Appeals Court Says Warrantless Use Of Stingray Devices Probably OK

from the Seventh-Circuit-says-'Not-It!' dept

An interesting ruling [PDF] has been handed down by the Seventh Circuit Court of Appeals on the warrantless use of Stingray devices to locate individuals. Wisconsin police used an IMSI catcher to track down Damian Patrick for a parole violation. He was arrested while sitting in a car on a public street.

Multiple factors played into the court’s decision, which found that using Stingrays without a warrant to locate people was not a Fourth Amendment violation. But it’s not quite as simple as it might first appear to be. Complicating things were the circumstances of the arrest and arguments raised in Patrick’s suppression request.

Patrick argued that the location tracking warrant (not a search warrant) was invalid. First, the tracking warrant made no mention of the Stingray the police used to locate him. Second, he argued that his personal location was not “contraband or the proceeds of a crime,” making his location “off limits” to the Wisconsin PD’s investigatory efforts. The court disagrees.

That sounds like an attempt to resurrect the “mere evidence” doctrine that the Supreme Court disapproved in Warden v. Hayden, 387 U.S. 294 (1967). Hayden authorized the use of warrants to get evidence to locate a wanted person. See also Steagald v. United States, 451 U.S. 204 (1981) (search warrant to enter house to look for person to arrest).

Police were entitled to use a warrant to obtain data that would help them track down Patrick’s location. Indeed, they were entitled to arrest him without a warrant of any kind, let alone the two warrants they had. United States v. Watson, 423 U.S. 411 (1976), holds that probable cause alone is enough for an arrest in a public place.

That statement, though, only refers to the arrest warrant. There’s the matter of the location tracking warrant — which only specified the use of “cell phone data,” not a cell tower spoofer. That isn’t addressed until later in the decision, but in terms of locating Patrick, the court feels his public location (parked on a city street) diminishes any expectation of privacy in his location. Once eliminated by the court’s reasoning, it no longer matters what method the police used to locate him, at least according to the majority.

Probable cause to arrest Patrick predated the effort to locate him. From his perspective, it is all the same whether a paid informant, a jilted lover, police with binoculars, a bartender, a member of a rival gang, a spy trailing his car after it left his driveway, the phone company’s cell towers, or a device pretending to be a cell tower, provided location information. A fugitive cannot be picky about how he is run to ground. So it would be inappropriate to use the exclusionary rule, even if the police should have told the judge that they planned to use a cell-site simulator to execute the location warrant.

The appeals court never addresses whether or not the use of a Stingray constitutes a search. It weighs it against precedent in terms of call records and GPS tracking devices, and concludes that neither of those constitute a search either. (Although it does grant that the Supreme Court’s Jones decision raises questions partially related to Stingray deployment — like how long the device was in use and how precise the location data collected was.)

The government, however, conceded that it was a search (“for the purposes of this litigation“), but argued the lack of information about the device on the affidavit did not make the tracking warrant invalid. The court agrees and finds no reason to suppress the evidence. As it sees it, where Patrick was found is more important than how he was found. In the eyes of the majority, there was no privacy violation and Patrick doesn’t have standing to challenge the government’s search on these grounds.

We can imagine an argument that it will often be unreasonable to use a cell?site simulator when phone company data could provide what’s needed, because simulators potentially reveal information about many persons other than the suspects. (The contrary argument is that data from simulators is current, while data relayed through phone companies’ bureaucracies may arrive after the suspect has gone elsewhere.) But if the problem with simulators is that they are too comprehensive, that would not lead to suppression—though it might create a right to damages by other persons whose interests were unreasonably invaded. Patrick is not entitled to invoke the rights of anyone else; suppression is proper only if the defendant’s own rights have been violated.

The court goes on to point out that no other appeals court has handled the issue of the constitutionality of Stingray searches… and that it’s not interested in being the first to do so.

Questions about whether use of a simulator is a search, if so whether a warrant authorizing this method is essential, and whether in a particular situation a simulator is a reasonable means of executing a warrant, have yet to be addressed by any United States court of appeals. We think it best to withhold full analysis until these issues control the outcome of a concrete case.

