When two Minneapolis police officers shot and killed Thurman Blevins in a Northside alleyway in June, the case was handed over to investigators at the Minnesota Bureau of Criminal Apprehension (BCA). As part of that process, the BCA seized and analyzed Blevins’ cell phone, and the department-issued iPhones assigned to Officers Justin Schmidt and Ryan Kelly, who fired the fatal shots.
On Monday, as it was announced that no charges would be filed against the officers, the BCA published over 2,000 pages of documents relating to their investigation, audio recordings of interviews, and dozens of body camera videos. But the BCA also published copies of the forensic analysis of the three cell phones, in full, and without any apparent redactions.
The forensic snapshots included all of the content on the devices, such as photographs and videos stored on the phones, text and chat history, call logs, contact lists, web browser history, and the contents of internal databases used by the devices to connect to various online services. Some of the data published online by the BCA was not legally public, and none of it was relevant to the shooting.
While the officers’ department-issued phones were used predominantly for work purposes, a significant amount of personal data was also published by the BCA, such as information about one of the officer’s Amazon purchases, stock market trades, Airbnb and rental car reservations, and history of watched TV shows and videos. One of their phones revealed their personal email address and the contents of their Pinterest account.
The officers’ search history reflected frequent lookups of various laws and ordinances, pill identification websites, and news stories about law enforcement activity. But the searches also included those of a more personal nature, from political issues to vacation planning.
The material published by the BCA also included text messages. On the officers’ phones, most of the messages were law enforcement-related, such as texts with other officers about cases or scheduling, texts encouraging a wanted person to turn themselves into police, and texts with a friend of a victim advising which hospital they were going to. But many of the released text messages were personal conversations with friends, and one of the officers had extensive, highly-personal text exchanges with his girlfriend published online by the BCA.
The BCA’s public release included a comprehensive analysis of device location history, including the officers’ visits to various locations in Minneapolis during shifts, but also documenting visits to restaurants and bars, a health clinic, and GPS data identifying an officer’s home was released. The database also included a history of connections to wi-fi access points, some of which were geographically identified. Both of the officers’ home wi-fi network passwords were included in the release, and one of the officer’s home addresses was published.
“I’m obviously disappointed that they published my home address. That’s a huge risk. They clearly weren’t thinking about that,” said Officer Schmidt, reached by phone.
Investigators did not recover as much data from Blevins’ phone, as the phone was just activated the week before the shooting. However, about 600 text messages were published from Blevins’ phone, including conversations with friends and family members.
The photos stored on the officers’ devices and published online by the BCA mostly appeared to be work-related, such as pictures of syringes, work schedules, and vehicle identification number plates, but one of the officer’s phones contained a video recorded inside his home living room, which identified where he lives. Blevins’ phone contained photos from a trail along the Mississippi River, including some selfies taken the night before the shooting.
The BCA’s forensic software captured passwords and authentication keys that were saved on the officers’ devices. This included passwords to the officers’ City of Minneapolis email accounts and an app to track the locations of other officers, as well as digital keys to upload and access evidence files. Each of these passwords and keys were published online by the BCA, in clear, readable text.
The BCA also published logs documenting every call placed to or from the officers’ cell phones; about six months of history for one officer, and 22 months of phone calls for the other. It was not possible to determine whether any of these numbers were associated with informants or victims, but at least one number was associated with an undercover officer, which must be protected under state law.
Blevins’ cell phone log showed friends and family repeatedly calling him in the minutes and hours after his death, prior to knowing about his death.
The officers’ phones contained documents which included the name, home address, and photograph of a minor, which is classified as private under state law. The contact lists of the phones were also included, which revealed the names and numbers of Blevins’ friends, family, and associates, as well as those of the officers. The BCA’s release disclosed the cell phone numbers of police command staff, and a non-public phone number that routes to an on-duty Hennepin County judge’s cell phone 24 hours a day.
