Updated September 7, 2015, 7:31 PM, with comment from the Department of Justice.
The twist in a new Department of Justice guidance on tracking people using their cell phones is tucked in its first footnote. What looks like a positive step in terms of protecting Americans privacy in the ever deepening surveillance state might in fact be a sort of misdirection. The first footnote reads:
This policy applies to cell-site simulator technology inside the United States in furtherance of criminal investigations.
As Nate Cardozo, a staff attorney at the Electronic Frontier Foundation, explained to the Observer in a phone call, “criminal investigation” is what’s called a “term of art” at the Department of Justice. It specifies one kind of work they do, when seeking people who have violated the law. That isn’t all federal law enforcement does, though. “For instance, when federal agents use cell-site simulators for ‘national security’ purposes, they won’t be required to obtain a warrant by the terms of this policy,” Mr. Cardozo writes on the EFF blog.
Emily Pierce, a spokesperson for the Department of Justice, wrote the Observer about the terms of art question, saying via email:
When acting pursuant to national security authorities, such as the Foreign Intelligence Surveillance Act, Justice Department components will be required to make a probable-cause based showing as well as make appropriate disclosures to the court in a manner that is consistent with the Department’s cell-site simulator policy.
Officers are also believed to act pursuant to an additional authority, however, that Ms. Pierce doesn’t mention: President Ronald Reagan’s Executive Order 12333, as described in Foreign Affairs.
Cell phones have unique IDs that they shout out to cell towers to show that they are authorized to make calls and send data using their services. It is simple to spoof a cell tower and find out what phones are in your immediate area, and privacy advocates have been concerned that law enforcement is hoovering up too much data about people’s comings and goings. On Thursday, the Department of Justice released a new guidance on the use of its technology that would govern departments like the FBI and DEA, but limiting the guidance to criminal investigations could mean that the surveillance state may continue to grow unchecked.
Cell-site simulators are often referred to as IMSI catchers or StingRays, after the model of a device made for the purpose by the Harris Corporation.
‘When federal agents use cell-site simulators for ‘national security’ purposes, they won’t be required to obtain a warrant by the terms of this policy.’
Last Fall, Washington Post reporters toured the Capital with a startup founder who claims to have technology that can spot cell phone tracking devices. It found a bunch. How many of those towers had been deployed for active investigation and how many were conducting general surveillance to protect the city most important to the country’s security?
So what changed?
The new guidance is generally encouraging to privacy advocates such as the EFF and the ACLU. The problem lies in the kinds of law enforcement activities to which it doesn’t apply.
When the FBI or DEA or other federal law enforcement use cell-site simulators, officers in a criminal investigation should now secure a warrant under guidance released [PDF] by the Department of Justice last night.
It concludes the guidance by writing, “Cell-site simulator technology significantly enhances the Department’s efforts to achieve its public safety and law enforcement objectives. As with other capabilities, the Department must always use the technology in a manner that is consistent with the Constitution and all other legal authorities.”
The ACLU released a statement promptly after the rules were announced, calling them a good step, with some caveats. Staff Attorney Nathan Freed Wessler said, in prepared remarks:
Disturbingly, the policy does not apply to other federal agencies or the many state and local police departments that have received federal funds to purchase these devices. In addition, the guidance leaves the door open to warrantless use of Stingrays in undefined ‘exceptional circumstances,’ while permitting retention of innocent bystander data for up to 30 days in certain cases.
The ACLU calls on Congress to act to further limit the use of cell-site simulators.
How far do they go?
Mr. Cardozo pointed out that, because it is only a guidance, there is no remedy if you are arrested under evidence obtained in a warrantless use of a cell-site simulator. In that case, he said, “You’re out of luck.”
The rule sheds some light on the use of cell-site simulators by the Federal government:
- Federal cell-site simulators don’t listen in. In its explanation of the rule, the DOJ writes that its simulators are pre-configured to work solely as pen registers, which means they can log rough location data, calls received, calls sent, the same for texts but none of the content of either. Local police might not be so considerate. During a Black Friday Chicago protest over police violence in Ferguson, Missouri, activists believe to have found evidence that police were using a StingRay to listen in on an organizers phone calls, according to the Christian Science Monitor.
- Cell-site simulators might impact service for those in its net. The rules require law enforcement to explain for the court whether or not the technique they use could cause hiccups in service for those in range, which suggests that this is a known issue.
- Law enforcement needs to dump data. The warrant rules require law enforcement to explain how they will dump data collected for non target devices and forbids them to analyze the data beyond sorting out which devices are targets of the surveillance and which are not. When law enforcement knows the device’s ID it is looking for, it has to dump all non-target data daily. If it obtains a warrant without knowing the device it’s looking for, it has to dump non-target data at least every 30 days.
- Reporting on use. Regional departments will have to report regularly on all instances in which the technology was used and whether it was used with or without a warrant. Theoretically, this should mean that privacy advocates and journalists should be able to keep an eye on how much the technology is being used and how often the warrant rule is bypassed.
- Emergencies can only last two days. The rules clarify that when a warrantless search is conducted it should largely follow the conditions described under the Pen Register Statute, the surveillance must end if the request for a warrant is denied, if the target data is attained or if 48 hours pass.
What do the courts say?
Your phone’s hunger for wifi makes it easy to map your habits.
While the guidance argues that the use of this technology has always been constitutional, the legal landscape is mixed. In September, the Florida Supreme Court ruled that warrantless use of this technology is unconstitutional, but the 11th U.S. Circuit court disagreed, in a separate case, in May. The latter case, Quartavious Davis v. United States, may be taken up by the Supreme Court soon.
Mr. Cardozo said, “This is the first case presenting the question of whether StingRays can be used by law enforcement that has a chance to be taken up by the Supreme Court.”
Once that happens, we’ll know.
The Department of Justice was not immediately available for comment for this story.
![Surveillance State Protected by a Footnote in DOJ Cell-Site Simulator Policy [UPDATED]](https://observer.com/wp-content/uploads/sites/2/2015/09/gettyimages-1326209.jpg?quality=80&w=970)