O

n June 17, 2019, at around 8:30 in the evening, 18-year-old Wasim Ibrahim Abu Shuldum was shot dead in Hura, a Bedouin town in southern Israel. Three rounds to the abdomen and neck ended his life. Minutes after the gunmen fled the scene in a car, reports came in about a Mazda on fire on the outskirts of town.

Detectives quickly put two and two together and concluded that the two incidents were connected. The license plate of the torched vehicle was still legible, and the number was fed into police computers. Almost instantaneously, police were able to retrace their suspects’ exact movements.

Three people were arrested, and two months later, they were charged with murder. The indictment included, in meticulous detail, their precise movement in the days leading up to the murder. The details – down to the minute – allowed police to pinpoint the vehicle’s exact location right up to the moment it was found.

According to the charge sheet, a few days before the murder, the defendants drove to Tul Karm, a Palestinian city in the West Bank. The suspects drove there in BMW, but returned shortly afterward with another vehicle – the Mazda that would later be discovered in flames. It was also alleged that two of the defendants drove to Hura in the Mazda, but left their cellphones in Lod. The third suspect, according to the indictment, joined them in Hura a short while later in the BMW.

Ali Abu-Laben, a public defender representing one of the suspects, wasn’t surprised to learn that the material from the police investigation includes a significant amount of evidence obtained via the tracking of the three suspects’ phones, along with various other digital surveillance methods. It is not unusual for law־enforcement agencies to use the digital signature left by the perpetrators to solve crimes.

"But," says Abu-Laben, "at the bottom of one of the pages showing a photograph of the car, I saw the words, ‘the system.’ I knew I wasn’t dealing with a run־of־the־mill surveillance system."

The ‘system’ which Abu-Laben stumbled upon is known within the police force as Hawkeye. It has been operational, in one form or another, since 2013. Initially, it was intended for use in combatting traffic violations, but officers quickly realized its potential in investigations and intelligence־gathering. It is, of course, a completely separate system to one used by the National Traffic Police, which uses cameras that do not store data.

At its heart, Hawkeye is designed to create an enormous database of information about all the vehicles and drivers who use the roads on which it is installed. Officers hoping to retrace suspects’ movements can enter the license plate number into the system and get an extensive history of all the routes taken by that vehicle.

An internal police document obtained by Shomrim makes it clear how the system works. "The police system handles all the files received from the cameras at one central location, which also includes a control system. This center receives signals, at one־minute intervals, from each of the cameras to indicate that it is functioning, connected to the network, and receiving and sending data, including time synchronization." The document also states that the system sends a location and timestamp that cannot be changed, and is synchronized with an American server.

Compared to cameras designed to capture traffic violations, these cameras are installed relatively close to the ground; although they’re designed to record license plates, the faces of the drivers are also readily captured.

"We had a case in which we apprehended a suspected car thief and he claimed he wasn’t behind the wheel of the car, and that a friend was. But we had a photograph that clearly showed he was lying," an officer familiar with the system tells Shomrim, proudly adding that, "the system was used to locate a car that was stolen in Bnei Brak just last night."

The Nonexistent System

From a technological and policing perspective, the system appears to rather impressive. There is, however, one substantial problem: The use of Hawkeye is not regulated by law. The system, in fact, doesn’t officially exist. It isn’t registered as a database, as required by law.

The procedures for using the system are vague at best. As far as anyone knows, the police have yet to formulate any official procedures at all, and it remains unclear who is allowed to use it – and, more pertinently, who is not – and under what circumstances. There’s also no way of knowing whether the system periodically deletes data and whether safeguards are in place to protect highly sensitive information about the movements of each and every Israeli citizen.

The fraught issue of sensitive personal data in the wrong hands is especially relevant in Israel today, given the debate over emergency COVID–19 regulations allowing the Shin Bet, Israel’s domestic security service, to track citizens’ cellphones. The Shin Bet, however, was only given permission to do so for a limited period and a mechanism was put in place to regulate the collection of the data. Moreover, the Shin Bet was required to report to the attorney general.

