The escape of Morales, who had been convicted of stealing 16 rifles and pistols from the U.S Army Reserve armory in Worcester while out on bail for a child rape charge, prompted a multi-state manhunt as Morales fled to Massachusetts, stole a car and attempted to rob two banks. Federal authorities described him as dangerous and possibly armed.
Morales was recaptured less than a week later, after a state trooper spotted him in Somerville, chased him on foot and grabbed him as he tried to jump a fence.
But investigators used more than shoe-leather police work in their efforts to bring him in.
MassLive has learned that Morales' escape was the first time Massachusetts authorities used the new surveillance capabilities of the Massachusetts Turnpike's all-electronic tolling system in an investigation.
The Massachusetts Department of Transportation placed the license plate of the car Morales stole on the system's "hotlist." It is a feature that allows real-time and historical tracking of license plates and EZ Pass transponders as they move beneath the Pike's gantries, designed to allow the warrantless surveillance of targeted vehicles during public safety emergencies.
"Lt Marc Lavoie of MSP is assisting on an investigation involving an escaped prison[er] and a stolen car," MassDOT RMV Director of Enforcement Services Sara Lavoie wrote to senior MassDOT counsel Eileen Fenton in a Jan. 1 email. "MSP wants to check toll records ASAP."
The emails, obtained by MassLive in a public records request, show officials figuring out the kinks of a new and potentially powerful law enforcement tool. In one message, Fenton asks if EZ Pass transactions from the same day are available yet; in another, after a license plate number does not register any hits, she suggests Lavoie send transponder and owner information instead.
In the end, there were no hits on the system, which only exists on the Pike; Morales traveled up I-95 to Boston, where he was eventually captured.
MassLive obtained records of all requests to use the hotlist system from its launch in October through this summer. Those records and statements from the state Executive Office of Public Safety and Security show:
Authorities have attempted to track vehicles in seven cases so far.
Those cases involve at-large murder, kidnapping and arson suspects, and missing senior citizens and children.
All the cases so far appear to fit the regulatory restrictions on the surveillance, which can only be used in "limited emergency situations" involving imminent threats to health or safety, including but not limited to terrorist threats, Amber Alerts, Silver Alerts, kidnappings, missing persons and felons actively traveling to or from a crime scene.
Through August 3, uses of the hotlist had not provided actionable information or led to any arrests.
MassDOT tolling consultants have the capability to search the Raytheon database that stores transponder and license plate data for the state. In one case, a consultant appears to search through over a month of a vehicle's trip records - despite only being asked to query less than 24 hours of records by a MassDOT official.
MassDOT has no training documents or written procedures on the use of the hotlist.
"The hot list capability is an important tool for law enforcement agencies, and we believe the rules governing its use in Massachusetts are appropriate," EOPSS spokesman Felix Browne said in a statement.
A new way to track travel
The ability of the system to collect information on vehicles is a byproduct of how all-electronic tolling works.With the demolition of the Pike's toll plazas last year, drivers are now billed as they drive under 16 gantries that line the cross-state highway. The gantries scan transponders and take pictures of license plates as cars move under them, and then either deduct funds from driver's EZ Pass accounts or use plate recognition software to bill people who do not use EZ Pass.
Those scans and photographs are stored in databases, and that data can also be used to track when and where vehicles move across the Pike. MassDOT's 2014 contract with Raytheon to operate the system includes the establishment of the hotlist, which can notify selected officials when flagged vehicles pass under gantries or be used to search for past trips along the Pike.
The existence of the hotlist raised eyebrows among privacy advocates when it was first reported by the Boston Globe two months before all electronic tolling went live. MassDOT and State Police officials said the use of the hotlist would be limited to emergencies, and that regulations would be drafted to ensure driver privacy.
The finalized regulations included limits to how the hotlist could be used, including requirements that all requests be made in writing by a designee of the Secretary of the Executive Office of Public Safety and Security and that vehicles not remain on the list for over 30 days. And while the regulations grant EOPSS flexibility in deciding what situations justify the warrantless tracking of drivers, they also restricted the hotlist's use to public safety emergencies.
"License plates and/or transponder numbers shall only be included on the Hot List in limited emergency situations involving imminent and immediate threat to the safety, health, and well-being of an individual or the public based on specific, reasonable intelligence sufficient to necessitate the need to provide this Hot List Data to law enforcement," the regulations state.
And MassDOT has consistently said it will protect the information of drivers, and that it does not plan to use speed data collected by the gantries for law enforcement.
"We're not in the spy business, we're in the toll business," then-Highway Administrator Thomas Tinlin told reporters in October.
How the hotlist was used
Authorities have used the hotlist during six public safety emergencies, often involving fleeing suspects suspected of violent felonies, according to the records obtained by MassLiveIts first use was to attempt to track Morales after his escape from prison in Rhode Island. In the second, police appear to have flagged a car stolen by Wes Doughty, an at-large suspect in a Peabody double homicide. Doughty was captured in South Carolina days later, though EOPSS officials said the hotlist did not provide any actionable leads.
On March 18 the system was activated again to assist in the investigation of an armed kidnapping, attempted murder and arson case, EOPSS said. At 12:46 p.m. Solet asked MassDOT to search for a hits on vehicle from the previous night, in addition to real-time surveillance.
The flagged vehicle did not trigger any hits, and the listing was deactivated when the suspect was captured less than three hours later, according to the emails.
