Proof, if proof were needed, that whatever higher power might be steering our fates must be possessed of a perverse sense of humor: I have spent the better part of five years writing about the ways sophisticated electronic surveillance tools, in the hands of intelligence and law enforcement agencies, might pose a threat to privacy and civil liberties. Now I find myself urging my own local police department to be more aggressive in the use of those tools. Not, of course, that I have ever had a problem with the appropriately targeted use of such methods, subject to judicial oversight, as part of legitimate law enforcement investigations. But I can’t help seeing a trace of irony at finding myself urging the Metropolitan Police Department to seek an order under the byzantine Electronic Communications Privacy Act, which I’ve devoted so many words to criticizing.
It started with an open window. Stumbling from my bedroom in my typical bleary, pre-caffinated state Tuesday morning, I was befuddled to feel a blast of cold air blowing through a gaping living room window that I had no recollection of having opened the night before. But I shut it, shrugged, and proceeded to shower and dress. It was only a bit later, hunting about with increasing frustration for my wallet and shoulder bag—hadn’t I left them right on my desk chair?—that I noticed the depressing rectangle of pristine black lacquer in the thin patina of dust covering the base of my television stand. It was a precisely Playstation-sized rectangle. I could be quite certain of this because I had, until just a few hours earlier, been the owner of one.
I’d always taken a measure of comfort in my buiding’s position on the edge of a moderately busy traffic circle—exposed enough, I thought, to deter most prospective burglars. Unfortunately, the local power company had been doing some work—protracted far beyond the initial estimate—upgrading our electric hookup, with two unfortunate consequences. First, their digging had left a mound of packed dirt outside a window normally a bit too high for the average person to easily reach. Second, they’d stretched an enormous tarpaulin over the work area to guard against rain—with the side effect that anyone perched under the window on that mound of dirt could now take the time to force it open without making too much of a spectacle of themselves. So thank you, Pepco.
The police arrived and duly dusted for fingerprints, but I wasn’t holding out any hope of recovering anything until it occurred to me a few hours later that the PS3 is, after all, a network device with a unique MAC address—and a lot of the cool stuff you can do with it requires connecting it to a network. A little Googling and, sure enough, Sony has the capability, at the request of law enforcement, to flag a stolen system using the serial number (which I still had on the original box) and record the IP address from which it’s connected—even if the thieves (or an unwitting buyer) wipe the machine and try to create a new account. From there, you’re a mere subpoena away* from getting a physical address from the Internet Service Provider. The folks I spoke to at MPD hadn’t encountered this approach before—Sony doesn’t seem to advertise it too widely, perhaps because they’d prefer I just bought another PlayStation—but seemed willing to look into it. Which means, I suppose, that spending as much time as I do thinking about the ways people can be tracked online could wind up having some direct practical benefit.
Another trackable bit of tech the thieves made off with was the SmarTrip card in my wallet. It was only Wednesday morning that I got around to e-mailing the good folks at Metro to ask them to cancel my card and send a replacement. Might one of the crooks have tried to use it?—I wondered. Well, it turned out someone had—and Metro was able to tell me the precise minute that person swiped themselves in at the Van Ness station, and then swiped themselves out at the Shaw station. And come to think of it, didn’t I read just about a year ago that WMATA had gotten a grant to begin installing surveillance cameras on buses and at Metro stations? How many people could there be swiping in and out at those precise stations, at those precise times, on a Tuesday afternoon in November? A comparison of any footage that exists from the two Metro stations at the time the card was used could yield at least a fuzzy image of the person who used it—quite likely the burglar.
I passed all this information on to the police—though all along with that scene from The Big Lebowski playing in my head: “Oh sure, I’ll just check with the boys down at the crime lab… they got us working in shifts!” Police in Washington DC, after all, have plenty of more serious crimes to worry about. Still, there has been a recent spate of burglaries, car break-ins, and muggings in my neighborhood—and plenty of locals believe it’s one or two groups of people responsible for most of them. If their little spree continues, sooner or later they’re likely to break into a lighter sleeper’s home, at which point it’s not a great stretch to think someone might end up getting hurt. So I’m hoping they may decide that finding the culprits is worth more hassle than my isolated burglary alone would merit.
So there you have it. In part because I spend my days thinking about the creepy potential of modern surveillance technologies—and warning against the potential harms of going too far with them—I now find myself hoping the DC police are prepared to go further down that avenue than seems to be customary for a garden variety burglary. If it does manage to get my PS3 back, though, I’ll be willing to love Big Brother just this once.
* I originally wrote “a §2703(d) order away”—that’s the catchall provision covering non-content communications records, and requiring an application to a judge advancing “specific and articulable facts.” But on second thought, the only records the police would really need in practice—the device IP from Sony and the service address from the ISP—are classed as “basic subscriber records” under 18 USC §2703(c)(2), so a mere subpoena should suffice. If I wrote the laws, I’d probably actually want the higher standard to apply to much of that info because of the potential First Amendment implications of revealing the identities of anonymous speakers, though obviously in this case either would be readily met.