"Just look at the debate over the Shin Bet’s [cellphone] tracking," says Abu-Laben. "Not only in the High Court, but in the Knesset and media, too. So many words and so much energy devoted it. Yet here we have a system that’s been operating now for years, illegally and without supervision, and we’re all being monitored by it. When you want to get an image from one of the Highway 6 cameras, you have to request a court order, but Hawkeye doesn’t operate in accordance with regulated procedures. People are being monitored nonstop, and maybe that’s okay, but I want to know who’s keeping track of me and what for."

Attorney Ali Abu־Laben, Public Defender’s Office: "Just look at the debate that ensued over the Shin Bet security service’s tracking [of cellphones], and not only in the High Court but in the Knesset and media, too. So many words and so much energy devoted to it. Yet here we have a system that’s been operating now for years, illegally and without supervision, and we’re all being monitored by it. People are being monitored nonstop, and maybe that’s okay, but I want to know who’s keeping track of me and what for."

‍

Despite insisting that, "in principle, I have no problem with the system and even think that it’s important," Abu-Laben has asked the court to suppress evidence obtained by Hawkeye – on the grounds that it’s illegal.

"I am very troubled by the fact that the system isn’t legally regulated and we don’t have information on who has access to it, who can use it, who’s responsible for safeguards, and how often the data is erased."

This is not an isolated incident. There has been an uptick in defense lawyers asking courts to rule evidence obtained by Hawkeye inadmissible simply because the system itself is illegal and has been used by the police for years without anyone taking the trouble to regulate it.

One such case came last month before the Jerusalem Traffic Court. In court, Daana argued that, since he had not violated any traffic regulations, police had no right to arrest him – even though his license had been suspended. The officers only discovered that Daana did not have a valid driver’s license by running his plates through the computer and that, Daana argued, was a violation of his rights.

Judge Naeel Mohana, deputy president of the Jerusalem Traffic Courts, denied Daana's request to throw out the case, but he did warn police that their conduct was problematic.

"The police," he wrote in his ruling, "are using and operating a system without being sanctioned by the courts to do so. Moreover, the police have not presented the legal authority that permits them to use this system so extensively, as is customary with its other databases."

According to Mohana, this "raises concerns about the violation of basic rights." He went on to urge authorities to ensure that future use of Hawkeye "be defined by law or in accordance with the law – in order to preserve, insofar as is possible, the right to privacy and the values of democracy."

Mohana agreed that Hawkeye "can serve as an effective tool in the fight against crime," but, he added, "the fact that the system has been used until now in the absence of any legal regulation" is problematic.

One former officer, who is very familiar with Hawkeye, backed the use of the system. "The police use various systems and I strongly support most of them, which demonstrate just how important they are," he says. "In other countries, where privacy is paramount, they use even more extensive systems – in Germany, for example. Civil rights are a matter of striking the correct balance: Do you want to know the particulars of a vehicle that’s being driven by a rape suspect? Yes, you do. The police weigh up when to use the system and when not to. The police possess a large amount of sensitive information that comes from other sources too. We know how to deal with it, and not everyone can receive and see whatever they want."

On the Main Traffic Thoroughfares

When it comes to monitoring vehicular traffic, almost every inch of Israel is covered. There are police traffic cameras and Public Works Department cameras; there are cameras on toll roads, on the railways and buses; local authorities have their own networks of security cameras; and there’s barely a parking lots, stores or private business that doesn’t have cameras installed. Hawkeye was added to this impressive array some seven years ago. It was purchased from Hikvision, a partially state־owned Chinese manufacturer and supplier of video surveillance equipment for civilian and military purposes. At first, the system was installed in the south of the country, but has since been expanded and now covers all the main traffic thoroughfares.

"In the past, the system was used exclusively by the police’s Intelligence Division," says Abu-Laben. "When images of criminals that were captured by Hawkeye were presented in court, the police tended to keep them secret."

Over the past 18 months, however, the police appear to have changed their approach and have started submitting the images as part of the evidentiary material. Responsibility for the system has also switched hands, and it comes today under the purview of the Logistics Division, which is responsible for the technologies employed by the Israel Police.

"The system is managed by the tech people at the National Headquarters’ Teleprocessing Division, behind a secured door," a police officer from the Intelligence Division told Shomrim. "It’s relatively secure, and they work with the various districts, but truth be told, it used to be more secure. An officer in one of the districts who needed data would have to submit a request and also fill out a form to explain the purpose. Today, it’s very easy to access the system, and almost any cop can retrieve information from it."

