PrivacyiPhones can reveal a lot about their owners to law enforcement

People assume their iPhones are safe to keep their personal information on. They would be dismayed  to realize what law enforcement agencies can find about them on their phone. 

Yesterday the American Civil Liberties Union (ACLU) published a report basedon a drug investigation by the Immigration and Customs Enforcement agency (ICE). Forbes reports that the report offered a detailed account of a  seizure of a suspect’s iPhone. The  seizure in this case did require a warrant, but this is not the case in every situation. DHS has created its own policy stating that border searches, which sometimes result in the seizure of laptops, cell phones, or other electronic devices, do not violate civil liberties.

The document shows a detailed list of personal information including call logs, photos, videos, text messages, Web history, and passwords for eight different Web services. The most important information  discovered was the 659 previous locations  where the person was, which was invisibly gathered from Wi-Fi networks and cell towers.

“We know the police have started using tools that can do this. We’ve known the iPhone retains records of the cell towers it contacts. But we’ve never before seen the huge amount of data police can obtain,” ACLU technology lead Chris Soghoian, who found the report in a court filing, told Forbes. “It shouldn’t be shocking. But it’s one thing to know that they’re using it. It’s another to see exactly what they get.”

ICE was able to extract the information with the help of Cellebrite. According to the report, the suspect did not seem to have a Personal Identification Number (PIN) or passcode, but law enforcement has shown the ability to bypass passwords and other basic security measures.

In the past, Google has helped law enforcement get past the lock screens of Android phones. In some situations, law enforcement has been known to mail a phone they cannot crack to Apple, which would take the data and store it on a DVD before sending it back to the law enforcement agency.

Soghoian said people who want to keep law enforcement away from their data should use long, complex passwords and encrypt their phone’s storage disk.

“While the law does not sufficiently protect the private data on smartphones, technology can at least provide some protection,” Soghoian told Forbes.