The Lighthouse: Theo Hayez’s Google data with destiny
The search for Belgian teenager Theo Hayez raises questions about whether tech giants could assist police more.
When Belgian teenager Theo Hayez disappeared in Byron Bay on May 31, very little was known at first about his movements. But after his family cracked his Google account, they had an incredible amount of information at their fingertips.
Theo’s case — detailed in The Australian’s new investigative podcast series The Lighthouse — raises fresh questions about the role the tech giants play when someone goes missing, and if the companies adequately respond to emergency requests for user data. In many cases, hackers have proven more adept than law enforcement and the tech giants themselves when it comes to tracking down missing persons.
Google was tracking and recording Theo’s movements and activities on the far north coast of NSW via his smartphone, an Oppo R17. This meant his family could see he went from Cheeky Monkey’s to Cosy Corner on Tallow Beach. It was tracking his location every 15 seconds after he left Cheeky Monkey’s.
Google’s location data is accurate to within 3m for most of Theo’s route, and the trove of data from the tech giant included his precise latitudes and longitudes, time-stamped to the millisecond.
Theo’s family could see a whole range of other things as well — what Theo had looked up online, when he’d checked maps and what he was searching on the maps.
And they couldn’t just see information from that night. Google Takeout gave Theo’s family his online history for the previous five years.
The information didn’t come from a request to Google, however. It came only when his family figured out his email password and then reset his Google account password.
Data disclosure
Google’s Transparency Report, available at its website, shows Google received emergency requests relating to 18 Australian user accounts between January and June this year, producing data in 60 per cent of cases.
Overall it received 2535 user data-disclosure requests relating to Australians, handing over that data about 70 per cent of the time.
But how quickly did it provide that data and what was the extent of data it provided? Google and police aren’t saying.
“This is one of the problems with the way the international law enforcement community works,” says private investigator Ken Gamble.
“It’s all too slow. There’s a lack of direct co-operation between these big tech giants and police.
“In life-threatening situations you can’t just reach out and get the info in real time.”
In Theo’s case, family members say they expected it to take police hours if not days to get information from the tech titans. When there appeared no movement, they did it themselves, but time had been lost.
The Lighthouse is continuing to investigate Google’s role in the case. The company says it hands data over to government agencies when it believes doing so is necessary to prevent death or serious physical harm to someone, such as in cases involving missing persons, kidnappings or bomb threats.
“Our thoughts are with the Hayez family during this incredibly difficult time,” a Google spokeswoman says in a statement.
“Google co-operates with law enforcement globally on lawful data access requests and has a process in place to disclose data in emergency situations where life is at risk.”
Emergency requests must contain a description of the emergency and an explanation of how the information requested might prevent the harm.
“When we receive such a request, our team reviews the request to make sure it satisfies legal requirements and Google’s policies,” the company says on its website.
“Generally speaking, for us to produce any data, the request must be made in writing, signed by an authorised official of the requesting agency and issued under an appropriate law. If we believe a request is overly broad, we’ll seek to narrow it.”
The Google spokeswoman adds that the tech giant has worked with local authorities to assist with Theo’s case, and that it has a “well-developed process” for handling missing persons inquiries with a global team dedicated to responding to requests from authorities.
READ MORE: Timeline: Theo Hayez’s last known whereabouts | The people involved
Ethical hackers
Others, including those looking for Theo, are skipping the official channels and are instead taking the search into their own hands.
Long-time Byron Bay resident Nicoletta Revis found a hacker via Gumtree who offered to get into Theo’s data within 24 hours for $2000. In the end she didn’t need to, given his family cracked his Google account themselves.
Experts say Australia’s laws and policies need to catch up to today’s techno realities.
Last month more than 350 ethical hackers met up in 10 cities across Australia in what’s thought to be the country’s first ‘capture the flag’ hackathon dedicated to finding missing persons.
Over six hours, teams searched online for clues to solve 12 of Australia’s top-priority missing persons cases, with 100 leads generated every 10 minutes.
The disappearance of Hayez was one of the 12 cases.
The effort was organised by the AustCyber Canberra Cyber Security Innovation Node, which partnered with the Australian Federal Police, the National Missing Persons Co-ordination Centre and non-profit Trace Labs.
“Hackers are one section of the community that police haven’t really tapped into,” AustCyber executive Linda Cavanagh, who organised the hackathon, tells The Australian.
“They search the internet for any minuscule piece of digital data that can then be passed on to police for investigation. It uses the community of people who have cyber skills and don’t normally get involved in something like this.”
The hackers took information from publicly available sources, including Google searches, Google Maps, and information from user Snapchat and Instagram accounts, as well as open-source data.
One team developed facial recognition software for the event and used it to trawl the dark web, looking for the faces of the missing people to find a match.
“Police don’t have the ability to just access anyone’s information,” Cavanagh says. “They have to go through the processes dealing with multinational corporations, diplomatic means and search warrants. That presents difficulty in accessing the information quickly. A lot of this information is needed immediately, police can’t wait months to obtain it.
“Legislation and policy is yet to address these challenges.”
Off the back of the success of the hackathon, Cavanagh is working on establishing a 24/7 online platform in which ethical hackers can assist police in missing persons cases.
Crowd-sourced searches
Australian Federal Police Assistant Commissioner Debbie Platz says crowd-sourcing like this opens up a whole new way of policing that will hopefully lead to solving more missing persons cases.
“Police often say that the community are our eyes and ears. We’re taking this concept to a new level,” she says.
“By involving the community, and in this case hackers, into the search for missing persons, we hope to solve more long-term missing person cases in a way that police could not do alone.”
An AFP spokeswoman declined to comment on Theo’s case specifically but says police work with the tech industry to try to provide answers to families about missing loved ones.
About 38,000 missing persons reports are made to police every year in Australia, which is more than 100 people a day, she says.
“While the majority are found quickly, there are more than 2600 long-term missing persons in Australia, people who have been missing for three months or more,” the spokeswoman adds.
“In 2017, Australian law enforcement worked with tech giant Facebook on the national rollout of the Facebook AMBER Alert system, providing a vital tool to find and return abducted children.
“While the rate of stranger abductions in Australia is low, with around 15 million Australians active on Facebook, the national rollout of the Facebook AMBER Alert initiative recognises state and territory police’s commitment to ensuring the safe and immediate return of children, particularly in the first crucial hours of a child’s abduction.”
Working with police
Some say the tech giants need to do more when it comes to proactively working with law enforcement.
US-based social network Nextdoor, which is sometimes dubbed the “anti-Facebook”, is a platform for neighbours to interact.
CEO Sarah Friar, who was in Australia and appeared on ABC’s Q&A program last week, says her platform works with thousands of police officers worldwide and gives them a special version of Nextdoor for public services, where they can share crime and safety updates directly with residents.
“We’ve seen at least one case already where police have found a missing person in less than 30 minutes after posting on Nextdoor, thanks to essential tips from neighbours in the area,” Friar tells The Australian. “Our members’ privacy is, and has always been, our highest priority. Therefore, as a general rule, we will share member information with law enforcement only in response to a valid legal request such as a search warrant, court order or subpoena.
“There may be some cases such as Theo’s case, however, where we receive a request of an urgent or exigent nature. In those cases, if we believe that sharing information is necessary to prevent death or imminent harm, we will provide an expedited response in accordance with our Privacy Policy and in compliance with applicable law.”
Theo’s cousin Michael Dorkhom, who was the first to access Theo’s Google account, says the relationship between police and the tech giants is burdened with privacy regulations and rules that prevent the police from accessing missing persons’ data easily.
“I’m not exactly sure what hoops they need to go through to get to there,” he says.
“A request to get access to this data was sent 10 days before we got it, and we finally got access to it.
“What happened between the moment that request was sent and 10 days later, I’m not too sure.”