Illinois Magistrate Judge Lays Down Ground Rules For Stingray Device Warrants

Privacy

from the law-enforcement-agencies:-'Is-there-someone-else-we-could-talk-to?' dept

It looks like a few law enforcement agencies might be doing some judge-shopping in the future. Magistrate judge Iain D. Johnston has announced — via an order in a (mostly) sealed drug investigation case — that agencies will no longer be able to come to him to get their Stingray-related orders rubber stamped.

His order points out that there’s still hardly any information in the public domain about Harris Corporation’s cell-site simulators, and even less so in terms of legal precedent.

[T]he manufacturer of cell-site simulators (a company called the Harris Corporation) is extremely protective about information regarding its device. In fact, Harris is so protective that it has been widely reported that prosecutors are negotiating plea deals far below what they could obtain so as to not disclose cell-site simulator information.

[…]

So where is one, including a federal judge, able to learn about cell-site simulators? A judge can ask a requesting Assistant United States Attorney or a federal agent, but they are tight lipped about the device, too; in all likelihood because of the NDAs…

The Court could attempt to learn about the device on the Internet. See Stingray Phone Tracker, http://en.wikipedia.org/wiki/Stingray_phone_tracker (last visited October 19, 2015). But most reasonable people know to be highly skeptical about what they read on the Internet, particularly in Wikipedia posts… [These] articles often rely on secondary source material, including the possibly untrustworthy Internet websites.

Unfortunately, the one place where a person will be unable to find much discussion of cell-site simulators is case law. In the Matter of the Application of the United States of America for an Order Authorizing the Installation and Use of a Pen Register and Trap and Trace Device, 890 F. Supp. 2d 747, 752 (S.D. Tex. 2012) (“Regardless of what it is called, there is scant case law addressing the equipment.”). And even case law that discusses stingrays refers to newspaper reports as authority on these devices.

Judge Johnston recommends magistrates at least read the DOJ’s own guidelines for electronic surveillance. Unfortunately, this document is a decade old and portions of it have been overwritten by the DOJ’s recent guidance on the use of Stingray devices. But it’s better than nothing. And “nothing” has been the goal of both law enforcement and law enforcement agencies over the past several years — something that has been achieved in large part thanks to the FBI putting its own NDA between Stingray-related information and courts, defendants and, in some cases, prosecutors.

Using what little information he’s been able to gather, Johnston has produced a set of ground rules for Stingray warrant applications. There are Constitutional issues raised by the use of Stingray devices, which collect device information (including location) even when the phone part of the phone isn’t in active use.

As Johnston points out, agencies using these devices routinely collect and store information on thousands of non-suspects, thanks to the catch-it-all nature of cell-site simulators. Like anything else Stingray-related, these agencies show little interest in discussing how this non-hit information is handled. Because of this, Johnston says the following guidelines will need to be followed if law enforcement agencies want him to sign off on cell-site simulator warrants.

When a cell-site simulator is used, the Court will impose three requirements: the first relates to the manner in which the device is used; the second relates to the destruction of innocent third parties’ data; and the third explicitly prohibits the use of innocent third parties’ data.

When using these devices, law enforcement agencies must make every reasonable effort to limit the amount of information gathered from innocent third parties. As an example, Johnston says pursuing a suspect may find police parked in front of a full stadium. If this is the case, the Stingray device should not be deployed as the ratio of non-hit data would be astronomical. As he points out, any reasonable law enforcement agency would prefer not to dig through tons of irrelevant data to find the devices they’re actually looking for.

This leads directly to the second requirement: the destruction of innocent third party data. Johnston won’t allow agencies to sit on data for the 90 days or six months they’re accustomed to (see also: the very few guidelines issued for the use of automatic license plate readers by law enforcement).

[L]aw enforcement officers must immediately destroy all data other than the data identifying the cell phone used by the target. The destruction must occur within forty-eight hours after the data is captured. The forty-eight hour time frame is designed to have some consistency with other Fourth Amendment principles…

And it’s not enough for agencies simply to claim they will destroy non-relevant data within 48 hours. They also must deliver to the court confirmation that the destruction of non-hit data has been completed.

Finally, Johnston’s rules forbid the use of non-hit data for any other reason, heading off potential Stingray fishing expeditions by law enforcement agencies.

[L]aw enforcement officers are prohibited from using any data acquired beyond that necessary to determine the cell phone information of the target. A cellsite simulator is simply too powerful of a device to be used and the information captured by it too vast to allow its use without specific authorization from a fully informed court.

The order notes that this applies to any federal agency working with local law enforcement. The FBI, DEA and US Marshals all must comply with Johnston’s stipulations, so any local agency looking to work around the new rules can’t send in a federal rep with a warrant request, or vice versa.

If Johnston’s court becomes a place law enforcement agencies avoid, their actions will make it clear they have little respect for the Fourth Amendment and would rather use power surveillance tools indiscriminately and without additional oversight.

Filed Under: 4th amendment, iain johnston, imsi catcher, stingray, warrants