What Can Police Do With Your Cell Phone Data?

In Wisconsin, the issue of how police use cell phone data gathered during investigations rests in a gray area. On the one hand, data extracted from modern cell phones can offer invaluable insights for any criminal investigation. On the other, those efforts can veer into a constitutional no-man’s-land — a place where advances in every-day technology outpace our fundamental expectations of privacy.

The Wisconsin Supreme Court recently considered the issue in  the case of George Burch, upholding Burch’s homicide conviction despite the fact that it relied on cell phone data extracted and then kept after another, unrelated incident. Officers of the Green Bay Police Department (GBPD) had investigated Burch for a hit-and-run crash back in 2016, downloading the entire contents of his phone. The officers were unable to link Burch to the crash, and the case closed. Two months later, however, the Brown County Sheriff’s Office sought Burch’s phone data for an unrelated murder investigation.

Using that data, which it obtained without a warrant directly from the GBPD, Brown County charged Burch with first-degree intentional homicide. Brown County initially approached Green Bay PD after DNA from the murder victim’s sock led the police to Burch. Brown County detectives saw that Burch’s phone contained 64 internet viewings of news stories about the victim’s death. The data also showed that Burch had a Google-associated email address. Detectives used the Google location data to place Burch’s phone at a bar with the victim on the night of her death.

The case raised many novel questions about the intimate nature of data stored on modern phones. Everything can be in your phone from medical data to personal insurance and job information, passwords to online accounts, bank information, call logs and cell tower pings, as well as pictures and messages. Only part of that information would be relevant to any given law enforcement investigation. In Burch’s case, Green Bay officers were interested in his text messages, but they held onto the entire contents of his phone.

On Oct. 14, the Wisconsin Justice Initiative published an analysis of the Supreme Court decision in Burch’s case. The majority opinion was written by Justice Brian Hagedorn. The Justice Initiative analysis sports the tell-all header: “It may be unconstitutional, but really, it’s fine.”

In his opinion rejecting Burch’s appeal, Hagedorn wrote, “We conclude that even if some constitutional defect attended either the initial download or subsequent accessing of the cell phone data, there was no law enforcement misconduct that would warrant exclusion of that data. Therefore, we conclude the circuit court correctly denied Burch’s motion to suppress that data.”

Hagedorn added that, “even if the Sheriff’s Office’s actions could be labeled as some kind of misconduct, nothing they did would rise beyond mere negligence. In addition, the societal cost of excluding the cell phone data would far outweigh any deterrence that exclusion might provide.”

But in her dissent, Justice Rebecca Dallet wrote that neither Burch nor any other reasonable person could have realized what consenting to police reviewing specific text messages could lead to.

“No reasonable person in Burch’s position would have understood that his consent to the GBPD was an open invitation for any other law enforcement agency to search his private information whenever it wanted to and without a warrant,” said Dallet. “Therefore, the consent exception to the Fourth Amendment’s warrant requirement does not apply to the Sheriff Offices’ subsequent warrantless search of Burch’s private cell phone data for an unrelated investigation. That search was unreasonable and violated the Fourth Amendment.”

How are Badger State cops handling data retention?

The Wisconsin Examiner reached out to the Green Bay police department, the Brown County Sheriff’s Office, and numerous other agencies to determine how data retention and sharing is being handled in Wisconsin,  how long police can store data after an investigation is closed and what rules exist around sharing that data.

Capt. Ben Allen of the Green Bay PD confirmed that his department “retains all extractions/forensic evidence files for long-term storage. The extractions/forensic evidence files are retained as evidence and department policy regarding storage of evidence is followed.” Allen added that there’s no time limit on  how long a department can retain extracted phone data. He said that, “extractions can be shared with other departments and can be shared after an investigation has closed.”

It was a point echoed by Sgt. Michael Luell, public information officer for the Racine County Sheriff’s Office. “Data needs to be retained after an investigation is ‘closed because a convicted suspect could appear their convictions and/or the information could be used in subsequent (currently unknown) criminal investigations,” said Luell. “There is no time limit to the retention of collected data. However, data is normally destroyed after a suspect has served their sentence.”