The dissenting opinion, written by Chief Judge Diane Wood, runs far longer than the majority’s opinion. Wood raises several questions about the assumptions made by the court. First, Wood points out the government has been willing to engage in very dubious practices just to keep the existence and use of Stingray devices secret.

This is the first court of appeals case to discuss the use of a cell?site simulator, trade name “Stingray.” We know very little about the device, thanks mostly to the government’s refusal to divulge any information about it. Until recently, the government has gone so far as to dismiss cases and withdraw evidence rather than reveal that the technology was used.

Because of this, no one other than the law enforcement agents who deployed the device know exactly how it was operated and what it collected. The DOJ guidance quoted in the majority opinion does not provide any details on device usage or capabilities — only that it has recommended the use of search warrants going forward by DOJ components. There is nothing in it that declares this guidance should be followed by local law enforcement agencies.

Wood points out that software packages for Stingray devices expand their capabilities significantly, allowing them to intercept communications as well as location data. Because the government on all levels refuses to discuss Stingray deployments, the court is left to assume all it did was scoop up location data. But that assumption may be incorrect, and if so, the government has zero interest in correcting the record.

In this case, the location warrant authorized only methods of fixing Patrick’s location that involved gathering information that would reveal his phone’s connection with cell? phone towers. The Supreme Court has recognized that a search of cellphone data requires a warrant. See Riley v. California, 134 S. Ct. 2473, 2494–95 (2014) The authorization of the collection of location data cannot be expanded to permit a search of the con? tents of Patrick’s cell phone. If the Stingray gathered information from the phone that went beyond his location, such a “search” of his phone would have been unauthorized, and suppression of the additional information (which might have pinpointed Patrick’s location) would likely be required.

Not only would the Supreme Court’s Riley decision be implicated by this interception, but Title III (which controls wiretap use) would be as well. But, once again, the court is forced to assume the only thing collected was location data because that’s all the government is willing to confirm. The government asserts that the Stingray collected nothing more than the same records it could have obtained without a warrant directly from service providers, albeit not in real time. However, there is seemingly no way to verify this as the government has refused to provide more details.

We are in all likelihood not looking at two interchangeable tools for gathering exactly the same information. If the facts ultimately show that the MPD had gathered the identical information in the same manner that Sprint would have used, I would concede that there is no problem. In such a case, the only difference between using the Stingray and obtaining the information from Sprint would be who gathered the information.


We do not know whether the warrant’s authorization of Sprint to “initiate a signal to determine the location of the subject’s mobile device on the service provider’s network or with such other reference points as may be reasonable available” also describes the working of the Stingray that was used. If so, perhaps all is well. If the Stingray works in a different manner—for instance, by forcing the cell phone to transmit location data housed inside the cell phone rather than using a signal to locate the cell phone on the Sprint network—it might not.

The dissenting opinion also finds the majority’s reasoning that the probable cause to arrest — along with the defendant’s public location — excuses the lack of information in the warrant specifying the use of a Stingray device.

I recognize that Strieff contains language that could be stretched to suggest that a warrant’s existence, regardless of the actual causal chain, is sufficient attenuation. But elsewhere in the opinion the Court emphasized not only that the “warrant was valid” and “predated [the officer’s] investigation,” but also that it “was entirely unconnected with the stop,” and that the officer’s decision to arrest the defendant was “a ministerial act that was independently compelled by the pre?existing warrant.”

Here, the use of the Stingray led to the arrest, and neither the arrest nor the search was a ministerial act.   It oversimplifies Strieff to focus solely on whether an intervening circumstance can be identified. That is important, but it is not enough by itself. Strieff, like all attenuation cases, also rests on two other factors: (1) the “temporal proximity” between the potentially unlawful action and the “search,” and (2) the culpability of the police misconduct. Id. As in Strieff, the relative temporal proximity in our case between the potentially illegal conduct and the search weighs against attenuation. But unlike the situation in Strieff, the facts here do not permit us to say that the MPD’s conduct was merely negligent: the police knew what they were doing. Purposeful evasion of judicial oversight of potentially illegal searches is exactly the kind of “police misconduct … most in need of deterrence.”

