In response to a recent lawsuit, the Anaheim Police Department (APD) in Southern California has released a short one-page letter attempting to explain how it seeks permission for and uses stingrays, the surveillance devices often used to track criminal suspects by locating their mobile phones. The letter was distributed to media and posted (PDF) on the APD's site last Friday.

But after some online searching, Ars located a similarly publicly available document posted on the website of the city attorney of San Diego (PDF) that has near-identical language to the Anaheim letter. That document's format indicates that it was authored by a federal agency. Another version of this stingray letter was released in February 2015 by the Gwinnett County Police Department in Northern Georgia.

When asked about the template, Lt. Eric Trapp, an APD spokesman, confirmed late Monday: "FBI material was consulted and considered. Some of that material was included in the content of the letter."

This canned press release marks yet another example clearly demonstrating how Washington, DC, is trying to prevent disclosure of how these devices are used nationwide. Last month, Ars reported how the FBI has been attempting to block release of stingray-related information.

Stingrays, which are also known as cell-site simulators, are not only used to determine a phone’s location, but they can also intercept calls and text messages. During the act of locating a phone, stingrays also sweep up information about nearby phones—not just the target phone.

“Substantial risk”

"With the understanding that the release of technical details and operational procedures concerning this technology would create a significant detriment to our efforts in protecting our community, the information provided herein will address common concerns while maintaining the relevance and effectiveness of this investigative tool," Raul Quezada, the APD chief of police wrote in the letter last Friday.

By comparison, the FBI letter states:

In the case of cell site simulators, numerous federal, state, and local law enforcement agencies have determined that the public release of technical details, applications, and operational procedures would create a significant detriment to the protection of their communities by providing criminal elements with the ability to circumvent the devices. (Law Enforcement Agency name) has concurred with the necessity of protecting certain aspect of the cell site simulator technology. Law enforcement agencies must always balance the desire to provide the public with full disclosure on the details of sensitive investigative and protective techniques versus the substantial risk that such knowledge would allow criminals to avoid detection and cause serious harm to law enforcement personnel and members of the community.

Curiously, the FBI was less forthcoming than the APD itself.

Christopher Allen, an FBI spokesman, e-mailed Ars on Monday: "Thanks for your inquiry, but I am not able to comment. As you know from our previous conversation on this issue, we consider details on use of this tool to be law enforcement sensitive."

When informed that the APD letter appeared to be based on a federal template, Peter Bribing, an attorney with the American Civil Liberties Union of Southern California (ACLU SoCal) e-mailed Ars: "Holy moley! That’s some remarkable transparency—distributing a pre-prepared release. But that also pretty much undermines any suggestion that APD has taken special steps to protect privacy."

The company that makes the stingray, the Harris Corporation, has been reticent to provide any information.

"We do not comment on solutions we may or may not provide to classified [Department of Defense] or law enforcement agencies," Jim Burke, a Harris spokesman, previously told Ars.

It's relevant because I say so

Although the APD letter doesn’t say so explicitly, it’s probably in response to a civil suit that was filed in state court by ACLU SoCal on March 10, 2015. In that suit, ACLU SoCal demanded the production of documents relating to the acquisition and use of stingrays. The APD had previously denied the group’s public records request.

Just like the FBI's version, the APD letter has two main sections, one labeled "legal concerns" and another entitled "privacy concerns."

Under the former section, Chief Quezada noted: "A court order signed by a judge is required before this equipment can be operated by the Anaheim Police Department. This judicial oversight ensures that usage of the cell site simulator meets the legal threshold for the US Constitution and the Constitution for the State of California."

Because Quezada does not specifically mention a warrant, this probably indicates that APD officers are going to judges asking them to sign off on a "pen register and trap and trace order" instead.

"I do not think that ‘[a] court order signed by a judge’ is necessarily a warrant consistent with the United States Constitution," Brian Owsley, a former federal judge who is now a law professor at Indiana Tech, told Ars by e-mail.