Publication of this story was delayed until the data was taken offline. The release of data was reported to the BCA and the Minnesota Department of Public Safety (DPS) which houses the BCA, but the BCA did not take the material off the internet until over 18 hours after being advised of the content. The publication was also reported to City of Minneapolis staff in charge of data management and communications, and the Minneapolis Police Department.
“[The BCA] obviously didn’t run it through their data practices folks,” said John Elder, Public Information Officer for the Minneapolis Police Department. He said the Chief’s office contacted the officers and advised them to change their passwords. The MPD was not aware of the BCA’s intent to release the data in advance.
Bruce Gordon is the Director of Communications for the DPS. Reached by phone, Gordon said he wasn’t sure if the BCA’s public release of the cell phone data was intentional. After advising him of some of material that could be accessed in the data, Gordon responded, “Oh, you’re kidding, wow.” He said he would look into the matter, but did not respond to later requests for comment. The BCA did not respond to multiple requests for comment prior to publication, but after sending a third request, the BCA removed the material from their website.
After publication of this story, Jill Oliveira at the BCA provided a one-sentence comment: “The data has been removed.”
The BCA’s publication violated state law requiring the protection of undercover officer names and juvenile identities, but while it might seem like an invasion of privacy and common sense that sensitive data like old communications with family, home addresses, and passwords would be protected under law, it’s a bit more complicated.
The Minnesota Government Data Practices Act provides numerous provisions allowing or requiring data to be withheld, even affording law enforcement substantial discretion to withhold any information it deems “security information.” But if data is used in a criminal investigation, many of those provisions do not apply.
“If all of that information was part of their investigation … generally that kind of personal data doesn’t have protection once that investigation is complete,” said Stacie Christensen, Director of the Data Practices Office at the Minnesota Department of Administration. Christensen said the legality of release hinges on whether the BCA used the data as part of their investigation.
According to BCA reports and executed search warrants, the BCA’s purpose for analyzing Blevins’ phone was to determine his “movement and communications before the shooting,” and the investigators sought to determine whether the body camera video, accessible on the officers’ cell phones, had been altered. However, investigators asked the judge to authorize a much larger scope for the phones: “all data contained within the seized cellular phone[s].” In notes added to the BCA’s investigative files, agents only looked at the most recent location and communications history on the devices.
The 2014 Minnesota Court of Appeals opinion in Gregerson v. Hennepin County involved a case where a man submitted a public records request for the contents of a forensic snapshot of a hard drive in a criminal case. The Court found that a search is authorized only for information relating to crimes, and that anything beyond that would be a violation of the owner’s Fourth Amendment right to privacy, be it part of the investigation or in response to a public records request. But here, a judge authorized a search of everything on the cell phones belonging to Blevins and the involved officers.
If BCA agents looked through the entirety of the cell phones, most of the data on the devices would become public upon closure of the investigation. But if the scope of the BCA’s review was more narrow, only the portions they reviewed would become public; in this case, nothing.
For over 30 years, Don Gemberling managed the state office that provides guidance to Minnesota government and members of the public on data and privacy issues. He said that while the law was written with future advancements in technology in mind, the scope of law enforcement investigations has dramatically widened, especially with respect to forensic searches of smartphones. Christensen agreed, noting that the Data Practices Act “clearly was not written with a forensic investigation of a phone” in mind.
The struggle of balancing privacy and transparency in state law is reflected in numerous administrative advisory opinions and court cases, and Christensen encouraged the Legislature to look into the issue of privacy in law enforcement investigations, but Gemberling cautioned that doing so might hinder accountability efforts, such as the Star Tribune’s recent reporting on why so many sexual assault cases go unsolved.
It remains unclear how many times the cell phone data in this case were downloaded from the BCA website prior to their removal this morning, or whether the BCA will revise any data release procedures going forward. Attempts to reach Blevins’ family were not immediately successful.
Tony Webster • email@example.com • (202) 930-9200