Federal Judge Says Real-Time Cell Location Info -- Whether Obtained With A Stingray Or Not -- Requires The Use Of A Warrant

from the no-more-pen-register-orders dept

An interesting decision by a federal judge in Florida suggests this district, at least, may not be amenable to the warrantless use of Stingray devices… or any other method that harvests cell site location data in real time.

Although the defendants lost their motions to suppress due to a lack of standing, the judge had this to say about the acquisition of cell site location info in this case. (via FourthAmendment.com)

Here, I agree with the Defendants that law enforcement's seizure of precise realtime location information by surreptitiously monitoring signals from the cell phones in this manner is a search subject to the proscriptions of the Fourth Amendment. Such is the express conclusion of the Florida Supreme Court and the conclusion suggested by the Supreme Court. See Tracey v. Florida, 152 So.3d 504 (Fla. 2014); United States v. Jones, 132 S.Ct. 945 (2012). As such, law enforcement should have obtained a search warrant issued upon probable cause. The Government concedes that the practice in this Court requires a warrant based upon probable cause for such searches and that the these pen/trap applications did not establish probable cause.

Originally, the defense claimed police used a Stingray to track five burner phones used by the defendants. This seemed to be the most logical conclusion, considering how closely and immediately the location data was acquired. But the government responded that no cell site simulators were used to track the devices. Instead, another tool that has long been available to law enforcement was deployed -- a tool created explicitly for law enforcement use by the cell provider.

On July 21, 2016, the Court heard argument of counsel and took testimony from Detective Joseph Petta, the co-affiant on each of the applications at issue. In short, Detective Petta testified that law enforcement obtained pen/trap authorizations for the cell phone numbers at issue in order to obtain precise realtime location information that was used to track the whereabouts of these phones, to identify those associated with Defendants, and to identify locations of interests. He denies use of a Stingray or similar device, but acknowledges that he used a website offered to law enforcement by Sprint (the "L-site") to obtain such information. Such realtime information was available every fifteen minutes twenty-four hours a day. He further acknowledges that law enforcement used the realtime information to track the cellular phones, which they believed were used by this group. By his account, such applications were the usual way to obtain such realtime location information at the time these applications were submitted.

[...]

According to Detective Petta, the website allows law enforcement to log on and obtain realtime or contemporaneous and highly precise longitudinal and latitudinal information linked to GoogleMaps. A spreadsheet of all such location data is made available to law enforcement. Detective Petta testified that the pen/trap orders were not used for any other purpose than to obtain the realtime location of the cell phones.

The information returned from L-site queries is likely not as timely or precise as a roving Stingray but can achieve the same objectives. (An example of L-site data can be seen here.) Sprint has made this tool available for law enforcement to use since at least 2009, tracking roughly with the rise in Stingray use by police departments. The difference here is any law enforcement agency can obtain this data, which opens the market to those who don't have these devices yet or a warrant requirement they'd rather work around. Obviously, this also aids those deploying parallel construction to keep Stingray use hidden.

Either way, the court doesn't agree with the government's assertion that a pen register order is sufficient for obtaining real-time cell site location info. The order cites the Supreme Court's US v. Jones decision in support of its determination that real-time location tracking is a search and requires the use of a warrant -- something the original decision failed to state quite as explicitly. (It only found that placing a GPS device on a vehicle is a search under the Fourth Amendment. The issue of real-time location tracking remained mostly unaddressed.)

But while this order may alter law enforcement's tactics (and even the government admits it should have acquired a warrant in light of other Florida district decisions), it does nothing for the two defendants. An expectation of privacy in real-time location data doesn't help two defendants with a handful of burner phones they're reluctant to claim as their own. The absence of any link between the tracked phones and the defendants means they have no standing to challenge the search.

Defendants here have asserted no claim to or interest in the cell phones at issue. The cell phones were not registered in Defendants' names, and Defendants presented no evidence regarding their possession, use, or control of the phones. Instead, Defendants rely solely upon loose allegations in the pen/trap applications submitted by the Government, which suggested a link between the cell phones and Defendants in conclusory, unsupported fashion. In the circumstances and in the absence of contrary case law, I am obliged to conclude that they fail to establish standing to contest the searches at issue and the motions to suppress should be denied.

