Boulder County used opioid settlement money to buy controversial phone-hacking tools

Sunday, Feb. 26, 2023

Last month, Boulder County spent the first of what it hopes will be millions of dollars for the treatment and prevention of drug addiction, courtesy of lawsuits against the drug manufacturers, distributors and pharmacies that helped fuel America’s opioid epidemic. 

Among the spending was money for controversial yet widely used technology to gain access to locked cell phones and computers. Law enforcement officials argue such products are necessary to find and prosecute drug dealers, whose illegal enterprises have produced an ever-mounting body count. 

Yet the increasing usage of such products has occurred largely without public knowledge and debate, or corresponding evolution of regulation to protect against potential abuse — a chief concern of privacy experts and human rights groups who warn the tools are an unprecedented, unchecked expansion of police power.

“There’s this really remarkable power that police have that can be used quietly and silently,” said John Davisson, senior counsel for Washington, D.C.-based Electronic Privacy Information Center. “It’s really putting a lot of power into the hands of law enforcement.”

Crucial tool for catching drug dealers

Spending on mobile device forensics tools, or MDFTs, as they’re known, represents just a sliver of Boulder County’s opioid settlement spending so far: $81,250 — 4.5% of an $1.8 million total first funding round — went to purchase products from Cellebrite and GrayKey, which unlock Android and Apple/iOS products, respectively, and Nighthawk and Magnet Forensics, which assembles extracted data into a readable format and “puts it all together in a pattern,” according to Boulder County Sheriff’s Office Sergeant Jeff Pelletier, who presented on the purchases at a December meeting of Boulder County’s Regional Opioids Council. 

The equipment will go to Longmont Police Department’s Special Investigations Unit, which handles narcotics investigations and Boulder County’s Drug Task Force, which serves the same function for most of the county, excluding Longmont and Louisville. A third Cellebrite device will go to Boulder County’s Digital Forensics Lab, which aids in investigations for the entire county.

It will supplement existing equipment and, law enforcement officials hope, relieve a backlog at the forensics lab. 

“There’s usually a line of homicides and other investigations needed,” Goldberger said. “Sometimes those overdose crimes get trumped.”

The lab processes phones and other electronic devices for law enforcement agencies throughout the county. Its work has expanded along with the proliferation of cell phones.

“Every crime, you pretty much guarantee there is at least one digital medium there that could help in an investigation,” Goldberger said. “We get called out, go to a scene, 90%-plus of the time, we come into contact with a phone or computer.”

“Pretty much everything you can think of,” Pelletier said during his December presentation,  “there’s digital evidence.”

The tools are especially critical in combating drug trafficking, Goldberger said, because of the information they can reveal about where drugs were purchased. 

“An example would be, hypothetically I have a drug dealer who is selling thousands of fentanyl pills,” he said. “Usually, business is done on a phone or a computer. In order to see where his dealers are or to see his supply, we need to have access to that device.”

Searches using MDFTs on suspects are conducted after obtaining a warrant, Goldberger said. The exceptions are searches performed on the devices of deceased overdose victims. 

“Technically there’s no expectation of privacy on a device” of a dead person, Goldberger said, “so a warrant would not be used in most cases.” 

Extraction technology is crucial, Goldberger said, because while a warrant allows law enforcement to possess a device, it does not compel its owner to grant access to it. MDFTs bypass the mechanisms that lock a phone, whether passcodes or biometric protections like face or thumbprint recognition.

The technology has already helped secure convictions against drug traffickers locally, Goldberger said, including one case that involved an overdose fatality.

“The drug task force currently has 18 active overdose investigations related to people who have passed, or overdosed and survived,” he said. “This is bettering our chances of having a successful investigation to hopefully catch the suppliers or dealers.”

It can also help in the county’s ongoing fentanyl crisis, Assistant District Attorney Ken Kupfner told the opioids council in December. Records taken from cell phones can identify “where these drugs are coming from and what it’s being marketed as,” he said, since dealers often cut other drugs with fentanyl to maintain or enhance their potency at a lower cost.

“There’s fentanyl in everything, from Xanax to cocaine to meth. I receive a call from the coroner’s office in every death involving overdose or poisoning. My first question is always the same: Do we have a device, and are we able to get into it?” 

Vague state language leaves door wide open

A single line in Colorado’s 75-page framework for settlement spending does allow for law enforcement-related purchases. “Law enforcement expenditures relating to the opioid epidemic,” is an allowed use under the “Additional Areas” category — that is, neither treatment nor prevention.

The purchases could also be considered prevention, local officials argued during a December meeting of Boulder County’s Regional Opioids Council.

“These are viewed as a prevention (tool),” said Kelly Veit, strategic implementation manager for BROC.  They do “tend to prevent the proliferation of these drugs more broadly.”

