DC Court Says Metro Police Need Warrants To Deploy Stingrays

from the another-win-for-the-4th dept

Another warrant requirement for Stingray use has been established. Again, it's not a federal decision, so jurisdiction is limited, but there's now another case to cite when fighting warrantless Stingray use in federal courts.

This decision comes from the DC Appeals Court (very much not the DC Circuit Court of Appeals). The case involves the Metro PD's use of a Stingray to track two phones: the suspect's and one he had stolen. The lower court handed the government a win. After pointing out there was plenty of time (around 10 hours between report of crime and Stingray deployment) to obtain a warrant (thus no exigent circumstances exception), the court decided the evidence derived from the tracking fell into the "inevitable discovery" exception since the tracking of the stolen phone would have led officers to the suspect.

The problem is the officers testifying for the Metro PD could not say for sure which phone they were tracking: the suspect's or the phone he had allegedly stolen from the victim. The lower court cut the cops some slack, allowing for the possibility of they were tracking a phone (the victim's) the suspect had no privacy interest in.

The appeals court, however, doesn't read it the same way. First, it goes further than the lower court, deciding the use of Stingray devices requires a warrant. As it points out in its opinion [PDF], the use of Stingray devices is far more invasive than other tracking methods. To begin with, it does something historic cell site location data and/or GPS trackers can't: locate a suspect no one's actively tracking.

With a cell-site simulator, however, police no longer need to track a person visually from some starting location or physically install a tracking device on an object that is in, or will come into, his or her possession. Instead, they can remotely activate the latent tracking function of a device that the person is almost certainly carrying in his or her pocket or purse: a cellphone. As the present case demonstrates, police officers first obtain subscriber information and real-time location information from the target‘s telecommunications provider to narrow down the search area. They then proceed to that area with a cell-site simulator, which they use to force the person‘s cellphone to identify itself and reveal its exact location. It is in this sense that a cell-site simulator is a locating, not merely a tracking, device: A cell-site simulator allows police officers who possess a person‘s telephone number to discover that person‘s precise location remotely and at will.

Further, Stingray devices force peoples' phones to relinquish information to law enforcement.

A final consideration is that when the police use a cell-site simulator to locate a person‘s cellphone, the simulator does not merely passively listen for transmissions sent by the phone in the ordinary course of the phone‘s operation. Instead, the cell-site simulator exploits a security vulnerability in the phone—the fact that cellphones are, in the words of the defense expert, ― "dumb devices," unable to differentiate between a legitimate cellular tower and a cell-site simulator masquerading as one — and actively induces the phone to divulge its identifying information.

Which flows directly into this determination:

The preceding considerations lead us to conclude that the use of a cell-site simulator to locate Mr. Jones‘s phone invaded a reasonable expectation of privacy and was thus a search.

There are reasons the court feels a warrant requirement is necessary -- ones that involve government responsibility and accountability.

[T]he simulator‘s operation involve[s] exploitation of a security flaw in a device that most people now feel obligated to carry with them at all times. Allowing the government to deploy such a powerful tool without judicial oversight would surely ―shrink the realm of guaranteed privacy "far below that which existed when the Fourth Amendment was adopted." Kyllo, 533 U.S. at 34. It would also place an individual in the difficult position either of accepting the risk that at any moment his or her cellphone could be converted into tracking device or of forgoing ― "necessary use of" the cellphone.

The government argued cellphone users have no expectation of privacy in location information they know (or should know) is being broadcast to third parties. The appeals court disagrees, pointing to the Supreme Court's decision on wiretap use.

Contrary to the government‘s argument, Katz makes clear that a person does not lose a reasonable expectation of privacy merely because he or she is made aware of the government‘s capacity to invade his or her privacy. When Katz was issued, the public and the courts were well aware of the government‘s capacity to wiretap and eavesdrop through technological means, yet the Supreme Court did not find this fact determinative of the question whether individuals possess a reasonable expectation of privacy in their conversations.

[...]

A person‘s awareness that the government can locate and track him or her using his or her cellphone likewise should not be sufficient to negate the person‘s otherwise legitimate expectation of privacy.

The court also shoots holes in the government's "inevitable discovery" theory. At some point, the officers switched from tracking a phone with zero privacy interest (the victim's) to tracking the suspect's phone. When they did this, they screwed themselves out of a warrant exception. The court decides the government doesn't get to pile up wrongs and ask the court to view them as "right."

[H]ere the government is asking us to find inevitable discovery where the police had mutually exclusive options and, for whatever reason, chose the option that turned out to be unlawful. The inevitable-discovery doctrine does not apply in this type of situation.

The good faith exception is killed off as well, thanks to the secrecy surrounding the Metro PD's ownership and deployment of a Stingray device.

The Supreme Court has not, however, recognized the applicability of the good-faith exception in a situation remotely like the present one—where the police, not acting pursuant to a seemingly valid warrant, statute, or court opinion, conducted an unlawful search using a secret technology that they had shielded from judicial oversight and public scrutiny. See supra note 26. Indeed, assuming the police believed the warrantless use of the cell-site simulator to be lawful, they could not have reasonably relied on that belief, given the secrecy surrounding the device and the lack of law on the issue.

As for the government's argument suppression of evidence isn't needed to deter future wrongdoing because the PD now abides by DOJ guidance recommending search warrants for Stingray use, the court finds its assertions hollow.

The government has not cited any case in which a court has declined to apply the exclusionary rule based on the government‘s representation that it will not engage in unlawful conduct in the future. [...] And given that the DOJ policy memorandum does not describe any sort of enforcement mechanism that would ensure compliance with the policy, and given that the present administration or a subsequent one may well revise this policy, we are not convinced that the need to deter future constitutional violations is lacking.

And with that, the government loses almost all of its evidence, as well as the testimony of one of its witnesses. The conviction obtained is also reversed. The concurring opinion points out something that clearly separates Stingray cellphone tracking from other cellsite location info collection methods: it turns people's cellphones into investigative tools by law enforcement. And it doesn't do this voluntarily, no matter how the government might choose to misread the Third Party Doctrine. It does it by forcing all phones in the area to connect with the Stingray device and cough up their identifying info, including location.

This decision stands next to the one in Maryland as the first court-determined Stingray warrant requirements. More will come, although it's not entirely clear at this point which way these decisions will go. The Supreme Court is set to hear a case on warrantless access to historic cell site data. Whatever's decided there will factor into ongoing courtroom discussions about warrantless deployment of cell tower spoofers.

Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.

Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.

While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.

–The Techdirt Team

Filed Under: 4th amendment, dc, imsi catchers, privacy, stingrays, surveillance