Capt. David Poteat, director for the Brown County Sheriff Office’s Investigative Division, acknowledges the legal questions surrounding data retention. “Let me first say that technology changes rapidly and some changes made by companies aren’t always transparent,” Poteat told Wisconsin Examiner. “What works for us today may change next year or next week. In contrast, jurisprudence changes slowly, especially case law surrounding Fourth Amendment searches of electronic devices. These are questions that have not been answered by the courts or certainly not conclusively and there is conflicting guidance coming from courts across the country. We rely on the [District Attorney’s] office, [Attorney General’s] office and [US Attorney’s Office] to guide our best practices.”

Poteat explained that data extraction requests are made based on consent from the device’s owner, or a search warrant. In Burch’s case, the Supreme Court found Brown County investigators “reasonably relied on” a Green Bay PD consent form signed by Burch for the crash investigation. In the case of a warrant, however, a certain scope can be established for what can be seized. That principle is put to the test, however, when comparing warrants for say, a house, and a warrant for phone data.

“If you were looking for a 60-inch TV, you couldn’t open drawers or the refrigerator during the search. You could search a walk-in closet but not the shoe boxes that are in the closet,” explained Poteat. By contrast, “electronic devices are different, data is stored as ones and zeros and can’t be searched in the same way a house could be. In other words, we can’t limit what we copy or extract because data may be broken up and stored in different locations. It would be like trying to identify specific words in a book without reading any other words.”

Sometimes computer forensic analysts copy a device’s contents and then make a report of items which fall within the scope of a given warrant. “That report will include things that aren’t necessarily relevant to the investigation but were within the scope of the search,” said Poteat. “Anything that was not in the scope of the search would not be included in the report.”

Some of the  departments contacted by Wisconsin Examiner stated that policies around data retention are largely based on how other evidence is handled. The Milwaukee Police Department stated, “We comply with all state and local retention requirements.” The department attached a copy of its Standard Operating Procedures for record retention which can range from paper and books to micofilm, CDs and DVDs, sound recordings, maps, blueprints, and emails among other examples.

Luell stated that Racine County is currently updating their own policies regarding property destruction. “This proposed policy does not (currently) specifically address collected data,” he said. “However, we have been instructed by our DA’s office that we may destroy electronic evidence after a suspect has served their sentence.”

Lt. Joseph Nosalik, of the Kenosha Police Department, also sent his agency’s policies on evidence control and destruction. “There is well established state law that dictates evidence retention requirements related to criminal investigations/prosecution,” Nosalik told Wisconsin Examiner. Milwaukee PD’s records division, and administrative services for the Kenosha Police Department, handle evidence destruction for their respective agencies.

Sgt. David Wright of the Kenosha County Sheriff’s Office explained that evidence is handled through the Kenosha County Joint Evidence Services Department, which sets its own policies. He added that, “from what I have been told, once the case has been settled our evidence department through Kenosha Joint Services will retain data extraction evidence for a minimum of seven years.” Brown County’s Capt. Poteat stressed that an investigation closing does not mean evidence gets purged.

“We retain the extraction until it is no longer needed, which is the standard for any evidence,” he told Wisconsin Examiner. “No longer needed for the investigation, prosecution, or for any appeal or possibility of a new trial. This is often years after the case is closed but it could be disposed of earlier if there is an agreement by both parties or an order from the court. The type of crime is relevant to when we dispose of evidence. In the case of a homicide, we retain evidence for 100 years. SANE [Sexual Assault Nurse Examination] Kits are retained for 50 years. Other evidence is generally retained until the statute of limitations has expired, the defendant has served their sentence, or the time for appearing has expired. There is no time defined limit on how long we can retain extracted data.”

Sgt. Abby Pavlik of the Wauwatosa Police Department noted that “digital data is retained under the same guidelines as physical data. We follow Wisconsin statute as it pertains to maintaining evidence. Retention times for evidence varies on the severity of the incident/crime. We do share evidence with other agencies as it pertains to investigations and there is no time restriction on that provided we still retain the evidence.” She added, “if another agency requested evidence that we had previously collected, as part of their investigation, we would typically share that evidence.”

