Spokane County Sheriff’s Office gets tech to access phones without passcodes, raising privacy concerns

The Spokane County Sheriff’s Office has had the technology to hack into cellphones without a passcode for the last year, an ability law enforcement says it is using responsibly to investigate crimes and privacy advocates fear could be rife for misuse.

The technology, GrayKey, is now used by law enforcement agencies across the country.

According to purchasing records obtained by The Spokesman-Review through a public records request, the sheriff’s office bought the $18,000 software in April 2019.

Deputy Mark Gregory confirmed that the phone unlocking technology was available to detectives now, but he declined to explain how it works or in what situations it is used.

Gregory emphasized that the sheriff’s office uses every technology it has lawfully, obtains warrants and does not release specific information about its investigative methods.

“Whether it’s physically searching a home (or using) any of our technology (or) investigative tools, we always use them lawfully and legally, which most of the time involves getting search warrants to make sure everybody’s rights are protected,” Gregory said.

If information about how law enforcement uses GrayKey and similar technology gets out, Gregory said people could take precautions that make investigating crimes more difficult, just as they might wear gloves to avoid leaving fingerprints.

The sheriff’s office purchased the technology after seeing other agencies use it successfully, Lt. Khris Thompson, who works in the sheriff’s office’s investigative division, told the Inlander, which first reported the use of GrayKey in Spokane County.

Information about GrayKey and products like it is scarce. The Atlanta-based company releases little information about itself to the public, and law enforcement who use the product say they don’t discuss investigative methods.

Grayshift, the company that makes GrayKey, and other companies that make similar products have been in a yearslong development battle with iPhone maker Apple, which has been updating devices to try to keep law enforcement from accessing user’s data.

The company was temporarily able to keep the device out of their phones, but Grayshift recently found a workaround and raised law enforcement’s subscription price, VICE News reported in March.

The Spokane Police Department does not use GrayKey, or a program like it, to bypass phones with passcodes, said Julie Humphreys, public safety communication manager for city police and fire. She said the police department does use a universal forensic extraction device, or UFED, technology, but it does not have the level of licensing to break into devices without a passcode.

In an email statement, she said the department does not discuss the tools it uses or its techniques.

“The Spokane Police Department uses many technological tools allowed by law to recover and seize digital evidence,” she said. “We do not, however, discuss some of these investigative tactics as such can make it unnecessarily difficult to work these cases and collect evidence.”

While the U.S. Supreme Court ruled that law enforcement can’t search cellphones without a warrant in 2014, some worry law enforcement units that use this technology with a warrant can still capture more personal information than they need.

Privacy advocates such as Jennifer Lee, technology and liberty project manager for the American Civil Liberties Union of Washington, said a cellphone can hold intimate details about a person just like their home or computer can, including photos and private conversations with loved ones, and can be a gateway to financial information.

“Because your phone carries so many details about your personal life, if a search is over broad, there’s a lot of potential for misuse, especially in the absence of laws mandating any agency using this technology has to make their use, acquisition and policies guiding their use public,” Lee said.

She said a policy like Seattle’s technology ordinance, which outlines a hearing and informational process for when the city acquires new technology that could be used to surveil people or invade their privacy, could alleviate some concerns.

Even without a policy, she said law enforcement should be transparent with the public when they use surveillance technology.

This technology is also ultimately purchased with taxpayer money, and the public should be able to weigh into its use she said.

“Lack of transparency creates perfect opportunities for abuse,” she said. “There may be some legitimacy in making things completely nontransparent, if it is helpful to completing an investigation, but what is the cost?”