Skip Navigation

Suggested Results

See All Search Results
Donate

Suggested Results

See All Search Results
Donate
Resource

Law Enforcement Access to Smart Devices

More and more devices are becoming part of the ‘internet of things.’ Here’s what they are, what they collect, and what police might get.

December 21, 2020
Government Power
December 21, 2020
Government Power
Preface

This resource details the potential privacy issues for numerous internet-connected devices. They include connected cameras (doorbells, indoor, and outdoor cameras), smart speakers and digital assistants, physical activity trackers, thermostats, in-car systems, and automated license plate readers.

The summaries include how the devices work and who makes them, what kinds of data are collected and how long it’s retained, possible uses of device data by law enforcement, transparency reports, and relevant legal cases and further reading.

The resource is a companion to our related expert brief, which covers privacy and civil rights concerns, the legal frameworks for data access, how law enforcement access works in practice, and conclusions about how to improve privacy protections.

I. Connected Cameras (Doorbells and Indoor and Outdoor Cameras)

How they work and who makes them

  • How they work: Connected cameras record preset areas in and around a home.1 These recordings are stored online and can be retained, clipped, and shared based on the user’s settings and subscription model.2 Recordings can be accessed via a mobile app, home console, or other personal device.3

    Connected cameras can be set to trigger alerts that are delivered to the device owner and other users.4 These can be based on facial recognition, motion triggers, or other settings selected by the person or persons who control the device.5

  • Who makes them: Companies selling this technology include Google (Nest), Amazon (Ring), SimpliSafe, eufy, and Arlo.

What kinds of data are collected and how long data is retained

  • Data about the owner: Name, home address, locations where the cameras are placed, and credit card information may be stored by these connected cameras.6 In some situations, users can also share their social media handles, demographic information, interests, hobbies, gender, and age.7
  • Data about others: Video and audio recordings of residents, guests, employees, service workers, and others who may enter the camera’s capture radius can be captured and stored. Depending on where a camera is placed, it may also record events that occur on the streets and even in homes surrounding the device — for example, when the camera can see a neighbor’s window.
    • Companies such as Google and eufy offer facial recognition data that captures “face images and underlying face prints,” allowing device owners to track anyone that comes into contact with the camera.8
    • Companies such as SimpliSafe also maintain lists of the number of adults and children living in a home, as well as the name and telephone number of a friend or family member to be alerted in case of an alarm.9
    • Companies also capture a running list of motions and alerts, including which camera captured the information; the date and time; environmental data such as the temperature of the device and ambient light sensors; and technical information such as the model and serial number, software version, and Wi-Fi signal strength.10
  • Retention: The retention period for footage may depend on the plan obtained by a user. For example, Nest Aware Plus stores 60 days’ worth of “event video” (recordings triggered by activity that a camera detects) history in the cloud, and stores 24/7 recordings for a period of 10 days.11 By comparison, some companies offer local retention using traditional memory cards which can store months’ worth of recordings but would not be directly available to anyone other than those with access to the physical card.12

Law enforcement access

  • Access via user: The person purchasing the cameras can choose to share recordings directly with law enforcement.
    • Companies like Ring partner with law enforcement to simplify requests for camera recordings, including offering advice on best practices to successfully request footage.13 Ring facilitates police requests through the app’s Control Center, though users can disable this feature so they do not receive law enforcement requests.14
    • Law enforcement may also be able to access videos that users share to public channels. For example, Ring has a feature that allows users to share clips to public social media, which are then available to any viewer, including law enforcement.15
  • Access via device manufacturer: Law enforcement can request access to data directly from the company.
    • Compelled Disclosure: Depending on factors such as the sensitivity of the data or if a request relates to the content of communications, a warrant or subpoena may be legally required. Company privacy policies typically note that they will disclose user data where required by law.16 However, in situations where legal obligations are unclear, it may be up to the company to make individual decisions about whether to push back against an overbroad request.
    • Voluntary Disclosure: Company privacy policies note that in situations such as emergencies or when the company believes it is necessary to protect against harm to the rights, property, or safety of the company, its users, or the public, they may voluntarily hand over data to law enforcement.17 However, depending on the nature of the company and the specific functionality of their product, there may be no legal restrictions that limit a company’s voluntary disclosure of data to law enforcement.

