Background

In 2013, three men set up a drug deal in a Tallahassee parking lot. When the drug dealer arrived, the men pulled out a weapon and robbed the dealer of the drugs and his cell phone.1 Police arrested the robbers a few days later, in possession of the drugs and the phone, and charged them with armed robbery with a deadly weapon, which carries a mandatory minimum sentence of nearly three years in prison under Florida law and allows sentences of up to 30 years. Prosecutors had the men dead to rights.

But the case took a bizarre turn when defense attorneys began wondering how the police managed to find their clients so quickly. The police and prosecution refused to say. Finally, the judge demanded answers. Rather than reveal the method by which police were able to find the suspects, the prosecution offered the men a plea deal: probation, with no jail time.2 Why would prosecutors drop such a “slam dunk” case?

The case came apart due to the government’s use of a surveillance device it refused to disclose to the court. Across the United States, federal and state law enforcement agencies are sweeping up cell phone and location data from American citizens using a device colloquially referred to as a “stingray.“3 Stingray surveillance devices are cellular site simulators — they mimic the signal of a cell phone tower in order to force cell phones in the area to connect. Once a phone connects, the officer can download information from the phone or track its location.

Originally designed for military and national security use, the surveillance devices made their way into local law enforcement officers’ hands, in coordination with the federal government, through a variety of transfer and grant programs — such as the Urban Areas Security Initiative — as well as through local funding sources such as civil asset forfeiture funds. Police agencies in 23 states and the District of Columbia, as well as federal agencies including the Federal Bureau of Investigation (FBI), the Drug Enforcement Administration (DEA), the National Security Administration (NSA), and the Department of Homeland Security, are known to be using the devices.4 Because of the difficulties of discovering law enforcement use of the technology, it is reasonable to assume that police agencies in many more states are also using the devices in secret.

While events like the 2014 unrest in Ferguson, Missouri, and repeated stories of botched Special Weapons and Tactics (SWAT) raids have laid bare many of the problems involved in an increasingly militarized domestic police force, mission creep has not been limited to weapons and tactics.5 What the War on Drugs has done for police militarization, the War on Terror is now doing for police intelligence gathering, and the privacy of millions of Americans is at risk.

Much remains unknown about these devices. More troubling still is that the lack of public knowledge is by design. Through the use of nondisclosure agreements, a refusal to honor freedom of information requests, and deceit toward courts and the public, the full capabilities of these devices, the extent of their use by law enforcement, and the existence of policies to govern their use remain secret. But interested defense lawyers and civil liberties advocates have uncovered evidence that the use of stingray devices by domestic law enforcement agencies poses a litany of legal and ethical questions. The purpose of this paper is to illuminate those issues and to suggest some possible legislative and judicial remedies.

The paper will detail the history of the devices and their use by local law enforcement, the known and alleged extent of their capabilities, and why this technology renders millions of innocent Americans at risk of having their personal data and communications information swept up in law enforcement fishing expeditions.

In recent years, stingrays have moved from military and national security uses to routine police use. Surveillance technology, designed for use on battlefields or in antagonistic states where constitutional concerns are minimal, has increasingly found its way into the hands of local law enforcement, often without any discernible effort to adapt the equipment or the policies governing its tactical use to the home front, where targets are citizens with constitutional rights rather than battlefield combatants.

Further exacerbating the problems with stingray transfers are the efforts of the Harris Corporation (the Florida‐​based manufacturer of the devices) and the federal agencies responsible for licensing and coordinating the transfers of these devices to state and local law enforcement agencies to hide the technology. The administrative regime that the federal government and the Harris Corporation have built requires law enforcement agencies to keep the capabilities, uses, and often, the very existence of stingrays a secret from citizens, legislators, and courts.

In defense of this veil of secrecy, government agencies have offered several justifications. Advocates of domestic stingray use insist that the devices are essential tools for law enforcement and that public revelation of their technological capabilities will compromise the efficacy of surveillance. They point to instances where stingray surveillance facilitated a positive outcome, and they highlight the need for law enforcement technology to keep up with advances in the technology of the criminal world.