Mohana also addressed this point in his ruling last month. "Giving hundreds or thousands of police officers access to this information, without any supervision over the extent to which they need it, if at all, seems problematic to me," he wrote. "This practice could raise concerns about the unsupervised use of such information and the potential violation of civil rights, including the right to privacy. In this case, the threat to privacy is not theoretical."

The matter is so non־theoretical that it came up for discussion two years ago, during a meeting of the Knesset Science and Technology Committee. The panel had convened to discuss the police’s technological advances over the past decade and, until the issue of data protection was raised, was primarily self-congratulatory.

"We’re talking here about the collection of huge amounts of information by various means," warned Dr. Tehilla Shwartz Altshuler, a senior fellow at the Israel Democracy Institute. "All the means used by the police – including private companies, of course – create amounts of data that are unprecedented in the history of mankind. Police can now obtain insights that were impossible before."

The head of the Logistics Division, Deputy Commissioner Shai Cooperman, was quick to reassure members of the committee that, "we are sticklers for the rules. We have every respect for those bodies which ensure that privacy is protected and laws upheld. We take these issues very seriously. In no way does the Israel Police handle data contrary to the law, or make use of such data – other than in a proportional and responsible manner."

"We cannot shy away from using this technology," he added. "We need to use it sparingly, and to refrain from exploiting this authority and these tools, but we also need to use it to solve cases, to get to places we aren’t able to get to today."

Whether or not the police are, indeed, using data in "a proportional and responsible manner" is open to debate. In one recent case, an Israeli man on a family vacation in Eilat was detained by police at a checkpoint at the entrance to resort city. Officers spotted on their computers that the man had subpoenaed to testify in an upcoming court case and detained him for an hour while looking into the matter. After he was released the man successfully sues the police for unlawful detention and was awarded $880 compensation.

"A Wide Range of Means"

The same former officer quoted above prefers to highlight the positive uses of Hawkeye. "I remember well an incident in which a woman briefly got out of her car, leaving an infant inside the vehicle, when a thief got in and drove off," he says. "Obviously, the mother was frantic, but we were able to locate the vehicle very quickly and rescue the infant. Had it not been for Hawkeye used, we would not have been able to find the vehicle so quickly and return the child to his mother."

The officer, who oversaw use of Hawkeye, insists that the locations of the cameras and how the system works must remain secret. "The less the criminals know, the more successful we will be," he says. "This is an important system that helps solve crimes."

Judge Naeel Mohana: "The police are using and operating a system without being sanctioned by the courts to do so. Moreover, the police have not presented the legal authority that permits them to use this system so extensively, as is customary with its other databases."

In the absence of clear and comprehensive police data, however, we have to rely on figures from just one police district from which Shomrim managed to obtain information to try to understand how effective the system is. According to this information, Hawkeye played a role in solving 35 percent of the criminal cases in which a vehicle was involved. "Do you get what a huge service Hawkeye provides to Israeli citizens? The data clearly shows that it helps us to get to those we need to find quickly," says one officer who uses the system.

Among the troubling questions that remain unanswered, despite repeated requests, are: How long is the information is stored in the system? How often is it deleted? What level of security is used? And who supervises the information? According to a senior officer questioned on the matter, "The system stores data. Does it store the data for five years or two days? That I don’t know, but it certainly stores information from the past."

Another police officer told Shomrim that the system stores data for several months, and that a quick check of the car's license plate number can yield information about where the car was up to a year ago.

In response to a query on the subject from an Israeli non־profit, the police said a few months that the, even though the system has been in operation for years, procedures were still being formulated.

In response to an approach from Shomrim, the Israel Police stated: "The Israel Police makes use of a wide range of technological means that facilitate optimum protection for the normative citizen and better police handling of the areas under its responsibility – preventing and exposing crime, locating criminals, and preserving the safety and security of the public. The means are legally valid and are used under supervision and in a regulated manner in keeping with the needs. Naturally, we don’t offer details about these means that help preserve the safety and security of the public."

According to a statement from the Justice Ministry, "an inquiry submitted to the Privacy Protection Authority reveals that a database named Hawkeye doesn’t exist. That said, the database may be registered under an alternative name."