A lack of standing tends to be fatal to motions to suppress. But the disavowal of ownership does shift the burden of proof back on the government, which makes it a little harder to prove the burner phones actually belonged to the defendants found carrying them. The court notes the "loose allegations" contained in the pen register applications are "conclusory" and "unsupported," which seems to indicate the government has a few more hurdles to overcome before it can tie the defendants to the phones they're not willing to claim.

Filed Under: 4th amendment, csli, imsi catcher, location info, stingray, warrants

New Law In Illinois Restricts Stingray Use, Requires Court Orders For Deployment

from the the-warrant-that-dare-not-speak-its-name dept

Roughly eight years after information about law enforcement use of Stingray devices began slowly making its way into the public sphere, positive changes are being made. While the government has often argued it can be the "Third Party" in "Third Party Doctrine" by inserting itself warrantlessly between people's cell phones and their carriers' towers, its assertions are being met with increased judicial skepticism.

Two judges -- one state, one federal -- have reached the same conclusion in recent months: using a cell tower spoofer to locate suspects by dragging information out of their phones is a search under the Fourth Amendment. Warrants are required.

A few state legislatures have gotten into the act as well, proposing laws that create a warrant requirement for Stingray deployment. Illinois is the latest to do so (and the law actually passed), creating a new set of guidelines for law enforcement Stingray device use, including limits on data retention. It doesn't go quite so far as to mandate warrant acquisition, but it does force law enforcement to specify the equipment used in their applications, which also serves to create a paper trail that can be examined by defendants and members of the public.

This is the new quasi-warrant requirement recently signed off on by the governor.

Provides that an application for a court order to use a cell site simulator device, including an emergency application under the Freedom From Location Surveillance Act, must include a description of the nature and capabilities of the cell site simulator device to be used and the manner and method of its deployment, including whether the cell site simulator device will obtain data from non-target communications devices. Provides that an application for a court order to use a cell site simulator device, including an emergency application under the Freedom From Location Surveillance Act, must also include a description of the procedures that will be followed to protect the privacy of non-targets of the investigation, including the immediate deletion of data obtained from non-target communications devices.

The presentation of probable cause basically makes it a warrant requirement, even if the word "warrant" appears nowhere in the legislation.

The other positive here is that very strict controls on the use and retention of non-hit data are being instituted as well.

Provides that if the cell site simulator device is used to locate or track a known communications device, all non-target data must be deleted as soon as reasonably practicable, but no later than once every 24 hours. Provides that if the cell site simulator device is used to identify an unknown communications device, all non-target data must be deleted as soon as reasonably practicable, but no later than within 72 hours of the time that the unknown communications device is identified, absent a court order preserving the non-target data and directing that it be filed under seal with the court.

An additional nice touch is that requests and orders aren't considered "sealed" by default and that any seal request granted only lasts six months, and extension requests must be accompanied by a certification indicating the documents are part of an ongoing investigation or a "showing of exceptional circumstances." The last one is a little worrying as it could be used to maintain seals indefinitely if the court is inclined to believe law enforcement claims about "exposing law enforcement means/methods."

This show of "support" from local law enforcement indicates the law isn't as far-reaching as privacy activists might have hoped, but it isn't exactly just a bundle of concessions to LEO interests either.

The Illinois State Police has taken a neutral position on the law and the Chicago Police Department did not take a position.

Expect this trend to continue. More courts and legislators are going to realize that tracking a person's location by forcing their cell phone to connect with law enforcement technology is in no way analogous to gathering phone records with a pen register order or subpoenaing historical cell site data from third-party carriers.

Filed Under: 4th amendment, court orders, illinois, imsi catcher, stingray, third party doctrine, warrants

FBI Vacuums Up Local Law Enforcement Documents To Block Open Records Requests About Orlando Shooting

from the PROPERTY-OF-THE-FBI-stamp-ink-running-dangerously-low dept

The FBI has decided to insert itself into another public records battle. The agency has long been known to cc: itself to public records requests for Stingray documents, but this time it's claiming any requests for local law enforcement documents related to the Orlando nightclub shooting need to be routed through it.

A June 20 letter from the FBI, attached to the City or Orlando's lawsuit over withholding 911 calls and other records from 25 media outlets including the Orlando Sentinel, was also sent to the Seminole County Sheriff's Office with instructions pertaining to how they should respond to records requests.

