Posted 5:05 a.m., March 15, 2018

RALEIGH, N.C. — In the many months since Adrian Pugh was shot and killed at his home on Saint Albans Drive, Raleigh police had managed to piece together a few important details of his final moments.

In the early morning hours of June 1, 2015, witnesses heard Pugh in an argument. They heard multiple gunshots. And they saw a figure illuminate the ground with a cell phone flashlight before fleeing the scene as the sun rose over north Raleigh.

A year and a half later across town, a taxi driver named Nwabu Efobi was gunned down in front of the Universal Cab Company. Security camera video caught Efobi in some kind of confrontation with the shooter before the unknown man opened fire. The day before, cameras caught the same guy several times walking around the building with what appeared to be a cell phone at his ear.

Raleigh police say the cases are unrelated. But in March 2017, months after investigations began into both shootings, separate detectives on each case, one day apart, employed an innovative strategy in criminal investigations.

On a satellite image, they drew shapes around the crime scenes, marking the coordinates on the map. Then they convinced a Wake County judge they had enough probable cause to order Google to hand over account identifiers on every single cell phone that crossed the digital cordon during certain times.

In at least four investigations last year – cases of murder, sexual battery and even possible arson at the massive downtown fire in March 2017 – Raleigh police used search warrants to demand Google accounts not of specific suspects, but from any mobile devices that veered too close to the scene of a crime, according to a WRAL News review of court records. These warrants often prevent the technology giant for months from disclosing information about the searches not just to potential suspects, but to any users swept up in the search.

City and county officials say the practice is a natural evolution of criminal investigative techniques. They point out that, by seeking search warrants, they're carefully balancing civil rights with public safety.

Defense attorneys and privacy advocates, both locally and nationally, aren't so sure.

They're mixed on how law enforcement turns to Google's massive cache of user data, especially without a clear target in mind. And they're concerned about the potential to snag innocent users, many of whom might not know just how closely the company tracks their every move.

"We are willingly sharing an awful lot of our lives with Google," said Jonathan Jones, a former Durham prosecutor who directs the North Carolina Open Government Coalition at Elon University. "But do people understand that in sharing that information with Google, they're also potentially sharing it with law enforcement?"

Most modern phones, tablets and laptops have built-in location tracking that pings some combination of GPS, Wi-Fi and mobile networks to determine the device's position.

That should come as no surprise to users of apps like Google Maps, Yelp and other software that becomes more helpful with the addition of accurate location data.

This data is immensely valuable to Google, one of the reasons the company collects and stores the information on users of both its Android operating system and, in some cases, mobile apps such as Gmail.

"From an average smartphone user's perspective, it's a little surprising once you start to learn the full scope of information about our locations and whereabouts and activities that companies like Google hold," said Nathan Freed Wessler, staff attorney with the American Civil Liberties Union's Speech, Privacy and Technology Project.

Users can switch location tracking off to prevent the device from pinging GPS satellites. But if it's on a cellular network or connected to Wi-Fi, the device is still transmitting its coordinates to third parties, even if they're far less accurate than GPS.

In the past, at least, turning off that technology has been no guarantee of privacy.

Business and technology news site Quartz discovered late last year that Google continued to track devices even when all GPS, Wi-Fi and cell networks were supposedly disabled. The tech giant says it has updated its software to stop the practice.

For its part, law enforcement makes frequent use of cellular network data to build cases.

"We certainly, for a number of years, have seen cell phone data specific to an individual that might be used in a case to try to build part of a story," Wake County District Attorney Lorrin Freeman said. "It's one piece in a larger story and one investigative tool of many."

Wessler, who recently argued before the Supreme Court in a major cell tower case, said "reverse searches" have been used to obtain dumps of device information from cell towers of a broad area when a suspect is unknown.

But he hasn't yet seen the tactic applied to more precise GPS data maintained by Google.

"In many ways, it is the same general tactic with different technology," Wessler said. "But the differences in technology can matter."

At least 19 search warrants issued by law enforcement in Wake County since 2015 targeted specific Google accounts of known suspects, court documents show.

But the March search warrants in the two homicide cases are after something different.

The demands Raleigh police issued for Google data described a 17-acre area that included both homes and businesses. In the Efobi homicide case, the cordon included dozens of units in the Washington Terrace complex near St. Augustine's University.

The account IDs aren't limited to electronics running Android. The warrant includes any device running location-enabled Google apps, according to Raleigh Police Department spokeswoman Laura Hourigan.

"At the end of the day, this tactic unavoidably risks getting information about totally innocent people," Wessler said. "Location information is really revealing and private about people's habits and activities and what they're doing."

Your browser does not support the video tag.

Raleigh police declined to make anyone at the department available for an interview for this story

Answering questions via email, Hourigan said Raleigh police began applying the tactic after learning about a similar search warrant the State Bureau of Investigation obtained in Orange County in 2017.