"Moreover, indicating that this judicial oversight meets constitutional standards again does not mean that a warrant is being obtained. It just means that whatever authorization they purportedly are obtaining is not violative of the Constitution. For example, a pen register is consistent with the Constitution insofar as it does not contravene the Fourth Amendment, but that court order authorizing a pen register is not based on a warrant."

In the pre-cellphone era, a "pen/trap order" allowed law enforcement to obtain someone's calling metadata in near real-time from the telephone company. Now, that same data can also be gathered directly by the cops themselves through the use of a stingray . In some cases, police have gone to judges asking for such a device or have falsely claimed a confidential informant while in fact deploying this particularly sweeping and invasive surveillance tool.

Most judges are likely to sign off on a pen register application not fully understanding that police are actually asking for permission to use a stingray. Under federal law, pen registers are granted under a very low standard: authorities must simply show that the information obtained from the pen register is "relevant to an ongoing criminal investigation."

Getting a judge to sign off on a pen register is a far lower standard than being forced to show probable cause for a search warrant or wiretap order. A wiretap requires law enforcement to not only specifically describe the alleged crimes but also to demonstrate that all other means of investigation had been exhausted or would fail if they were attempted.

Trapp, the APD spokesman, declined to answer Ars’ question as to whether his agency was applying for pen/trap orders or warrants, or if the APD always gets a warrant. He said: "That is as far as we're going to discuss this topic at this time."

California doesn’t actually have a specific pen register statute—a pen/trap application template that Ars recently obtained from the Oakland Police Department under a public records request cites the federal statute. However, that practice goes against a 2003 opinion from the California Attorney General. The AG concluded that because California affords its citizens more privacy under the state constitution than does federal law, a state law enforcement officer cannot use a federal statute for a pen/trap order.

"I have exactly the same questions as you do," Bribing, the ACLU attorney, added. "The fact that they talk about a court order signed by a judge leaves unclear whether they mean a pen register that is a less standard than a warrant, or a warrant that requires probable cause. It is particularly important given the number of instances across the country when police have misled police and prosecutors as to what the device does. That's an important question, one that the public has a right to know. There's no law enforcement interest in keeping the public in the dark as to whether they use a warrant or a pen register application and what they tell the courts about the technology in seeking the approval."

Police explanation doesn't hold water

The second section, under "privacy concerns," states:

The cell site simulator possessed by the Anaheim Police Department does not retain third party information that it encounters in the process of locating the targeted cellphone. The device does not create or feed any sort of database. Information evaluated or obtained by the cell site simulator is not kept or maintained by the Anaheim Police Department, or any state or federal government agencies, Harris Corporation, or any other person or entity. The device cannot identify the operator of a cellphone, cannot intercept the content of calls or texts, and our personnel do not have the ability to listen to calls or read text messages using this device.

Bribing was also unmoved by this language.

"The way that stingrays work is that, inherently by the nature of the way that they operate, they collect info on any phone in the area," he told Ars.

"Maybe they're operated in a way that they don't provide the user on anything besides the target? Is that a policy? Is that a setting on the device? Is that how the device is hard-wired? All those things are important to know exactly how important the protections for privacy are. [The APD says] that the information is not kept by anybody. On some level that's hard to believe that there's no record maintained of the information that the devices collect. A lot of what they've said about the privacy concerns is basically inconsistent with the ways that stingrays work."

Mike Katz-Lacabe, a privacy activist in San Leandro, California, who has been conducting a nationwide census of stingray use, says that the APD’s data explanation is utterly false.

"The claim that no data is retained is nice but ignores the fact that the stingray is intrusive and interrupts cell phone connectivity for anybody near it," he wrote to Ars. "It also fails to mention the complete lack of oversight that could independently verify the Anaheim Police Department’s claims."

"The letter also states that ‘our personnel do not have the ability to listen to calls or read text messages using this device,’ but does not make clear that the device has the ability and the distinction between whether personnel can listen to calls or whether the device can intercept and record calls is semantic."