Last month, Boulder County spent the first of what it hopes will be millions of dollars for the treatment and prevention of drug addiction, courtesy of lawsuits against the drug manufacturers, distributors and pharmacies that helped fuel America鈥檚 opioid epidemic.
Among the spending was money for controversial yet widely used technology to gain access to locked cell phones and computers. Law enforcement officials argue such products are necessary to find and prosecute drug dealers, whose illegal enterprises have produced an ever-mounting body count.
Yet the increasing usage of such products has occurred largely without public knowledge and debate, or corresponding evolution of regulation to protect against potential abuse 鈥� a chief concern of privacy experts and human rights groups who warn the tools are an unprecedented, unchecked expansion of police power.
鈥淭here鈥檚 this really remarkable power that police have that can be used quietly and silently,鈥� said John Davisson, senior counsel for Washington, D.C.-based Electronic Privacy Information Center. 鈥淚t鈥檚 really putting a lot of power into the hands of law enforcement.鈥�
Crucial tool for catching drug dealers
Spending on mobile device forensics tools, or MDFTs, as they鈥檙e known, represents just a sliver of Boulder County鈥檚 opioid settlement spending so far: $81,250 鈥� 4.5% of an $1.8 million total first funding round 鈥� went to purchase products from Cellebrite and GrayKey, which unlock Android and Apple/iOS products, respectively, and Nighthawk and Magnet Forensics, which assembles extracted data into a readable format and 鈥減uts it all together in a pattern,鈥� according to Boulder County Sheriff鈥檚 Office Sergeant Jeff Pelletier, who presented on the purchases at a December meeting of Boulder County鈥檚 Regional Opioids Council.
The equipment will go to Longmont Police Department鈥檚 Special Investigations Unit, which handles narcotics investigations and Boulder County鈥檚 Drug Task Force, which serves the same function for most of the county, excluding Longmont and Louisville. A third Cellebrite device will go to Boulder County鈥檚 Digital Forensics Lab, which aids in investigations for the entire county.
It will supplement existing equipment and, law enforcement officials hope, relieve a backlog at the forensics lab.
鈥淭here鈥檚 usually a line of homicides and other investigations needed,鈥� Goldberger said. 鈥淪ometimes those overdose crimes get trumped.鈥�
The lab processes phones and other electronic devices for law enforcement agencies throughout the county. Its work has expanded along with the proliferation of cell phones.
鈥淓very crime, you pretty much guarantee there is at least one digital medium there that could help in an investigation,鈥� Goldberger said. 鈥淲e get called out, go to a scene, 90%-plus of the time, we come into contact with a phone or computer.鈥�
鈥淧retty much everything you can think of,鈥� Pelletier said during his December presentation, 鈥渢here鈥檚 digital evidence.鈥�
The tools are especially critical in combating drug trafficking, Goldberger said, because of the information they can reveal about where drugs were purchased.
鈥淎n example would be, hypothetically I have a drug dealer who is selling thousands of fentanyl pills,鈥� he said. 鈥淯sually, business is done on a phone or a computer. In order to see where his dealers are or to see his supply, we need to have access to that device.鈥�
Searches using MDFTs on suspects are conducted after obtaining a warrant, Goldberger said. The exceptions are searches performed on the devices of deceased overdose victims.
鈥淭echnically there鈥檚 no expectation of privacy on a device鈥� of a dead person, Goldberger said, 鈥渟o a warrant would not be used in most cases.鈥�
Extraction technology is crucial, Goldberger said, because while a warrant allows law enforcement to possess a device, it does not compel its owner to grant access to it. MDFTs bypass the mechanisms that lock a phone, whether passcodes or biometric protections like face or thumbprint recognition.
The technology has already helped secure convictions against drug traffickers locally, Goldberger said, including one case that involved an overdose fatality.
鈥淭he drug task force currently has 18 active overdose investigations related to people who have passed, or overdosed and survived,鈥� he said. 鈥淭his is bettering our chances of having a successful investigation to hopefully catch the suppliers or dealers.
鈥滻t can also help in the county鈥檚 ongoing fentanyl crisis, Assistant District Attorney Ken Kupfner told the opioids council in December. Records taken from cell phones can identify 鈥渨here these drugs are coming from and what it鈥檚 being marketed as,鈥� he said, since dealers often cut other drugs with fentanyl to maintain or enhance their potency at a lower cost.
鈥淭here鈥檚 fentanyl in everything, from Xanax to cocaine to meth. I receive a call from the coroner鈥檚 office in every death involving overdose or poisoning. My first question is always the same: Do we have a device, and are we able to get into it?鈥�
Vague state language leaves door wide open
A single line in Colorado鈥檚 for settlement spending does allow for law enforcement-related purchases. 鈥淟aw enforcement expenditures relating to the opioid epidemic,鈥� is an allowed use under the 鈥淎dditional Areas鈥� category 鈥� that is, neither treatment nor prevention.
The purchases could also be considered prevention, local officials argued of Boulder County鈥檚 Regional Opioids Council.
