A Police Gadget Tracks Phones? Shhh! It’s Secret

By MATT RICHTEL NYTIMES 
MARCH 15, 2015

A powerful new surveillance tool being adopted by police departments across the country comes with an unusual requirement: To buy it, law enforcement officials must sign a nondisclosure agreement preventing them from saying almost anything about the technology.

Any disclosure about the technology, which tracks cellphones and is often called StingRay, could allow criminals and terrorists to circumvent it, the F.B.I. has said in an affidavit. But the tool is adopted in such secrecy that communities are not always sure what they are buying or whether the technology could raise serious privacy concerns.

The confidentiality has elevated the stakes in a longstanding debate about the public disclosure of government practices versus law enforcement’s desire to keep its methods confidential. While companies routinely require nondisclosure agreements for technical products, legal experts say these agreements raise questions and are unusual given the privacy and even constitutional issues at stake.

“It might be a totally legitimate business interest, or maybe they’re trying to keep people from realizing there are bigger privacy problems,” said Orin S. Kerr, a privacy law expert at George Washington University. “What’s the secret that they’re trying to hide?”

The issue led to a public dispute three weeks ago in Silicon Valley, where a sheriff asked county officials to spend $502,000 on the technology. The Santa Clara County sheriff, Laurie Smith, said the technology allowed for locating cellphones — belonging to, say, terrorists or a missing person. But when asked for details, she offered no technical specifications and acknowledged she had not seen a product demonstration.

Buying the technology, she said, required the signing of a nondisclosure agreement.

“So, just to be clear,” Joe Simitian, a county supervisor, said, “we are being asked to spend $500,000 of taxpayers’ money and $42,000 a year thereafter for a product for the name brand which we are not sure of, a product we have not seen, a demonstration we don’t have, and we have a nondisclosure requirement as a precondition. You want us to vote and spend money,” he continued, but “you can’t tell us more about it.”

The technology goes by various names, including StingRay, KingFish or, generically, cell site simulator. It is a rectangular device, small enough to fit into a suitcase, that intercepts a cellphone signal by acting like a cellphone tower.

The technology can also capture texts, calls, emails and other data, and prosecutors have received court approval to use it for such purposes.

Cell site simulators are catching on while law enforcement officials are adding other digital tools, like video cameras, license-plate readers, drones, programs that scan billions of phone records and gunshot detection sensors. Some of those tools have invited resistance from municipalities and legislators on privacy grounds.

The nondisclosure agreements for the cell site simulators are overseen by the Federal Bureau of Investigation and typically involve the Harris Corporation, a multibillion-dollar defense contractor and a maker of the technology. What has opponents particularly concerned about StingRay is that the technology, unlike other phone surveillance methods, can also scan all the cellphones in the area where it is being used, not just the target phone.

“It’s scanning the area. What is the government doing with that information?” said Linda Lye, a lawyer for the American Civil Liberties Union of Northern California, which in 2013 sued the Justice Department to force it to disclose more about the technology. In November, in a response to the lawsuit, the government said it had asked the courts to allow the technology to capture content, not just identify subscriber location.

The nondisclosure agreements make it hard to know how widely the technology has been adopted. But news reports from around the country indicate use by local and state police agencies stretching from Los Angeles to Wisconsin to New York, where the state police use it. Some departments have used it for several years. Money for the devices comes from individual agencies and sometimes, as in the case of Santa Clara County, from the federal government through Homeland Security grants.

Christopher Allen, an F.B.I. spokesman, said “location information is a vital component” of law enforcement. The agency, he said, “does not keep repositories of cell tower data for any purpose other than in connection with a specific investigation.”

A fuller explanation of the F.B.I.’s position is provided in two publicly sworn affidavits about StingRay, including one filed in 2014 in Virginia. In the affidavit, a supervisory special agent, Bradley S. Morrison, said disclosure of the technology’s specifications would let criminals, including terrorists, “thwart the use of this technology.”

“Disclosure of even minor details” could harm law enforcement, he said, by letting “adversaries” put together the pieces of the technology like assembling a “jigsaw puzzle.” He said the F.B.I. had entered into the nondisclosure agreements with local authorities for those reasons. In addition, he said, the technology is related to homeland security and is therefore subject to federal control.

In a second affidavit, given in 2011, the same special agent acknowledged that the device could gather identifying information from phones of bystanders. Such data “from all wireless devices in the immediate area of the F.B.I. device that subscribe to a particular provider may be incidentally recorded, including those of innocent, nontarget devices.”

But, he added, that information is purged to ensure privacy rights.

In December, two senators, Patrick J. Leahy and Charles E. Grassley, sent a letter expressing concerns about the scope of the F.B.I.’s StingRay use to Eric H. Holder Jr., the attorney general, and Jeh Johnson, the secretary of Homeland Security.

The Harris Corporation declined to comment, according to Jim Burke, a company spokesman. Harris, based in Melbourne, Fla., has $5 billion in annual sales and specializes in communications technology, including battlefield radios.

Jon Michaels, a law professor at the University of California, Los Angeles, who studies government procurement, said Harris’s role with the nondisclosure agreements gave the company tremendous power over privacy policies in the public arena.

“This is like the privatization of a legal regime,” he said. Referring to Harris, he said: “They get to call the shots.”

For instance, in Tucson, a journalist asking the Police Department about its StingRay use was given a copy of a nondisclosure agreement. “The City of Tucson shall not discuss, publish, release or disclose any information pertaining to the product,” it read, and then noted: “Without the prior written consent of Harris.”

The secrecy appears to have unintended consequences. A recent article in The Washington Post detailed how a man in Florida who was accused of armed robbery was located using StingRay.

As the case proceeded, a defense lawyer asked the police to explain how the technology worked. The police and prosecutors declined to produce the machine and, rather than meet a judge’s order that they do so, the state gave the defendant a plea bargain for petty theft.

At the meeting in Santa Clara County last month, the county supervisors voted 4 to 1 to authorize the purchase, but they also voted to require the adoption of a privacy policy.

(Sheriff Smith argued to the supervisors that she had adequately explained the technology and said she resented that Mr. Simitian’s questioning seemed to “suggest we are not mindful of people’s rights and the Constitution.”)

A few days later, the county asked Harris for a demonstration open to county supervisors. The company refused, Mr. Simitian said, noting that “only people with badges” would be permitted. Further, he said, the company declined to provide a copy of the nondisclosure agreement — at least until after the demonstration.“Not only is there a nondisclosure agreement, for the time being, at least, we can’t even see the nondisclosure agreement,” Mr. Simitian said. “We may be able to see it later, I don’t know.”

Police Given Direct Line To Cell Phone Searches

Reporting Jay Gormley
March 6, 2012

DALLAS (CBSDFW.COM) – Think about all the personal information we keep in our cell phones: It’s something to consider after the U.S. Court of Appeals for the 7th Circuit ruled it is now legal for police to search cell phones without a warrant.

Former Dallas FBI Agent Danny Defenbaugh said the ruling gives law enforcement a leg up. “I think not only will it help them, but it could be life saving,” said the former Special Agent, who was based in Dallas.

The decision stems from an Indiana case where police arrested a man for dealing drugs. An officer searched the suspect’s cell phone without warrant.

The judge in the appeal case, Judge Richard Posner, agreed that the officer had to search the phone immediately or risk losing valuable evidence. Judge Posner ruled it was a matter of urgency, arguing it was possible for an accomplice to wipe the phone clean using a computer or other remote device.

Defenbaugh says the ruling takes into account exigent or time-sensitive circumstances that could be life saving in more urgent cases, such as child abduction. ”If the child is alive and you’re only minutes behind, that could be critical to recovering that child alive,” added Defenbaugh.

Judge Posner ruled that the search was legal because the officer conducted a limited search and only looked for phone numbers associated with the alleged drug deal. The judge argued it was similar to flipping through a diary to search for basic information such as addresses and phone numbers.

