Judge sets new limits on cell phone surveillance

Privacy advocates now have a judge’s ruling to point to when addressing fears about the growing U.S. law enforcement use of a secretive cell phone-tracking technology.

A magistrate judge in Rockford, Ill., in one of the first judicial rulings regarding cell phone tower simulators, or stingrays, on Tuesday put new limits on police agencies’ collection of private data.

Stingrays, used by law enforcement agencies for about a decade, intercept and re-transmit cell phone signals as if they are cell towers. This enables them to identify and track mobile devices used by criminal suspects, but privacy groups have complained about the potential for stingrays to track or collect cell phone data from a large group of people not suspected of crimes.

The ruling, by Magistrate Judge Iain Johnston of the U.S. District Court for the Northern District of Illinois, Western Division, does not apply to law enforcement agencies operating outside the district, but privacy advocates are optimistic that it could serve as a blueprint for judges nationwide.

Johnston, addressing a warrant application by the FBI to track a drug-trafficking suspect using a stingray, imposed three requirements. First, law enforcement officers must make “reasonable efforts” to avoid capturing cell phone signals of people not being investigated.

Police must also “immediately” destroy all data other than that identifying the suspect’s cell phone. And they are prohibited from using any data collected, other than the cell phone information of the target, Johnston wrote.

“It’s a fantastic ruling, and it’s really heartening to see a federal judge wrestling seriously with these issues,” — Nate Wessler, ACLU attorney

Johnston’s ruling deals with most of the core privacy issues raised by stingray use, Wessler said. Since the FBI sought a warrant in this case, Johnston didn’t address the question of whether a warrant is needed to set up a stingray. Some other law enforcement agencies aren’t seeking warrants to deploy the technology.

The American Civil Liberties Union has reported stingray use at 57 law enforcement agencies across 22 states and Washington, D.C., as well as more than a dozen federal agencies, including the National Security Agency, the Internal Revenue Service, and Immigration and Customs Enforcement.

“It’s a fantastic ruling, and it’s really heartening to see a federal judge wrestling seriously with these issues,” said Nate Wessler, an attorney with the ACLU’s Speech, Privacy, and Technology Project.

An additional concern for privacy groups is the secrecy surrounding the use of stingrays. Harris Corp., the maker of one stingray technology, has required police users to sign nondisclosure agreements, and in a couple of cases, prosecutors have opted to drop criminal charges instead of disclose information about stingrays in court.

Johnston’s ruling provides the public with basic information about “why this technology is concerning, and it enforces necessary and common-sense restrictions to protect the privacy of innocent bystanders,” Wessler said. And because law enforcement’s use of stingrays has been addressed in only a few other states—Wisconsin, Florida, and Maryland—he added, it may have a lot of influence.

The U.S. Department of Justice declined to comment on Johnston’s decision. In September, it published a policy saying it would delete data not associated with a criminal suspect collected by stingrays within 30 days. That policy also requires the Justice Department and related agencies to seek court-ordered warrants to set up stingrays, except in largely undefined “exceptional” cases.

Johnson’s rules are an important addition to a warrant requirement for the use of stingrays, said Harley Geiger, senior counsel at the Center for Democracy & Technology. Ensuring that data collected about “innocent people is destroyed” is a key privacy protection, he said.

Judges looking at stingrays should also tackle the “high degree of secrecy” surrounding the technology, Geiger suggested. “That secrecy is unacceptable when individuals must defend their rights,” he said.

Johnston noted the secrecy surrounding the use of stingrays in his decision. Prosecutors and federal agents are “tight-lipped about the device…in all likelihood because of the NDAs,” he wrote. “Some commentators argue that judges may be allowing the use of cell site simulators without possessing a complete understanding of the device and how it works.”

Information about the device is often “buried in the technical jargon” of a law enforcement agency’s application, Johnston added.