An SBI spokesperson did not return calls seeking comment.

Hourigan said Raleigh police investigators use these search warrants on a case-by-case basis and consider Fourth Amendment protections against unreasonable search and seizure.

"This technique is used in extraordinary circumstances because the department is aware of the privacy issues that the tactic raises," she said in an email March 9.

Since the murder investigations of Pugh and Efobi, extraordinary circumstances emerged two more times in 2017. And these cases, privacy advocates and lawyers who spoke with WRAL News said, are more problematic.

On March 16, 2017, a five-alarm fire ripped through the unfinished Metropolitan apartment building on West Jones Street. The massive blaze was the largest in Raleigh in at least a century. It melted the sides of nearby buildings, toppled a construction crane and closed down adjacent streets for a year.

About two months later, Raleigh police obtained a search warrant for Google account IDs that showed up near the block of the Metropolitan between 7:30 and 10 p.m. the night of the fire. The area just east of Glenwood Avenue is close to heavily trafficked bars, restaurants and apartments.

In addition to anonymized numerical identifiers, the warrant calls on Google to release time stamped location coordinates for every device that passed through the area. Detectives wrote that they'd narrow down that list and send it back to the company, demanding "contextual data points with points of travel outside of the geographical area" during an expanded timeframe. Another review would further cull the list, which police would use to request user names, birth dates and other identifying information of the phones' owners.

In August and again in October, Raleigh police took reports about a man who attacked women near Wakefield High School. As part of the sexual battery investigation, detectives obtained a search warrant nearly identical to the arson investigation for any Google account IDs that appeared in either area within the timeframe of the crimes.

Warrant timeline June 1, 2015

Police find Adrian Pugh shot and killed at 1721 Saint Albans Drive. Nov. 8, 2016

Police find Nwabu Efobi shot and killed at the Universal Cab Company, at 432 Hill St., where Efobi was a driver. 2017

State Bureau of Investigation uses a location-specific search warrant for Google device IDs during a case in Orange County. March 7, 2017

Detectives take out a search warrant for any Google accounts appearing near the scene of Pugh's murder. March 8, 2017

Detectives take out a search warrant for any Google accounts appearing near the scene of Efobi's murder on the day of the shooting and the day before. March 16, 2017

A massive fire breaks out at the unfinished Metropolitan apartment building in downtown Raleigh. April 7, 2017

Detectives take out a second search warrant for Google accounts appearing near the scene of Pugh's murder, expanding the timeframe and providing more explicit coordinates. May 5, 2017

Detectives take out a search warrant for any Google accounts appearing near the scene of the fire on the night it burned. July 21, 2017

Both warrants in the Pugh murder investigation are returned. The first document says nothing was seized, while the second lists only "data" among the inventory of items. Aug. 12, 2017

Police investigate a reported sexual battery near Wakefield High School in which a woman was attacked by an unknown man. Oct. 11, 2017

Police investigate a second incident of sexual battery near Wakefield High they believe to be related to the August incident. Oct. 13, 2017

Tyron D. Cooper is arrested and charged in the murder of Nwabu Efobi. Oct. 27, 2017

Detectives take out a search warrant for any Google accounts appearing near the scene of both sexual battery cases around the time of the crime. Jan. 23, 2018

Warrant in the Efobi shooting case is returned. Detectives note they've retrieved and reviewed accounts associated with the scene of the crime. Feb. 14, 2018

Warrant in the arson investigation is returned. No inventory of seized items is attached. Feb. 22, 2018

Warrant in the sexual battery investigation is returned. The inventory of items seized notes only that detectives received "electronic data."

Freeman, the Wake County district attorney, said police are following best practices by targeting narrow areas and specific time windows. She points out that data investigators receive from Google contain only anonymized account numbers without any content included.

"We're not getting text messages or emails or phone calls without having to go through a different process and having additional information that might lead us to a specific individual," Freeman said.

After five years as a Wake County prosecutor, Raleigh defense attorney Steven Saad said he's familiar with police demands for Google account data or cell tower records on a named suspect. But these area-based search warrants were new to him.

"This is almost the opposite technique, where they get a search warrant in the hopes of finding somebody later to follow or investigate," Saad said. "It's really hard to say that complies with most of the search warrant or probable cause rules that we've got around the country."

Jones, the Elon professor and former Durham prosecutor, expressed similar concerns after reviewing the warrants. In particular, the fire and sexual battery cases didn't present evidence that the arsonist or the attacker had a cell phone, he said.

"In those cases, the evidence provided to establish probable cause seems very thin to me," Jones said. "These amount to fishing expeditions that could potentially snare anyone in the vicinity with a cell phone, whether they were involved in the crime or not."

To Stephanie Lacambra, criminal defense staff attorney at the Electronic Frontier Foundation, all of the search warrants she reviewed are "deficient."