Similarly, Racine County Sheriff’s have similar sharing practices. Luell explained that the office will, “share information with another law enforcement organization that is conducting an investigation upon request or when [Racine County Sheriff’s Office] has determined that criminal acts have occurred in that other law enforcement organization’s jurisdiction.” He noted that another agency, “may also obtain a search warrant to review our files.”

“Records can be released with a simple public records request,” said Julie Laundrie, records custodian for the Madison Police Department. “Obviously phone extractions can often contain personal information including GPS data and all of their personal contacts, photos, messages, etc. Current public law and precedent as well as the balancing test would apply to any public records request. I am not an attorney, but I would expect that an [law enforcement] agency could also procure phone data from a different [law enforcement] agency by order of the court.”

Wisconsin’s Department of Justice (DOJ) once considered all data to be a record. “Recently, a decision was made to now classify some data as evidence,” explained spokesperson Samantha Standley. Files that are created when data is extracted from a cell phone or hard drive are considered evidence. But after an examiner gathers those files and places them on a USB flash drive and gives it to a law enforcement agency, it is considered a record.

DOJ relies on the evidence policies of its Division of Criminal Investigation (DCI) to determine how long data can be retained. “For external agencies, we will rely on their recommendation as to when the data can be purged,” said Standley.

How is it done?

To extract data, DOJ and many other agencies utilize devices or services including Cellebrite or Graykey. Whereas Cellebrite once dominated the law enforcement landscape for cell data extraction, Graykey came on the scene within the last decade. Graykey, a device produced by the company Grayshift, was pushed as a new way to break into passcode protected Apple smartphones. Recently, Grayshift also began developing spyware tools which can remotely record a passcode. However, police must first physically seize the phone in order to download the spyware onto a target phone.

Standley stated that the Wisconsin DOJ uses both Cellebrite and GrayKey, “in addition to several other digital forensic tools.” Milwaukee PD’s fusion center, which acts as an intelligence-gathering hub for all of southeastern Wisconsin, and Green Bay PD also utilize GrayKey. The Brown County Sheriff’s Office, Kenosha County Sheriff’s Office, and Green Bay PD told Wisconsin Examiner that they utilize Cellebrite. Captain Allen of Green Bay also mentioned other tools utilized by his department including, “AXIOM, Paladin, FTK Imager, Recon ITR, etc.”

Luell noted that Racine County Sheriff’s Internet Crimes Against Children unit has a computer analyst with Cellebrite software. “We also have professional relationships with other law enforcement organizations that allow us, at times, to request use of GrayKey,” he explained. “These organizations include DCI and HIDTA.”

Kenosha PD’s Lt. Nosalik, declined to answer the direct question, stating, “There is a lot of available information on what type of extraction devices/software is used to retrieve data from cell phones. We have nothing that is not known to the public.”

Many fear that local departments have attempted to access phones seized during Black Lives Matter protests last year. The owners of these phones did not consent for their phones to be seized or searched by law enforcement. During a curfew in the City of Milwaukee last summer, County Supervisor Ryan Clancy was arrested by officers despite being exempt from arrest as an elected official. While he was detained, Clancy said officers wanted to access his phone.

In another case, Taleavia Cole, the sister of Alvin Cole, a teenager killed during an officer-involved shooting in 2020, was arrested during protests after a curfew declaration in Wauwatosa alongside her mother by members of Wauwatosa’s Special Operations Group and federal officers with a U.S. Marshals Task Force. Following her arrest on Oct. 8, Cole was detained at the Waukesha County Jail while her phone was taken back to Wauwatosa.

After 22 days, the phone was returned to Cole on Oct. 30. Unlike many protesters who had their phones eventually returned to them, Cole’s phone wasn’t released until court actions by her attorneys. Court filings state that while the phone was in WPD’s possession, Cole’s Instagram and other social media disappeared. Her iCloud account, which had personal information and attorney-client privileged documents, was also tampered with, her attorney’s claimed. Internal WPD emails show that Cole’s phone was separated from the others seized during the curfew.

Several protesters whose phones were seized during Wauwatosa’s curfew say that police sought warrants to access the phones. The court awarded Cole $300, the maximum amount allowed in this type of civil case for unlawful seizure.

What can the police do with your phone data? was originally published by the Wisconsin Examiner.