While stingray technology indeed gives law enforcement officers an added advantage over their surveillance targets, the advantage does not justify secrecy or answer constitutional concerns. The claims that these devices are essential for preventing terrorist attacks and bringing down drug kingpins do not, as this paper will show, fit with the data thus far uncovered, which details stingray use by local law enforcement. Terrorists and drug kingpins long ago concluded that their cell phones were liabilities, and the reports detailing local stingray use support that conclusion. Several data releases compelled by state freedom of information litigation have uncovered little evidence that stingrays are being used to foil terrorists. The releases have, however, revealed thousands of warrantless stingray uses across the country for entirely routine law enforcement actions. Rather than bringing down terrorists and cartels, the government is using stingray surveillance to sidestep the Fourth Amendment’s warrant requirement.

Meanwhile, the overly restrictive terms of the nondisclosure agreement, upon which both the Harris Corporation and the FBI condition the local use of stingrays, have compromised prosecutions of people suspected of serious violent crimes. In other words, the ostensibly hypothetical prosecutions of terrorists and drug kingpins are crowding out actual prosecutions of criminals when police and prosecutors are forbidden from disclosing stingray use to the courts.

This phenomenon is not an accident; the terms of the agreement make such crowding out inevitable. The government plainly views sacrificing individual prosecutions, even for serious crimes, as an acceptable price for concealing the nature of stingray surveillance. The FBI’s nondisclosure agreement is clear: in exchange for permission to use stingray devices, state and local officials must surrender prosecutorial discretion to the federal government.

Few jurisdictions have willingly admitted to deploying stingray devices. Even fewer have offered any semblance of a publicly available policy on their use. The Department of Justice, which has deployed stingrays for years, only recently announced an initial stingray policy for Justice Department agencies, and it leaves much to be desired. The use of stingray surveillance devices in the absence of a warrant from a fully informed judge and without any legislative or public oversight undermines the separation of powers necessary to hold the government accountable.

The relationship between the federal government, Harris, and state and local law enforcement agencies also represents a threat to American federalist principles. The federal government’s terms of use amount to a demand that state and local officials abrogate their authority to prosecute cases when the federal government would rather maintain secrecy. These conditions undermine the police powers of the states, as does the mandate that agencies conceal their surveillance tactics from judges in cases before them.

This threat to federalism was apparent when, in 2014, U.S. Marshals literally raided the Sarasota Police Department and seized stingray documentation in order to prevent the department from complying with a state‐​level freedom of information request.6 The Florida chapter of the American Civil Liberties Union (ACLU) had recently secured an order requiring the Sarasota police to turn over documents pertaining to stingray use. To prevent that information from being turned over to the ACLU and the public, the U.S. Marshals Service launched a pre‐​dawn raid on the police department to take possession of the information. The federal government has also urged local law enforcement agencies to deceive state judges, and continues to exert pressure in favor of secrecy rather than public disclosure and oversight.7

Ultimately, the increasing militarization of police through federal equipment transfers and grant programs unavoidably risks the subversion of local law enforcement priorities in favor of federal ones. When state and local law enforcement are beholden to the federal government for funding, equipment, and tactics, state law enforcement priorities are inevitably altered.

Stingray use presents several novel legal issues as well. The Fourth Amendment provides that people have a right to “be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures.“8 Over the years, the Supreme Court has adopted methods of analyzing Fourth Amendment claims, such as the reasonable expectation of privacy9 test and third‐​party doctrine.10

In the absence of guidance from the courts, many law enforcement agencies settle for the use of what are known as “pen register” or “trap and trace” orders, which generally require less evidence of wrongdoing than a proper warrant would. 11 As the names suggest — both were originally methods of obtaining information from telegraph machines — these legal standards were created at a time when today’s technological infrastructure could scarcely be imagined.

