Seattle Police Getting Device That Can Crack iPhones

According to Patch (October 14, 2018) the Seattle police will be getting the iPhone-cracking device GrayKey, but this device will not be subject to review under Seattle's surveillance ordinance.

A powerful tool that can unlock a range of iPhone, iPod, and iPad models in minutes may soon be available to Seattle police. The department is in the process of acquiring GrayKey, a device that appeared on the market in February and is being used by federal and local police departments nationwide to quickly break through the iPhone's security features.

Unlike many other high-tech tools Seattle police use, GrayKey will not go through a review under the city's surveillance ordinance. Instead, GrayKey will undergo a "privacy review" by the city's chief technology officer. That type of review does not allow for public comment, according to Seattle IT spokeswoman Megan Erb, although City Council could still review the device.

A public comment process is precisely what civil liberties experts say is needed with such powerful and relatively unknown new technology.

"For a tool like this, the best practice would be to put it out for public comment and see what the concerns are," said Shankar Narayan director of the technology and liberty project at the ACLU of Washington.

Seattle police have been interested in getting GrayKey since at least March, according to documents obtained by Patch. The King County Sheriff's Office is also interested in the device, documents show.

GrayKey marketing materials obtained by Patch show the device can crack a range of iPhone models, from the 5 to the iPhone X, which was released in November 2017. The tool costs $15,000 for 300 uses, or $30,000 for an upgraded version with unlimited uses. It appears Seattle is aiming to get the $15,000 version.

The tool itself is just a small, gray box with two lighting cables sticking out of the front. To use it, you simply plug an iOS device into one of the lightning cables, and then wait. GrayKey guesses passwords until it gets the right one, at the same time circumventing security features that usually disable iOS devices after too many wrong password attempts.

Seattle's Tricky History With Surveillance

GrayKey will not be reviewed under the city's surveillance ordinance because, the IT spokeswoman said, it doesn't meet the definition of "surveillance" as outlined in the law.

That definition: "Observe or analyze the movements behavior, or actions of identifiable individuals in a manner that is reasonably likely to raise concerns about civil liberties, freedom of speech or association, racial equity or social justice."

Instead, GrayKey will get a "full privacy review." "The full privacy review is through the CTO office and the Chief Privacy Officer as well. It is the same questions for both the privacy and surveillance. What it doesn't include is the financial aspect and the public comment if it's not designated as a surveillance tool. We submit this report in the CTO quarterly report and the Council can decide if more review is needed," Erb told Patch via email.

The City Council first adopted a surveillance ordinance in 2013, a year that included controversies involving police surveillance capabilities. First, the police department ended its controversial unmanned drone program. Later that year, The Stranger revealed that SPD had installed a wireless mesh network in the downtown area, which had the capability to track the movements of cellphones and other wireless devices. The mesh network was never used, according to Seattle police, and is in the process of being dismantled.

The ordinance was updated in 2017 after another surveillance controversy. SPD acquired the service Geofeedia, which mapped social media posts in real-time. That prompted Councilwoman Lorena Gonzalez to revisit the surveillance ordinance. The 2013 version was replaced with the one signed by former Mayor Ed Murray in August 2017.

Outside Seattle, Tacoma has been sued over using the tool stingray, which acts like a cellphone tower, allowing police to capture call data from criminal targets and anyone else who happens to be in the vicinity.

Best To Have 'Daylight'

By skipping the surveillance ordinance process, the public will have little say in Seattle's acquisition of GrayKey. The ordinance would allow City Council to vote on the acquisition, and require the department to release detailed reports on how the tool is used, such as with license plate readers.

The department's acquisition of GrayKey, therefore, could become another public relations blunder, the ACLU's Shankar Narayan said.

"It would be very smart for SPD to bring some transparency around the tool. Then you avoid public blow up like you had with the drones, for example," he said.
--

GrayKey is surveillance technology. If SPD needs it for legitimate investigative purposes, submit the request for review and public comment under the city's surveillance ordinance. Most people don't object to the police having whatever technology they need to fight crime - that is what the community asks them to do - but acquiring surveillance technology without public review or comment raises concerns.

I discussed the GrayKey device here in the blog in March 2018: GrayKey iPhone Unlocker Poses Serious Security Concern.