DOJ Says Federal Agents Must Seek Warrants For Stingrays; Forbids Collection Of Communications

Privacy

from the long-delayed-but-mostly-good-news dept

Federal law enforcement agencies of America: prepare to get your Stingray house in order. The DOJ has just issued its official guidance for Stingray use and it’s full of stipulations that won’t make the FBI, DEA or any other participant in a federal investigation very happy.

The seven-page document opens by reminding readers that Stingrays are used for Very Important Work (fugitive apprehension, recovery of kidnapped children, narcotics investigations, etc.). And certainly this is true. But they’re also used to hunt down people suspected of misdemeanor theft and used regularly in other non-critical law enforcement work.

After that, it gets to the new rules for Stingray use. Casual use and concerted cover-ups are no longer allowed.

First off, the DOJ states that any IMSI catcher used by a covered agency must be set up to comply with pen register orders, i.e., no interception of communications. This includes the interception of text messages, emails or any other data that can be gathered from a nearby cellphone.

While the policies require restricting the device to information comparable to that received through pen register orders (if you don’t count all the other cellphone connections harvested during the deployment of the device), law enforcement agencies won’t be able to use these orders to permit deployment of IMSI catchers. Instead, they’ll have to seek actual warrants.

While the Department has, in the past, appropriately obtained authorization to use a cell-site simulator by seeking an order pursuant to the Pen Register Statute, as a matter of policy, law enforcement agencies must now obtain a search warrant supported by probable cause and issued pursuant to Rule 41 of the Federal Rules of Criminal Procedure (or the applicable state equivalent), except as provided below.

Not only will warrants be required, but the search warrant must specifically note that it is being requested for the use of IMSI catchers.

When making any application to a court, the Department’s lawyers and law enforcement officers must, as always, disclose appropriately and accurately the underlying purpose and activities for which an order or authorization is sought. Law enforcement agents must consult with prosecutors in advance of using a cell-site simulator, and applications for the use of a cellsite simulator must include sufficient information to ensure that the courts are aware that the technology may be used.

There are exceptions, of course, but even the exceptions are more limited than we’ve come to expect. Exigent circumstances exceptions can be used to expedite the process (read: skip warrant acquisition) but the use of the device still needs to comply with the pen register statute (call info only; no communications). If this minimal paperwork still seems like it might take too long, the agency wishing to deploy needs to seek internal approval — which means a quick run up the chain of command to the local US Attorney’s office, who will then contact the DOJ on the agency’s behalf. (Unless it’s a non-federal investigation, in which case the chain of command stays local.)

There are also limits placed on the gathering and retention of non-targeted phone data. If a known device is targeted, all data must be deleted once located, or at least once daily. For unknown devices, all data must be deleted upon identification and all data within 30 days. In addition, any application for a Stingray warrant must include information regarding proposed minimization procedures.

Now for the bad news.

The DOJ refers to this as “guidance” and the document contains a footnote that seemingly exempts the DOJ from any form of accountability should it fail to follow its own rules.

This policy guidance is intended only to improve the internal management of the Department of Justice. It is not intended to and does not create any right, benefit, trust, or responsibility, whether substantive or procedural, enforceable at law or equity by a party against the United States, its departments, agencies, instrumentalities, entities, officers, employees, or agents, or any person, nor does it create any right of review in an administrative, judicial, or any other proceeding.

The other downside is that it only deals with investigations by federal DOJ components or the DOJ’s involvement in state or local cases. This leaves local agencies free to continue hiding Stingray use from judges, prosecutors and defendants as well as avoid seeking warrants before deployment. Somewhat confusingly, the document contains a footnoted reference to “non-federal cases” which deals with the approval needed at local levels for exigent circumstance deployment, but nowhere else in the document does it say this applies to anything but federal agencies under the DOJ’s purview.

Still, it’s more good than bad and it’s a giant step forward from the secrecy these devices have operated under for most of a decade, if not longer. Hopefully, the DOJ will continue to issue more guidance, hopefully aiming some of it local law enforcement agencies who have been just as guilty about hiding usage and deploying devices carelessly.

Filed Under: doj, guidelines, imsi catcher, non-disclosure agreements, stingrays