Last Thursday afternoon, just as we were all heading out for the Labor Day weekend, the Justice Department released new policy guidance on the use of cell-site simulator technology. The policy is a good first step, requiring all DOJ components (including the FBI, the DEA, and the US Marshals Service) to obtain a warrant before using cell-site simulators to glean highly sensitive location information. But large loopholes remain.
These devices, popularly known as Stingrays, pose as cell phone towers. They scoop up the signals that your iPhone regularly sends to AT&T towers to allow the company to provide you with service, revealing at least your approximate location and potentially your movements over time. By picking up information directly in real time, Stingrays and similar devices obviate the need to obtain the cooperation of service providers in collecting this data. As the DOJ policy makes clear, these devices are used both to locate particular cell phones and to pinpoint one that is not identified. In either case, they pick up location information not just about a target, but also everyone who happens to be in the vicinity.
Stingrays are used for a variety of criminal investigations: For example, the Wall Street Journal has reported that the FBI used one to locate a person suspected of hacking and that the Marshals Service put ultra powerful Stingray-type devices on airplanes that potentially flew over most of the population of the United States looking for criminal suspects. According to the new policy, until now, Stingrays have been deployed under the Pen Register Statute, which simply requires a certification to the court that the information sought is relevant to an ongoing criminal investigation. The probable cause warrant regime, the DOJ states, is being implemented "as a matter of policy" -- i.e., not as a matter of law.
Requiring federal law enforcement agencies to demonstrate probable cause and obtain a warrant before deploying Stingrays is a good move. The DOJ policy also includes important back-end protections. For example, when a Stingray is used to locate a particular cell phone, the data must be deleted as soon as the phone is located but "no less than once daily." When a Stingray is used to locate an unknown cell phone, the data must also be deleted as soon as the phone is identified, but "in any event no less than once every 30 days." Law enforcement is also limited in the use it can make of data obtained from Stingrays -- the warrant application must state that they won't use non-target data without a further order from the court. And, in an apparent reversal of federal authorities' practice of keeping the use of Stingrays secret, the policy requires prosecutors to disclose their intention to use the technology when seeking a court order.
But the policy contains two large loopholes. First, although it sets out a detailed procedure to be followed when there are exigent circumstances (such as threats to human life or serious injury, the destruction of evidence, hot pursuit, or preventing escape of a suspect or fugitive), it also creates an exception for "other circumstances in which, although exigent circumstances do not exist, the law does not require a search warrant and circumstances make obtaining a search warrant impracticable." Since the DOJ has not conceded that a warrant is required for Stingrays as a matter of law, this leaves open potentially all uses of Stingrays where the agency concludes it is impracticable to obtain a warrant. In addition, the policy document gives no examples of what these circumstances might be other than to say that they are expected to be "very limited."
Normally, we would gain some insight into this exception at a criminal trial when prosecutors try to introduce evidence obtained using the devices without a warrant. Although the policy states that it applies to the use of Stingrays "in furtherance of criminal investigations," there remains the possibility that they will be used as part of intelligence operations not expected to result in a prosecution. If this were the case, the issue might never see the light of day. There may be other ways to interpret this language, and input from readers of this site would be welcome. In any event, one way for the Department to enhance transparency and trust about the matter would be to disclose information about how often the exception is invoked, data that it is required to track under the policy.
Second, the policy doesn't address the use of cell-site simulators by state and local law enforcement agencies. The DOJ Stingray guidance applies when, for example, the FBI uses Stingrays in support of other federal agencies or police departments. But police departments themselves are not in any way constrained by the policy. This is a huge gap because evidence is mounting that police departments around the country (at least 46 at last count) are using Stingrays, generally under a shroud of secrecy and without a warrant. In some cases, police have deliberately hidden Stingray use from courts because of non-disclosure agreements with the FBI. Although the DOJ may be hesitant to affirmatively require police departments to obtain warrants for Stingray use, it can certainly attach some requirements to devices that it provides or finances. For example, it could explicitly forbid the FBI from entering into agreements that purport to prevent police departments from disclosing Stingray use to courts and require police departments to have in place privacy policies and the like prior to providing them with equipment.
Finally, the DOJ should address the issue more comprehensively -- plenty of real-time cell phone tracking is simply not covered by the policy. While there is no firm data, it seems likely that most such tracking takes place through service providers rather than Stingrays, which aren't cheap and require specialized training. Several courts, both federal and state, have required a probable cause warrant for real-time tracking over any substantial period of time. The position is not uniform though. For example, the Sixth Circuit has held that three days of real-time location tracking did not require a warrant, although it too left open the possibility that longer-term tracking might change its analysis. A single rule that meets the constitutional threshold would contribute greatly to clarity in this area of the law. Moreover, technologies other than Stingrays used for location tracking -- such as the recently disclosed devices that passively gather radio waves from cell phones -- are also not covered by the DOJ policy.
The Department is to be congratulated for issuing policy guidance on Stingrays, which have been the subject of much controversy in recent years. But to catch up to public concerns and the courts, it needs a broader approach. Even if the DOJ wants to preserve its position that historical (as opposed to real-time) cell site location information should be regarded as third party records that don't require a warrant, it would surely make sense to have a consistent policy requiring warrants for real time tracking -- whether via Stingrays, some other type of technology, or via service providers.
