Newly released records show that Florida law enforcement agencies have been using stingrays thousands of times since at least 2007 to investigate crimes as small as a 911 hangup. They also seemingly obliquely refer to stingrays in police reports as “ electronic surveillance measures ,” or even as a “ confidential informant .”

Stingrays, the common name for “cell-site simulators,” can be used to determine a phone’s location, but they can also intercept calls and text messages. During the act of locating a phone, stingrays also sweep up information about nearby phones—not just the target phone. Earlier this month, Ars reported on how the FBI is actively trying to “prevent disclosure” of how these devices are used in local jurisdictions across America.

The trove of documents, which were published earlier this week by the American Civil Liberties Union, show that while police agencies often justify the purchase of such hardware in the name of counter-terrorism—none of the hundreds of disclosed uses involves terrorism.

In the case of a 2003 document produced by the Miami-Dade Police Department, that agency requested an “emergency” purchase of stingrays in efforts to protect the city during the Free Trade Area of the Americas (FTAA) Conference, held in Miami in late November 2003.

As the agency wrote:

Based on the history of these conferences, the department anticipated criminal activities directed at attendees and conference sites facilitated by the use of cellular phones. Wireless phone tracking systems utilized by law enforcement have proven to be an invaluable tool in both the prevention of these offenses and the apprehension of individuals attempting to carry out criminal activities.

That could suggest that the MDPD intended on using the stingrays against people protesting the event—a constitutionally protected activity.

A third of the listed stingray cases, in a list provided by the Tallahassee Police Department (TPD), show that the most frequently cited crimes were robbery, burglary, and theft. A few of the cases cited involved more serious crimes, such as homicide.

Elsewhere, in one instance, the Palm Bay Police Department simply borrowed a stingray directly from its manufacturer, the Harris Corporation—located down the road in Melbourne, Florida—to respond to a 2006 bomb threat at a school, absent any judicial oversight.

The TPD did not immediately respond to Ars’ request for comment as to how, when, and why stingrays are used in the Florida state capitol. Public defenders in Tallahassee and Miami also did not immediately respond to Ars' queries.

“For so long, police across the country have been doing their level best to keep stingrays completely secret and this proves one of the most detailed looks as to how this is being used across the state,” Nathan Freed Wessler, an ACLU attorney, told Ars.

“Knowing which departments have purchased or are using these will let defense attorneys start asking the right questions and then it is possible that people who are bystanders whose records are swept up could try to vindicate their own rights. If you can prove that you live next door to an address, odds are that phone was caught up in that dragnet search—that sounds like a Fourth Amendment violation to me.”

The “pen/trap” is mightier than the sword

Relatively little is known about how, exactly, the stingrays are used by law enforcement agencies nationwide, although documents have surfaced showing how they have been purchased and used in some limited instances. In 2013, Ars reported on leaked documents showing the existence of a body-worn stingray. Five years ago, Kristin Paget famously demonstrated a homemade device built for just $1,500.

Worse still, cops have lied to courts about the use of such technology. In January 2015, two US senators made public the FBI’s position that the agency could use stingrays in public places without a warrant.

The largest manufacturer of the devices, the Harris Corporation, has been tight-lipped about its hardware capabilities.

“We do not comment on solutions we may or may not provide to classified [Department of Defense] or law enforcement agencies,” Jim Burke, a spokesman for the Harris Corporation previously told Ars.

In an e-mail to Ars on Tuesday, Burke declined further comment.

Typically the legal process that local law enforcement uses is asking a judge to sign off on a “pen register and trap and trace order.”

In the pre-cellphone era, a “pen/trap order” allowed law enforcement to obtain someone's calling metadata in near real-time from the telephone company. Now, that same data can also be gathered directly by the cops themselves through the use of a stingray. In some cases, police have gone to judges asking for such a device or have falsely claimed a confidential informant, but in fact have deployed this particularly sweeping and invasive surveillance tool.

Most judges are likely to sign off on a pen register application, not fully understanding that police are actually asking for permission to use a stingray. Under both Florida state law and federal law, pen registers are granted under a very low standard: authorities must simply show that the information obtained from the pen register is “relevant to an ongoing criminal investigation.”

Getting a judge to sign off on a pen register is a far lower standard than being forced to show probable cause for a search warrant or wiretap order. A wiretap requires law enforcement to not only specifically describe the alleged crimes but also to demonstrate that all other means of investigation had been exhausted or would fail if they were attempted.

A different tactic

But in the documents provided to the ACLU as an example of such applications, none of them were pen/trap applications, but rather were simply other applications to the court to compel Sprint to hand over customer data under a different state law. (Presumably similar applications to other mobile providers exist as well.)

The first application provided, for example, cites “active GPS precision location information.”

“One possibility is that police considered an order for the service provider to provide real-time location information as also granting authority to use a stingray to independently capture real-time location information,” Wessler told Ars.

“The orders are issued under the state’s analogue to the federal Stored Communications Act (SCA), Florida Statute 934.23, and not the pen register statute, as you point out. But note that this state statute, like the federal SCA, is intended to deal with stored records, not real-time/prospective data. So it’s not an appropriate way to seek real-time cell phone location data, whether from the service provider or using a stingray. But if they are using the state stored records statute to get real-time tracking from the service provider, there’s no reason to think they wouldn’t believe they could do the same thing for stingrays.”

Hanni Fakhoury, an attorney with the Electronic Frontier Foundation and a former federal public defender, told Ars by e-mail that he agreed with the ACLU’s interpretation of the released information.

“Basically, as we’ve said many times before, these documents confirm our worst fears about the use of stingray technologies: police are deploying them routinely in mundane cases while being less than forthright with the courts about what exactly they’re doing,” he wrote.

“While the order you linked to certainly suggests the [Tallahassee] PD plan to obtain location information from a specific cell phone, it clearly reads as if the police planned to go to the cell phone provider and obtain location information about that one individual user, rather than operate a stingray that captures information about many other innocent individuals.”

A few law enforcement agencies, including Charlotte, North Carolina, have recently reformed their processes in the wake of local reporting on the issue. Judges in Pierce County, Washington, have newly required that cops be more forthright and explicit in their desire to use the technology.

Mike Katz-Lacabe, a former school board member and privacy activist based in San Leandro, California, who has examined the use of stingrays and license plate readers, among other tools, is concerned that as such devices get cheaper, their use will only increase.

“The secrecy surrounding stingrays and similar equipment might be justified if their use was limited to the anti-terrorism scenarios that are often used as justification in the grant applications to fund these purchases,” he told Ars by e-mail.

“But they are being used in low-level criminal cases, often without warrants (the FBI has stated that it doesn’t need a warrant if the stingray is used in a public area). If there is a warrant, the information in the court application is purposely intended to deceive the judicial system about both the use of the stingray and how it operates. That is required by the non-disclosure that the FBI requires for a law enforcement agency to acquire the product and the terms and conditions from Harris Corporation.”