What happened:
The FBI is the latest government agency to admit that it has purchased the location data of Americans from private companies.
Like the Department of Homeland Security (DHS) and Customs and Border Protection (CBP) before it, the FBI claims that it does not need a warrant to access location data in this way.
The argument goes like this:
- Users have voluntarily provided personal data to tech companies when they accept the terms and conditions on programs such as mobile games and weather apps.
- Tech companies legally sell this information on the open market.
- Therefore, these federal law enforcement agencies are not violating anyone’s Fourth Amendment rights against unreasonable search and seizure.
FBI Director Christopher Wray made the admission during a recent Senate intelligence hearing (52:10).
The FBI has never previously admitted to using this type of data collection.
Wray claims that while the FBI has engaged in this type of warrantless surveillance in the past, it is not currently doing so. And they have no plans to do so in the future.
Why this matters:
This tactic clearly violates the spirit of the law. But the Supreme Court hasn’t specifically addressed whether this violates the letter of the law.
It’s similar to how government agencies partner with big tech and social media companies to censor speech. Clearly, if the government uses its influence to suppress free speech, that is contrary to the First Amendment right.
What you can do about it:
The good news is that you still have control over the amount and type of information you hand over to tech companies.
And you can maintain that control without giving up access to all the conveniences of modern technology.
The first step is to compartmentalize.
This means segregating different areas of your digital life so that they are not all connected.
For example, using different phones is one way to compartmentalize.
One phone could be used to download all the apps you want, understanding that they may be tracking you. This would be your low trust phone you don’t use for sensitive purposes.
Then use a different phone which you take with you to places you don’t want to be tracked.
And while on the go, nobody is forcing you to use Google and Apple maps. There are alternatives which allow you to download maps to navigate offline, while still providing turn by turn directions.
As examples (not recommendations) MagicEarth and OsmAnd each allow you to download maps for offline navigation to enhance your privacy.
You can do the same thing with phone numbers, handing out one for trusted personal contacts, and another whenever you are required to enter a phone number online or in person.
The same goes with email. Services from companies like Protonmail, for example, allow you to create alias email addresses so that you can compartmentalize with a different email address for each online account. If one is compromised, it does not affect the others.
The second step is to use encryption.
VPNs (Virtual Private Networks) create a secure, encrypted tunnel from your device to the VPN provider’s server. Instead of connecting to your ISP (Internet Service Provider) and then to the Internet, a VPN allows you to connect, via an encrypted tunnel, through your ISP to the VPN provider.
That means no one in between you and the VPN provider can see what’s happening inside the tunnel. So if someone is listening in on your local WiFi, or if the government is gobbling up all traffic going through your ISP, you’re protected.
But it’s important to remember the weaknesses of VPNs as well…
You’re essentially trusting that your VPN provider is being honest when it claims to not keep logs of its customers’ internet traffic.
But when using encrypted communications programs with open-source code that anyone can audit, such as the Signal messenger app or Protonmail, you can be sure that no one can intercept your communications.
That’s true as long as you are communicating with someone else using the same program, so that the communications are end-to-end encrypted. But communicating with a Gmail user, for example, means there is no privacy, even if you’re using an encrypted service. Gmail is not encrypted, and it scans messages for advertising purposes.
These are basic steps that can move the needle on protecting your privacy, whether that’s from overreaching government agencies, or any hacker who would do you harm.
We talk about all of this, and much more in two Black Papers on Securing Your Digital Life, available to members of Sovereign Confidential.
In Securing Your Digital Life Part I, we discuss threat modeling (who wants your data?), passwords, private communication solutions, digital payment solutions, and encrypting your online traffic.
In Securing Your Digital Life Part II, we go into backing up and encrypting your data, private phones, and enterprise solutions that allow companies to collaborate, host data, and process payments without relying on (and giving up privacy to) big tech.