The letter requests that agencies deny inquiries and directs departments to "immediately notify the FBI of any requests your agency received" so "the FBI can seek to prevent disclosure through appropriate channels, as necessary."

Notice the FBI says "prevent disclosure," rather than, say, "assist in determining which documents can be released." The letter [PDF] claims that all records generated by local law enforcement agencies are now the FBI's by proxy and that the "investigative documents" exemption [Exemption 7(A)] prevents the release of all documents related to the shooting.

The FBI flat-out states all documents are belong to it.

The FBI considers information obtained from state and local law enforcement agencies in furtherance of its investigation to be evidence, or potential evidence.

Presto! Instant blanket exemption from disclosure at both federal and state level. The FBI takes care to point out which Florida Sunshine Law exemption local agencies can use to withhold documents from requesters.

There's significant public interest in these documents, especially those related to EMS/police response to emergency calls. This obviously conflicts with the FBI's determination that its ongoing investigation -- which now apparently contains every document created by every responding law enforcement agency in Florida -- should preempt any and all requests for documents via Florida open records laws.

Not for nothing have there been several efforts mounted to alter blanket exemptions like the one the FBI is using to insert itself into local level records requests. Unfortunately, it's very likely the FBI's wielding of this "open investigation" exemption will be granted deference by the federal court currently presiding over an open records lawsuit between the Orlando Sentinel and the City of Orlando, even though this fight never should have included a federal agency conducting its own concurrent investigation of the mass shooting.

Filed Under: fbi, foia, imsi catcher, law enforcement, orlando, public records, stingray

Stingray Memo From FBI To Oklahoma Law Enforcement Tells PD To Engage In Parallel Construction

from the fake-it-til-you-make-it dept

The concept of "checks and balances" kind of takes a beating when one branch of the government says it's ok to lie to another branch. We've already seen the FBI tell law enforcement agencies -- through extensive NDAs it makes them sign before they can deploy cell site simulators -- that it's better to let suspected criminals walk away from charges than risk allowing details on Stingray devices to make their way into the public domain via submitted evidence.

Many law enforcement agencies appear to be doing exactly that. More than one agency has misled judges with applications for pen register orders and requests for cell site location data -- neither of which provide details on the technology actually being used.

Another memo from the FBI shows the federal agency directly instructing a local law enforcement agency to engage in parallel construction. The memo, obtained by Oklahoma Watch, explicitly spells out what is supposed to happen if cell site simulator use is part of the evidence chain. (h/t Nate Wessler)

Information obtained through use of the equipment is FOR LEAD PURPOSES ONLY, and may not be used as primary evidence in any affidavits, hearings or trials. This equipment provides general location information about a cellular device, and your agency understands it is required to use additional and independent investigative means and methods, such as historical cellular analysis, that would be admissible at trial to corroborate information concerning the location of the target obtained through use of this equipment.

The problem is that this sort of "lead" often leads directly to search warrants of residences where people are located. The Oklahoma City PD is being told to obtain other non-Stingray-related data that could plausibly explain how it managed to located Subject X at Location Y. Officers won't be telling magistrate judges when seeking pen register orders or subpoenas for cell location info. And officers won't be telling defendants or their representation how they managed to be in the right place at the right time with a search warrant.

The memo also notes that the FBI "will use all appropriate legal means" to prevent Stingray use from being uncovered in discovery requests. Apparently, "all appropriate legal means" covers parallel construction.

What sets this apart from the FBI NDAs we've covered here previously is that this memo is limited to the local law enforcement's borrowing of FBI equipment to locate suspects. With the FBI still in control of the device, it's obviously going to be that much more concerned with controlling the narrative.

Clifton Adcock of Oklahoma Watch notes that local law enforcement appears to be using Stingray devices but covering it up through pen register orders. In one case, this has led to a very suspect request from the Oklahoma City PD, suggesting it had borrowed an FBI cell site simulator to locate the defendant.

In one of those cases, a defense attorney, Douglas Parr of Oklahoma City, said he believes a cell site simulator was used to collect his client’s phone data. The client is charged with drug trafficking. During a hearing in Oklahoma County District Court in September 2015, Parr asked an Oklahoma City police detective whether a simulator had been used. The detective, who had requested the order, testified that to his knowledge such a cell site simulator had not been used.

Testimony in the case shows the officer did not file for a trap and trace order with the court until the day he testified in September – more than a year after he conducted the surveillance.

According to the FBI's new rules for Stingray use, warrants must be sought and provide explicit details about the technology being used -- including the facts that Stingrays search every phone in the area while trying to locate devices and that local service may be disrupted during deployments. The DOJ's ruleset arrived a few months after this particular Memorandum of Understanding was signed with the Oklahoma City PD. One would hope a revised version is on the way, if not already in the hands of Oklahoma law enforcement -- one that does a better job of reflecting the DOJ's current stance on warrants and information dissemination.

Filed Under: 4th amendment, evidence, imsi catcher, oklahoma, parallel construction, stingray

EFF, ACLU And Public Records Laws Team Up To Expose Hidden Stingray Use By The Milwaukee Police Department

from the acronyms-to-the-rescue! dept

The EFF and ACLU -- along with the assistance of a very fortuitous public records request by Stingray-tracker extraordinaire Mike Katz-Lacabe -- have uncovered more hidden use of IMSI catchers by law enforcement. A criminal prosecution relying on real-time tracking of a suspect's cell phone has finally led to the admission by Wisconsin police that they used a Stingray to locate defendant Damian Patrick.

The information wasn't handed over to the court until the EFF, ACLU, and Katz-Lacabe's FOIAed documents forced the government to admit it used the device. Up until that point, testimony given by officers gave the impression that tracking Patrick down only involved the use of records from his service provider. They also claimed the information pinpointing Patrick's location in a parked vehicle was just a tip from an "anonymous source."

As we’ve seen in other cases involving Stingrays, the government did everything it could in this case to hide the fact that it used a Stingray—from the court that issued the pen register/trap and trace order, the court that heard Patrick’s motion to suppress the evidence, and even from Patrick, himself. In police reports, the officers said only that they “‘obtained information’ of Patrick’s location; . . . had ‘prior knowledge’ that Patrick was occupying the vehicle; . . . [and] ‘obtained information from an unknown source’ that Patrick was inside the vehicle at that location.”

This charade continued through an evidentiary hearing, where the judge refused to allow the defense to coax more specific information out of the testifying officer.

[E]ven at an evidentiary hearing where officers admitted to cellphone tracking, they would only acknowledge, cryptically, that they’d received “electronic information” confirming Patrick was in the vehicle. When Patrick’s attorney asked what “electronic information” meant, the officer on the stand would say only that it involved “tracking [a] cell phone.” The judge cut off any further questioning at that point.

And that's where Katz-Lacabe's FOIA request played a significant role. Katz-Lacabe had obtained Stingray logs using Wisconsin's public records laws. Contained in those logs were Stingray deployments matching up to the government's tracking and locating of Damian Patrick. The government has now begrudgingly admitted as much, via a letter from the DOJ to the court regarding the Milwaukee Police Department's Stingray deployment.

Per our conversation last week, the government has determined that on October 28, 2013, the Milwaukee Police Department used a cell site simulator to locate Damian Patrick. At this time, we do not intend to seek leave to supplement the record pursuant to Federal Rule of Appellate Procedure 10.

The government is still arguing that the MPD complied with the Fourth Amendment, even if it never obtained a search warrant to deploy the Stingray. In any event, the affidavit it submitted (for what appears to be a pen register order, rather than a warrant) did not mention the use of a Stingray. Still, it argues no evidence should be suppressed… because circular reasoning.

[T]he government also argues it didn’t violate the Fourth Amendment in this case because it actually got a warrant—or maybe, in the alternative, the equivalent of a warrant (the police had a warrant to arrest (not search) Patrick and a court order (not a search warrant) to track Patrick’s phone). In a confusing and somewhat circular argument, the government asserts that because it submitted a “sworn affidavit” in support of its request for the pen/trap order, the order must have actually been a search warrant—if it hadn’t been a warrant, then it “wouldn’t have needed a finding of probable cause, which it contained.”

Dumping probable cause into a pen register application is a nice nod to the Fourth Amendment, but it's not required and it doesn't turn a court order into a warrant. An arrest warrant is not a search warrant, and it's likely the MPD would not have been able to serve its arrest warrant without the use of its Stingray-obscuring pen register order. The admission that Stingray surveillance should require the use of a warrant is, again, a nice nod to the Fourth Amendment, but it means nothing if that's not how the Milwaukee PD actually operates. And, yet again, the long battle to uncover evidence of Stingray tracking makes it clear the PD is hiding this information from judges when applying for court orders and warrants.

Filed Under: imsi catcher, milwaukee, milwaukee pd, police, secrecy, stingrays
Companies: aclu, eff

Milwaukee PD Hid Stingray Usage From Judges, Defendants And Now Congress Members Want Answers From The FBI

from the the-huge-secret-that-isn't dept

More evidence of Stingray obfuscation has been uncovered in Milwaukee. What appeared at first to be a bog standard court order for tracking of a suspect using a cell phone provider's own "network equipment" actually appears to be something else. The ACLU was already involved in this case, arguing that such tracking by cell phone providers only be available with a warrant. But as it dug into the specifics, it became obvious the tracking had not been performed by the cell provider.

As we read through documentation from the case, however, we began to suspect that something else was going on. It appears that police secretly used a cell site simulator, also known as a Stingray, to track the phone, but successfully concealed that fact from the defense and the court.

Our suspicion was first raised because police initially did not disclose to the defendant that they had located him by tracking his phone, only revealing it at an evidentiary hearing. In reports prepared after the defendant’s arrest, police officers used oddly vague language to explain how they located him: one officer merely wrote that law enforcement had “obtained information” about the defendant’s location; another said that police “obtained information from an unknown source” about where he was. This sounded to us a lot like the kind of intentionally ambiguous language used by police across the country to hide their Stingray use.

Like every other law enforcement agency with a Stingray device in its possession, the Milwaukee PD had signed a nondisclosure agreement with the FBI. This "allowed" it to withhold the information from courts and defendants. But cracks in the NDA appeared and a prolific FOIA filer was able to pry loose documents detailing MPD's use of cell tower spoofers.

Last fall, privacy activist Mike Katz-Lacabe obtained a list of 579 investigations in which the Milwaukee Police Department used Stingrays. (Here are Mike’s public records request and MPD’s response letter). That previously unpublicized list includes an entry for a case that matches the date and description of this one: an October 28, 2013, apprehension of a “fugitive” “related to [an] FBI roundup.”

The ACLU is now arguing for suppression of the evidence obtained with the Stingray. That isn't local law enforcement's only problem, however. The ACLU's exposure of this secret Stingray use (along with the Milwaukee Journal-Sentinel's coverage) has attracted the attention of people in a better position to demand answers from the FBI: Reps. Jim Sensenbrenner and Sheila Jackson.

In a letter sent to James Comey (who kind of has a lot on his plate already, tbh), the Congress members demand to know why the FBI is actively hiding information about these tracking devices from the public.

The FBI’s stated reason for secrecy was that disclosing the existence of the capabilities may allow “the subject of investigation wherein this equipment/technology is used to employ countermeasures to avoid detection by law enforcement.” But certainly not lost on the FBI was the fact that secrecy shields the technology from debate and inevitable controversy. Courts could not review its constitutionality. The public could not debate the merits and costs of the technology and what limitations might be appropriate. While this type of secrecy may be appropriate in the national security context, it is entirely inappropriate in the context of law enforcement where citizens have the constitutional right to challenge the government’s evidence against them

We are not prejudging the outcome of the debate over the use of Stingray technology, but we categorically denounce the use of nondisclosure agreements that limit the ability of the public and of courts to debate the merits of the technology and to implement limits they may deem appropriate.

The letter acknowledges that the FBI has recently backed away from supporting its own NDAs. The FBI's last statement on the matter basically said the NDAs should not be read as saying exactly what they say: that information about Stingray usage should be hidden from everyone, if possible. It also expressed mild disbelief that the agreements were being taken so literally. The disingenuous and self-serving nature of this walkback is highlighted in the letter.

This, however, is at odds with the explicit language of the NDA which precludes disclosure to the public in any manner “including but not limited to: in press releases, in court documents, during judicial hearings, or during other public forums or proceedings.” The agreement, in fact, goes much further and states that the Milwaukee Police Department should seek FBI permission before responding to court ordered disclosures and should be prepared to dismiss cases at the FBI’s request if necessary to protect against disclosure.