Paul Coggins is the former U.S. Attorney for the Northern District of Texas. Coggins says the court’s ruling pushes the envelope on privacy issues and wonders if it opens the door to more extensive searches down the road. “Does that mean officers now have the right to search through your phone, search through your search history, your photographs, your e-mails and the rest, because it could all be wiped clean,” Coggins asked.

Many critics are asking the same question. They call the ruling an invasion of privacy that far outweighs the needs of law enforcement.

Both Defenbaugh and Coggins agree that the case is likely to go to the U.S. Supreme court.

Important Things You Should Know About Privacy and the Supreme Court Ruling on GPS Tracking

On its face, this represents an important victory against the surveillance state. But this is a narrow ruling that leaves many crucial questions unanswered. 

By Scott Lemieux, AlterNet
Posted on January 29, 2012

Antoine Jones was sentenced to life in prison on drug distribution charges. The key evidence against him came from a month’s worth of data collected by a GPS tracker that police had attached to Jones’s car. The GPS, however, was attached without a valid warrant (police had obtained a warrant, but is was expired and for another jurisdiction.) Jones appealed his conviction, arguing that the warrantless GPS tracking violated the Fourth Amendment’s prohibitions against “unreasonable search and seizures.” The government replied that the installation of the GPS did not constitute a “search,” and hence could not have violated Jones’s constitutional rights. The Court of Appeals for the District of Columbia Circuit rejected the government’s argument, however. And earlier this week in United States v. Jones, the Supreme Court unanimously agreed that the police actions constituted a “search” and were subject to the restrictions of Fourth Amendment.

Here are some things you should know about this case and how the Bill of Rights might apply to modern technologies that increase the government’s power to invade private space:

1. While the Court ruled that Jones had been subject to a “search,” it did not address the question of whether the search was “unreasonable.” Because the search was conducted without a valid warrant, the search was presumptively unconstitutional. But – especially when it comes to cases involving the War On (Some People Who Use Some) Drugs – the Republican-dominated federal courts have been increasingly willing to carve out exceptions for warrantless searches. Until the courts decide this question, we don’t even know if the search of Jones will ultimately be ruled illegal.
2. Even in cases where a search has been held to be illegal, the Supreme Court has shown a willingness to water down the “exclusionary rule,” which holds that illegally obtained evidence cannot be used in courts. The provides strong incentives for the police to respect constitutional rights, because they cannot profit from illegal behavior; conversely, absent the exclusionary rule police have little incentive to comply with the law (civil remedies for violations of the Fourth Amendment are generally ineffective.) For example, in its infamous 2006 ruling Hudson v. Michigan, the Court ruled that while dangerous “no-knock” searches of homes were illegal, evidence obtained from them was admissible. If the courts rule that the search of Jones was illegal but the evidence can be admitted anyway, it will be a hollow victory for civil liberties indeed, as police will have strong incentives to push the envelope as new surveillance technologies emerge.
3. Justice Scalia’s majority opinion rested on grounds that actually have little application to new surveillance technologies. According to Scalia, since the GPS installation required trespassing private property, it “would have constituted a “search” within the original meaning of the Fourth Amendment.” While this isn’t necessarily wrong per se, as the concurrences by Justices Alito and Sotomayor point out ruling on this basis says nothing about more crucial questions about how the courts should assess searches that don’t require the direct invasion of physical property. As Justice Alito points out, “the Court’s reasoning largely disregards what is really important (the use of a GPS for the purpose of long-term tracking) and instead attaches great significance to something that most would view as relatively minor.” As a result, the long-term consequences of this decision are unclear.
4. Justice Alito’s concurrence proposes that rather than focusing on whether a trespass of property has occurred, the Court should focus on whether or not an individual had a “reasonable expectation of privacy” (the standard the Court has generally used since the early 1970s.) Again, there’s nothing wrong with this in and of itself, but in practice these kinds of balancing tests are only as good as the judges applying them. (In theory, the rule that abortion regulations that constitute an “undue burden” are unconstitutional could provide robust protection for reproductive freedom; in practice, it doesn’t.) Alito focuses on the relatively extreme facts of the case (tracking that lasted a month seeking evidence for a non-violent crime), which opens up the possibility that the state will be given wide latitude under this standard.
5. By far the strongest opinion, then, is Justice Sonia Sotomayor’s concurrence. As she notes, “[a]wareness that the Government may be watching chills associational and expressive freedoms.” Given the rapidly expanding tools that the executive branch has at its disposal to conduct surveillance on citizens, and the general unwillingness of legislatures to restrain intrusive searches, it is crucial that the courts not be behind the curve in applying Fourth Amendment protections. United States v. Jones could be a good first step – but only if the many questions it leaves open are answered in a way that takes the protection of privacy seriously. Justice Sotomayor’s concurrence provides a good road map. 