鈥淭hese are viewed as a prevention (tool),鈥� said Kelly Veit, strategic implementation manager for BROC. They do 鈥渢end to prevent the proliferation of these drugs more broadly.鈥�
It is unclear if any other communities used their respective funds to purchase similar technology. Two regions 鈥� 3, covering Weld County, and 19, which encompasses nine counties in southeast Colorado and includes the cities of Pueblo and Trinidad 鈥� did include unspecified criminal justice enforcement spending in their requests, according to the state鈥檚 .
Region 3鈥檚 plan lifts language directly from state guidelines, for 鈥渓aw enforcement expenditures relating to the opioid epidemic.鈥� Region 19 for 鈥渃riminal justice recovery to be done within the allowable uses of the grant,鈥� with a formal proposal process determining what those eventual programs and expenditures will be.
A representative from Region 19 agreed via email to send the 鈥渓ist of first-year funding so far,鈥� but had not provided it as of the publication of this article. Region 19 will make its second round funding decisions Monday, the spokesperson wrote.
A Region 3 representative did not respond to a request for comment.
The technology has yearly licensing fees, totaling thousands of dollars. Opioid funds could potentially be used to cover these costs into the future.
That鈥檚 exactly what Goldberger is hoping for.
鈥淗opefully as long as the regional opioid council concurs,鈥� he said, 鈥渢hey will keep funding us for this recurring cost.鈥�
Tools used in 鈥榯he worst of the worst鈥� way
Extraction tools are already widely in use across Colorado. An October 2020 report from nonprofit advocacy group Upturn found more than a dozen agencies employing them, including the Colorado State Patrol, Denver PD, and law enforcement in Broomfield, Fort Collins, Colorado Springs, Wheat Ridge, Golden, Adams County, Arapahoe County and the city of Aurora.
That report, , also found that law enforcement agencies across the country use MDFTs 鈥� often without a warrant 鈥� for a variety of crimes: the drug trafficking and more serious offenses touted in defense of such tools, but also low-level crimes like graffiti, vandalism, public intoxication and traffic violations.
Extraction products can pull everything from a phone or electronic device: emails, texts, usage data from apps, activity from social media accounts, geo-tagged photos and even deleted data. Once assembled, this massive amount of information can track an individual鈥檚 movements and map out their social networks.
鈥淭he result: protections guaranteed by the Fourth Amendment are made meaningless,鈥� report authors wrote.
Because of this, Upturn recommended banning the use of consent searches 鈥� when a person allows the police to search their phone voluntarily, without a warrant. Many people may be unaware that such technology exists, or ignorant to its vast capabilities.
鈥淭hey go beyond what a police officer would be able to see if you unlocked your phone for them manually,鈥� said Riana Pfefferkorn, a research scholar with the Stanford Internet Observatory, who has with Cellebrite following multiple hacks of its data. 鈥淭hey can pull deleted data, metadata that鈥檚 not readily available to a naked eye.
鈥淚t鈥檚 way more intrusive than a search would be that was done manually.鈥�
In particular, the ability to construct 鈥渟ocial graphs鈥� has been used in nefarious ways around the globe, including tracking political dissidents as well as asylum seekers and refugees. The U.S. Department of Immigration and Customs Enforcement has with Cellebrite, an Israeli-based company that has also been criticized for selling its technology to .
Domestically, EPIC鈥檚 Davisson worries about the role MDFTs can play in a post-Roe country to surveil reproductive choices, or to exacerbate law enforcement鈥檚 well-documented history of tracking political activists.
鈥淚f you use this tool to fight drug trafficking, that is all well and good,鈥� Pfefferkorn said. 鈥淏ut what we see with technologies like this is they invariably get used outside of the worst of the worst context.鈥�
Little to no oversight, accountability
Adding to the potential for abuse is an extreme lack of oversight. The Upturn report found that very few departments have crafted specific policies for the use of MDFTs 鈥� such as limiting when and on what types of crimes they can be used 鈥� or the data they extract.
鈥淣early 90% of the departments that responded to our records requests give their officers wide discretion to use MDFTs and the phone data they collect,鈥� authors wrote. 鈥淓ven when policies exist, they are often remarkably vague. 鈥� We rarely saw any detailed guidance on concerns related to digital searches, such as the scope and particularity of searches, and the retention and use of extracted data.鈥�
Because proprietary software is used to extract and compile data, the public is reliant on law enforcement agencies to accurately report how and when such searches are being made, and whether or not applicable laws were followed. But reporting requirements are scarce.
鈥淭here is almost no public accounting of how often or in what kinds of cases law enforcement use these tools,鈥� authors wrote.
Upturn recommended that law enforcement be required by law to 鈥渄ocument a chronological record of all interactions that law enforcement had with the software, such as how they browsed through the data, any search queries they used, and what data they could have seen.鈥�
The group would also like to see requirements to delete data after 30 days if it is not relevant to the objectives of a specific warrant. That would prevent law enforcement from building surveillance networks or engaging in what鈥檚 known as parallel construction, wherein a case is built by first obtaining evidence illegally, then reconstructing it with legally obtained evidence.