The FBI has until March 25th to answer the following questions:

• Does the FBI consider state and local law enforcement to be bound by the NDAs related to the use of cell-site simulators?
• Has the FBI ever requested that a law enforcement agency dismiss a case to maintain the secrecy of law enforcement technology?
• How many NDAs has the FBI signed with state and local law enforcement agencies regarding cell-site simulators?
• Are there other technologies for which the FBI demands state and local law enforcement sign an NDA?
• Does the FBI continue to believe that NDAs are appropriate?
• Would the FBI ever condone perjury to Congress or judges to protect the existence of technology?

The answers should be illuminating -- if the public is actually allowed to see the responses. The FBI may still try to claim this super-secret technology that everyone knows about can't be discussed in an open forum. And I'm certain the agency will claim it would not condone perjury even though its NDAs strongly hint this would be preferable to exposing "sensitive" law enforcement methods.

Filed Under: congress, courts, evidence, fbi, imsi catcher, judges, milwaukee, police, stingray

Maryland Court Suppresses Evidence Gathered By Warrantless Stingray Use

from the court:-a-pen-register-order-is-not-even-close-to-the-same-thing dept

The Maryland Special Appeals Court isn't buying government lawyers' arguments that warrantless deployment of Stingray devices has no 4th Amendment implications. The government had argued that "everyone knows" phones generate location data when turned on and this information is "shared with the rest of the world" (but most importantly with law enforcement).

The court has yet to release its written opinion, but it did issue a one-page order upholding the lower court's suppression of evidence related to law enforcement's use of a Stingray. This ruling is especially important in Maryland, where Baltimore police have used the devices hundreds of times a year without seeking warrants or notifying judges and defendants about the origins of evidence.

The ruling has the potential to set a strong precedent about warrantless location tracking. “Police should now be on notice,” said Nate Wessler, a staff attorney with the ACLU’s Speech, Privacy, and Technology Project. “Accurately explain your surveillance activities to a judge and get a warrant, or risk your evidence being thrown out.”

As has been noted here, the Baltimore police use pen register orders to deploy Stingrays, allowing it obscure the usage of the devices as well as to avail itself of lower evidentiary demands. This won't be the case going forward. The court has (at least orally) expressed its displeasure with the Baltimore PD's deceptive tactics.

During the oral argument before the appeals court in February, one of the judges called the police’s pen register application a “completely false document,” and “completely disingenuous.”

As The Intercept notes, this is the first time a US court has suppressed evidence gathered with warrantless Stingray deployments. More will probably follow -- not because the Maryland Special Appeals Court decision will affect courts in other states -- but because more and more information on these devices and how law enforcement deploys them is coming to light.

The government tends to rely on the Third Party Doctrine. While courts may consider the connection and data collected by Stingrays to fall under this doctrine, they're far less likely to find law enforcement's secrecy and deception acceptable. On top of that, using a cell tower spoofer for real-time tracking isn't like deploying a pen register at all, even if judges find the lower evidentiary standard acceptable.

Pen register orders historically involved static phones. The location of the suspect was already known. All law enforcement was looking for was data on incoming and outgoing calls from certain numbers. With Stingrays, law enforcement is trying to find a suspect, not whoever that person is calling (even though that information will be gathered as well). And in order to do so, it has to place itself between hundreds or thousands of non-suspects and the receiving parties of their phone calls and messages. This location tracking and collection of non-relevant data needs to be held to a higher standard, and this decision from Maryland may finally be the start of that.

Filed Under: due process, evidence, imsi catcher, maryland, stingray

Memphis Mayor Ushers In New Era Of Transparency By Refusing To Discuss City's Stingray Devices

from the I-have-several-terrible-reasons-for-not-going-so dept

Multiple Stingray nondisclosure agreements between law enforcement agencies and the FBI have been obtained by FOIA requesters. They all contain the same boilerplate stating that law enforcement officers must do everything up to swallowing their cyanide pills (let suspects walk, route FOIA requests through the FBI, engage in parallel construction, etc.) to prevent information about the technology from making its way into the hands of defendants, judges or peskily inquisitive members of the public.

