alt Hacker NewsThere is another middle option that I would have liked to see the author discuss: requiring either a case number or a CAD ID, instead of a "search reason".
In my conversations with law enforcement (mostly at management level, chiefs of police), all of them have had reasonable-sounding objections to a warrant requirement for a search, but zero of them have been able to come up with a reason why a case-or-CAD ID requirement isn't workable. Generally, they argue that in practice obtaining a warrant can be too onerous in time sensitive situations, and can be harder to obtain than the public realizes. Two popular examples are in kidnappings (time sensitive) and missing persons (difficult to obtain).
A case number or CAD ID however simply requires that the details of either a public call for service or an active investigation are associated with the historical search. It closes the door on officers' hobby searching.
Andrew's blog post does note the problems with oversight, which also match my experience, so this isn't a perfect fix. But it will go further in conversations with law enforcement for people that are trying to thread the needle on making "safe" mass surveillance.
(I am personally opposed to mass surveillance in all its forms, but arguing only from that position pretty much immediately excludes me from policy discussions.)
Replies
Yeah but that is the exact purpose of the warrant. It's suppose to add friction so you can't do this exact thing, even if it's useful and faster not to.
This is already the current status quo on paper. I bet the majority of the cases IJ identified of mis-use the PDs already had this policy. (That is the same standard when you do a background criminal history check in New York, need to put in a case number, FYI.)
I did not want to go into too many technical details on the post -- I think you could do an AI audit at the point in time of the search query to prevent people putting in junk cases. That said I believe there will always need to be third party audits at a minimum.
Part of the issue is policies on paper are not effectively enforced. So people saying "just have policy X to prevent abuse" is a non-answer.
I wrote the post mainly because people arguing for limited data retention I think is bad for both sides -- it neither protects civil liberties and simultaneously makes it harder for long term criminal investigations.