Possible uses of device data by law enforcement

  • Review video and audio recording of an incident.
  • Review footage of a person or their car or other mode of transportation.
  • Establish a relationship between people and between a person and a given residence.
  • Evaluate a person’s alibi or version of events.
  • Run still images through police facial recognition systems.

Transparency reports

  • Google and Amazon publish summaries incorporating all disclosures of user data into an overall report that gives numbers across each company’s entire suite of products. These documents do not break down the number of law enforcement requests for data from connected cameras or specify the type of data provided.18
    • Transparency reports do not account for situations where users voluntarily turn over data to law enforcement. 
  • SimpliSafe, Arlo, and eufy do not publish transparency reports.

Relevant legal cases and further reading

II. Digital Assistants

How they work and who makes them

  • How they work: Digital assistants are voice-enabled devices that perform a variety of tasks based on preset commands.1 They can be used to perform internet queries, display connected camera streams, control speakers and television sets, and more.2 Amazon allows users to set up their devices to detect sounds such as smoke alarms or glass breaking, and they can be programmed to “deter” unwanted visitors by turning on lights or playing the sound of a dog barking.3
  • Who makes them: Some of the companies selling this technology include Google (Google Assistant), Amazon (Alexa), and Apple (Siri). They integrate this technology into a variety of different hardware devices, such as the Google Nest Hub, Amazon Echo, and Apple HomePod.

What kinds of data are collected and how long data is retained

  • Data about the owner: Voice recordings, name, address, email address, nickname, telephone number, credit card information, and more.4 Digital assistants may also access location history, search history, device contacts, website activity, calendar data, and more.5
  • Data about others: Voice recordings of individuals who interact with the digital assistant or whose voices are audible in a recording.
  • Retention: Amazon retains voice recordings and transcripts indefinitely, until a user deletes them.6 Google says that it does not retain audio recordings by default; users can elect to store recordings and can set up automatic deletion.7 Apple stores recordings using a random identifier for six months (making it difficult to connect the recordings to a person’s account) and then stores them without any identifier for up to two years.8

Law enforcement access

  • Access via user: Law enforcement can ask the owner of the device to turn over data voluntarily.
  • Access via device manufacturer: Law enforcement can also request access to data directly from the company.
    • Compelled Disclosure: Depending on factors such as the sensitivity of the data or if a request relates to the content of communications, a warrant or subpoena may be legally required. Company privacy policies typically note that they will disclose user data where required by law.9 However, in situations where legal obligations are unclear, it may be up to the company to make individual decisions about whether to push back against an overbroad request.
    • Voluntary Disclosure: Company privacy policies note that in situations such as emergencies or when the company believes it is necessary to protect the rights, property, or safety of the company, its users, or the public, the company may also voluntarily hand over data to law enforcement.10 However, depending on the nature of the company and the specific functionality of their product, there may be no legal restrictions that limit a company’s voluntary disclosure of data to law enforcement.

Possible uses of device data by law enforcement

  • Identify a suspect, victim, or witness through voice recordings.
  • Evaluate a person’s alibi or version of events.
  • Establish a relationship between people and between a person and a given residence.

Transparency reports

  • Amazon, Google, and Apple publish summaries incorporating all disclosures of user data into an overall report that gives numbers across each company’s entire suite of products. These documents do not break down the number of law enforcement requests for data from digital assistants or specify the type of data provided.11
    • Transparency reports do not account for situations where users voluntarily turn over data to law enforcement.

