A Charlotte, North Carolina, judge has single-handedly sparked the release of surveillance applications involving the use of secretive cell-site simulators known as stingrays. To date, it's the most substantial set of surveillance applications—specifically " trap and trace device " orders, a cousin of the "pen register"—to become available.

Senior Resident Judge Richard Boner told Ars on Monday that he’s no privacy absolutist, and he shouldn't get credit. The way Boner sees it, he simply signed off on a common sense compromise between journalists and police.

"The Charlotte Observer has been pursuing this, and I met them two weeks ago with the editors and the reporters," Boner said.

"They asked how they would be able to see the orders that had been entered and I said, 'file a motion and I will get police and district attorney to have their say and see if they had any objection for keeping them sealed.' As it turned out, the attorney for the Observer got together with the police attorney and they reached an agreement, so the records for cases that are now closed could be released and would not jeopardize prosecution. They agreed on the form—it wasn't necessarily a matter of me ordering to release the records."

Security through obscurity

While stingrays do target specific phones, they also sweep up cell data of innocents near by who have no idea that such collection is taking place. Authorities have been notoriously tight-lipped about how such devices are acquired and implemented. Former federal magistrate judge Brian Owsley (now a law professor at Indiana Tech) has been unsuccessful in his efforts to unseal similar orders despite familiarity with the legal system. And just last week, prosecutors in a Baltimore robbery case even dropped key evidence that stemmed from stingray use rather than fully disclose how the device was used.

So the release of these documents in Charlotte is a rare bit of transparency amid the vast trove of surveillance applications nationwide. According to the Charlotte Observer, these court documents ask for surveillance permission, but they do not specifically mention a stingray, nor indicate how it would be used, nor explain the device's capabilities.

Ars has requested the full set of these applications with the court along with a copy of the order that the Charlotte-Mecklenburg Police Department (CMPD) and the Charlotte Observer submitted to Judge Boner.

Boner is set to retire at the end of the year after 27 years on the bench, and he admitted that everything he’s learned about stingrays is "based on what I’ve read on the Internet." As a judge, he hasn’t gotten any privileged information from the Harris Corporation, one of the most well-known manufacturers of such devices.

"It's only permitted to access the permission of data, not the contents of the telecom, and that is one of the conditions that the manufacturers impose," he said, without being able to cite a specific website.

Harris has previously declined Ars’ request to learn more about stingrays and how they are used by local law enforcement. But slowly, more and more documents have surfaced showing how the devices are purchased and used in limited instances. Last year, Ars reported on leaked documents showing the existence of a body-worn stingray. In 2010, security researcher Kristin Paget famously demonstrated a homemade device built for just $1,500. The Charlotte release is merely the latest reveal.

“The people that they are trying to trace are not law-abiding citizens”

"The reason that the CMPD is using this device is to try and locate people who are wanted," Judge Boner said. "Most of the cases, when they come to me or another judge, they already have an outstanding charge against this individual. This person is eluding arrest and they are trying to locate them."

For the judge, giving police the ability to locate someone by using a stingray or by accessing their metadata—not content via a wiretap—is a worthwhile trade.

"You cannot make the concessions to allow for security—then they will complain if your relative is killed in Boston or New York, or if somebody is killed by the person that they're trying to locate," he said. "You're going to have to make some concessions."

When Ars pointed out that law enforcement in Charlotte and other places haven’t historically been very transparent about how stingrays are used or what information they collect, Boner was unmoved.

"The people that they are trying to trace are not law-abiding citizens—I’ve dealt with CMPD enough and know the officers that do it," he said. "If it ever happens that I can't trust them then that might be a different occasion. All of these requests come through the CMPD police attorney’s office. The police orders are drafted, they have been vetted a certain extent. My inquiry is: why do you need the information and what are you going to do with it?"

Boner said the means by which such location data is obtained, whether via stingrays or other means, doesn’t concern him—even if data is gathered up of unwitting innocents nearby. The judicial veteran said that if the public is truly concerned about the privacy implications, they should approach policymakers.

"The North Carolina legislature, if it wanted to introduce a bill to pass restrictions like for pen registers, saying here's what you have to do—or Congress could also do that," he concluded. "But in my opinion, these concerns better be addressed by legislation, rather than a judge saying: ‘I'm not going to sign, so if [the suspect] takes off, too bad!’ I'm not going to do that. I don’t think that's fair to the citizenry. Once the person has been charged, once the prosecution has been done, there's no good reason not to release the record."