An Arizona judge has denied a motion to suppress evidence collected through a spoofed cell tower that the FBI used to track the location of an accused identity thief.

The ruling means that the government may use not only evidence gathered through its fake cell tower to locate an air card that Daniel David Rigmaiden was using to access the internet, but also evidence gathered from the apartment to which they tracked him through the air card and evidence collected from a storage space and computer hard drives found in the apartment and storage locker.

In his ruling, U.S. District Judge David Campbell based his decision on whether Rigmaiden had a reasonable expectation of privacy in the use of the air card inside his apartment, as well as in the apartment itself and the storage unit that was discovered through the search of the apartment.

Judge Campbell concluded that Rigmaiden did not have a reasonable expectation of privacy in any of these because he had obtained the air card and rented the apartment and storage space through fraudulent means – that is, using identifications that he had stolen from other people.

Campbell wrote that even if Rigmaiden had a subjective expectation of privacy in these items, "the Court cannot conclude that his expectation is one society should be prepared to recognize as objectively reasonable."

Prosecutors assert that Rigmaiden purchased the air card in May of 2006 using the stolen identity of Travis Rupard, and maintained a Verizon wireless account used with the air card under the same name. He also allegedly obtained a Visa card in the name of Andrew Johnson, a deceased individual, to purchase the laptop computer he used with the air card. He allegedly rented the apartment under the name of Steven Travis Brawner, a deceased individual.

According to authorities, Rigmaiden then used the air card and the laptop computer to file hundreds of false tax returns using the names of hundreds of deceased individuals.

"One who so thoroughly immerses himself in layers of false identities should not later be heard to argue that society must recognize as legitimate his expectation of privacy in the location and implements of his fraud," Campbell wrote in his ruling, citing a number of precedent-setting cases to support his decision, including a Ninth Circuit decision that a defendant can have no expectation of privacy in a computer that is obtained through fraud. "Having utterly disregarded the privacy rights of Travis Rupard, Steven Brawner, and Andrew Johnson, not to mention the many other names used in his scheme, Defendant cannot now credibly argue that he had a legitimate expectation of privacy in the devices and apartment he acquired through the fraudulent use of their identities."

The ruling is a huge win for the government, which would have been hard-pressed to preserve its case against Rigmaiden without evidence gathered from the apartment and seized hard drives.

But the American Civil Liberties Union, which filed an amicus brief in support of Rigmaiden's motion to suppress, says the judge missed the mark on a number of issues in the case. According to Linda Lye, a staff attorney for the ACLU's Northern California office, past rulings have asserted that a defendant doesn't have the expectation of privacy when it comes to someone else's property. But in Rigmaiden's case, there is no dispute that the air card was his and that the aliases he used to obtain the air card and rent the apartment were being used by him.

"If you can't connect that the other name [you are using] is you, then there's no expectation of privacy," she told Wired. "But there's no dispute that the aliases that Rigmaiden used were his aliases. Also, the government talks a lot of about fraud, but fraud has a very legal definition. There has to be a material misrepresentation that caused harm, but there's no showing that the apartment complex or Verizon felt that Rigmaiden's use of another name was material to the transaction or that they suffered any harm. They were all paid."

Rigmaiden was arrested in 2008 on charges that he was the mastermind behind an operation that involved stealing more than $4 million in refunds from the IRS by filing fraudulent tax returns. He and others are accused of using numerous fake IDs to open internet and phone accounts and using more than 175 different IP addresses around the United States to file the fake returns, which were often filed in bulk as if through an automated process. Rigmaiden has been charged with 35 counts of wire fraud, 35 counts of identify theft, one count of unauthorized computer access and two counts of mail fraud.

In court documents, Rigmaiden asserted that in July 2008 Verizon surreptitiously reprogrammed his air card so that it would connect to a fake cell site, or stingray device, that the FBI was using to track his location.

Air cards are devices that plug into a computer and use the wireless cellular networks of phone providers to connect the computer to the internet. The devices are not phones and therefore don’t have the ability to receive incoming calls, but in this case Rigmaiden asserts that Verizon reconfigured his air card to respond to surreptitious voice calls from a landline controlled by the FBI.

The FBI calls, which contacted the air card silently in the background, operated as pings to force the air card into revealing its location so they could use the stingray to track him.

The secretive technology, generically known as an IMSI catcher, allows law enforcement agents to spoof a legitimate cell tower in order to trick nearby mobile phones and other wireless communication devices like air cards into connecting to the stingray instead of a phone carrier’s legitimate tower.

When devices connect, stingrays can see and record their unique ID numbers and traffic data, as well as information that points to the device’s location.

By moving the stingray around and gathering the wireless device’s signal strength from various locations in a neighborhood, authorities can pinpoint where the device is being used with much more precision than they can get through data obtained from a mobile network provider’s fixed tower location.

In order to use the stingray with Rigmaiden's air card, the defendant asserts in court documents that Verizon reprogrammed his air card so that when an incoming voice call arrived, the card would disconnect from any legitimate cell tower to which it was already connected, and send real-time cell-site location data to Verizon, which forwarded the data to the FBI. This allowed the FBI to position its stingray in the neighborhood where Rigmaiden resided. The stingray then “broadcast a very strong signal” to force the air card into connecting to it, instead of reconnecting to a legitimate cell tower, so that agents could then triangulate signals coming from the air card and zoom-in on Rigmaiden’s location.

To make sure the air card connected to the FBI’s simulator, Rigmaiden says that Verizon altered his air card’s Preferred Roaming List so that it would accept the FBI’s stingray as a legitimate cell site and not a rogue site, and also changed a data table on the air card designating the priority of cell sites so that the FBI’s fake site was at the top of the list.d

The government has never disputed Rigmaiden’s assertions about Verizon’s activities or that it relied on the stingray to locate Rigmaiden in his apartment.

But the actions described by Rigmaiden are much more intrusive than previously known information about how the government uses stingrays, which are generally employed for tracking cell phones and are widely used in drug and other criminal investigations.

Rigmaiden sought to suppress evidence obtained through the use of the stingray on grounds that it involved a search of his apartment and that the government did not obtain a probable-cause warrant to use the stingray.

The government has long asserted that it doesn’t need to obtain a probable-cause warrant to use stingrays because they don’t collect the content of phone calls and text messages and operate like pen-registers and trap-and-traces, collecting the equivalent of header information.

The government has conceded, however, that it needed a warrant in Rigmaiden's case alone — because the stingray reached into his apartment remotely to locate the air card — and that the activities performed by Verizon and the FBI to locate Rigmaiden were all authorized by a court order signed by a magistrate.

But the ACLU and the Electronic Frontier Foundation argued in their amicus brief that the order the government obtained did not qualify as a warrant and that the government withheld crucial information from the magistrate who issued the order to use the device — such as identifying that the tracking device they planned to use was a stingray and that its use involved intrusive measures — thus preventing the court from properly fulfilling its oversight function. The government did not tell the magistrate that all phones and devices in the vicinity of a stingray will connect to it when it is turned on, not just those of a target being tracked.

Judge Campbell disagreed with the civil liberties groups on all counts.

"The intrusion that allowed agents to locate the aircard – using a mobile tracking device to send signals to and receive signals from the aircard – was not a 'severe intrusion,'" he wrote in his ruling. "The evidence in this case suggests that Defendant used the aircard and laptop computer to perpetrate an extensive scheme of fraud through electronic communications. The Court cannot conclude that the government’s corresponding use of electronic communications to find the aircard violated any legitimate expectation of privacy."

The judge also ruled that the government was not in the wrong for failing to disclose to a magistrate judge that it planned to use a stingray to track the defendant, or to explain to the judge how the tracking device it intended to use worked. He characterized this information as a "detail of execution which need not be specified."

Lye says the government has a duty of candor when seeking court approval for the use of surveillance technology, and the judge's ruling has strong implications for any new surveillance technology used by federal agencies.

"When the government is seeking a warrant to use new technology, it has the duty to explain to the court what that technology is and how it works," she said. "Stingrays are a very potent example of why that is so, because it scoops up innocent information of third parties who are not under probable cause surveillance."

Rigmaiden's case is expected to go to trial later this month.