Relevant legal cases and further reading

III. Activity Trackers

How they work and who makes them

  • How they work: Activity trackers are personal devices that are used to track an individual’s movements and health data. This data can be accessed via a mobile application or other personal device.1
  • Who makes them: Companies selling this technology include Fitbit, Garmin, Amazon, and Apple.

What kinds of data are collected and how long data is retained

  • Data about the owner:
    • Name, email address, mailing address, phone number, and payment information.31
    • Location data derived from GPS signals, device sensors, Wi-Fi access points, cell tower IDs, and IP addresses.32
    • Steps traveled, calories burned, weight, heart rate, sleep stages, and time spent in movement.33
  • Retention: Varies by device, but many companies retain data as long as they consider a user to have an active account.34

 Law enforcement access

  • Access via user: Law enforcement can ask the owner of the device to turn over data voluntarily.
  • Access via device manufacturer: Law enforcement can also request access for data directly from the company.
    • Compelled Disclosure: Depending on factors such as the sensitivity of the data or if a request relates to the content of communications, a warrant or subpoena may be legally required. Company privacy policies typically note that they will disclose user data where required by law.35 However, in situations where legal obligations are unclear, it may be up to the company to make individual decisions about whether to push back against an overbroad request.
    • Voluntary Disclosure: Company privacy policies note that in situations such as emergencies or where the company believes it is necessary to respond to threats to the security of the services or the physical safety of any person, companies such as Fitbit may also voluntarily hand over data to law enforcement.36 However, depending on the nature of the company and the specific functionality of their product, there may be no legal restrictions that limit a company’s voluntary disclosure of data to law enforcement.

 Possible uses of device data by law enforcement

  • Approximate a person’s location or movements during a given time frame.
  • Evaluate a person’s alibi or version of events.
  • Approximate a person’s time of death.

Transparency reports

  • No transparency reports identified.

 Relevant legal cases and further reading

IV. Connected Thermostats

How they work and who makes them

  • How they work: Thermostats regulate the temperature of a home through a mobile app, a connected speaker, or a home console.37Some models also have artificial intelligence capabilities that learn preferences over time.38
  • Who makes them: Companies that sell this technology include Google (Nest), Honeywell, Lux Kono, Bosch, and Amazon (Ecobee).

What kinds of data are collected and how long data is retained

  • Data about the owner:
    • These devices may collect the owner’s name, email, telephone number, home address or zip code, credit card information, nationality, and country of residence.39
    • With user permission, devices also collect geolocation information from users’ phones.40
  • Data about a residence and its inhabitants:
    • These devices can collect indoor and outdoor temperature, smoke and carbon monoxide levels, humidity, ambient light, movement, and more.41
    • They may also gather usage data, including the status and runtime of heating and air conditioning in the home and the overall home electrical usage.42
    • Some devices store information based on interactions with third party devices, such as home computers. 43
  • Retention: The retention period for data varies. For example, Google says it may retain some data indefinitely, whereas other data is deleted after a “predetermined period.” However, there is no specific retention period by each data type.44

Law enforcement access

  • Access via user: Law enforcement can ask the owner of the device to turn over data voluntarily.
  • Access via device manufacturer: Law enforcement can also request access for data directly from the company.
    • Compelled Disclosure: Depending on factors such as the sensitivity of the data or if a request relates to the content of communications, a warrant or subpoena may be legally required. Company privacy policies typically note that they will disclose user data where required by law.45 However, in situations where legal obligations are unclear, it may be up to the company to make individual decisions about whether to push back against an overbroad request.
    • Voluntary Disclosure: Company privacy policies note that in situations such as emergencies or when the company believes it is necessary to protect against harm to the rights, property, or safety of the company, its users, or the public, the company may also voluntarily hand over data to law enforcement.46 However, depending on the nature of the company and the specific functionality of their product, there may be no legal restrictions that limit a company’s voluntary disclosure of data to law enforcement.

