Stingrays mimic cell tower signals to trick mobile phones into connecting with them, allowing law enforcement agents to track a target's location, record text messages or calls, or deny service to a particular phone. The controversial technology has been slammed by civil liberties groups for what they say are invasive and unconstitutional methods, while the departments who employ them have historically remained secretive over their use and ownership of the devices.
In addition to the new rules on warrants, the DOJ's enhanced policies, which go into effect immediately for all federal law enforcement agencies, require more stringent data deletion and ban agents from using the devices to collect communications, emails, contact lists, images, or any other data contained on the phone itself.
The new rules will "enhance transparency and accountability, improve training and supervision, establish a higher and more consistent legal standard and increase privacy protections in relation to law enforcement's use of this critical technology," the DOJ said in its announcement.
"With only this policy shielding us, there's nothing keeping warrantless Stingray evidence out of court, and therefore nothing to deter agents from behaving badly."
--Nate Cardozo, Electronic Frontier Foundation
"At long last," responded Electronic Frontier Foundation staff attorney Nate Cardozo.
Cardozo provided more details on the new rules in a write-up published Friday:
What today's changes do:
- Federal law enforcement agents will be required to obtain a search warrant supported by probable cause prior to using a cell-site simulator in a law enforcement context. A search warrant requires a showing by the agent, under oath, that meets one of the highest standards in federal law. This incredibly important change is precisely what EFF has been asking for.
- Agents will only be allowed to use Stingrays in "pen register" mode, meaning the devices will collect only the basic location of the phone and the numbers of incoming and outgoing calls and texts. Agents will not be allowed to collect the content of your communications -- like your emails or text messages -- even if the cell-site simulator is capable of such collection.
- Finally, Agencies must delete data on users not targeted in either 24 hours or 30 days, depending on context.
What today's changes don't do:
- The new policy isn't law and doesn't provide any remedy to people whose data is swept up by Stingrays operated without a warrant. Indeed, it won't even act to keep evidence collected in violation of the policy out of court (this is known as suppression).
- The policy doesn't apply to the use of Stingrays outside of the criminal investigation context. For instance, when federal agents use cell-site simulators for "national security" purposes, they won't be required to obtain a warrant by the terms of this policy.
- There are two enumerated exceptions to the warrant requirement in today's guidance. The first is the traditional "exigent circumstances" exception, common to all warrant requirements and not particularly worrisome. But the second exception listed in today's policy for undefined "exceptional circumstances" is potentially problematic. We have no idea what that means, so we're waiting to see if and how the exception will be used.
The reaction from civil liberties groups on Thursday, while largely positive, asserted that the new rules must only be seen as a starting point.
"The DOJ's new policy on cell-site simulators is a step in the right direction," Jeramie Scott, national security counsel at the Electronic Privacy Information Center (EPIC), told Common Dreams. "Most importantly, the policy requires a warrant to use the devices, prohibits their use to intercept communications, and requires the deletion of all non-target data."
"Unfortunately, the policy only applies to DOJ components," Scott continued. "Additionally the national security exception could be used as a loophole around the warrant requirement in some circumstances if combined with parallel construction--a practice of reconstructing the evidence obtained in a criminal case to conceal the true source."
Nathan Freed Wessler, staff attorney for the ACLU's Speech, Privacy, and Technology Project, added in a statement: "After decades of secrecy in which the government hid this surveillance technology from courts, defense lawyers, and the American public, we are happy to see that the Justice Department is now willing to openly discuss its policies. Requiring the FBI, DEA, and other agencies to obtain a warrant before deploying these surveillance technologies--in most circumstances--is a positive first step."
"However, this policy does not adequately address all concerns," Wessler continued.
While federal agencies have been hesitant to disclose information about the technology, civil liberties groups like the ACLU have previously obtained documents through Freedom of Information Act (FOIA) requests that indicate widespread use of the devices in certain locations, such as Florida, New York, and Baltimore.
And while police departments often invoke counter-terrorism measures as justification for buying up Stingrays and related technology, reporting by the ACLU also found that they are used as a first resort in the investigation of minor crimes.
As Cardozo explains, "With only this policy shielding us, there's nothing keeping warrantless Stingray evidence out of court, and therefore nothing to deter agents from behaving badly."
Wessler added, "Disturbingly, the policy does not apply to other federal agencies or the many state and local police departments that have received federal funds to purchase these devices. In addition, the guidance leaves the door open to warrantless use of Stingrays in undefined 'exceptional circumstances' while permitting retention of innocent bystander data for up to 30 days in certain cases."
"The DOJ should close any loopholes created by the exceptions and work to extend the policy to all federal agencies as well as state and local law enforcement that receive federal funding to buy the cell-site simulators," Scott said.
