VIA MISSISSIPI COUNTY SHERIFF'S FACEBOOK
Suspended Sheriff Cory Hutcheson illegally tracked cell phones, authorities say.
Cory Hutcheson was ahead of his time.
Last week, a U.S. Senator from Oregon called for an investigation into the security and software company that the now-suspended rural Missouri sheriff used to track cell phones of five state troopers, the former sheriff and a sitting judge in the Bootheel. The New York Times published a story online Thursday, leading to flurry of articles in other media.
For many, it was the first time they had heard of the company in question, Securus Technologies Incorporated. And they were stunned to learn the private firm could pinpoint any of millions of people's cell phones "in seconds."
But Hutcheson had been well aware of its powers for years.
If his name sounds familiar, it should. We've written extensively about the Mississippi County sheriff's legal troubles, including a cover story in April 2017. The tough-talking lawman, a Republican elected in the Trump wave of 2016, didn't even last six months in office before being hit with criminal charges. He currently faces charges for more than two dozen state and federal crimes, including robbery and identity theft.
He is also being sued in numerous civil suits. One was filed by the family of a woman who died of a drug overdose in the Mississippi County jail as staff allegedly mocked her. Another was filed by the ACLU on behalf of a former inmate who claims her baby was stillborn because jail staff refused to get her medical help. Hutcheson was the jail administrator at the time of both incidents.
There is more, but the latest interest is the Securus business. As the service provider for pricey inmate phone calls, it is a major contractor at facilities around the country.
Tracking cell phones is a little-known side service. Sen. Ron Wyden (D-Oregon) says he only recently learned about it but sees potential for some serious invasions of privacy. As he and the Times story revealed, Securus buys location data through a middleman from all the major carriers, including AT&T, Sprint, Verizon and T-Mobile. It then makes that data available to its government clients through a convenient web portal.
All a client — say, the administrator of a Bootheel jail — has to do is go online, punch in the phone number they want to locate, upload a legal document that says they have permission to access that info and then click an authorization box. Securus pulls up the phone's GPS data and delivers a location within moments.
As a selling point, law enforcement has reportedly been able to find wandering Alzheimer's patients and move quickly in other emergency situations.
But Wyden says its a system ripe for abuse, and he is asking the Federal Communications Commission to investigate. He has also written to wireless carriers, warning them they could be responsible for Securus jeopardizing the security of their customers' data. He likens the authorization process of Securus' web portal to a "pinky promise" between the company and its clients.
"This practice skirts wireless carriers' legal obligation to be the sole conduit by which the government conducts surveillance of Americans' phone records and needlessly exposes millions of Americans to potential abuse and surveillance by the government," he writes in a letter to the FCC chairman.
Wyden says the cell phone companies are legally obligated to protect customers' data and personally vet any law enforcement requests for that data. Instead, they're selling that data to other companies that do little to safeguard it. Top officials at Securus have told Wyden that they do nothing to make sure that the affidavits or other legal documents submitted by law enforcement are legit or actually give them permission, he writes in his letters.
In case anyone needed an example of what could go wrong, the Times story lays out Hutcheson's case.
The Missouri Attorney General and the U.S. Attorney for the Eastern District of Missouri have filed separate criminal cases against the suspended sheriff, alleging he repeatedly and illegally accessed cell phone data.
In a probable cause statement filed last year and obtained by the Riverfront Times, Missouri State Police claimed Hutcheson used the Securus service to track or "ping" cell phones of troopers, then-Sheriff Keith Moore and Judge David Dolan between July and November 2014.
"Those 'pings' provide the current location of cellular telephones in near real time," state police Corporal D.B. Reed writes in the probable cause statement.
To gain access, Hutcheson uploaded to the portal affidavits that falsely made it appear he had permission for what amounted to warrantless searches, state police say. Even a quick scan of the documents should have revealed them as illegitimate. State police say Hutcheson was listed as both the author and notary on the affidavits, which isn't allowed. But Securus handed over the information anyway.
Moore was Hutcheson's boss at the time of the tracking, and the two were quickly becoming rivals. Hutcheson ultimately ran against the longtime sheriff in 2016 and unseated him following a bitter campaign. He took office in January 2017 and was in the job less than a year before he was arrested and suspended from duty.
Moore told the RFT last year that Hutcheson had been under investigation for years. He said the FBI seized Hutcheson's work computer back in 2014.
Hutcheson has continuously denied any wrongdoing. He is fighting the criminal charges, civil lawsuits and suspension of his peace officer's license.
We welcome tips and feedback. Email the author at [email protected] or follow on Twitter at @DoyleMurphy.
