Smartphone Kill-Switch Mandate Raises Privacy, Civil-Liberty Concerns

Megan Boken was chatting with her mom on her new iPhone on August 18, 2012, when a thief shot her dead on the street in St. Louis, Mo. He wanted the 23-year-old’s smartphone.

A new law signed in California last week is designed to eliminate the incentive for smartphone-related crimes like the one that killed Boken. The law requires all cellphones sold in the state to come with a “kill switch” that allows phones to be remotely disabled, rendering them useless to thieves.

Since there’s little point in making only smartphones in California comply with the new law, the legislation likely will push the wireless industry to adopt kill switches as a default feature on all phones in the United States and worldwide.

Most major smartphone manufacturers and cellular providers in the United States already are moving in that direction, with Apple, Google, Microsoft and others announcing their intention to equip all phones built after July 2015 with anti-theft software, at no cost to consumers.

Consumer advocates and law-enforcement officials cheer the prospect, calling the kill switch a powerful tool to protect smartphone users.

“We hope it will be a market changer,” said Elisa Odabashian, who lobbied for the California bill as director of the West Coast office and state programs for Consumers Union, the advocacy arm of Consumer Reports.

But privacy groups worry that the technology could be abused by government authorities or police, and mobile carriers have raised concerns that a kill switch could make smartphones more vulnerable to hackers.

“We’ve seen instances of governments abusing the ability to block communications both home and abroad; while this bill acknowledges safeguards to prevent such abuses in California, a large barrier — technical access to our phones — will have disappeared,” protested the digital civil-liberties group Electronic Frontier Foundation in a written statement.

Sponsored by state senator Mark Leno, California’s kill-switch law follows a similar one enacted in Minnesota in May. In Minnesota, however, it’s up to users to download and enable anti-theft technology, whereas in California the kill-switch functionality must be preloaded onto the phone.

Kill-switch bills also are being considered in Illinois, New York and Rhode Island.

A federal version, dubbed the Smartphone Theft Prevention Act, was introduced by Democrats in the U.S. Congress earlier this year.

For privacy groups, however, the concern is that the California bill isn’t explicit about who can activate a kill switch, and the technology could potentially be abused by law-enforcement or government authorities.

The California bill allows law enforcement to use the kill switch under certain conditions outlined in the state’s public-utility code, which gives police the ability to cut off communications with a court order or in an extreme emergency that presents an “immediate danger of death or great bodily injury.”

This means that police could use the kill switch to shut down phones as a means of disrupting protests if they deemed the situation sufficiently dangerous, said Jake Laperruque, a fellow on privacy, surveillance and security at the Center for Democracy & Technology.

Recent events in Ferguson, Mo., highlight the risks of abuse, Laperruque wrote in a blog post last week.

“Police have repeatedly attempted to disrupt protests and ordered both demonstrators and press to turn off recording devices,” he wrote. “If the California bill were in place in Missouri, these officers might deploy the government kill switch alongside tear gas and rubber bullets, using the mandated technology to stop coordination between protesters, cut off access to outside information, and shut down video recordings that can deter police misconduct.”

This article appeared in print in the September 1st, 2014 edition of Hamodia.