S. E. Williams
Late last May, technology news and information website Ars Technica, published a startling report that exposed the covert use of cell-site simulators or stingrays by the San Bernardino County Sheriff’s Department.
It is highly probable a number of individuals were arrested and/or convicted based on evidence secretly obtained by the San Bernardino County Sheriff’s Department with this telephone monitoring technology—purportedly, in some instances, the department may even have provided misleading information regarding how the evidence was acquired.
Cell site simulators, commonly referred to as “stingrays” mimic cell towers and are frequently used to determine where a cell phone is located. They also intercept phone calls and text messages. What is also concerning about how this technology works is that once it is deployed it not only has the ability to intercept information from the target phone—but from other phones in the vicinity as well.
And if this is not concerning enough, there are reports that at times police departments have purportedly provided misleading information regarding how stingray gathered evidence was obtained–falsely claiming it was provided by an informant.
Documents sent to Ars Technica (Ars) by the San Bernardino County Sheriff’s Department (SBCSD) in response to a public records request and recently reviewed by The Voice, showed that since the department acquired a stingray during the latter part of 2012, it used the equipment more than three hundred times between January 1, 2014 and May 7, 2015.
SBCSD, like other agencies who use this technology around the country, advised Ars it maintained a non-disclosure agreement (NDA) with the FBI that professed the agency would work with the local prosecuting authority to dismiss cases rather than reveal information in court about stingrays. However, on May 15, 2015, the FBI released a statement (published by Ars and reviewed by The Voice), that contradicted the NDA provided by SBCSD.
It read in part, “The NDA should not be construed to prevent a law enforcement officer from disclosing to the court or a prosecutor the fact that this technology was used in a particular case. Defendants have a legal right to challenge the use of electronic surveillance devices, and not disclosing their use could inappropriately and adversely affect a defendant’s right to challenge the use of the equipment.” Previous to the release of this statement the Justice Department that oversees the FBI announced it was reviewing its stingray policy.
As part of its response to Ars, SBCSD also provided a template for a “pen register and trap and trace order” application. In the correspondence, county attorneys claimed it was a warrant application template.
San Bernardino, like other places in the country where stingrays are being deployed, typically go to a local judge and apply for a “pen register and trap and trace order.” Such orders are normally sealed and remain so even after the case is concluded, even though state law requires warrants be made available for public examination once served and complete.
Such orders initiated by SBCSD read in part, “Detective Name, a detective for the San Bernardino County Sheriff's Department. hereby applies to the Court for an Order (1) authorizing the use of a PEN register on the telephone lines currently designated by the numbers; Telephone Number (The “Telephone Line”); (2) authorizing the use of a trap-and-trace device on the Telephone Line: and (3) requiring the disclosure of subscriber name and address, whether listed or unlisted for numbers called by the Telephone Line or numbers calling the Telephone Line; or found during investigation of this case upon oral or written demand of agents of the San Bernardino County Sherriff‘s Department.”
This order however, is very misleading because the type of information provided by communications companies in the pre-cell phone era, police can now obtain directly with the use of a stingray. The American Civil Liberties Union (ACLU) described the language used by SBCSD in the orders as “very unusual,” and told Ars, “The template is likely to mislead judges who receive applications based on it because it gives no indication that the Sheriff’s Department intends to use a stingray.”
The ACLU’s assessment was reinforced this July when a United States federal judge in New York rebuked the government’s warrantless use of stingrays.
The appeals court judge threw out the evidence in question in the case, United States v. Raymond Lambis, and ruled the government could not use stingray equipment to locate a drug suspect, asleep in his apartment. As a result, the judge suppressed the evidence found in the man’s bedroom—effectively putting an end to the case.
The federal judge strongly affirmed that the Fourth Amendment of the Constitution requires police to get a warrant to use a stingray. “Absent a search warrant, the government may not turn a citizen’s cell phone into a tracking device,” US District Judge William Pauley wrote.
In 2015, both the Homeland Security Department and the Department of Justice implemented new policies that now require that a warrant be obtained for the use of stingrays in most cases. In the case detailed above the stingray device was deployed by the Drug Enforcement Agency. In the warrant application issued in the United States v. Raymond Lambis case the agent stated, “. . . the prospective location information will be obtained by requiring the Service Provider to provide the information.”
In his ruling in this case the federal judge made it abundantly clear that not only is a warrant required for use of a stingray, but that the court authorizing the surveillance must be told that they are authorizing the use of a stingray.
In the federal ruling in the New York case the judge also addressed another sticky issue related to the use of stingrays. It involved the so called third-party doctrine which in essence states that citizens do not have a privacy interest in data they hand over to third parties like telephone companies for example. This 1979 Supreme Court ruling has been quoted as precedent by police agencies again and again to justify the use of information/evidence obtained by stingrays in other cases—herein lies a problem for the San Bernardino County Sheriff’s Department—and other jurisdictions.
Most of the requests for warrants that resulted in the use of stingrays either directly or by inference led judges to believe the warrants were authorizing the use of pen registration information and/or cell-site location information (CSLI) provided the telephone companies—cell site simulators or stingrays operate differently. Although a service provider may provide pen registration information/cell-site location information (CSLI) it only points officers in the general direction—it is the cell site simulator or stingray that takes officers directly to their subject of interest. As a result, the information or communication obtained via a stingray is not initiated by the user nor is it sent to a communications company—the stingray equipment in essence, allows the police to obtain information directly—it cuts the communications companies out of the loop; and as a result, the third-party doctrine referred to in the 1979 Supreme Court ruling does not apply.
With this in mind, San Bernardino County Sheriff John McMahon was asked by The Voice to comment on the department’s use of stingrays and the recent ruling by the federal judge in New York in regards to what impact it might have on the criminal cases pending in San Bernardino County that may hinge on evidence secured as a result of the 300 plus times stingrays were used in San Bernardino County; in addition to how the ruling might impact the future use of stingrays in the county. McMahon declined to comment and instead referred The Voice to the county’s legal department.
The legal department also failed to respond directly to The Voice’s inquiry and instead provided a copy of the county’s newly implemented temporary order regarding the Use of Cell-Site Simulators (stingrays). The guidelines are dated effective April 2, 2016. The policy reads in part, “. . . a search warrant supported by probable cause shall be obtained prior to use of a cell-site simulator. When making any application to a court, a deputy must disclose appropriately and accurately the underlying purpose and activities for which an order or authorization is sought. Applications for the use of a cell-site simulator must include sufficient information to ensure that the courts are aware that the technology may be used.”
Knowing the Department put a policy in place for the deployment of stingrays effective April 2, 2016, does little to explain the fate of the potentially hundreds of suspects arrested in San Bernardino whose cases were impacted by evidence questionably collected with stingray technology between January 1, 2014 and April 1, 2016.
On October 8, 2015, Governor Jerry Brown signed SB178, the landmark California Electronic Communications Privacy Act. The law became effective January 1. Described as the most comprehensive digital privacy law in the nation, it is supposed to assure that police go to a judge and secure a warrant before accessing electronic information about any citizen. The law requires a probable cause warrant for “all digital content, location information, metadata, and access to devices like cell phones.” Now, some are questioning whether SBCSD ever bothered to follow this law in regards to stingrays.
Ars Technica was established in 1998. It publishes news, reviews, and guides on issues such as computer hardware and software, science, technology policy, and video games.