Little-know surveillance tool raises privacy questions

Federal investigators in Northern California routinely used a sophisticated surveillance system to scoop up data from cellphones and other wireless devices in an effort to track criminal suspects — but failed to detail the practice to judges authorizing the probes.

The practice was disclosed in documents obtained under the Freedom of Information Act by the American Civil Liberties Union of Northern California — in a glimpse into a technology that federal agents rarely discuss publicly.

The investigations used a device known as a StingRay, which simulates a cellphone tower and enables agents to collect the serial numbers of individual cellphones and then locate them. Although law enforcement officials can employ StingRays and similar devices to locate suspects, privacy groups and some judges have raised concerns that the technology is so invasive — in some cases effectively penetrating the walls of homes — that its use should require a warrant.

The issues, judges and activists say, are twofold: whether federal agents are informing courts when seeking permission to monitor suspects, and whether they are providing enough evidence to justify the use of a tool that sweeps up data not only from a suspect’s wireless device but also from those of bystanders in the vicinity.

In Northern California, according to the newly disclosed documents, judges expressed concerns about the invasive nature of the technology.

“It has recently come to my attention that many agents are still using [StingRay] technology in the field although the [surveillance] application does not make that explicit,” Miranda Kane, then chief of the criminal division of the Northern California U.S. attorney’s office, said in a May 2011 email obtained by the ACLU.

As a result of that, she wrote, “effective immediately, all ... applications and proposed orders must be reviewed by your line supervisor before they are submitted to a magistrate judge.”

The Justice Department has generally maintained that a warrant based on probable cause is not needed to use a “cell-site simulator” because the government is not employing them to intercept conversations, former officials said. But some judges around the country have disagreed and have insisted investigators first obtain a warrant.

“It’s unsettled territory,” said one U.S. law enforcement official, who spoke on the condition of anonymity because he was not authorized to speak for the record.

In a statement, Christopher Allen, a spokesman for the FBI, said the bureau advises field offices to “work closely with the relevant U.S. attorneys office to adhere to the legal requirements” of their respective districts.

One of the problems is there is “scant law” addressing the issue of cell-site simulators, said Brian Owsley, a federal magistrate judge in the Southern District of Texas, who in June wrote a rare public ruling on the issue. He denied an application to use a StingRay, in large part because he felt the investigating agent failed to explain the technology or how it would be used to gather the target’s cellphonenumber.

Moreover, the government did not explain what it would do with the numbers and other data “concerning seemingly innocent cellphone users” that were also picked up.

“Neither the special agent nor the assistant United States attorney appeared to understand the technology very well,” Owsley wrote. “At a minimum, they seemed to have some discomfort in trying to explain it.”

At a recent conference on cellphone tracking issues at Yale University, Owsley said he thought that “there are magistrate judges around the country that are getting these requests and not realizing what these requests are,” in some cases perhaps because the agents are not clear about their intent to use the technology.

“By withholding information about this technology from courts in applications for electronic surveillance orders, the federal government is essentially seeking to write its own search warrants,” said Linda Lye, a staff attorney for the ACLU of Northern California.

Judges “need the opportunity to require privacy safeguards, such as rules on how to handle the data of innocent people that may be captured by the devices as well,” she said. Lye will be arguing the issue on Thursday in a federal case in Arizona, in support of a defendant charged with tax fraud and identity theft. Daniel Rigmaiden, known as “the Hacker” to acquaintances and federal agents, was tracked in part with the use of a StringRay. He has alleged that investigators did not seek a court’s approval to use the technology.

“The main concern we have in Rigmaiden is the government was not being forthright with the magistrate when it was seeking to use this device,” said Lye, whose organization is one of several that have filed an amicus brief in the case.

The newly disclosed documents suggest “Rigmaiden was not an isolated case,” she said.

The government said it obtained a warrant to track Rigmaiden, but the ACLU is arguing that the government did not present key information about the surveillance device to the magistrate, rendering the warrant invalid.

Chris Soghoian, the ACLU’s principal technologist, said cell-site simulators are being used by local, state and federal authorities.

“No matter how the StingRay is used — to identify, locate or intercept — they always send signals through the walls of homes,” which should trigger a warrant requirement, Soghoian said. “The signals always penetrate a space protected by the Fourth Amendment.”