the purchase information collected by data brokers, to location data showing every step taken, is available to law enforcement — often without a warrant.
Check out our investigation into how these digital data trails complicate politicians’ efforts to prohibit protesters from wearing masks at public demonstrations.
Incoming President Trump has sworn that he will pursue various groups like his political enemies or immigrants, and could use the expansion of the national surveillance state for his own purposes.
Avoiding all of this tracking would require such extrication from modern social life that it would be virtually impossible for most people. That said, some simple steps could help in not becoming the lowest hanging fruit, like leaving a cell phone behind. Understanding more about what technologies the local police force has access to can also inform how a community approaches surveillance and safety issues.
Here are just some of the technologies law enforcement can use to surveil protesters.
Stingrays (a.k.a. IMSI Catchers or Cell Site Simulators)
What is it?
International Mobile Subscriber Identity (IMSI) catchers, or Stingrays, impersonate cell phone towers to collect the unique ID of a cell phone’s SIM card. These IDs allow law enforcement officials to request additional information from phone carriers, matching devices with owners’ names, addresses, and location histories.
Stingrays help law enforcement to collect data even without a warrant. Since the technology has the capability to collect information about all the phones in an area, it's an ideal method for identifying people en masse.
While some cities, like New York, have published guidelines on how IMSI catchers can be deployed, others have been less forthcoming — even lying to judges to conceal their use of the technology.
Who sells it?
The name “Stingray” is the name of a specific device made by L3Harris (formerly known as Harris), but has now colloquially become the generic term for all cell site simulators. IMSI catchers are sold by many other companies, like Digital Receiver Technology.
Can it be circumvented?
Apple and Google, which control the operating systems of nearly all smartphones in the U.S., have begun preventing cell phones from dropping down from more advanced and protected network protocols, like 5G, to less secure 2G networks, which are necessary for IMSI catchers to function.
Protesters are also often advised to either put their phones on airplane mode, which shuts down any cellular connections, or just leave their devices at home.
Some groups are trying to develop workarounds to allow phone communication at protests without the need to connect to a cellular network — although research suggests that sort of mesh network communication may not be the most secure either.
Tushar Jois, a City College of New York computer science professor studying privacy, is working on one such app called Amigo. He recommends using end-to-end encrypted chat messaging platforms (like Signal), encrypting the data on your phone and in the cloud, as well as enabling settings like Apple’s Lockdown Mode, which enhances the device’s security. Still, nothing beats leaving the phone at home.
Geofencing
What is it?
Geofence warrants, also known as reverse location warrants, are a type of search warrant that lets law enforcement request location data from apps on your phone or tech companies, about all the devices or users in a certain area within a specified time frame. Geofence warrants are being increasingly used on protesters, with evidence of the technique being deployed to identify people demonstrating against the police shooting of Jacob Blake in Kenosha, Wisconsin and the students who marched in protest of a statue of a Confederate soldier on the campus of the University of North Carolina.
These warrants don’t target a specific person or suspect. Instead, they ensnare all devices in a particular area at a particular time. Not only can law enforcement track devices’ locations and identify users, they can also gather other data, like social media accounts.
Critics argue the technology is overly broad, making suspects out of anyone in the general vicinity of a crime scene. In 2011, a federal judge agreed, rendering geofence warrants unconstitutional, but that ruling was later overturned. This past summer, a Fifth Circuit U.S. Court of Appeals judge ruled that geofence warrants constituted an unreasonable search, making them illegal in Texas, Mississippi and Louisiana.
Who sells it?
Geofencing itself isn’t a technology, so there is no vendor to provide protester data to law enforcement. Instead, these warrants are served to companies that collect location data, like Apple or Google.
Can it be circumvented?
As with IMSI catchers, protesters trying to evade this kind of surveillance either have to leave their phones at home, turn off location tracking services, or use airplane mode. However, if a phone connects to a nearby Wi-Fi signal, its location can still be recorded.
Historically, Google has been a major recipient of these information requests. Google revealed more than 25% of the warrants it received in 2020 were geofence warrants, constituting more than 10,000 requests. Google’s transparency reports do not specify what percentage of the geofence warrants it received that resulted in the company handing over data.