What it means to “be secure” from unreasonable searches is also the source of renewed interest among Fourth Amendment scholars, who argue that the phrase’s meaning has been historically misconstrued. This paper will explore that argument and whether it contains the answer to the problem of mass surveillance under our constitutional framework.

As the private details of our lives are increasingly susceptible to digital hacking and surveillance, the government’s technological capabilities have far outpaced legal standards created to regulate much older and less invasive technology. It is incumbent upon legislatures and courts to close the growing gap.

Finally, this paper will explore possible reforms, including efforts at both the state and federal level that are already underway. Several state legislatures have already undertaken efforts to oversee the use of these devices, several courts have now revised their rules for dealing with stingray evidence, and there is a realistic potential for public policy to vastly improve the protection of our constitutional rights in the face of warrantless surveillance by law enforcement. While law enforcement’s crime‐​fighting capabilities must keep pace with advances in technology, stingray supporters’ argument that complete secrecy is the only means of effecting such advances requires scrutiny.

How Do Stingrays Work?

Although the precise extent of stingray use remains shrouded in secrecy, defense lawyers and civil liberties advocates, working through trial discovery efforts and freedom of information litigation, have uncovered a great deal about the capabilities of the devices.

Historically, police have tracked cellular phones through the use of cell tower data collected from, and in coordination with, third‐​party cell signal carriers. Through the use of pen register or trap and trace orders, police compel carriers to disclose phone records that allow law enforcement agents to locate particular cellular phones. The records allow police to use the carrier’s cell towers to triangulate the position of the suspect’s phone at any given time.12

Stingrays, on the other hand, give government agents the capability to circumvent that process by locating cell phones without the assistance of cell carriers, potentially enabling law enforcement to avoid seeking any judicial authorization first.

Stingrays are cellular‐​site simulators. They operate by mimicking the signal of a cell phone tower in order to force all cell phones within a given area to connect to the stingray device.

Cell phones are designed to automatically connect to the cell tower that is broadcasting the strongest signal. A typical cell phone could connect and reconnect dozens of times in a given day in order to achieve the strongest signal as the user travels. Stingray devices produce a boosted signal that muscles out the signals from legitimate cell towers and becomes the preferred signal source for the cell phone. All of this can transpire without the knowledge of, or any input from, the cell phone user or the network carrier. Once the phones are connected to the device, the stingray operator can locate the phone, interfere with its signal, and even retrieve personal data from the device.

A phone’s location can be triangulated using its international mobile subscriber identity (IMSI), which is a unique number that phones use to communicate with the cellular network. There are two methods of using the IMSI to locate a phone: the government can either ask the third‐​party carrier to voluntarily reveal the IMSI of a particular phone or compel the carrier under a court order. As the stingray forces cell phones in a target area to connect to it, the operator can screen the incoming “ripped” IMSI numbers against the known IMSI number he or she is trying to track. Once the suspect IMSI pings the stingray, the precise location of the phone can be triangulated.

Alternatively, if the IMSI number of the target is unknown, the stingray can collect the IMSI numbers of every phone in the target location.13 Law enforcement can then visually survey the scene while collecting cell data in order to isolate the IMSI number of an individual suspect’s phone. As police follow the suspect out of range of the other phones, his unique IMSI will eventually become apparent to the stingray operator. This tactic can be combined with the previously discussed pinging tactic in a way that cuts the network carrier entirely out of the process and allows police to both derive and surveil a given IMSI number on their own.

The location data produced by the stingray and its accompanying software is remarkably precise. Law enforcement officials have testified that stingray devices have allowed them to locate cell phones to within six feet and to identify a phone in a particular section of an apartment in a large apartment complex.14 The precision of this data raises constitutional questions regarding warrantless searches of private domiciles, a practice the Supreme Court has historically viewed with immense skepticism.

The full extent of the stingray data‐​ripping capability is unknown, but there is substantial reason to believe that even user content, such as browser activity, SMS text messages, and the content of phone calls can be intercepted. The Department of Justice’s own Electronic Surveillance Manual is vague but certainly leaves the door open to widespread personal data collection: