Warrant now required for federal 'Stingray' surveillance use - DoJ
US Department of Justice agents now have to acquire a search warrant before utilizing a cell-site simulator, the department said, though the new policy allows for exceptions. The devices, known as 'Stingrays,' trick phones into connecting to them.
The Department of Justice (DOJ) announced on Thursday that while the department's agents have followed "appropriate legal authorizations" for cell-site simulators in the past, effective immediately, federal agencies must now get a search warrant supported by probable cause before using a cell-site simulator.
READ MORE: Associated Press sues US DoJ over access to FBI records
The Harris Corporation’s ‘Stingray’ is the most well-known brand of the controversial spying technology, used by the FBI, the Secret Service, the Drug Enforcement Agency, and many state and local police agencies. By impersonating cell towers, the suitcase-sized devices force phones in the area to broadcast information that can be used to identify and locate users. The devices are able to indiscriminately collect and intercept data from hundreds of phones at once.
Oops. Knew it.
New policy doesn't actually apply to Nat Sec uses. pic.twitter.com/wcjKAEXfim— emptywheel (@emptywheel) September 3, 2015
New Stingray policy: 6 pages long. 9 footnotes, all pretty pregnant with meaning.— emptywheel (@emptywheel) September 3, 2015
The new policy does allow federal agencies to skirt those rules in the case of "dire circumstances," such as when agents are attempting to avoid a death or injury, to keep a cellphone or other device they are tracking from being destroyed, or when a pursued criminal is in danger of escaping. Agents will be required to note how many times those exceptions are used so that they can be part of an audit at a later date.
Feds say the new phone surveillance rules will not require legal notice/updates in current or past prosecutions— Devlin Barrett (@DevlinBarrett) September 3, 2015
The policy says federal agents cannot collect content from phones, including email, text messages, or GPS data, but they can monitor the general location of a tracked device. All data gathered and used to locate a device must be deleted as soon as it’s located, or no less than once per day.
DOJ on stingrays: it's "collection" when you temporarily hijack phone data, but not when you temporarily search email. @emptywheel— Patrick Toomey (@PatrickCToomey) September 4, 2015
“Cell-site simulator technology has been instrumental in aiding law enforcement in a broad array of investigations, including kidnappings, fugitive investigations and complicated narcotics cases," said Deputy Attorney General Sally Quillian Yates in announcing the new guidance. "This new policy ensures our protocols for this technology are consistent, well-managed and respectful of individuals’ privacy and civil liberties.”
READ MORE: You're on camera, you betcha: Fargo police live stream traffic stops
The guidance only applies to federal law enforcement, not state or local policing agencies, which have increasingly turned to Stingrays, not just for high-profile terror plots or other major criminal cases, but for routine police investigations.
The Federal Bureau of Investigation has long advocated secrecy surrounding Stingrays. But in May, the FBI said that its non-disclosure agreement (NDA) with local law enforcement agencies regarding Stingrays is actually not intended to shield the technology's use. Dozens of law enforcement departments nationwide have long attempted to hide Stingray use, going so far as to drop cases rather than disclose that the technology was used, according to documents obtained through Freedom of Information Act requests.
READ MORE: Whistleblowers sue DOJ, FBI, and NSA for malicious prosecution, civil rights violations
For example, it was revealed last month that the Baltimore Police Department has used Stingrays to pursue petty crimes while concealing that usage from suspects, their attorneys, and judges.
"The FBI’s concern is with protecting the law enforcement sensitive details regarding the tradecraft and capabilities of the device," FBI spokesman Christopher Allen said in May.
The FBI has previously justified the secretive aura around Stingrays based on the possible ability of criminals to thwart FBI tactics. The public cannot know about Stingrays because criminals are part of the public, the FBI has suggested.
"The FBI routinely asserts the law enforcement sensitive privilege over cell site simulator equipment because discussion of the capabilities and use of the equipment in court would allow criminal defendants, criminal enterprises or foreign powers, should they gain access to the items, to determine the FBI’s techniques, procedures, limitations and capabilities in this area," Bradley Morrison, chief of the tracking technology unit at the FBI, wrote in an affidavit last year.
"This knowledge could easily lead to the development and employment of countermeasures to FBI tools and investigative techniques by subjects of investigations and completely disarm law enforcement’s ability to obtain technology-based surveillance data in criminal investigations," Morrison added.
The American Civil Liberties Union said that "after decades of secrecy" surrounding Stingray surveillance, it was cautiously optimistic about the DOJ's new policy. However, it was also concerned about the myriad loopholes attached to rules guiding police tracking capabilities.
READ MORE: US Freedom Act a ‘surveillance act in disguise' - ex-MI5 agent
“[T]his policy does not adequately address all concerns," the ACLU wrote. "Disturbingly, the policy does not apply to other federal agencies or the many state and local police departments that have received federal funds to purchase these devices. In addition, the guidance leaves the door open to warrantless use of Stingrays in undefined 'exceptional circumstances,' while permitting retention of innocent bystander data for up to 30 days in certain cases."
The ACLU has identified more than 50 state and local policing agencies in 21 states, plus the District of Columbia, and at least a half dozen federal law enforcement agencies, as owning Stingray surveillance devices. Civil liberties groups that have been making public records requests in order to learn more about the technology have discovered that non-disclosure agreements exist between governments and companies like Harris.
The ACLU has also uncovered the ability of a Stingray to negate cell phone calls by either downgrading mobile devices from 3G or 4G connectivity to 2G – enabling them to access identification and location information – or by using the devices’ “catch-and-release” functions.
Last week, a US federal appeals court validated the National Security Agency's bulk collection surveillance program under Section 215 of the USA Patriot Act. The three-judge appeals court threw out a 2013 verdict against the NSA that deemed unconstitutional the agency's bulk collection of telephony metadata. Plaintiffs argued that the NSA refused to provide evidence showing they had been spied on, though the judges said that secrecy is basically how the law was intended to work.
“Plaintiffs complain that the government should not be allowed to avoid liability simply by keeping the material classified. But the government’s silence regarding the scope of bulk collection is a feature of the program, not a bug,” Judge Stephen F. Williams wrote in the decision.
The controversial section of the Patriot Act expired at the end of May, after a bipartisan group of lawmakers filibustered to prevent its extension. Under the subsequently passed USA Freedom Act, the collection of metadata will be entrusted to telecom companies, and the NSA will be able to obtain the records through seeking a warrant from the secretive Foreign Intelligence Surveillance Act (FISA) court.