"I don't think with real scrutiny that they would hold up," Lacambra said.

She also singled out the possible arson and sexual battery warrants, pointing out that the affidavits fail to link devices with the crimes.

"To just say, 'Criminals commit crimes, and we know that most people have cell phones,' that should not be enough to get the geo-location on anyone that happened to be in the vicinity of a particular incident during a particular time," Lacambra said.

Without that probable cause, she said, the department is "trying to use technology as a hack for their job."

Hourigan did not respond to questions about criticism of the warrants. But Freeman said that, based on her review of case law, she was confident the warrants would stand up to legal challenges.

"I think there are steps being put in place to try to protect people's Fourth Amendment rights while still allowing law enforcement access to information that is very helpful during the course of the investigation," Freeman said.

While it's important for law enforcement to remain sensitive to privacy rights, she said, warrants like these aren't so different than more established techniques.

"For years, we've pulled surveillance videos, for example, of convenience stores where there may have been an armed robbery," Freeman said. "In looking through that surveillance video, it's very possible that people are in and out of that store who had nothing to do with the crime."

It's important that investigators use such techniques when appropriate to solve crimes, she said.

That's not how Saad sees it. He said requests like these might make sense if there's a named suspect. But as it stands, he's worried about the potential erosion of constitutional protections that guard against search and seizure "based on a hunch or theory."

"If you know a crime was committed in an area and you have no information on a suspect, would you allow for them to go through every house in the neighborhood?" Saad said. "Of course not."

The ACLU's Wessler notes that, in all of these investigations, Raleigh police are seeking the highest bar of court review by obtaining a search warrant – the "gold standard" in such cases, he said.

The broad scope of the search does raise important questions about privacy, but he said case law still needs to catch up with technology to decide how Fourth Amendment protections will apply.

"That is a concern here, but we just don't have good guidance from the courts about how you should apply the warrant requirement to this kind of reverse search," Wessler said.

There's evidence of that uncertainty in the warrants themselves.

A footnote in every one of the documents notes that North Carolina officials disagree with Google's position that search warrants are necessary to demand the account data. But law enforcement are seeking the warrants anyway.

"Google is really standing up for its customers' privacy rights here in demanding law enforcement get a search warrant instead of one of these less protective orders," Wessler said. "That's a good thing."

The search warrants indicate that not all of the requests have resulted in the seizure of data. Google spokesman Aaron Stein declined to comment on specific cases or to clarify whether the company has pushed back against requests from Raleigh investigators specifically.

"We have a long-established process that determines how law enforcement may request data about our users," Stein said in a statement. "We carefully review each request and always push back when they are overly broad."

Google's most recent transparency report shows that there were about 5,200 search warrants requesting user information in the U.S. in the first half of 2017, an all-time high. User information requested through subpoenas and other court orders accounted for more than twice that number. The company produced at least some data in response to requests in the first of half of 2017 about 81 percent of the time.

Google declined to say whether it released data in any of the Raleigh cases, and it's unclear from the search warrants exactly what information was seized or whether it's been effective in moving the investigations forward.

Of the four cases, only one has resulted in an arrest.

Tyron D. Cooper was charged Oct. 13 with the murder of Efobi, the taxi driver gunned down in east Raleigh. But the related search warrant shows data wasn't received from Google until months later.

Cooper's attorney, Christian Dysart, declined to comment on the case.

But that delay poses another problem.

Search warrants are typically executed within 48 hours and returned to the courthouse for filing. Until then, they're off limits to the public.

The long wait time on these reverse search warrants to Google, coupled with a judicial order not to disclose the request for data to any affected users, means the documents remain secret for months.

As a result, it's difficult to say exactly how many times Raleigh police and other law enforcement agencies have employed the tactic – or how many more may be in the works.

For people who are never criminally charged, Wessler said, the lack of notification is particularly troubling.

"There's a risk that they will never learn about the search if there's not notice provided by the government, or at least by the company after they're allowed to do so," Wessler said.

While she maintains reverse searches have a lot in common with other investigative techniques, Freeman acknowledged that consumers aren't always aware of how their digital choices are effectively mapping where they've been and what they've done. Like debit card transactions and other digital fingerprints, she said, this data can be valuable to law enforcement when properly obtained.

"All of us who are living in this age of technological advances have to grapple with this issue of what are we giving up in exchange for convenience," Freeman said.

The EFF's Lacambra says it's important for users to educate themselves and advocate for policies that protect their privacy. But she argues that staying connected shouldn't mean consent to constant monitoring.

"It does not have to be that we have to give up our privacy rights in order to participate in the digital revolution," Lacambra said.

ADDITIONAL CREDITS: Design by Tyler Dukes. Motion graphics by John Renigar.

CORRECTION: A previous version of this story incorrectly spelled the name of Stephanie Lacambra, of the Electronic Frontier Foundation.