Daily Briefing for 01.24.25

At a glance.

• US court rules that the FBI’s warrantless FISA searches violated Fourth Amendment.
• US Justice Department indicts five individuals over North Korean IT worker scheme.
• Texas investigates four more car companies for alleged deceptive data collection practices.

US court rules that the FBI’s warrantless FISA searches violated Fourth Amendment

A federal court in New York has ruled that the FBI violated a US resident's Fourth Amendment rights by using communications collected under Section 702 of the Foreign Intelligence Surveillance Act (FISA) as evidence to prosecute him, Ars Technica reports. FISA authorizes the warrantless gathering of communications data from non-US residents outside the United States, but often involves incidental collection of US residents' conversations. The government's use of these communications has been a major point of controversy, with digital rights groups like the EFF and ACLU asserting that the law has led to widespread privacy violations.

Federal district Judge LaShann DeArcy Hall, in a decision made last month and unsealed this week, agreed with an appeals court ruling that "the government cannot circumvent application of the warrant requirement simply because queried information is already collected and held by the government." DeArcy Hall wrote. "To hold otherwise would effectively allow law enforcement to amass a repository of communications under Section 702, including those of US persons that can later be searched on demand without limitation. While communications of US persons may nonetheless be intercepted, incidentally or inadvertently, it would be paradoxical to permit warrantless searches of the same information that Section 702 is specifically designed to avoid collecting." The ruling stops short of banning all warrantless searches but emphasizes the need for tighter controls.

The case in question involved Albanian citizen and US resident Agron Hasbajrami, who was arrested at JFK airport in New York in 2011 and convicted of attempting to provide material support to terrorists. The Register notes that DeArcy Hall denied a request to suppress the evidence in this case for separate reasons, so Hasbajrami will remain in prison.

US Justice Department indicts five individuals over North Korean IT worker scheme.

The US Justice Department has indicted five people for their alleged involvement in a scheme that allowed North Korean nationals to gain employment with at least 64 US companies, SecurityWeek reports. North Korean nationals Jin Sung-Il and Pak Jin-Song, US citizens Erick Ntekereze Prince and Emanuel Ashtor, and Mexican national Pedro Ernesto Alonso De Los Reyes allegedly generated over $866,000 between 2018 and 2014.

The DOJ alleges, "[T]he defendants used forged and stolen identity documents, including U.S. passports containing the stolen personally identifiable information of a U.S. person, to conceal the true identities of Jin, Pak, and other North Korean co-conspirators, so that these North Korean nationals could circumvent sanctions and other laws to obtain employment with U.S. companies. Ntekereze and Ashtor received laptops from U.S. company employers at their residences, downloading and installing remote access software on them, without authorization, to facilitate IT worker access and to perpetuate the deception of U.S. companies. The defendants further conspired to launder payments for the remote IT work through a variety of accounts designed to promote the scheme and conceal its proceeds."

Texas investigates four more car companies for alleged deceptive data collection practices.

Texas Attorney General Ken Paxton has sent letters to Ford, Hyundai Motor America, Toyota Motor North America, and Fiat Chrysler Automobiles U.S., demanding information about how they collect, share, and sell consumer data, the Record reports. Paxton filed a lawsuit against General Motors in August, alleging that the automaker pushed drivers to enroll in programs that collected their data, then sold that data to insurance companies.

Paxton also sued Allstate earlier this month, accusing the insurance giant of violating the Texas Data Privacy and Security Act (TDPSA) by collecting and selling drivers' cell phone location and movement data.