Megan Boken was chatting with her mom on her new iPhone on August 18, 2012, when a thief shot her dead on the street in St. Louis, Mo. He wanted the 23-year-old’s smartphone.
A new law signed in California this week is designed to eliminate the incentive for smartphone-related crimes like the one that killed Boken. The law requires all cellphones sold in the state to come with a “kill switch” that allows phones to be remotely disabled, rendering them useless to thieves.
Since there’s little point in making only smartphones in California comply with the new law, the legislation likely will push the wireless industry to adopt kill switches as a default feature on all phones in the United States and worldwide.
Most major smartphone manufacturers and cellular providers in the United States already are moving in that direction, with Apple, Google, Microsoft and others announcing their intention to equip all phones built after July 2015 with anti-theft software, at no cost to consumers.
Consumer advocates and law enforcement officials cheer the prospect, calling the kill switch a powerful tool to protect smartphone users.
“We hope it will be a market changer,” said Elisa Odabashian, who lobbied for the California bill as director of the West Coast office and state programs for Consumers Union, the advocacy arm of Consumer Reports.
But privacy groups worry that the technology could be abused by government authorities or police, and mobile carriers have raised concerns that a kill switch could make smartphones more vulnerable to hackers.
“We’ve seen instances of governments abusing the ability to block communications both home and abroad; while this bill acknowledges safeguards to prevent such abuses in California, a large barrier – technical access to our phones – will have disappeared,” protested the digital civil liberties group Electronic Frontier Foundation in a written statement.
Sponsored by state senator Mark Leno, California’s kill switch law follows a similar one enacted in Minnesota in May. In Minnesota, however, it’s up to users to download and enable anti-theft technology, whereas in California the kill switch functionality must be preloaded onto the phone.
Kill switch bills also are being considered in Illinois, New York and Rhode Island.
A federal version, dubbed the Smartphone Theft Prevention Act, was introduced by Democrats in the U.S. Congress earlier this year.
Among those pushing for mandatory kill switches are Boken’s family.
“Megan lost her life because people can sell stolen smartphones without any fear of getting caught,” Boken’s father, Paul, said in a hearing on the bill before the California State Senate’s energy committee in April. “This legislation would shut down the market for stolen smartphones, which will end the victimization of innocent smartphone customers.”
The gunman in Boken's killing, 19-year-old Keith Esters, pleaded guilty last year and was sentenced to 50 years in prison.
An estimated 3.1 million smart phones were stolen in the United States last year, up from 1.6 million in 2012, according to a recent survey by Consumer Reports.
The survey found that although many people use their phones to store passwords, credit cards, Social Security numbers and other sensitive information, only 26 percent of them take the precaution of using a password or screen lock on their phone.
“Most people aren’t smart about their smart phones,” said Odabashian, of Consumers Union. “They put a lot of personal data on their phone and then they don’t protect it, so a huge part of this is to combat the theft that goes on, the violent theft that is going on in major cities around cell phones.”
For privacy groups, however, the concern is that the California bill isn’t explicit about who can activate a kill switch, and the technology could potentially be abused law enforcement or government authorities.
The California bill allows law enforcement to use the kill switch under certain conditions outlined in the state’s public utility code, which gives police the ability to cut off communications with a court order or in an extreme emergency that presents an “immediate danger of death or great bodily injury.”
This means that police could use the kill switch to shut down phones as a means of disrupting protests if they deemed the situation sufficiently dangerous, said Jake Laperruque a fellow on privacy, surveillance and security at the Center for Democracy & Technology.
Recent events in Ferguson, Mo., highlight the risks of abuse, Laperruque wrote in a blog post this week.
“Police have repeatedly attempted to disrupt protests and ordered both demonstrators and press to turn off recording devices,” he wrote. “If the California bill were in place in Missouri, these officers might deploy the government kill switch alongside tear gas and rubber bullets, using the mandated technology to stop coordination between protesters, cut off access to outside information, and shut down video recordings that can deter police misconduct.”
A trade group representing the wireless communications industry – CTIA-The Wireless Association – also has warned that hackers could permanently disable phones if they crack users’ kill switch codes.
The association called the California law unnecessary, given the voluntary steps companies already have taken to deter smart phone theft.
In addition to rolling out stolen phones databases and anti-theft apps, the association earlier this year unveiled a voluntary, industry-wide commitment to implement uniform anti-theft measures on smartphone devices nationwide by July 2015.
“Uniformity in the wireless industry created tremendous benefits for wireless consumers, including lower costs and phenomenal innovation,” said Jamie Hastings, vice president of external and state affairs for the association, in a statement.
“State by state technology mandates, such as this one (in California), stifle those benefits and are detrimental to wireless consumers,” Hastings said.
Now that the California bill has become a legal reality, however, mobile carriers are busy reviewing the full text of the legislation to assess how it might impact their business.
A spokeswoman for Sprint acknowledged that more needs to be done to protect consumers from smartphone-related crime.
Spokeswoman Crystal Davis said the Kansas-based company is working with handset vendors on adding more features to protect customers.
“While open to a kill switch option, Sprint remains concerned that ‘permanent’ kill switches could lead to unintended consequences for customers, reputable recycling programs and legitimate used or trade-in devices, given that many devices reported lost or stolen are subsequently found by their owners,” Davis said.
Odabashian said consumer advocates and law enforcement officials championed the kill switch because they really want to protect the public.
“We’ll see how it works,” she said. “We make these laws and you never know, there might be unexpected consequences. I don’t worry about (abuse of the kill switch). And you know what, if that becomes an issue we will do another law.”