Focus on Law Enforcement

The ready accessibility of location information not only opens up new service opportunities; it provides new options for law enforcement, public safety, and security. The example of emergency calling has already been covered in quite some detail. For law enforcement and public safety uses, the privacy implications are not as well defined.

When and how location information can be given to the police and similar agencies is important to consider. One critical consideration in this area is how legislation provides for privacy overrides, that is, the agency can acquire location regardless of the wishes of the individual being located, and the individual is not even aware that they are being located.

HELD, with the additional identity parameters (as described in Appendix E), can be used by a law enforcement or public safety agency to request location information of an LIS based on a public identifier, such as an IP address. This form of request permits an instant response from an LIS, without the knowledge of the user.

Obviously, location can be a powerful tool for law enforcement, and it opens a number of possibilities for locating or tracking criminals. Controlling when this is permitted becomes an important question, a question that must be resolved in legislation. Legislation constrains law enforcement agencies by stating under what circumstances location information can be acquired. These constraints specify what conditions must be satisfied, whether permission needs to be sought, and whether the attempt must be publicly recorded. For instance, a court order might be required, which could, in turn, require evidence suggesting criminal activity or an imminent threat to public safety.

The use of information for public security and law enforcement is also subject to different legislative constraints than for standard social and commercial use. Local legislation varies greatly in this area, and some aspects relating to location are untested. Location can be covered under different laws depending on whether it is considered real-time information or recorded data (tracked by mobile phone).

Regardless of what local laws dictate, the availability of location information will guarantee its desirability for law enforcement. The implications for privacy depend on local legislation.

Location Acquisition Challenges for Law Enforcement

Assuming that a Law Enforcement Agency (LEA) is able to acquire appropriate permission as mandated by local legislation, determining location without knowledge of the target presents a number of challenges.

Initially, the target is usually only identified by a transitory identifier. An IP address or a TCP connection rarely remains static for any considerable period of time. Therefore, where these are the only identifiers available, they need to be acted upon quickly.

An IP address can be traced to its end-point; however, there are a number of measures that can be used to obscure the true source of messages. Internet traffic can be forwarded through a proxy, which masks the true source address. Many services like this exist, or the proxy might be run by a friend, or on a compromised machine. Virtual Private Networks (VPNs), which are commonly used by corporations for remote access, also provide a similar problem.

Assuming that the actual address of a target can be determined, the LIS that serves that address needs to be identified. This can be possible using DNS in the same fashion that a device would be used to determine the location of the LIS. Again, this step can be thwarted if the access network only makes their LIS and the associated DNS records available to users within the access network.

Once the LIS has been identified, assuming that the LIS is subject to the jurisdiction of the LEA, a request can be made using the IP address as a key. The LIS can then use whatever network-based methods it has to determine the location of the target.

An alternative method for acquiring location relies on knowing the presentity of the target. Knowing a presentity means that the LEA can request location information, along with other presence information, directly from the presence service. This assumes that location information is available to the presence service-that is, the target has provided the presence service with location information or a location URI.

One reason that a presence service is less useful in this situation is that a presence service is not necessarily located in the same physical region as the target. Where the access network requires physical presence in order to provide access, the presence service does not have this constraint. This can mean that the presence service is not within the jurisdiction of the LEA, so a request for location by the LEA may not be honored.

As has been a general theme in this book, the challenges before the LEA essentially arise from the service-provider access-provider decoupling. When an LEA asked for a conventional wireline phone tap, they applied the warrant against the telephone company. The telephone company provided the voice service to be monitored; the target identity was well understood as the telephone number to be tapped, and the telephone company owned the access network which physically needed to be tapped. Further, since the access network was in the jurisdiction of the LEA and, because the service provider was also the operator of the access network, the provider of the service to be tapped was also guaranteed to be in the same jurisdiction. This didn't change completely with mobile telephony. The network provider and the voice service provider remained one and the same; placing a tap on the service was still a matter of applying the warrant to the same operator against a given phone number. However, a flavor of what was to come with Internet services was provided with mobile telephony. GSM networks and other modern cellular standards support global roaming. It became possible, for example, to purchase a prepaid service from a foreign network operator. The user could operate their phone on that subscription while on a local cellular network. For the LEA, placing a warrant on the foreign service provider was not necessarily practical, not least because none of the voice data of interest would actually be visible to that operator. Similarly, placing a warrant on the local cellular network operators meant dealing with a user identity that was not under their control; their network equipment may not have even been able to intercept the necessary data.

At least in the preceding cellular scenario, user identity is still transferred from the home to the visited network in the form of subscriber profiles being read from the HLR into the VLR. This is done for authentication purposes primarily related to the need to ensure that billing charges are appropriately transferred. In the Internet, even this tenuous link is finally lost. Internet access is a purchasable service in itself. The user acquires it independently of the services that can be reached on the Internet. User identity from the access provider perspective is limited to that which may need to be authenticated for the purposes of billing the access alone. The only access identity that the remote Internet-based services see is the relatively anonymous IP address and, as described earlier, even this may have been obfuscated by the time the service sees it.

In the final analysis, the challenge for the LEA comes down to this: A choice has to be made to monitor the broadband access that the target is using and to acknowledge that obtaining content directly from a service provider is not always feasible. The warrant goes against the access provider who is in the jurisdiction of the LEA. The identity of the user is the login and authentication information that the network provider allocates to them. The service content becomes the equivalent of the voice content that was monitored and recorded in the traditional telephone tap. Untangling the many streams of application data, and decoding them is the difficult part. If the user moves to a different access network-such as a free public hotspot-their identity is lost; it is the analog of moving to a public phone box.

Location in this perspective is mostly of interest in mobile broadband access networks. As long as the target's authentication identity is known and a warrant can be placed on the operator of that network, then the IP location infrastructure described in this text, together with the necessary privacy controls described in this chapter, will permit lawful intercept of the location information.