It is unclear if any other communities used their respective funds to purchase similar technology. Two regions — 3, covering Weld County, and 19, which encompasses nine counties in southeast Colorado and includes the cities of Pueblo and Trinidad — did include unspecified criminal justice enforcement spending in their requests, according to the state’s settlement distribution dashboard.

Region 3’s plan lifts language directly from state guidelines, allocating $136,234 for “law enforcement expenditures relating to the opioid epidemic.” Region 19 intended to spend $270,000 for “criminal justice recovery to be done within the allowable uses of the grant,” with a formal proposal process determining what those eventual programs and expenditures will be.

A representative from Region 19 agreed via email to send the “list of first-year funding so far,” but had not provided it as of the publication of this article. Region 19 will make its second round funding decisions Monday, the spokesperson wrote.

A Region 3 representative did not respond to a request for comment.

The technology has yearly licensing fees, totalling thousands of dollars. Opioid funds could potentially be used to cover these costs into the future.

That’s exactly what Goldberger is hoping for.

“Hopefully as long as the regional opioid council concurs,” he said, “they will keep funding us for this recurring cost.”

Tools used in ‘the worst of the worst’ way

Extraction tools are already widely in use across Colorado. An October 2020 report from nonprofit advocacy group Upturn found more than a dozen agencies employing them, including the Colorado State Patrol, Denver PD, and law enforcement in Broomfield, Fort Collins, Colorado Springs, Wheat Ridge, Golden, Adams County, Arapahoe County and the city of Aurora.

That report, titled Mass Extraction: The Widespread Power of U.S. Law Enforcement to Search Mobile Phones, also found that law enforcement agencies across the country use MDFTs — often without a warrant — for a variety of crimes: the drug trafficking and more serious offenses touted in defense of such tools, but also low-level crimes like graffiti, vandalism, public intoxication and traffic violations.

Extraction products can pull everything from a phone or electronic device: emails, texts, usage data from apps, activity from social media accounts, geo-tagged photos and even deleted data. Once assembled, this massive amount of information can track an individual’s movements and map out their social networks.

“The result: protections guaranteed by the Fourth AmendmentChange made to existing documents, resolutions, or ordinances are made meaningless,” report authors wrote.

Because of this, Upturn recommended banning the use of consent searches — when a person allows the police to search their phone voluntarily, without a warrant. Many people may be unaware that such technology exists, or ignorant to its vast capabilities. 

“They go beyond what a police officer would be able to see if you unlocked your phone for them manually,” said Riana Pfefferkorn, a research scholar with the Stanford Internet Observatory, who has written about security concerns with Cellebrite following multiple hacks of its data. “They can pull deleted data, metadata that’s not readily available to a naked eye. 

“It’s way more intrusive than a search would be that was done manually.”

In particular, the ability to construct “social graphs” has been used in nefarious ways around the globe, including tracking political dissidents as well as asylum seekers and refugees. The U.S. Department of Immigration and Customs Enforcement has multi-million dollar contracts with Cellebrite, an Israeli-based company that has also been criticized for selling its technology to authoritarian regimes.

Domestically, EPIC’s Davisson worries about the role MDFTs can play in a post-Roe country to surveil reproductive choices, or to exacerbate law enforcement’s well-documented history of tracking political activists.

“If you use this tool to fight drug trafficking, that is all well and good,” Pfefferkorn said. “But what we see with technologies like this is they invariably get used outside of the worst of the worst context.” 

Little to no oversight, accountability

Adding to the potential for abuse is an extreme lack of oversight. The Upturn report found that very few departments have crafted specific policies for the use of MDFTs — such as limiting when and on what types of crimes they can be used — or the data they extract.

“Nearly 90% of the departments that responded to our records requests give their officers wide discretion to use MDFTs and the phone data they collect,” authors wrote. “Even when policies exist, they are often remarkably vague. … We rarely saw any detailed guidance on concerns related to digital searches, such as the scope and particularity of searches, and the retention and use of extracted data.”

Because proprietary software is used to extract and compile data, the public is reliant on law enforcement agencies to accurately report how and when such searches are being made, and whether or not applicable laws were followed. But reporting requirements are scarce.

“There is almost no public accounting of how often or in what kinds of cases law enforcement use these tools,” authors wrote. 

Upturn recommended that law enforcement be required by law to “document a chronological record of all interactions that law enforcement had with the software, such as how they browsed through the data, any search queries they used, and what data they could have seen.”

The group would also like to see requirements to delete data after 30 days if it is not relevant to the objectives of a specific warrant. That would prevent law enforcement from building surveillance networks or engaging in what’s known as parallel construction, wherein a case is built by first obtaining evidence illegally, then reconstructing it with legally obtained evidence. 

Pfefferkorn’s own wish list for MDFT regulation includes laws governing the secondary market.

“Past generations of forensics tools end up on eBay, in the hands of people who are not law enforcement,” she said. “Then they are susceptible to falling into the very hands that are supposed to be getting investigated.

