5 Things We Learned from Erie County’s Stingray Surveillance Ruling
Earlier this month, I wrote about the extraordinary measures undertaken by local, state, and federal law enforcement agencies to keep secret any and all information about “cell-site simulators.” Colloquially known by the brand name Stingray, the device is used by police to track cell phone users—potentially violating the constitutional rights of many innocent bystanders in the process. Since then, several additional lawsuits have been filed by ACLU affiliates across the country that would force police to reveal information about Stingrays.
The most interesting recent development, though, has been in Erie County, New York. Two weeks ago, in Buffalo, State Supreme Court judge Patrick H. NeMoyer ordered the Erie County Sheriff’s Office to comply with a New York Civil Liberties Union (NYCLU) records request for documents related to Stingray use by Erie County police. Erie County is expected to appeal the order, and the documents are not yet available, but Judge NeMoyer’s detailed ruling confirms some of privacy advocates’ suspicions—and provides some key new information—about how cops go about using Stingrays.
1. The FBI would rather let criminals go free than reveal information about Stingrays.
As I discussed with my colleague Barton Gellman, prosecutors in some states have negotiated lesser pleas or dropped charges to avoid disclosing facts about Stingrays in court. But the Erie County ruling confirms what many had suspected: that the FBI explicitly requires local law enforcement to do so. An FBI nondisclosure agreement signed by the Sheriff’s Office—and summarized in NeMoyer’s ruling—directs the department to “seek dismissal of a criminal prosecution . . . in lieu of making any possibly compromising public or even case-related revelations” about Stingrays or their use. Apparently, the federal government’s desire to use Stingrays in secrecy—and without taking the risk of judicial review—trumps its commitment to actually enforcing the law.
Watch the video of Gellman and Adler-Bell discussing illegal Stingray use:
2. Police used a Stingray to track down an 87-year-old man with dementia.
Police departments have repeatedly claimed that Stingrays are critical for national security—both as justification for purchasing them and for maintaining an extreme degree of secrecy surrounding their use. The company that makes them, Florida-based Harris Corporation, told the FCC in 2010 that Stingrays should be reserved for “emergency situations.” But, in practice, law enforcement deploy Stingrays in all kinds of investigations, from tracking down suspected thieves to recovering stolen cell phones. And, in at least one case in Erie County, cops used a Stingray to locate an elderly man with dementia who had gone missing. Helping to find grandpa is, of course, important—and a nice thing for the police to do—but it doesn’t quite qualify as an issue of national security.
The reality is, our nation’s cops are using military-grade technology for everyday police work, while refusing to explain why they need it or why they believe it to be lawful. As John A. Curr III, director of the NYCLU’s Western Regional Office put it, “This is not Iraq or Afghanistan—this is Buffalo. And we have a right to know what the Sheriff is doing to us in the name of keeping us safe.”
3. Police in New York State routinely use Stingrays without obtaining authorization from a judge.
We already knew from disclosures in other states that cops have only sometimes sought court authorization before using Stingray technology. Of the 47 cases identified by Erie County in which Stingrays were used, only one mentions that a court order was obtained “as a predicate for engaging in the cellular tracking.” In most of these cases, then, it’s entirely possible that police tracked their suspect, collecting data on her and those around her, without ever talking to a judge.
What makes this fast-and-loose attitude toward court authorization all the more striking is that FBI Director Jim Comey spent a good chunk of last Wednesday emphasizing to Congress just how committed he and his agency are to getting warrants to access cell phone data. “Our practice is always to get search warrants for devices,” Comey told the House Appropriations Committee, “That makes good sense to me. All our lives are there. It’s no longer just a phone. It’s a suitcase carrying your kids’ pictures, your documents.” He went on:
If I want to look at your phone, without your consent, I will go to a judge, make a showing of probable cause, get a court order, and then if I can get the phone open, look at it.
To be fair to Director Comey, courts apply different standards to the metadata supposedly collected by Stingray devices (that is, calls made and received, location data) and content (that is, text and voice messages, pictures, and so on). To get the former, police only have to prove to a judge that the information sought is “relevant” to an ongoing investigation, whereas the latter requires the higher bar of a probable cause warrant. (State laws and courts disagree at present on the standards that apply to real-time location data collection.)
But, as so often in public statements from law enforcement and intelligence agencies (the FBI is both), Director Comey has a far narrower meaning in mind than most listeners would hear. His principled defense of judicial process is limited to the search of devices themselves and does not apply, it seems, to surreptitious surveillance from a distance.
4. It’s still unclear whether Stingrays are ever used to collect the content of cell phone conversations.
All of the above being said, there is reason to believe that Stingray technology could be used to collect content as well as metadata. Judge NeMoyer’s Erie County ruling states, “The record is not definitive concerning whether cell site simulators in general, and the Stingray or other like products of the Harris Corporation in particular, can be used to monitor the content of cell phone conversations or texts.” The FBI’s own Electronic Surveillance Manual states that cell site simulators “may be capable of intercepting the contents of communications and, therefore, such devices must be configured to disable the interception function,” unless authorized under a probable cause warrant.
Uncertainty about this question—whether or not Stingrays are ever employed by law enforcement to eavesdrop on our conversations—is one of the reasons the excessive secrecy about Stingrays is so objectionable. Police departments maintain that their cell site simulators are not being used for content collection. But in the absence of more substantive disclosures about how, when, and under what authority Stingrays are used, it’s difficult to blindly accept their assertions. In my experience, the equation goes something like this:
new surveillance technology + secrecy – oversight = rights violations
But I welcome the Department of Justice to prove otherwise.
5. Police don’t have legal ground to withhold this stuff from the public.
Finally, and most hopefully, the ruling confirms what privacy advocates have been saying from the beginning: law enforcement agencies have no legal standing to prevent disclosing how, when, and why this technology is being used. As NYCLU staff attorney Mariko Hirose put it, “The court . . . has confirmed that law enforcement cannot hide behind a shroud of secrecy while invading the privacy of those it has sworn to protect and serve.”
5 Things We Learned from Erie County’s Stingray Surveillance Ruling
Earlier this month, I wrote about the extraordinary measures undertaken by local, state, and federal law enforcement agencies to keep secret any and all information about “cell-site simulators.” Colloquially known by the brand name Stingray, the device is used by police to track cell phone users—potentially violating the constitutional rights of many innocent bystanders in the process. Since then, several additional lawsuits have been filed by ACLU affiliates across the country that would force police to reveal information about Stingrays.
The most interesting recent development, though, has been in Erie County, New York. Two weeks ago, in Buffalo, State Supreme Court judge Patrick H. NeMoyer ordered the Erie County Sheriff’s Office to comply with a New York Civil Liberties Union (NYCLU) records request for documents related to Stingray use by Erie County police. Erie County is expected to appeal the order, and the documents are not yet available, but Judge NeMoyer’s detailed ruling confirms some of privacy advocates’ suspicions—and provides some key new information—about how cops go about using Stingrays.
1. The FBI would rather let criminals go free than reveal information about Stingrays.
As I discussed with my colleague Barton Gellman, prosecutors in some states have negotiated lesser pleas or dropped charges to avoid disclosing facts about Stingrays in court. But the Erie County ruling confirms what many had suspected: that the FBI explicitly requires local law enforcement to do so. An FBI nondisclosure agreement signed by the Sheriff’s Office—and summarized in NeMoyer’s ruling—directs the department to “seek dismissal of a criminal prosecution . . . in lieu of making any possibly compromising public or even case-related revelations” about Stingrays or their use. Apparently, the federal government’s desire to use Stingrays in secrecy—and without taking the risk of judicial review—trumps its commitment to actually enforcing the law.
Watch the video of Gellman and Adler-Bell discussing illegal Stingray use:
2. Police used a Stingray to track down an 87-year-old man with dementia.
Police departments have repeatedly claimed that Stingrays are critical for national security—both as justification for purchasing them and for maintaining an extreme degree of secrecy surrounding their use. The company that makes them, Florida-based Harris Corporation, told the FCC in 2010 that Stingrays should be reserved for “emergency situations.” But, in practice, law enforcement deploy Stingrays in all kinds of investigations, from tracking down suspected thieves to recovering stolen cell phones. And, in at least one case in Erie County, cops used a Stingray to locate an elderly man with dementia who had gone missing. Helping to find grandpa is, of course, important—and a nice thing for the police to do—but it doesn’t quite qualify as an issue of national security.
The reality is, our nation’s cops are using military-grade technology for everyday police work, while refusing to explain why they need it or why they believe it to be lawful. As John A. Curr III, director of the NYCLU’s Western Regional Office put it, “This is not Iraq or Afghanistan—this is Buffalo. And we have a right to know what the Sheriff is doing to us in the name of keeping us safe.”
3. Police in New York State routinely use Stingrays without obtaining authorization from a judge.
We already knew from disclosures in other states that cops have only sometimes sought court authorization before using Stingray technology. Of the 47 cases identified by Erie County in which Stingrays were used, only one mentions that a court order was obtained “as a predicate for engaging in the cellular tracking.” In most of these cases, then, it’s entirely possible that police tracked their suspect, collecting data on her and those around her, without ever talking to a judge.
What makes this fast-and-loose attitude toward court authorization all the more striking is that FBI Director Jim Comey spent a good chunk of last Wednesday emphasizing to Congress just how committed he and his agency are to getting warrants to access cell phone data. “Our practice is always to get search warrants for devices,” Comey told the House Appropriations Committee, “That makes good sense to me. All our lives are there. It’s no longer just a phone. It’s a suitcase carrying your kids’ pictures, your documents.” He went on:
To be fair to Director Comey, courts apply different standards to the metadata supposedly collected by Stingray devices (that is, calls made and received, location data) and content (that is, text and voice messages, pictures, and so on). To get the former, police only have to prove to a judge that the information sought is “relevant” to an ongoing investigation, whereas the latter requires the higher bar of a probable cause warrant. (State laws and courts disagree at present on the standards that apply to real-time location data collection.)
But, as so often in public statements from law enforcement and intelligence agencies (the FBI is both), Director Comey has a far narrower meaning in mind than most listeners would hear. His principled defense of judicial process is limited to the search of devices themselves and does not apply, it seems, to surreptitious surveillance from a distance.
4. It’s still unclear whether Stingrays are ever used to collect the content of cell phone conversations.
All of the above being said, there is reason to believe that Stingray technology could be used to collect content as well as metadata. Judge NeMoyer’s Erie County ruling states, “The record is not definitive concerning whether cell site simulators in general, and the Stingray or other like products of the Harris Corporation in particular, can be used to monitor the content of cell phone conversations or texts.” The FBI’s own Electronic Surveillance Manual states that cell site simulators “may be capable of intercepting the contents of communications and, therefore, such devices must be configured to disable the interception function,” unless authorized under a probable cause warrant.
Uncertainty about this question—whether or not Stingrays are ever employed by law enforcement to eavesdrop on our conversations—is one of the reasons the excessive secrecy about Stingrays is so objectionable. Police departments maintain that their cell site simulators are not being used for content collection. But in the absence of more substantive disclosures about how, when, and under what authority Stingrays are used, it’s difficult to blindly accept their assertions. In my experience, the equation goes something like this:
But I welcome the Department of Justice to prove otherwise.
5. Police don’t have legal ground to withhold this stuff from the public.
Finally, and most hopefully, the ruling confirms what privacy advocates have been saying from the beginning: law enforcement agencies have no legal standing to prevent disclosing how, when, and why this technology is being used. As NYCLU staff attorney Mariko Hirose put it, “The court . . . has confirmed that law enforcement cannot hide behind a shroud of secrecy while invading the privacy of those it has sworn to protect and serve.”