These agreements are usually signed by a handful of law enforcement officers and FBI reps. The documents are never signed by city legislators or officials… which makes the claims of Memphis mayor Jim Strickland either ignorant, misleading, just plain old politican bullshit.

Memphis Mayor Jim Strickland confirmed Monday that the city is using cell phone eavesdropping technology with court approval, but said he couldn't discuss specifics.

[...]

"As a candidate for mayor, I did not know the legal restrictions that were in the Harris contract that my predecessor signed," he said. "But now, as mayor, I'm bound by those restrictions, and I cannot talk about how the cell-site simulators are used."

[...]

"I've been more open about this issue than my predecessor was, but there are restrictions that I have and I just can't break the law," he said.

I'm going to go with ignorant. An NDA is not "the law," even if it's a federal agency writing them up. At best, the FBI could possibly demand local law enforcement stop using the equipment, or threaten future federal funding, for violating the agreement. But the NDA does not prevent city representatives from talking about, no matter what law enforcement officials may have told them.

This is especially uncomfortable for Strickland, who ran his mayoral campaign on a platform of greater transparency -- specifically in regards to city's ownership and use of a Stingray device. Now that's he in a position to be more open about the law enforcement technology, he's chosen to stop talking about it.

Maybe Strickland should just stop talking about not talking about Stingrays. Everything he says in explanation makes him sound even more inept and clueless.

He said he doesn't know which court reviews Memphis Police's requests for cell-site simulators or if they are commonly used.

Great oversight there, chief.

"It's an important crime-fighting tool," he said.

Well, at least he appears to have given the talking points a once-over. That's something.

Asked whether the Fourth Amendment against unreasonable searches and seizures trumps the wording of the Harris contract, Strickland said he was following the law as his administration understood it.

"I'm not a Fourth Amendment lawyer," he said.

Obviously. And not much of a mayor either. Strickland seems to have not even read the same contract he claims he's bound by.

But would he have signed the contract if he'd been mayor? "I don't know. I'd have to really review that more," he said.

For a guy whose campaign explicitly mentioned Stingrays and the secrecy surrounding them, Strickland seems incredibly reluctant to be the disinfecting sunshine his supporters thought he would be. This doesn't make him a terrible person. But it does make him nothing more than a politician, with all the negatives that implies. And he's certainly no better than his predecessor, whom he attacked for doing the same thing he's doing here: not answering questions about secret law enforcement surveillance tech.

Filed Under: imsi catcher, jim strickland, memphis, nda, stingray

State AG: We Have A Warrant Requirement For Stingrays; State Police: FILE(S) NOT FOUND

from the the-latest-in-LEO-tech:-the-warrantless-warrant dept

In a comprehensive look at Delaware State Police usage of Stingray devices at DelawareOnline, there's this very darkly amusing factoid. (h/t Nathan Burney via Brad Heath)

The state Attorney General's Office says police must obtain a warrant to deploy the Stingray, but when The News Journal requested those court orders through a FOIA, state police said none existed.

This is a problem. It's not that the state police chose to withhold the information, as it has with several other Stingray-related documents requested by the News Journal and the local ACLU. It's that it says no records exist. This means the warrants the Attorney General says police must use are not being used.

What do appear to be used by Delaware State Police are vague pen register orders that hide from judges and defendants the technology actually being used to obtain this phone data. Public defender John Daniello had one such document turned over to him by the police -- one that apparently was used to deploy Harris Technology's cellphone-tracking technology.


It's a pen register order, with a handwritten "negative on TriggerFish location" scrawled across the top. Daniello's now looking to force the state police to hand over the paperwork it's actually using to deploy cell tower simulators -- which isn't the same paperwork the AG's office has stated must be used.

“I was going to make a stink about it and demand all the information,” Daniello said. “They’re going out and pinging everybody."

Daniello said that police are "pulling one over on the courts" by not indicating in the full text of a warrant that cell-site simulators are being used.

Daniello's inquisitiveness has already helped one defendant out. Rather than turn cell tracking documents over to Daniello, prosecutors offered his client a "far better" plea deal than they had initially offered.

The Delaware State Police are following the pattern set by many other law enforcement agencies: claiming their agreement with Harris (and the FBI) forbids any mention of cellphone tracking technology and using pen register orders (which have a lower evidentiary standard than warrants -- information sought must only possibly be "relevant" to an ongoing investigation). The State Police may disingenuously assert the two are roughly equivalent, but the Attorney General's office has explicitly stated Stingray devices can only be deployed with warrants.

This suggests the Attorney General really isn't paying too much attention to what the police are doing with their cell tower spoofers. The following suggests the AG isn't the only person not in the know. The obfuscation of Stingray/TriggerFish deployments is apparently so multi-layered that even the state police find it impossible to locate relevant documents.

The News Journal sent a FOIA request to the Delaware State Police asking for copies of all warrants from adjudicated cases that contained the term “pen register,” the technical term for a call search history. Despite existence of the warrant* issued for Daniello’s client, the agency responded that no records existed.

*It's not a warrant.

Police departments sold state legislators on Stingrays by citing terrorism and drug warring. No one asked too many questions because these are Serious Things few legislators could possibly oppose. They allowed hundreds of thousands of dollars to be spent on technology that's being deployed with little to no oversight. Also discovered during the FOIA requests is that the State Police have no written policies or guidelines covering these deployments. The Attorney General may claim a warrant requirement is in place, but -- considering the lack of responsive documents -- it's entirely unclear what he's basing this assertion on.

Filed Under: delaware, foia, imsi catcher, police, records, stingray

NYPD Has Deployed Stingrays Over 1,000 Times Without Warrants

from the no-surprises-here-(other-than-the-document-release-itself) dept

The New York ACLU has obtained documents from the NYPD -- a feat on par with prying paperwork away from the FBI, CIA or NSA -- showing the department has been deploying Stingrays without a warrant since 2008. This puts them on the same timeline (and with the same lack of legal paperwork) as the Baltimore Police Department, although the BPD was much more proactive with their deployments: over 4,300 since 2008, as compared to the NYPD's relatively restrained 1,016.

Not only does the NYPD deploy Stingrays without warrants, it apparently does so without any official guidance at all. (The better to keep paper trails from developing, I would guess. This also allows it to choose its own scapegoat when the political hammer falls, rather than there being a bunch of inculpatory signatures on internal policies/permission slips.)

The NYPD also disclosed that it has no written policy for the use of Stingrays but that, except in emergencies, its practice is to obtain a “pen register order” – a court order that is not as protective of privacy as a warrant – prior to using the device.

The use of pen register orders suggests major police departments all had the same idea when they got their hands on the repurposed military technology: it's a phone, so why not pen register orders? Well, to begin with, Stingrays capture a whole lot more than a pen register would -- like everyone connecting to the faux cell tower, rather than just the target. Pen registers also can't be used to track someone in motion. All they can do (in the historical sense) is generate phone records of calls made and received. Utilizing this paperwork lowers the amount of proof needed to obtain permission as well as obscures the technology behind the collection of "phone records."

That the NYPD is using Stingrays is no surprise, considering how many other law enforcement agencies in the country use them. The NYPD has always considered itself to be an extension of federal intelligence services and a bit of a standing military force, so it follows that it would be ahead of the curve when it comes to both surveillance equipment and repurposed military gear.

What is surprising is that these documents are in the ACLU's hands at all. The NYPD is notoriously resistant to FOIL (Freedom of Information Law) requests, having gone so far as to deny requesters copies of its FOIL response procedures.

And, as usual, the Stingrays went into use without any sort of public comment period or any information being passed on to affected citizens (which would be anyone with a cell phone) by the city representatives who signed off on the purchase orders. No doubt these were pushed through with maximum secrecy while NYPD officials chanted their "terrorism" mantra and spritzed the passing documents with holy water redactions.

"Terrorism" is the most frequently cited reason when law enforcement agencies seek to obtain military technology -- which Stingrays are -- but the documents obtained show no deployments for terrorist-related activity. Instead, they've been used to tackle all sorts of "normal" crime, from the violent (rape, homicide, armed robbery) to more mundance illegal activities -- like bail jumping, fraud, drug possession, suicide [?] and the location of material witnesses. For the most part, the NYPD's Stingrays seem to be effective in tracking people/phones down, but that's hardly any excuse for brushing past the Fourth Amendment with a minimum of paperwork or internal accountability.

Filed Under: 4th amendment, imsi catcher, nypd, stingray, warrants