This decision is mostly a punt by the appeals court. It routes around most of the Fourth Amendment implications by relying heavily on the arrest warrant rather than the location warrant. The majority raises few challenges to the government’s assertions about its Stingray use and obviously feels the issues it avoided dealing with here would be better dealt with anywhere but in its courtroom. While it is true there were any number of ways the police could have located Patrick, the fact is it used a Stingray device — one it didn’t disclose in its warrant request — to do so. The decision to give the government a pass only encourages the culture of secrecy surrounding the use of cell tower spoofers.

Filed Under: , , , ,

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Appeals Court Says Warrantless Use Of Stingray Devices Probably OK”

Subscribe: RSS Leave a comment
Anonymous Coward says:

It is always being operated illegally

The devices were authorized on an emergency only basis during their FCC review. These have never been used in an actual emergency so every use has been illegal and will always remain so. They use frequencies already given to others for use and interfere with legitimate equipment. They are not allowed to be used for domestic operations yet everyone just ignored that and assumed they are legit. The company knows it is not allowed to be used other than emergencies so the devices all need to be destroyed and any evidence gathered is null and void.

Derek Kerton (profile) says:

Re: It is always being operated illegally

Normally, the wireless telcos would pursue and sue the asses off of anyone who transmitted in their licensed frequencies. It is illegal for others to broadcast on these channels:

So, why is there no involvement from the Telcos here? The Law Enforcement agencies are setting up a man-in-the-middle attack in their networks, they are transmitting on their frequencies, they are degrading the quality of the cellular service.

Why no outcry from carriers? Something’s going on there.

Anon E. Mous (profile) says:

The various appellate courts seem to have forgotten what a person’s right are under the Constitution and have made a mix of rulings of what Law Enforcement entities can and cant do and even when the courts have been shown that a person rights have been violated have let that violation not effect a case, which has only muddied where the line is drawn between a violation and non violation of a person rights.

Law Enforcement knows full well that Stigrays hoover up way more information than they would be able to get from a pen register application to the court.

The Fact that Law Enforcement agencies are specifically hiding a Stingray’s use unless a defense counsel stumbles upon it or suspect’s that a Stingray was used just further proves the point that the prosecution and Law Enforcement agencies are withholding evidence that a Defendant and his counsel have a legal right to.

The fact that Prosecutors and Federal law Enforcement agencies and police departments across the U.S. are being specifically told not to reveal a Stingray’s use and to put forth that the evidence gathered from a Stingrays use came from “other sources ” is intentionally lying to the defense counsel and the court and not providing full disclosure of the evidence and is a violation of the defendants criminal and constitutional rights, not to mention a violation of the rules of ethics governing an officer of the court.

This gives the prosecution and government a serious advantage and unfair one and intentionally hinders the defense at being able to challenge the evidence when such a crucial piece of disclosure is missing.

The fact that the courts are saying “yeah it was a violation but that’s okay” Just goes to show you how broken the Justice system is. The courts are here to be impartial and to rule according to the letter of the law that they are sworn to uphold. Since when did peoples constitutional and criminal rights be up for a spin the bottle type of decision making.

The various rulings from the courts and appellate courts across the U.S.has made the use of Stingray such a fucking mess it isn’t even funny and the SCOTUS bares some responsibility in this as well for not making a ruling that is clear cut and not this one that seems to be interpretated by Law Enforcement agencies and the goverment however it seems fit.

If the pen registers dont fit the rules governing trap and trace warrants then the US DOJ and the various state AG’s need to petition the senate and congress to bring the laws into the 21st century. The Government should not be allowed to mislead defendants and the courts by outright lying and deceiving the court about how it is obtaining evidence that it puts forth

Anonymous Coward says:

Re: Re:

The entire system is tilted to make convictions the most likely result. The process has been altered to give the accused the least amount of power and to bury them in redundant charges. No prosecutor should be allowed to have more than one case before successfully defending a case as a court appointed defender. When you are only exposed to one side, where the defendant is the enemy, your mind becomes warped into thinking that the defendants are automatically the enemy. If justice were truly blind, the lawyers would be assigned to be prosecution or defense on the day of the trial and everyone would have to prepare for both sides equally up to that point.

Anonymous Coward says:

Re: Re: Re:

If justice were truly blind, the lawyers would be assigned to be prosecution or defense on the day of the trial and everyone would have to prepare for both sides equally up to that point.

The problem with this is that then the defendant has no effective access to his lawyer prior to the trial. He cannot speak meaningfully with a lawyer prior to the case, as that lawyer may end up using the contents of their conversations to better prosecute him. (In the sense that, "I know how this man speaks, how he thinks about the case, and the ways that I’ve told him to answer certain questions, all of which I can use to make him look bad on the trial date.")

Anonymous Coward says:

From the decision: “So it would be inappropriate to use the exclusionary rule, even if the police should have told the judge that they planned to use a cell-site simulator to execute the location warrant.”

My question to the court is: if it’s not appropriate to use the exclusionary rule, what else have you got to make the police behave?

In my state, if a process server serves a paper but doesn’t make the correct endorsement, the service is still valid. However, by law, the server is then not paid. I wonder if that would be incentive enough for police. Violate someone’s rights to a degree that doesn’t get the evidence excluded? OK, but you don’t get paid for that day’s work. Ignore people’s rights on a regular basis and it could become a real problem for you.

At least that would get rid of our current ridiculous situation where the courts routinely say “yes, the police exceeded their limits, but there are no consequences whatsoever”.

Anonymous Coward says:

Seems to me that the court has this absolutely backwards.
They did the search, found him in a public place, therefore they searched only the public place he was found in and the search was legal?
Utter nonsense.
They searched literally everywhere in the surrounding area, violating not just the defendant’s rights, but the rights of every citizen whose property was within range of the Stingray, whose property was searched by it.

DannyB (profile) says:

Hypothesis about Stingray secrecy

Hypothesis about Stingray secrecy

Law enforcemnt is extremely secretive about Stingray. Why? Their suppliers even require them to sign agreements with extreme conditions. Why?

(Sorry, this is only quasi related to the lack of warrants. But the lack of warrants relates to the secrecy issue.)

1. The wireless network standards were designed when we were still using Windows 3.1.

2. The designers may have considered security, in some sense, but not in a way that can withstand 21st century attacks. The security may be in large part due to obscurity.

3. Stingray is not authorized by the mobile network operators who have not given Stingray any SIMs (subscriber identity module) or other cryptographic keys necessary to access the network. Those network operators have exclusive rights to spectrum which Stingray is subverting.

4. Stingray works by compromising the security of the network. Effectively a genuine hack or intrusion into the network.

5. There may be no effective fix short of redesigning the network.

6. If the mechanism of the hack were generally known, mass chaos could ensue.

7. The network operators are strongly against this but powerless to do anything about it, other than potentially litigate.

8. The secrecy of Stingray is largely due to several factors such as:

A. If the mechanism of the attack became generally known, there could be vast numbers of unauthorized “stingrays” compromising everyone’s privacy — including (OMG!) rich and powerful people!

B. It would be possible for a network of distributed “stingray” clones to disrupt mobile network service by tricking nearby phones to connect to fake networks. What if this were deliberately done during an emergency?

C. The creators / operators of genuine(tm) Stingray devices don’t want to be exposed to the potential of litigation for actionable things that Stingray may be doing as part of its operation. Including disrupting networks, stolen proprietary or trade secret information, having compromised individuals into divulging network secrets, keys, etc.

This hypothesis would explain observed evidence about why those who built Stingray want desperately to keep it secret. Please consider. The secrecy is so important, that it leads to:

1. Dismissing or disposing of prosecutions rather than reveal any information about Stingray.

2. Binding agencies and organizations using Stringray to high levels of secrecy, including keeping THE VERY EXISTENCE of Stingray a secret.

3. Outright Brazen Perjury a.k.a. Parallel Construction, which is a euphemism for conspiracy to lie to the court and the defense, concealing discoverable information.

The behavior of those behind Stingray fits this hypothesis. They want to use it “for truth, justice and the corporate way”, but are desperately fearful of the secret hack escaping.

Add Your Comment

Your email address will not be published.

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...