“It’s difficult to put the genie back in the bottle. There are all of these guardrails that could at minimum be placed on this technology.”

Law outpaced by technology

Such guardrails are lacking locally. County officials were unaware of any policies crafted specifically for MDFTs. 

“We are unfamiliar with any policies that specifically address data extraction,” Boulder County Sheriff’s Office spokesperson Carrie Haverfield wrote via email.

“The county utilizes data loss prevention programs and auditing procedures, including audits logs, but does not use screen recording, “Haverfield wrote. And while Goldberger said the sheriff’s officer produces annual reports on how many devices were searched by the forensics lab, Haverfield wrote that, “the county does not produce or maintain annual cybersecurity reports.”

In interviews, followup emails and public statements, officials indicated that they rely on existing laws and policies to govern the use of data extraction tools. Goldberger referenced evidence collection and retention requirements in response to questions about data usage and storage, including laws specific to body-worn camera footage. Haverfield provided a link to the sheriff office’s policies. 

“There’s a legal basis for every single thing that we do,” Kupfner told the opioids council in December. 

There are indications that extracted data is being used locally to build multiple cases from a single search. At the BROC meeting, Sergeant Pelletier said the technology “allows investigators to perform some link analysis” to “maybe point out other potential victims.” Separately, Goldberger also referenced the technology’s ability to identify multiple overdose victims using information from one device.

In two separate interviews, Goldberger repeated numerous times that officers follow all existing state and federal laws, including Fourth Amendment protections against unlawful search and seizure. He insisted that priority for MDFT use is placed on crimes related to “life and safety.”

“There is no sneaky or ill intent when we do our investigation,” he said. “ We’re doing it above board, we’re following the law. We just don’t play in that blurred area.”

But critics insist that existing laws — written for physical searches — are insufficient. 

“As is common with technology,” Pfefferkorn said, “the technology has gotten out ahead of the regulation.”

“It’s a ‘shoot first, ask questions later’ approach of ‘Let’s get more surveillance tech and see what we could do,” Davisson said. 

“It feels darkly ironic that a settlement that arises out of these really harmful phenomenon of opioids that has caused so much pain and death and heartbreak, that the public benefit of that is being funneled into surveillance tech that is then being turned back on a lot of the same people that are suffering from the use of opioids.”

No pushback from public officials

It’s unclear what if any discussions on MDFTs occurred at the state level when crafting guidelines for opioid settlement money. A spokesperson for the Colorado attorney general’s office was unable to provide information in time for this article to be published.

The merits of extraction tools also do not appear to have been debated locally. BROC’s December discussion centered solely over the use of settlement funds for tools with general criminal justice applications.

Law enforcement officials stressed the severity of the local drug crisis, their presentation peppered with stories of overdose deaths.

“I have been begging the task force … We have to have the ability to process these devices quickly” to understand where drugs are coming from and how they are being marketed, assistant DA Kupfner said.

“Waiting months and months for a device to be processed — we’re too far behind the curve if we identify those things three months, six months down the road.”

Of the 25 programs BROC supported with the first round of funding, Goldberger said, “this is the only one aimed at stemming the flow of narcotics into our community.”

Boulder County Commissioner Claire Levy and Boulder City Manager Nuria Rivera-Vandermyde were the only two members to raise — as Levy put it — “questions about whether this is the right pot of money.” Both couched their queries, which were met with arguments from law enforcement officials about why the devices were necessary.

“You’ve made a very good case for the need for these tools, but I am having trouble matching that up with my understanding on what we’re supposed to be spending opioid settlement money on,” Levy said, “which is harm reduction.”

“I want to make clear that my questions are not because I don’t think it’s a good tool for law enforcement; I think it is,” Rivera-Vandermyde said. “I’m struggling to put together why these funds are the right funds. Once you have this equipment, you can use it for any type of intervention that requires the unlocking of a device” whether opioid related or not. 

“Again, I am a supporter of law enforcement,” she concluded. “I have no doubt the tools are used appropriately.”

— Shay Castle, @shayshinecastle or on Mastodon at toot.bldrweb.org/@shayshinecastle

Help make the Beat better. Was there a perspective we missed, or facts we didn’t consider? Email your thoughts to boulderbeatnews@gmail.com

Governance Police Axiom Big Pharma Boulder County Boulder County Digital Forensics Lab Boulder County Regional Opioids Council Boulder County Sheriff BROC Cellebrite city of Boulder city of Longmont Claire Levy Colorado Attorney General data extraction drug addiction drug manufacturers drug trafficking Electronic Privacy Information Center GrayKey ICE Immigration and Customs Enforcement law enforcement Longmont Police Department Mobile Digital Forensic Tools NightHawk Mobile Nuria Rivera-Vandermyde opioid crisis opioid epidemic Stanford Internet Observatory Upturn