Data Brokers
What are they?
Data brokers are companies that assemble information about people from a variety of usually public sources. Tons of websites and apps that everyday people use collect information on them, and this information is often sold to third parties who can aggregate or piece together someone’s profile across the sites that are tracking them to create a more comprehensive look into their lives. These companies mostly function to sell data about people to advertisers, but law enforcement is also able to purchase such information.
Who sells it?
Companies like Fog Data Science, LexisNexis, Precisely and Acxiom possess not only data on billions of people, they also promote the fact that they have information about someone’s political preferences as well as demographic information about them. Fog Data Science boasts it also has near real time access to users’ geolocation, just because applications often collect this information. By aggregating on various advertising ID’s across various platforms, these companies can understand not only your daily routines and travel, but also where you sleep.
Can it be circumvented?
Short of living off the grid, it can’t, sorry. Welcome to 2024.
In order to get around this kind of surveillance, people would not only need to be regularly changing out their credit cards and website accounts, they’d need to avoid traceable transactions by paying for everything in cash. Data brokers also ingest public government data, so unless someone is entirely off the grid, these firms will likely have something on almost everyone.
Social Media Monitoring
What is it?
Reports of social media surveillance go back over a decade, when law enforcement was reportedly tracking social media sites like Tumblr and Myspace, and Facebook — frequently utilizing networks of fake accounts. More recently, companies like Dataminr have been used to surveil protests, including the George Floyd demonstrations.
There are several tech companies helping law enforcement sift through the “firehose” of social media posts. One firm advertised the ability to help police identify “activists and disruptors” at protests.
Social media gives law enforcement a lot of information about how people are connected to each other, where they are posting from, and what they are posting — whether public or not. Meta sued one social media monitoring company for creating over 38,000 fake accounts on Facebook to collect data on more than half a million of the platform’s real users, including even private posts.
Surveillance of social media accounts allows police to gather vast amounts of information about how protests are organized. Former Chicago Mayor Lori Lightfoot, claimed, “proactive monitoring will provide the crucial information our public safety agencies need in order to be aware of planned activity as early as possible and to enable them to respond quickly and appropriately.”
Who sells it?
Companies operating in this space include Dataminr, Babel Street, and Voyager Labs. Geofeedia used to be a go-to tool for law enforcement to gain insight into the social media lives of Americans, until Facebook, Twitter, and Instagram blocked access to their feeds in 2017. A few years ago, the FBI purchased 5,000 licenses for Babel Street’s system for gathering information from a plethora of social media platforms. .
Can it be circumvented?
Avoiding social media monitoring services can be accomplished by simply logging off, though admittedly this is often easier said than done.
Pictures and other information posted to Instagram or the social network formerly known as Twitter contain metadata, information embedded in images or videos with data about the user’s location or device.
At the very least, privacy advocates recommend waiting to post to social media until you are at a different location, avoiding pictures with people’s faces or other potentially identifying personal information, not posting overly sensitive information about yourself or others and stripping images of their metadata before posting.
Gait Recognition Technology
What is it?
The idea that animals can be identified by how they move about the world has been around since Aristotle.
Capturing a human’s gait on camera started in the 1970s for medical purposes. More recently, by analyzing how a person moves, police use gait recognition technology to, for example, identify a person by their footprints, even if their face is obscured, or they are facing away from the camera. Just last year, a distinctive gait helped law enforcement identify a man accused of robbing casinos in Las Vegas.
In recent years, Chinese law enforcement authorities have employed software to automate the gait recognition process. While there isn’t conclusive evidence of its use in the US as a prepackaged technology, its principles have been applied in the field of forensic gait analysis or forensic podiatry.
Who sells it?
In the U.S., this process has, thus far, been exclusively manual — with forensic podiatry experts assisting law enforcement by analyzing people’s gaits from CCTV camera footage. But it’s likely only a matter of time until the type of gait recognition software utilized in China makes its way across the Pacific. A technology company called Prove has developed a product that lets someone’s distinctive walk act as a key, allowing them entrance into secure locations.
