Keynote: Threat Modeling and Constitutional Law

Overview: In this Black Hat keynote, civil liberties attorney Jennifer Granick examines how the expanding digital attack surface has outpaced Fourth Amendment constitutional protections, requiring security practitioners to incorporate government surveillance into their threat models. Drawing an analogy to Marvel's Avengers—where SHIELD weaponizes the Tesseract while hunting Loki—Granick illustrates how state entities often represent an overlooked threat vector alongside traditional cybercriminals. She details how modern bulk data harvesting, commercial data brokers, administrative database commandeering, and reverse search warrants routinely circumvent constitutional safeguards designed to curb dragnet surveillance.

Key Topics: - Expanding security threat models to encompass state actors and law enforcement surveillance - Constitutional limitations: Fourth Amendment particularity vs. modern dragnet surveillance - Commercial data brokers as an end-run around Fourth Amendment warrant requirements - Commandeering civil databases and reverse search warrants (geofence and reverse keyword searches)

Technical Details: Granick explains that the Fourth Amendment was engineered to curb general warrants by demanding probable cause and strict particularity—limiting searches to specific places and items rather than broad sweeps, as echoed in the Supreme Court's 2018 Carpenter decision regarding cell phone location records. Historically, personal privacy was protected by physical ephemerality; today, ubiquitous telemetry, automated license plate readers (ALPRs), cell phone location records, and web histories create perpetual digital dossiers. This vast telemetry is actively exploited through commercial data brokers, a multibillion-dollar ecosystem that harvests location data and advertising IDs from innocuous mobile apps. Government agencies—including both the Trump and Biden administrations—regularly purchase bulk location records tracking hundreds of millions of devices directly from brokers, entirely evading the judicial oversight and particularity mandates of traditional warrants.

Furthermore, state entities increasingly commandeer databases originally established for mundane administrative functions. Granick highlights efforts to repurpose IRS tax databases—spanning approximately 7 million records protected by statute—as well as housing, healthcare, and labor records for immigration enforcement and mass deportation operations without judicial review. Additionally, law enforcement routinely issues "reverse search" warrants, inverting the investigative paradigm from "where was a specific suspect" to "who was near a geographic coordinate or searched for a specific keyword." Using geofence warrants against Google's Sensorvault repository, police compel disclosures across entire city blocks encompassing thousands of innocent bystanders. Federal courts remain sharply divided over reverse searches: while some judges rule that bulk database queries constitute unconstitutional general warrants, others apply the third-party doctrine, asserting that users surrender reasonable expectations of privacy once data resides on third-party servers.

Key Takeaways: Security architects and engineers must include state surveillance in enterprise risk assessments and avoid building enticing bulk data repositories. Organizations should enforce strict data minimization—collecting and retaining only the telemetry essential for immediate operations—and implement architectural privacy controls, such as client-side encryption and decentralizing data storage (exemplified by Google moving location histories on-device). Finally, companies handling sensitive user information must establish clear legal protocols to contest overbroad subpoenas and non-disclosure gag orders, and mandate notifications to affected users when records are requested by law enforcement.

(AI summary — Gemini Flash)