And in June, the call came again, after an elderly woman was murdered and her car stolen.
"Plate related to recent murder and robbery of elderly female, suspect at large and victim's vehicle missing," Solet wrote to MassDOT. "Seeking both prospective activation and historical data from May 25 (inclusive) onward."
EOPSS would not confirm the identity of the suspect for the June 1 search, but the timeline matches up with the case of Tammie Galloway, who was charged with murder and motor vehicle larceny after her 81-year-old neighbor Laura Shifrina was found dead in her Needham apartment on May 31.
And on July 7, three days after Lewis Starkey III allegedly killed 48-year-old Amanda Glover and hours later shot an employee of Specialized Trucking in Chicopee, EOPSS put in another hotlist request.
"Plate related to a subject wanted for murder and a workplace shooting," EOPSS Assistant General Counsel Shannon Sullivan wrote. "Seeking both prospective activation and historical transponder/LPR data from 7/4/2017 (inclusive) onward."
The hotlist activation came as authorities distributed a flyer with Starkey's picture and a description of his car, asking for tips leading to his capture. He was later arrested on July 9 in Orange.
The most recent hotlisting, on Aug. 3, involved a Silver Alert search for a missing senior citizen, Browne told MassLive.
None of the first six hotlist activations led to actionable investigative leads or arrests, Browne wrote in an email.
Authorities turned to the technology again Wednesday night, when 3-year-old Ella Abbott was taken from her Worcester home by her mother Leeann Rickheit. The state issued an Amber Alert, and Browne confirmed her vehicle was placed on the hotlist.
Police located Rickheit and her daughter in a wooded area near Charlton early Thursday morning. Browne could not confirm whether the tracking system helped lead to their recovery.
Democratic State Sen. Eric Lesser, who has introduced a bill that would tighten privacy protections on tolling data, said he is appreciative that law enforcement is taking the limits on the hotlist seriously. But he argued that those rules need to be written into law, rather than regulations that future administrations could easily change.
"There are clearly some internal protocols and systems in place and it look like those are being followed," he said. "But there clearly needs to be some codification of this and some safeguards built into law, just as there are for accessing phone records or library records, internet records or emails."
Did a consultant go too far?
Kade Crockford, the Director of the Technology for Liberty Program at the ACLU of Massachusetts, reviewed the hotlist records obtained by MassLive, said the use of the system so far appears limited and largely fits the Fourth Amendment's allowance for warrantless searches during "exigent circumstances" that require immediate action to protect life."We are happy that MassDOT has a policy to govern its hotlist. The policy is pretty good, actually, because it requires that the hotlist only be used in true public safety emergencies," Crockford said. "It's certainly good to see that they're not using it for routine drug investigations and things like that."
But she also said some of the emails obtained by MassLive show a troubling misuse of the system.
On Feb. 17, Peabody couple Jennifer O'Connor and Michael Greenlaw were killed in a shooting and stabbingso violent police were initially unsure how many bodies were found inside the home. One suspect, 45-year-old Michael Hebb, was swiftly arrested, while the other, Wes Doughty, allegedly carjacked a vehicle and fled.
Police were at first unable to locate Doughty, and early on the morning of February 23 EOPSS Chief Legal Counsel David Solet emailed his counterparts at MassDOT asking them to add a vehicle to the hotlist.
"Suspect involved in double homicide and carjacking," Solet wrote. "Please confirm receipt."
At 9:43 a.m., Fenton, MassDOT's chief counsel, confirmed that the plate had been added to the list. And an hour later, MassDOT Manager of Statewide Tolling Carrie McInerny sent an email to one of the department's tolling consultants asking him to search the database for a plate.
"Can you query the host database and see if you can get any hits for the following license plate - on the road since 9pm last night until now," McInerny wrote to Rick Stone of TTI Consulting.
"No luck. I also tried looking for pattern [Redacted] since yesterday and then looked at the UFM images in (in construction) trips but nothing matches that plate," Stone replied. "It was seen on 1/15, that's the last in the Host DB. Data attached."
Stone, it appears, had searched for over a month's data on the license plate without authorization from the state, eventually finding a hit on January 15.
Crockford said it is "really troubling" that a MassDOT consultant used access to the data to find a vehicle's location from that long ago - an action she could not square with regulations that limit the use of the hotlist to situations that involve imminent danger.
"In these emails it's revealed that there's a conflation between the tracking of someone who's a a public safety threat and looking back at the date to see where someone has been," Crockford said. "Those historical searches really should require a warrant. There's nothing emergency about seeing where someone has been six months ago or last year."
And beyond civil liberties concerns, such use of the system could threaten prosecutions if they are introduced as evidence at trial, Crockford said.
"If I were a defense attorney and there was evidence introduced against my client - his EZ pass data from a year ago that the state police obtained simply by emailing MassDOT and asking for it - I would file a motion to quash that evidence," she said. "Certainly that would be a legal challenge that any defense attorney worth their salt would marshal."
In response to a public records request, MassDOT also stated it did not possess any training documents or written procedures relating to use of the hotlist.
MassDOT declined to answer specific questions about the consultant's use of the system.
"The Massachusetts Department of Transportation utilizes the 'Hot List' only in accordance with the applicable regulations," MassDOT spokesman Patrick Marvin said in a statement.
©2017 MassLive.com, Springfield, Mass. Distributed by Tribune Content Agency, LLC.
