The FBI wants the ability to know the position of every man, woman and child in America without a warrant, without a court order, and without any reason or justification.
Well, not every man, woman, and child. Only those with a cell phone or Internet connected devices. Oh, and they also want to know what you are doing with those devices.
That’s the startling position the FBI is taking in its communications with the United States Senate. The Attorney General claims that no warrant is generally required for the FBI to capture this data from anyone.
If the government wants to find out who you call on your phone, who you receive calls from, or from whom you send or receive texts messages, or where you are physically located while you have your phone, they have to apply for and receive a Court Order for that information.
Note I said a Court Order and not a warrant. That’s because, for “non-content” information, the government doesn’t need to show probable cause. It just needs to certify to a Court that the information it seeks is “relevant to” some criminal investigation.
Then the Court MUST order the production of the information. The Court actually can’t even question the government’s certification. In fact, if that is too burdensome, the government can even just subpoena the records from the phone company.
In that case, they don’t even have to show “relevance” unless the phone company chooses to challenge the subpoena. Even if the phone company does, the grand jury operates in secret. So the government’s pretty much going to get what it wants.
Problem is, it will have to actually ask for the information from the phone company. That’s too much of a bother. It’s better for the government to collect all of that data itself from the air, and then just ping the database whenever they want to.
That’s what Stingray is for. It captures this data (IMSI data) as it travels through the air.
If you drive through say downtown Washington DC, you may encounter as many as 20-30 such IMSI detectors in operation. In fact, the technology is so scary that one researcher has developed and Android app to detect (but not yet prevent) such Stingray devices.
When your phone is on, it is searching for a cell tower to get a signal from. Stingray acts like a cell tower, and “pings” your phone. It captures the unique IMEI number, from which the Stingray can tell your phone number (and inferentially who you are), and your location.
It can also capture header information (call data information) and, if properly configured, even content information. Everyone agrees that the government needs a real live actual warrant to capture content information. But the government contends that it needs neither a warrant nor any court order (or any process whatsoever) to capture the other data, so long as the consumer is “in the public.”
What the HECK does that mean?
In meetings with Senators Chuck Grassley and Pat Leahy, outgoing Attorney General Eric Holder reportedly told the Senators as much. Holder took the legal position that “the FBI’s new policy requires FBI agents to obtain a search warrant whenever a cell-site simulator is used as part of a FBI investigation or operation, unless one of several exceptions apply, including (among others): (1) cases that pose an imminent danger to public safety, (2) cases that involve a fugitive, or (3) cases in which the technology is used in public places or other locations at which the FBI deems there is no reasonable expectation of privacy.”
What???
In the first case – imminent harm to safety. A warrant is generally not needed for a “search” or “seizure” because of what the law calls “exigent circumstances.”
So I don’t need a warrant to rescue a kid from a burning building. But Stingray is different. While there are some circumstances where it could be deployed without a warrant because of exigency, the scope of this exception is WAY too broad.
Imagine the government saying that it could enter everyone’s home and install video cameras and monitoring devices in every room, but that it would only turn them on only if there was an imminent threat to public safety so that no warrant is required.
The invasion of privacy occurs with the deployment of the technology, not just with its activation. Oh, and who decides that there is a threat to safety? Based on what standards? And with what consequences if they are wrong?
If the cops kick in my door based on “exigency” and they are wrong, I can at least know they did it, and might have some recourse under 28 USC 1983. But if they track my movements and intercept my calls and texts, I may never know about it.
Under current precedent, they don’t have to tell me. As long as I don’t know about it, it is the government’s position that I have suffered no harm. So much for privacy.
Same thing about “cases that involve a fugitive.” The FBI and DOJ are not saying that they are monitoring the phones OF fugitives. Or even monitoring phones in cases where they are LOOKING for a fugitive. Or where people are suspected of harboring a fugitive. Even if they were, they would need a warrant.
The cops couldn’t just traipse into my house without a warrant because the case “involves a fugitive.” That’s what arrest warrants are for. Go get one. In law school I never learned that the Fourth Amendment didn’t apply in “cases that involve a fugitive.” But maybe things are different now.
But it’s the final “exception” that eats up the entire case.
The FBI takes the position that they need no warrant or court order if “the technology is used in public places or other locations at which the FBI deems there is no reasonable expectation of privacy.”
Not so fast. First, I don’t give a rat’s behind WHERE the technology is used. They can hang it on top of the J. Edgar Hoover building, or fly it from an airplane (both of which they do).
It’s not WHERE the technology is deployed that matters for Fourth Amendment purposes. In Kyllo v. United States, the government took the position that it could deploy an infrared sensor in a public place to see whether someone was growing pot in his or her home. They argued forcefully that the sensor was deployed in a place where the person had no expectation of privacy. It was deployed in a public courtyard.
Similarly, in Florida v. Jardines, the government argued that it could deploy a drug sniffing dog in a “public place” outside a person’s residence to see if it could smell drugs inside the residence. “It’s a publicly accessible place,” the government argued. “Surely we can use this canine technology in a public place. “
“No, you can’t” the Supreme Court ruled. “And don’t call me Shirley.”
And in United States v. Jones, the government argued “we can monitor a person’s location when they are out in public without a warrant. After all they have no expectation of privacy!”
The Supremes skirted the issue but did rule that you couldn’t put a GPS device on a car (in a public place, to monitor it in a public place) without a warrant.
Well, maybe fourth time’s a charm for the Department of Justice (DOJ). But note that DOJ doesn’t even go as far as they did in losing the Jones argument.
In Jones, the government argued that the person being surveilled was in a place where THEY had no expectation of privacy – because THEY were in a public place.
The FBI is claiming that it can deploy Stingray so long as THEY – the FBI – is in a public place, irrespective of where the target of the surveillance may be located.
It’s like saying you can put up a giant microphone to listen in on what you are saying in your bedroom, as long as the microphone is in a public place – like the hallway of your apartment.
But even if you reverse what the FBI is saying, and look at the location of the target of the surveillance, the policy makes little sense. First, of course, the Stingray device can’t tell whether the phone it is pinging is outside or inside.
And even if outside, is it in a place where the user has a “reasonable expectation of privacy” – in a tent or enclosure? And if “inside” is the user in a crowded shopping mall, or alone in their bedroom? The technology don’t know, and the technology don’t care.
And even the construct about “reasonable expectation of privacy” as applied to Stingray type devices is somewhat strange. You can be outside in a public space and not have a reasonable expectation of privacy in the fact that you are outside, but still have a reasonable expectation of privacy that your cell phone won’t be “pinged” by some electronic device. Some places “outside” are private and some places “inside” are public.
How will the Stingray determine that? Oh, and these “mobile” devices are … well… mobile. In addition, the Stingray device itself must have an FCC license to operate, and the operator themselves must be licensed (remember those old short-wave operator licenses.) Without such licenses or deferral from the FCC, the FBI’s use of the technology is unlawful.
But it also assumes that, just because you are outside, you have no expectation of privacy in the emanations from your cell phone. Hmm. We will see how that argument works out when criminals start offering cell location data on cops and FBI agents. No privacy, eh?
And the worrisome part of this argument is that, if no warrant is required because either the FBI agent OR the subject is “outside” then there is nothing –absolutely nothing – to stop the FBI from collecting this data on everyone, storing it forever, and creating a database of everyone’s locations all the time.
The reason you require a warrant or court order is to limit exactly that. To say, “you may have the data when you have a REASON to have it, and ONLY for that reason.” That’s not too much to ask for.
There’s another problem with the way Stingray works, and why its operation should be exposed to public scrutiny. I am sure that the FBI is telling judges and the public that the device is narrowly targeted and only captures data on the person for whom the government is seeking.
If the government wants to know where Dr. Richard Kimball is in Chicago, it punches in his telephone number (translated to an IMEI) and the Stingray scans for that phone somewhere within range. A harpoon, not a net. It’s narrow, reasonable and targeted.
And bull-hockey.
The Stingray and other devices capture data on EVERY IMEI and EVERY device within range. That data is then sent to the FBI and stored in a hard drive. The location of every phone, every mobile device, everything trying to ping a cell phone or cell tower. It’s all captured by the FBI. For everyone. Hundreds of thousands or millions of people.
Bethcha dollars to donuts that the FBI doesn’t tell the Court about that. In fact, federal magistrates have reported that prosecutors have been routinely misrepresenting what the Stingray is, and what it does in order to get what are called “trap and trace” orders – the kind of orders the FBI now claims are unnecessary. Despite that, the FBI routinely keeps this data from the Courts. We know that in at least one case, the device doesn’t just work as a “passive” receiver of data.
It actively interferes with the user’s use of their device. In United States v. Rigmaiden, the government used a Stingray device to capture information from a user’s air card – a mobile data card attached to their computer.
In that case, “Verizon reprogrammed the device so that when an incoming voice call arrived, the card would disconnect from any legitimate cell tower to which it was already connected, and send real-time cell-site location data to Verizon, which forwarded the data to the FBI.
This allowed the FBI to position its stingray in the neighborhood where Rigmaiden resided. The stingray then “broadcast a very strong signal” to force the air card into connecting to it, instead of reconnecting to a legitimate cell tower, so that agents could then triangulate signals coming from the air card and zoom-in on Rigmaiden’s location.
To make sure the air card connected to the FBI’s simulator, Rigmaiden says that Verizon altered his air card’s Preferred Roaming List so that it would accept the FBI’s stingray as a legitimate cell site and not a rogue site, and also changed a data table on the air card designating the priority of cell sites so that the FBI’s fake site was at the top of the list.”
This is what the FBI wants to be able to do without any warrant so long as their device is in a public place.
We also don’t know if the use of these devices interfere with the ability of other users to use their phones – even to call 911 in an emergency. That’s what the FCC licensing is for.
After intercepting, capturing, storing and analyzing the data on the thousands of cell locations intercepted, the FBI likely purges the “unneeded” data. Maybe in seconds. Maybe in minutes. Maybe in months. We don’t know. It’s classified as law enforcement sensitive information. But that’s why we need adversarial hearings on how the technology
There is a solution. The FBI can do what the Supreme Court suggested they do when they wanted to be able to search the contents of a cell phone because they had arrested the owner. Get a warrant. Now that wasn’t too hard, was it?