Pfefferkorn鈥檚 own wish list for MDFT regulation includes laws governing the secondary market.
鈥淧ast generations of forensics tools , in the hands of people who are not law enforcement,鈥� she said. 鈥淭hen they are susceptible to falling into the very hands that are supposed to be getting investigated."
Law outpaced by technology
Such guardrails are lacking locally. County officials were unaware of any policies crafted specifically for MDFTs.
鈥淲e are unfamiliar with any policies that specifically address data extraction,鈥� Boulder County Sheriff鈥檚 Office spokesperson Carrie Haverfield wrote via email.
鈥淭he county utilizes data loss prevention programs and auditing procedures, including audits logs, but does not use screen recording,鈥� Haverfield wrote. And while Goldberger said the sheriff鈥檚 officer produces annual reports on how many devices were searched by the forensics lab, Haverfield wrote that, 鈥渢he county does not produce or maintain annual cybersecurity reports.鈥�
In interviews, followup emails and public statements, officials indicated that they rely on existing laws and policies to govern the use of data extraction tools. Goldberger referenced evidence collection and retention requirements in response to questions about data usage and storage, including laws specific to body-worn camera footage. Haverfield provided a link to the sheriff office鈥檚 policies.
鈥淭here鈥檚 a legal basis for every single thing that we do,鈥� Kupfner told the opioids council in December.
There are indications that extracted data is being used locally to build multiple cases from a single search. At the BROC meeting, Sergeant Pelletier said the technology 鈥渁llows investigators to perform some link analysis鈥� to 鈥渕aybe point out other potential victims.鈥� Separately, Goldberger also referenced the technology鈥檚 ability to identify multiple overdose victims using information from one device.
In two separate interviews, Goldberger repeated numerous times that officers follow all existing state and federal laws, including Fourth Amendment protections against unlawful search and seizure. He insisted that priority for MDFT use is placed on crimes related to 鈥渓ife and safety.鈥�
鈥淭here is no sneaky or ill intent when we do our investigation,鈥� he said. 鈥� We鈥檙e doing it above board, we鈥檙e following the law. We just don鈥檛 play in that blurred area.鈥�
But critics insist that existing laws 鈥� written for physical searches 鈥� are insufficient.
鈥淎s is common with technology,鈥� Pfefferkorn said, 鈥渢he technology has gotten out ahead of the regulation.鈥�
鈥淚t鈥檚 a 鈥榮hoot first, ask questions later鈥� approach of 鈥楲et鈥檚 get more surveillance tech and see what we could do,鈥� Davisson said. 鈥淚t feels darkly ironic that a settlement that arises out of these really harmful phenomenon of opioids that has caused so much pain and death and heartbreak, that the public benefit of that is being funneled into surveillance tech that is then being turned back on a lot of the same people that are suffering from the use of opioids.鈥�
No pushback from public officials
It鈥檚 unclear what if any discussions on MDFTs occurred at the state level when crafting guidelines for opioid settlement money. A spokesperson for the Colorado attorney general鈥檚 office was unable to provide information in time for this article to be published.
The merits of extraction tools also do not appear to have been debated locally. BROC鈥檚 December discussion centered solely over the use of settlement funds for tools with general criminal justice applications.
Law enforcement officials stressed the severity of the local drug crisis, their presentation peppered with stories of overdose deaths.
鈥淚 have been begging the task force 鈥� We have to have the ability to process these devices quickly鈥� to understand where drugs are coming from and how they are being marketed, assistant DA Kupfner said.
鈥淲aiting months and months for a device to be processed 鈥� we鈥檙e too far behind the curve if we identify those things three months, six months down the road.鈥�
Of the 25 programs BROC supported with the first round of funding, Goldberger said, 鈥渢his is the only one aimed at stemming the flow of narcotics into our community."
Boulder County Commissioner Claire Levy and Boulder City Manager Nuria Rivera-Vandermyde were the only two members to raise 鈥� as Levy put it 鈥� 鈥渜uestions about whether this is the right pot of money.鈥� Both couched their queries, which were met with arguments from law enforcement officials about why the devices were necessary.
鈥淵ou鈥檝e made a very good case for the need for these tools, but I am having trouble matching that up with my understanding on what we鈥檙e supposed to be spending opioid settlement money on,鈥� Levy said, 鈥渨hich is harm reduction.鈥�
鈥淚 want to make clear that my questions are not because I don鈥檛 think it鈥檚 a good tool for law enforcement; I think it is,鈥� Rivera-Vandermyde said. 鈥淚鈥檓 struggling to put together why these funds are the right funds. Once you have this equipment, you can use it for any type of intervention that requires the unlocking of a device鈥� whether opioid related or not.
鈥淎gain, I am a supporter of law enforcement,鈥� she concluded. 鈥淚 have no doubt the tools are used appropriately.鈥�
