Federal Court Says Warrants Are Needed For Stingray Deployment

from the little-more-Fourth-for-cellphone-users dept

A federal court in Oakland, California has come to a conclusion the DOJ definitely didn't want it to reach, as Cyrus Farivar reports for Ars Technica.

In the 39-page ruling, US District Judge Phyllis Hamilton notably found that the use of stingray to find a man named Purvis Ellis was a "search" under the Fourth Amendment—and therefore required a warrant.

The DOJ -- despite issuing its own guidance requiring warrants for Stingrays in 2015 -- argued in court earlier this year that no warrant was needed to deploy the Stingray to locate a shooting suspect. It actually recommended the court not reach a conclusion on the Fourth Amendment implications of Stingray use, as it had plenty of warrant exceptions at the ready -- mainly the "exigent circumstances" of locating a suspect wanted for a violent crime.

Unfortunately for the federal government (and all other law enforcement agencies located in the court's jurisdiction), the court declined the DOJ's offer to look the other way on Constitutional issues. It found a Stingray's impersonation of cell tower to obtain real-time location information is a search under the Fourth Amendment.

The court adopts Judge Koh’s reasoning in In re Application for Telephone Information, 119 F. Supp. 3d at 1026, to hold that cell phone users have an expectation of privacy in their cell phone location in real time and that society is prepared to recognize that expectation as reasonable. While Judge Koh limited her analysis to the privacy interest in historical CSLI, the court determines that cell phone users have an even stronger privacy interest in real time location information associated with their cell phones, which act as a close proxy to one’s actual physical location because most cell phone users keep their phones on their person or within reach, as the Supreme Court recognized in Riley. In light of the persuasive authority of Lambis, and the reasoning of my learned colleagues on this court recognizing a privacy interest in historical cell site location information, the court holds that Ellis had a reasonable expectation of privacy in his real-time cell phone location, and that use of the Stingray devices to locate his cell phone amounted to a search requiring a warrant, absent an exception to the warrant requirement.

The court also has something to say about the FBI/Oakland PD's use of a pen register order as a stand-in for a warrant specifically detailing the type of device to used to obtain these so-called "phone records."

The government contends that since the Stingray devices used in this case were configured in compliance with the pen register statute, then the provisions of the pen register statute, including the “emergency” provisions, govern their operation. Doc. no. 321 at 9 (citing 18 U.S.C. § 3125). The government does not address the key issue in dispute, namely, whether the provisions of the pen register statute and the SCA provide the appropriate standard for using a CSS to locate a cell phone in real-time. The court follows Judge Illston’s determination in Cooper, 2015 WL 881578, that the provisions of the pen register statute and the SCA do not authorize the use of a CSS to disclose realtime information about a cell phone user’s physical location, and that such location monitoring must be authorized by a showing of probable cause.

It also points out the DOJ's reliance on the Stored Communications Act to salvage its warrantless Stingray use is misplaced -- something that could be gathered by the name of the statute.

[C]ongress intended that the SCA “was to be used as a means to obtain data which has already been stored at the time the government seeks to obtain it,” as opposed to real-time data.

Ultimately, though, the court denies the suppression of the evidence, allowing the government's "exigent circumstances" argument to prevail. This may prove to be a good thing in the long run (although it does little for the defendant). Allowing the government to keep its evidence gives it no reason to appeal the decision. And this decision implements a warrant requirement for obtaining real-time cell site location info and gives certain third-party records an expectation of privacy.

Filed Under: 4th amendment, imsi catcher, oakland, purvis ellis, stingray, surveillance, warrant

Court Documents Show FBI Had To Bail Out Oakland Police With Its Bigger, Better Stingray

from the stand-back-and-let-the-pros-handle-this,-son dept

Cyrus Farivar of Ars Technica has obtained court documents showing the Oakland Police Department had to call in the feds -- and their IMSI catcher -- to track down a suspect wanted in connection with a shooting of an off-duty police officer.

According to new government affidavits filed earlier this week, the Oakland Police Department (OPD) used its stingray without a warrant in 2013 for several hours overnight as a way to locate a man accused of being involved in shooting a local police officer. The OPD called in the FBI when that effort was unsuccessful. The FBI was somehow able to locate the suspect in under an hour, and he surrendered to OPD officers.

The only reason these affidavits even exist is because the judge presiding over the prosecution of Purvis Ellis ordered the government to submit declarations detailing how the devices were used to locate him. Two declarations -- one from the FBI [PDF] and one from the Oakland PD [PDF] -- shed some additional light on the now-ubiquitous cell phone-tracking technology.

Neither law enforcement agency sought a warrant for their Stingray deployments. Both declarations claim none was needed because of "exigent circumstances." Given that this occurred before the DOJ instituted a warrant requirement for the FBI's Stingray use, it's unlikely any evidence is in danger of being tossed.

The Oakland PD's declaration states the same thing: no warrant was sought because of "exigent circumstances." Similarly, there appears to have been no warrant requirement in place for the Oakland Police Department at that time. That doesn't mean the court won't find that the use of a Stingray device (or, in this case, two of them) requires the use of a warrant, but even if it does, the good faith exception is likely to apply -- especially in the FBI's case, as its warrant requirement was still thee years away. In both deployments, pen register orders were used to obtain subscriber info. Because exigent circumstances dictated the requests, no judicial approval of the orders was needed.

Ellis' lawyers are hoping the judge will find the circumstances surrounding the Stingray deployments to be not nearly as "exigent" as the government claims.

Prosecutors argued that because the three men involved in the altercation were at large, there was a clear exigency. Ellis’ defense, meanwhile, has countered that because the OPD had declared the scene “secure” 14 minutes after Karsseboom was shot, there was no exigency. This issue remains unresolved.

On one hand, securing a crime scene doesn't immediately dispel perceived exigency. As the government points out, the shooting suspects were still free and roaming Oakland. On the other hand, the amount of time that elapsed between the Oakland PD's response to the reported shooting and the eventual location of Ellis by the FBI -- 15 hours -- suggests some of the exigency may have dissipated by the time the FBI fired up its tracking device.

Whatever the case is, the Oakland PD's call for assistance suggests its equipment was already outdated.

“It's unclear from the Oakland declaration how continuous the operation of their equipment was,” Brian Hofer, chair of the City of Oakland Privacy Advisory Commission, told Ars. His newly created commission has been scrutinizing the city’s procurement process for surveillance and has pushed for new policies overseeing its use.

“We believe that Oakland only had an older 2G/3G Stingray, based on public records in our possession,” he continued. “It is possible that the FBI already possessed a Hailstorm or similar 4G capable device at this time, or an older 2G/3G system but with enhanced amplification, or maybe Oakland's equipment was simply malfunctioning."

The shooting occurred roughly two years before the PD attempted to secure a Homeland Security grant to pay for the Hailstorm upgrade, which would have allowed it to track the suspect. The FBI's newer version had no such problems. The Oakland PD spent ten futile hours searching for Ellis. The FBI located him roughly an hour after deploying its Stingray. It also deployed something else along with it. From the FBI's declaration:

At one point, in an effort to reduce the error radius and increase the accuracy of the location of the cellular telephone, a cell site simulator augmentation device was deployed into the interior of the apartment building. This device is used in conjunction with the cell site simulator and has no data storage capability whatsoever.

Farivar spoke to Daniel Rigmaiden -- the person who first uncovered government use of Stingray devices in criminal investigations (prior to that, it had only been deployed in war zones by the military) while serving time for tax fraud -- who suggested the "augmentation device" might be something made by KeyW or one of its competitors. These devices passively collect connection info and are small enough to be carried in an agent's hand.

Rigmaiden also points out something else this incident shows, however inadvertently. All the money being spent by local law enforcement agencies might be better off spent on other things. Not having a Stingray device isn't the end of the world -- especially when the FBI is willing to put its devices and technical expertise to use at a moment's notice.

Filed Under: fbi, oakland, oakland police department, privacy, purvis ellis, stingray