Police face constitutional challenges for using cellphone tracking devices to locate suspects
The StingRay collects cellphone identification data by pretending to be a cell tower. AP Images.
While helpful, this information could not pinpoint the exact location. However, once in the area, the police Advanced Technical Team deployed an electronic device that tricked Andrews’ phone into giving up its precise location. Moments later, officers arrested Andrews as he sat on a friend’s couch.
The device police used is called Hailstorm, a type of cell site simulator also known as an IMSI catcher, or by the brand name StingRay. (IMSI is short for international mobile subscriber identity.) It’s a small, desktop tool that collects cellphone identification information by pretending to be a cell tower. Like a dragnet, the tool collects the location of every phone in its vicinity.
As police increasingly use this technology to track suspects, defense attorneys and privacy advocates are challenging the practice because, they argue, it violates individual privacy and due process. If the recent case in Baltimore is any indicator, the courts may find that police have gone too far.
That city’s cops got permission to use the tool under a pen register order, which requires a lower burden of proof than a typical warrant. However, during preliminary motions at Andrews’ trial, the judge suppressed evidence collected at the time of arrest, including a gun, based on the use of the StingRay. The case, which was appealed, may be the first in which evidence collected as a result of a cell site simulator was thrown out for lack of a warrant.
While in existence since 2003, the simulators exploited 2G cellphone networks, an older system with security vulnerabilities most carriers will phase out by the end of 2016. Many believed that the newer LTE 4G networks, which are faster and more secure, would render cell site simulators obsolete. However, the newer Hailstorm shows that 4G is not as secure as initially thought.
BUYING SPREE
As the technology evolves, local and federal law enforcement agencies are buying up these tools. Nathan Freed Wessler, a staff attorney with the American Civil Liberties Union’s Speech, Privacy and Technology Project, says 58 agencies in 23 states and 12 federal agencies, including the FBI, IRS and ATF, possess cell site simulators. Since 2007, the U.S. Marshals Service has gone so far as to attach the devices to planes.
This increased use by law enforcement has not been matched with greater transparency. “We see time and again that police are hiding their use of StingRays from the defense, but also the prosecutor and the judge,” says Jennifer Lynch, a senior staff attorney at the Electronic Frontier Foundation. Not only that, but most jurisdictions do not have a policy about how the tools are used or what happens after third-party data is collected.
In September 2015, the Department of Justice and the Department of Homeland Security became the first federal agencies to create public guidelines on the use of cell site simulators. The new guidelines acknowledge that the DOJ and DHS previously obtained pen register orders for permission to use StingRays, but now require a search warrant supported by probable cause, except in exceptional circumstances such as when a person might be in imminent danger.
The DOJ did not respond to an interview request from the ABA Journal. The DHS did not answer specific questions, instead referring inquiries to congressional testimony explaining the tool’s function and its new policy and guidelines.
Stephanie Pell, an assistant professor at West Point’s Army Cyber Institute, says the guidelines are a good step forward, but without case law or clearer statutes, questions around Fourth Amendment compliance go unanswered. “We don’t have definitive guidance on the range of issues that the StingRay raises from the courts,” Pell says.
Only about a dozen states have statutes pertaining to cell site simulators or cell tracking. In Washington and Montana, for example, the law requires a warrant before tracking a cellphone. In Colorado, police need a warrant to track a device, but a warrant is not required when gathering the same information from a service provider.
Obscuring these issues further are the nondisclosure agreements that local law enforcement sign with the FBI. According to the NDAs, the bureau requires a law enforcement agency purchasing a cell site simulator from the Harris Corp., the primary vendor of these tools, to sign an agreement. Harris did not respond to an interview request.
According to Allen, the NDAs are meant to protect “the capabilities of the device” and “not meant to protect the use of ” cell site simulators themselves.
Wessler thinks the agreements are needless. One reason is that plans for $1,100 do-it-yourself Hailstorm-like devices are available online, so protecting how the device works is a moot point. And even if people understood how the simulators work, they couldn’t protect against them, short of taking the battery and SIM card out of their phones.
Even with these challenges, “lawyers always have a duty to stay on top of the way that law enforcement is doing their work,” says Jumana Musa, the senior privacy and national security counsel at the National Association of Criminal Defense Lawyers. To help, Musa points to the ACLU of Northern California’s guide, StingRays: The Most Common Surveillance Tool the Government Won’t Tell You About.
Lynch of the Electronic Frontier Foundation says that defense attorneys need to ask: “How did the police find my client?” In one incident, now on appeal in the 7th U.S. Circuit Court of Appeals at Chicago, Milwaukee police claimed to obtain location information “from an unknown source.” A privacy advocate later discovered the source was a cell site simulator.
EVIDENCE SUPPRESSED
During February’s oral arguments in the Baltimore case, State v. Andrews, frustration was palpable among the three-judge panel at the Maryland Court of Special Appeals. At issue was the pen register order, which, according to the EFF, was insufficient under the Fourth Amendment and did not inform the judge, defense or prosecutor of the cell site simulator’s use.
Robert Taylor Jr., a Maryland assistant attorney general, argued that the pen register order was sufficient to permit use of the simulator. Judge Andrea M. Leahy asked whether the comparison between a pen register and Hailstorm was as misguided as comparing “a rain drop and a hail storm.”
“No need to rule on the Fourth Amendment issues,” Taylor said after arguments. “It’s a case that’s unlikely to rise again in the future because we now have a statute that governs [cell tracking].”
Indeed, Maryland recently changed its criminal procedure code to provide guidance on cell tracking after the events in Andrews took place. How-ever, Dan Kobrin, the assistant public defender arguing for Andrews, hinted in arguments that the statute was insufficient because it does not include a suppression mechanism.
In early March, the appellate court released an order siding with Andrews that kept the evidence suppressed. The opinion states that a warrant is required when deploying a cell site simulator, and that “people have a reasonable expectation that their cellphones will not be used as real-time tracking devices by law enforcement.”
As Maryland continues to grapple with this emerging issue, many states have yet to confront it. “Courts, by the nature of our legal system, are slow to update,” says the ACLU’s Wessler. But, he says of the Andrews order, “the court has put law enforcement on notice that it cannot avoid the requirements of the Constitution by hiding its use of surveillance technology from judges, defense attorneys and the public.”
This article originally appeared in the July 2016 issue of the ABA Journal with this headline: “Cell Block: Police face constitutional challenges for using cellphone tracking devices to locate suspects.”