Judge Declares Law Governing Warrantless Cellphone Tracking Unconstitutional

By Julia Angwin - Wall Street Journal
November 16, 2011,

In a succinct one-page ruling, U.S. District Court Judge Lynn N. Hughes of the Southern District of Texas declared that the law authorizing the government to obtain cellphone records without a search warrant was unconstitutional.

“The records would show the date, time, called number, and location of the telephone when the call was made,” Judge Hughes wrote in the decision, dated Nov. 11. “These data are constitutionally protected from this intrusion.”

Judge Hughes’ decision comes as the U.S. government is facing increasing judicial challenges to its practice of obtaining information about the location of individuals without a search warrant. Last week, the Supreme Court heard oral arguments in a case where the government placed a GPS tracking device under a vehicle and monitored the driver’s movements for a month without a search warrant.

During the argument, Chief Justice John Roberts said to Michael Dreeben, deputy solicitor general of the Justice Department: “If you win this case then there is nothing to prevent the police or the government from monitoring 24 hours a day the public movement of every citizen of the United States.” The Justice Department argues that people have no expectation of privacy on public roads.

Cellphone records are governed by the Electronic Communications Privacy Act, a 1986 law that permits law enforcement officers to obtain certain digital records – such as some e-mail and cellphone records – without a search warrant. A coalition of technology companies—including Google Inc., Microsoft Corp. and AT&T Corp.—is lobbying Congress to update the law to require search warrants in more digital investigations.

At the same time, judges in lower courts have been questioning the constitutionality of the law, which only requires officers to show “specific and articulable facts” the electronic records sought are “relevant and material” to an ongoing investigation. For physical searches of a person’s home, the government is required to show probable cause that a crime was committed and obtain a search warrant.

Since 2005, more than a dozen magistrate judges have written opinions denying applications for court orders to track cellphones without search warrants. The nation’s roughly 500 magistrate judges handle applications for search warrants and other types of electronic surveillance in federal courts.

Of course, some have upheld warrantless searches. Last week, U.S. District Court Judge Liam O’Grady ruled that the government could obtain data from the Twitter accounts of three WikiLeaks without a search warrant.

Last year, Magistrate Judge Stephen Smith of U.S. District Court in the Southern District of Texas issued an opinion denying the government access to 60 days worth of information about a cellphone subscriber’s location and phone calls, without a search warrant.

Magistrate Judge Smith wrote that although cellphone tracking wasn’t envisioned by the writers of the Constitution, it had become so precise and pervasive that “for a cellphone user born in 1984, however, it is now conceivable that every movement of his adult life can be imperceptibly captured, compiled, and retrieved from a digital dossier somewhere in a computer cloud. Now as then, the Fourth Amendment remains our polestar.”

The government appealed, saying that the Fourth Amendment, which protects against unreasonable searches and seizures, does not apply because “a customer has no privacy interest in business records held by a cell phone provider, as they are not the customer’s private papers.” The government also challenged Judge Smith’s description of the accuracy of location tracking as “inaccurate or misleading,” and submitted an affidavit from cellular provider MetroPCS Wireless Inc. stating that the average coverage radius of its cellular towers was about “one or two miles.”

The district court ruling was short, but declarative. It affirmed Magistrate Judge Smith’s decision on constitutional grounds. “When the government requests records from cellular services, data disclosing the location of the telephone at the time of particular calls may be acquired only by a warrant issued on probable cause,” Judge Hughes wrote. “The standard under the [existing law] is below that required by the Constitution.”