Possible uses of device by law enforcement

  • Verify a person’s alibi or version of events.
  • Evaluate movements that may contradict a person’s statements.
  • Verify whether someone was inside a home.

Transparency reports

  • Google and Amazon publish reports incorporating all disclosures of user data into an overall summary that gives numbers across each company’s entire suite of products. These documents do not break down the number of law enforcement requests for data from connected thermostats or specify the type of data provided.47
    • Transparency reports do not account for situations where users voluntarily turn over data to law enforcement.
  • Honeywell, Lux Kono, and Bosch do not publish transparency reports.

Relevant legal cases and further reading

V. Connected Cars

(a) Embedded Technology

How they work and who makes them

  • How they work: Embedded technologies are built-in features that enable cars to perform a variety of tasks. These can include:
    • talking to other vehicles that surround them, such as when a car uses driving assist mode to determine when other cars are braking or encroaching on its lane.48The car may then alert the driver, depending on the settings available;
    • talking to cloud networks to perform services including navigation, to receive alerts, to run diagnostics, and to communicate with emergency responders;49and
    • talking to their environment, such as a car’s communication with a “smart city” to receive information about things such as traffic congestion or fuel station locations.50
  • Who makes them: Companies offering embedded technologies in their vehicles include BMW, Ford, Tesla, Toyota, Subaru, and others.

What kinds of data are collected and how long is data retained

  • Data about the owner: Embedded technologies can collect the owner’s name, address, telephone number, date of birth, email address, login information, demographic data, gender, emergency contact information, information about the acquisition and financing of a vehicle, and credit card information.51
  • Data about the car and people inside the car: These technologies can also record the location data of a car’s movements; audio recordings (such as voice recordings of individuals that interact with a digital assistant); car diagnostics (such as tire pressure, fuel levels, and odometer readings); incident data (such as information about collisions, the direction from which a car was hit, which airbags were deployed, and safety belt usage); communications with third parties and with employees providing support services; and vehicle data such as a car’s location within a lane or its average speed.52
  • Retention: Retention periods are unclear; some privacy policies disclose that they retain information as long as necessary to provide services and comply with legal obligations.53OnStar warns users that it is their responsibility to delete their information from OnStar systems before they sell or otherwise transfer their car to another owner.54

Law enforcement access

  • Access via user: Law enforcement can ask the car owner to provide information they can access in the car or through a mobile application connected to the car. The owner may be different from the person who regularly operates the car — for example, where an employer, partner, parent, or other person is the car owner.
  • Access via car manufacturer: Law enforcement can also request data directly from the company.
    • Compelled Disclosure: Depending on factors such as the sensitivity of the data or if a request relates to the content of communications, a warrant or subpoena may be legally required. Company privacy policies typically note that they will disclose user data where required by law.55For example, police have been able to request location data and real-time wiretapping of conversations with a warrant.56However, in situations where legal obligations are unclear, it may be up to the company to make individual decisions about whether to push back against an overbroad request.
    • Voluntary Disclosure: Company privacy policies note that in situations such as emergencies or where the company believes it is necessary to protect against harm to the rights, property, or safety of the company, its users, or the public, the company may also voluntarily hand over data to law enforcement.57However, depending on the nature of the company and the specific functionality of their product, there may be no legal restrictions that limit a company’s voluntary disclosure of data to law enforcement.

Possible uses of device data by law enforcement

  • Evaluate a person’s alibi or version of events.
  • Evaluate a person’s location or movements during a given time frame.
  • Evaluate whether someone was inside a car.
  • Analyze voice recordings that identify a suspect, victim, and more.
  • Intercept communications and track location on an ongoing basis.

Transparency reports

  • No transparency reports were located.

Relevant legal cases and further reading

  • Cartapping: How Feds Have Spied on Connected Cars For 15 Years (Forbes)
  • Burglary Suspect Arrested in Camden After OnStar Tracks Stolen Vehicle (Philly Voice)
  • 12-Year-Old Faces Felony Charges After High Speed Chase Through Conroe (The Courier)
  • BMW Remotely Locks Alleged Thief In Car He’s Trying to Swipe (CNET)
  • In the Matter of the Application of the United States for an Order Authorizing the Roving Interception of Oral Communications, 2003 in case # 02–15635, the Ninth Circuit allowed the FBI to obtain a court order compelling a car manufacturer to use technology embedded in a car to allow agents to eavesdrop on conversations in the car.
  • People v. Oelerich, 78 N.E.3d 992 (Ill. App. Ct. 2017). Defendant’s car had OnStar. One piece of evidence was a 47-second-long recording of the conversation between the OnStar operator and the defendant, where the operator asked the defendant what had just happened and the defendant said, referring to a hallucinogenic drug, “I was driving because I wanted to have the great DMT trip of my life. And I cannot die….” The prosecutor used the OnStar recording to argue that the defendant was deliberate in driving into the other vehicle, while the defense used the recording to show that the defendant had not been rational and was in a psychotic state.
  • State v. Wilson, 2008-Ohio-2863 (Ohio Ct. App. 2008). Defendant purchased a used vehicle equipped with OnStar, but he declined OnStar services. However, the service had not yet been disabled when OnStar received an emergency button key press from the vehicle. After the OnStar operator received no response, they requested local police to provide emergency assistance at the vehicle’s location. While monitoring the vehicle, the operator overheard the vehicle occupants discussing a possible illegal drug transaction and permitted the police dispatcher to listen in. The dispatcher notified the officers. The officer who arrived on scene “observed furtive movement” from the driver of the vehicle (the defendant), removed him from the vehicle, and conducted a search, ultimately finding marijuana. The trial court denied the defendant’s motion to suppress, finding there was no Fourth Amendment violation because governmental action did not cause the OnStar employee to monitor the conversation. The court of appeals affirmed.
  • People v. Jacques, 2016 WL 4482930 (Cal. Ct. App. 2016). Following a burglary where the victim reported the license plate number of the defendant, police obtained a warrant to access the location of the defendant’s vehicle through OnStar. After locating the defendant’s vehicle, the police planted their own tracking device on the car to track its location.

(b) Supplemental Technology

How they work and who makes them

  • How they work: Supplemental technologies are external tools that enable cars and drivers to perform a variety of tasks. These technologies include:
    • GPS navigators that provide driving directions;58
    • dashboard cameras that record what’s happening inside of a car and can be set up to automatically record when they detect impacts or possible accidents;59
    • security devices that track a car’s location and send messages to the user if a car is bumped or moved; 60
    • other devices that can plug into a car and issue diagnostic reports and driving reports;61  and
    • digital assistants that can perform a variety of services based on voice commands.62
  • Who makes them: Companies selling these devices include Google, Apple, Pioneer, Kenwood, OnStar, Amazon, Garmin, Raven, and Vivint.

What kinds of data are collected and how long data is retained

  • Data about the device owner: These devices may collect the user’s name, mailing address, email address, telephone number, and payment information.63
  • Data about the car and people inside the car: They may also gather location data, video and audio footage of what occurs in and around a car, and diagnostic reports about the condition of a car.64
  • Retention: Retention periods are unclear, with some privacy policies disclosing that they retain information as long as necessary to provide services.65

Law enforcement access

  • Access via user: Law enforcement can ask the owner of the device to turn over the data. The device owner may be different from the car owner — for example, where an employer, partner, parent, or other person controls a device attached to a car.
  • Access via device manufacturer: Law enforcement can also request access for data directly from the company.
    • Compelled Disclosure: Depending on factors such as the sensitivity of the data or if a request relates to the content of communications, a warrant or subpoena may be legally required. Company privacy policies typically note that they will disclose user data where required by law.66 However, in situations where legal obligations are unclear, it may be up to the company to make individual decisions about whether to push back against an overbroad request.
    • Voluntary Disclosure: Company privacy policies note that in situations such as emergencies or when the company believes it is necessary to protect their rights and property, they may also voluntarily hand over data to law enforcement.67However, depending on the nature of the company and the specific functionality of their product, there may be no legal restrictions that limit a company’s voluntary disclosure of data to law enforcement.

Possible uses of device data by law enforcement

  • Evaluate a person’s alibi or version of events.
  • Evaluate a person’s location or movements during a given time frame.
  • Verify whether someone was inside a car.
  • Evaluate voice recordings to help identify a suspect, victim, and more.

Transparency reports

  • Apple, Amazon, and Google publish summaries incorporating all disclosures of user data into an overall report that gives numbers across each company’s entire suite of products. These documents do not break down the number of law enforcement requests for data from each product or specify the type of data provided.68
    • Transparency reports do not account for situations where users voluntarily turn over data to law enforcement.
  • Pioneer, Kenwood, OnStar, Garmin, Raven, and Vivint do not publish transparency reports.

Relevant legal cases and further reading

VI. License Plate Readers

How they work and who makes them

  • How they work: License plate readers use a combination of cameras and computer software to scan and store the license plates as well as photos of every car passing by the device.
    • Through a user interface, users can set up “hot lists” to alert them whenever a particular car passes by or leaves a neighborhood.
    • Companies also retain license plate information for future uses. These uses may include data sharing with law enforcement and with other customers who have “a legitimate commercial interest,”69 such as repossession services on behalf of creditors.70
  • Who makes them: Companies selling these devices include Flock Safety, Vigilant Solutions, and Obsidian Integration.

What kinds of data are collected and how long is data retained

  • Data about the owner: These devices may record the name, phone number, email, zip code,71 usernames, affiliated organizations, and IP addresses of anyone who accesses the license plate reader data.72
    • Vigilant Solutions logs how its customers use their products, and occasionally audits these logs.73
  • Data about cars: Some devices may record video and still images of cars and license plate scans, as well as the date, time, and location associated with this data.74
  • Environmental data and data about the license plate reader: Some devices collect temperature and ambient light information.75 Additionally, companies maintain records on the serial number, software version, cellular signal strength, and geolocation of their license plate readers.76
  • Retention: Flock Safety retains video and audio information for 30 days, although users can save and retain data indefinitely.77 Vigilant Solutions retains data as long as it has “commercial value.”78

Law enforcement access

  • Access via user: Law enforcement can ask the owner or any user with access to the data to voluntarily disclose it. Companies like Flock Safety create user interfaces that allow users to either share information with police on a case-by-case basis or to allow the police to have direct access to the system.79
  • Access via device manufacturer: Law enforcement can also request access for data directly from the company.
    • Compelled Disclosure: Depending on factors such as the sensitivity of the data, a warrant or subpoena may be legally required. Company privacy policies typically note that they will disclose user data where required by law.80 However, in situations where legal obligations are unclear, it may be up to the company to make individual decisions about whether to push back against an overbroad request. Flock Safety also reserves the right to use and disclose aggregated data the company collects for unspecified “crime prevention efforts.”81
    • Voluntary Disclosure: Company privacy policies note that in situations such as emergencies or when the company believes it is necessary to protect against harm to the rights, property, or safety of the company, they may also voluntarily hand over data to law enforcement.82 However, depending on the nature of the company and the specific functionality of their product, there may be no legal restrictions that limit a company’s voluntary disclosure of data to law enforcement.

Possible uses of device data by law enforcement

  • Verify cars and people present at the scene of a crime.
  • Establish relationships between people.
  • Track a particular driver’s location and movement over time.
  • Locate cars associated with AMBER alerts for abducted children.
  • Cross-reference state and federal databases with information on gang membership and unpaid fines.

Transparency reports

  • No transparency reports identified.

Relevant legal cases and further reading

Related Resources