New police tech tracks cell-phone location data without provider intermediary

See an amicus brief (pdf) and press release from the national ACLU and the Electronic Frontier Foundation about yet another cell-phone tracking device used by law enforcement that any new, restrictive Texas legislation filed next year should try to account for: "Stingray" phone surveillance. Here's a description of the new technology from ComputerWorld's Darlene Storm:

Let’s say you have your cell phone with you, even if you are not talking or texting, otherwise minding your own business, innocent of being suspected of any crime . . . but hey your privacy can be invaded as if you have no Fourth Amendment rights at all. A portable device known as an IMSI catcher, also known by the generic term stingray, acts like a fake cell tower and tricks your mobile device into connecting to it even if you are not on a call. It is used for real time location tracking; some can pinpoint you within two meters as well as eavesdrop and capture the contents of your communications. There’s been a stink about them for a little more than a year, but three big privacy and civil liberty groups, the ACLU, EPIC and the EFF have all warned that the secretive devices threaten your rights and that the invasive technology is unconstitutional.

The ACLU/EFF amicus was filed, wrote Storm, in a case out of Arizona, but it turns out a federal magistrate judge in Texas has been recently been plowing the same earth. "Judge Brian Owsley in Texas pushed back against the warrantless use of stingrays, not once but twice, the Wall Street Journal reported." Indeed, the Wall Street Journal has been all over the Stingray story, which (to my knowledge) they broke about a year ago documenting its warrantless use by the FBI. That earlier WSJ story mentioned that the same manufacturer, "holds trademarks registered between 2002 and 2008 on several devices, including the StingRay, StingRay II, AmberJack, KingFish, TriggerFish and LoggerHead." That piqued my interest because the Fort Worth PD not long ago purchased a KingFish system. (Who knows whether other Texas agencies have purchased similar systems or not?)

Anyway, bully for Judge Owsley! Here's a link to his most recent order, and an earlier opinion on the same subject. This week's Wall Street Journal story on his cell-site orders opened, "A judge in Texas is raising questions about whether investigators are giving courts enough details on technological tools that let them get data on all the cellphones in an area, including those of innocent people." The Journal story concluded:

In the Texas cases, Judge Owsley held hearings to determine what devices were being used. Ultimately, he wrote that stingrays and cell tower dumps did not fall within the categories of tools that Congress has said can be used without a warrant.

According to Judge Owsley’s order, the U.S. attorney in the stingray case said the application was based on a standard model approved by the Department of Justice and indicated he would give the judge more examples of law supporting the application. But that memo, Judge Owsley writes, was never provided to the court.

In the end, wrote Judge Owsley, "cell-site data are protected pursuant to the Fourth Amendment from warrantless searches. Thus, the Government could obtain the cell site data only by establishing probable cause pursuant to Rule 41 of the Federal Rules of Criminal Procedure." Orin Kerr said Owsley's opinion "relies primarily on Magistrate Judge Smith’s decision now on appeal before the Fifth Circuit that held that cell-site data is protected under the Fourth Amendment and compelling it therefore requires a warrant."

Two lessons arise for any privacy legislation going forward next spring at the Texas Lege tht may address these issues: 1) the language must be flexible enough to account for rapidly changing technology, and 2) it should echo Judge Owsley's decision to require a warrant, as opposed to a lesser court order based on reasonable suspicion. That latter, weaker standard is what the government would prefer in the federal cases (see the ACLU/EFF amicus for more detail) and what, as I understand it, Texas law requires now for traditional GPS tracking. Technology is outpacing statutory Fourth Amendment protections at a dizzying clip, and nowhere is that more true than with regards to cell/smart phone data.

These cases, either way, are the beginning of a long discussion that will inevitably end up in SCOTUS' lap. Personally, I'd like to see the legislative branch for once, both state and federal, try to get ahead of the curve rather than wait for judges to write the law after the technology has been in use for years.