Is Seattle Police iPhone Hacking Tool Skirting City Law?

SEATTLE, WA - Seattle police may be avoiding a city law that allows the public to review surveillance equipment, according to a local civil liberties watchdog. SPD is in the process of acquiring a device that can unlock iOS devices, but city officials reviewing the tool have said it is "not surveillance" under Seattle's surveillance ordinance.

GrayKey, which can unlock a range of iOS devices from iPhones to iPods, would only be used by police with a warrant, and that's why officials in the city's Information Technology office, during an initial review, deemed that GrayKey out side the definition of "surveillance" in the ordinance.

Shankar Narayan, director of the technology and liberty project at the ACLU of Washington, says that's "contradictory to the spirit of the surveillance ordinance."

"There is no warrant exemption for technology going through the full process of scrutiny under the ordinance," he said.

Tuesday night, the Information Technology office sent a statement to Patch acknowledging that obtaining a warrant does not exempt technology under the ordinance - but it's unclear what that means for GrayKey.

"The comment in the draft document regarding the warrant requirement represented a question that was asked about the technology and which the Chief Privacy Officer was seeking clarification from advisors who are also reviewing the material. The Surveillance Ordinance does not provide exemptions for technologies whose use requires a warrant. Further review has clarified that fact and the privacy review is proceeding with that understanding of the law," the statement read.

Under the ordinance, surveillance equipment used by the city undergoes a public review including public meetings and City Council review. This week, Seattle is holding a series of public meetings on other surveillance technology the city uses, like license plate readers.

Right now, GrayKey is going through an internal privacy assessment. According city documents, Chief Privacy Officer Ginger Armbruster on Sept. 21 deemed GrayKey outside the surveillance ordinance.

"If phones are acquired either under warrant or with suspect's knowledge, then this is not surveillance by ordinance definition," she wrote.

On Oct. 4, Privacy Program Specialist Nathan Merrells agreed with Armbruster.

"GrayKey is used with either individual consent or notice, the last in cases of search warrant. While there are other privacy and legal considerations for the use of this technology, the policies around obtaining the mobile devices under consent or via warrant place this technology outside the surveillance ordinance," he wrote.

According to the ordinance, a tool doesn't count as "surveillance" if a person can opt out. But Narayan says a warrant is not akin to allowing someone to opt out.

"When someone goes and gets a warrant and seizes the phone, you can challenge the warrant - but that's not an opt-out. That's legally indefensible," he said.

Read: Seattle Police Getting Device That Can Crack iPhones

According to GrayKey marketing materials, the $15,000 tool can unlock an iPhone and download its contents in as little as 20 minutes. The department's child sex crimes unit has asked for GrayKey, according to SPD spokesman Sgt. Sean Whitcomb, but any investigator in the department would be free to use it.

(UPDATE: Forbes reported Wednesday that Apple has created a security feature to block GrayKey.)

The city's surveillance ordinance first went into effect in 2013. It was rewritten in 2017 after SPD illegally acquired a tool to track social media posts.

Patch has reached out to City Council members Mike O'Brien, Teresa Mosqueda, and Lorena González, who started the 2017 re-write of the surveillance ordinance. Mosqueda declined to comment, and neither González nor O'Brien responded to an interview request.

"The point of the surveillance ordinance was to get agencies to do their homework and get on the record about the civil liberties costs and benefits of the technology, and to give members of the public the opportunity to comment. It looks like in this case what looks like a surveillance tool is bypassing both of those purposes," Narayan said.

You can read the Seattle police privacy assessment for GrayKey here:

Image via Shutterstock