Can it be circumvented?
It’s difficult to intentionally change one’s gait, so other than affecting a silly walk or taking a movement lesson from Dune, avoiding posting video of people moving around during a protest is the only suggestion given by privacy advocates.
Automated License Plate Readers
What is it?
Automated license plate readers (or ALPRs) are specialized cameras, installed in most major American cities, that log the license plates of every car that passes by. Some are stationary, while others can be installed on police vehicles. ALPRs can track a car’s movement through an area, or tell police officers all the cars that crossed a certain checkpoint during a certain period of time.
Who sells it?
Vendors include companies like Motorola or Flock Safety. The latter also offers a host of other plug-and-play surveillance tools for law enforcement. Motorola is able to pair its surveillance with other datasets, like auto repossession data collected by partner companies, to provide more information to its customers. Other firms in the space include Axon, Rekor, Leonardo, Jenoptik and Perceptics.
Can it be circumvented?
Since obscuring a car’s license plate is illegal, protesters can only be sure to avoid ALPRs by taking public transit, biking or walking. However, certain forms of public transit payments can be tracked, as can walking (using gait analysis techniques).
Camera Systems: Drones, Private and Commercial CCTVs, and Body Cameras
What is it?
Drones are unmanned aerial vehicles, often equipped with sensors like IMSI catchers or video cameras. Some cities are beginning to use drones as first responders, visiting potential crime scenes before law enforcement arrives. Several protesters have also reported noticing drones flying overhead during demonstrations. Recently, police in upstate New York used a drone to solve a case of collegiate art theft.
Private retailers, like Target, have been aiding law enforcements’ video surveillance capabilities by installing their own cameras not only inside retail stores, but around the surrounding neighborhood as well. For example, if a protester ducks into a Target before attending a protest, it might be caught on camera and turned over to police.
Private residence doorbell cameras, like Amazon’s Ring, have also attracted attention for their partnerships with police, though earlier this year the company changed its policy of complying with warrantless requests for footage.
Body cameras are small recording devices that are usually worn by law enforcement officials. While they are often used to hold officers accountable to the community, they can also be used to identify individuals. California temporarily prohibited facial recognition being used on body camera footage, but the ban expired last year.
Vendors
Drone vendors include Motorola and Axon, both of which also provide body cameras to police.
Private retailers’ camera systems come from a multitude of companies, but those feeds are often combined by technologies like Axon’s Fusus, which bills itself as a “real-time crime center surveillance platform.”
Can it be circumvented?
Those who are at a protest where a drone is being flown will likely be captured on the drone’s cameras. Using a face covering, like a mask, is of increasingly limited value as governments across the country pass mask bans and law enforcement’s facial recognition tools become more able to discern identities of masked individuals.
Biometric Identification
What is it?
Biometric surveillance technologies use physical characteristics to identify people, with data ranging from their tattoos to iris scans to DNA database matching.
Software that detects and logs physical biometric data can be run on previously captured video feeds or even pictures posted on social media.
Tattoo recognition technology is being rapidly improved upon both in the private and public sphere. Federal agencies like NIST have held competitions to help them develop state-of-the-art identification algorithms, and conducted research to find tattoo recognition applications for law enforcement. The Arizona Department of Public Safety has a system it uses to identify tattoos from a database with more than a million photos they acquired from “criminal booking procedures.”
Who sells it?
Companies like Idemia, Dataworks, Rank One Computing, and Neurotechnology are other examples of vendors that help law enforcement with biometric identification.
In 2020, IBM announced it would stop offering facial recognition software, citing civil rights concerns. “IBM firmly opposes and will not condone uses of any technology, including facial recognition technology offered by other vendors, for mass surveillance, racial profiling, violations of basic human rights and freedoms, or any purpose which is not consistent with our values,” wrote IBM CEO Arvind Krishna wrote in a letter to Congress.
Can it be circumvented?
Like avoiding other kinds of physical identification, privacy advocates recommend wearing clothing that covers any identifiable markings like tattoos. But since these physical markers are unique and usually impossible to change, they are an added cause for concern.
