Reining in 'cellphone snoops'

The Houston Chronicle published a staff editorial this week ("Cellphone Snoops," March 4) lamenting Houston PD's opacity surrounding their use of international mobile subscriber identity (IMSI) catchers, known by the trade name "Stingray." The article opened, "For about seven years, HPD has been spying on Houstonians by using devices that mimic cellphone towers and trick phones into connecting through them." Moreover:

the whole history of law enforcement using Stingrays has been tarnished by a pattern of secrets and cover-ups. Police departments across the nation have relied on non-disclosure agreements to keep citizens in the dark about what the devices are capable of. Harris County prosecutor Bill Exley told Chronicle reporter Karen Chen that even prosecutors were out of the loop on HPD's Stingray use.

The paper also mentioned the useful fact bite that:

State Supreme Courts in Florida and Massachusetts have required police to seek warrants before engaging in real-time cellphone tracking. Eight states - Illinois, Indiana, Maryland, Minnesota, Tennessee, Utah, Virginia and Wisconsin - have passed laws specifically requiring warrants.

Real-time cell phone tracking probably is the closest analogy to what an IMSI catcher is doing, so I agree it should require a warrant. But the Chronicle repeated a misconception that dogs the Stingray debate - mostly because of misinformation spread by law enforcement - and which deserves correction. Said the editorial, "These briefcase-sized gadgets ... allow officers to look at the metadata on any nearby cellphone - such as whom you call and where you travel - all without needing a warrant."

The "without a warrant" part is accurate. But, while it's technically correct to say the device collects "metadata," it's also incomplete and misleading. A Stingray gathers more than "metadata," a term more applicable to information from phone companies about their customers. Instead, IMSI catchers hijack the phone call entirely, using fraudulent identifiers to convince your device that it's a real, commercial cell phone tower instead of a covert device performing a man-in-the-middle hacking attack. Stingrays don't just collect "metadata," they collect content, similar to an interloper climbing up a pole to listen in on a telegraph line in the 19th century. That's how they work.

Law enforcement claims they do not use Stingrays for wiretapping but that's not because an IMSI catcher cannot perform that function. Some models sold by the vendor, Harris Corporation can tap phones as well as gather "metadata," but non-disclosure agreements prevent anyone - even prosecutors - from knowing whether the model purchased by the City of Houston has that functionality.

Basically, HPD is telling you: Trust us, we're the government. But as Ronald Reagan advised, it's always best to "trust, but verify."

Legislation filed this week by state Senators Craig Estes and Rodney Ellis (SB 942) would require judicial oversight of Stingrays, but treating them as "pen registers" which require a lower standard than a probable-cause warrant ("reasonable suspicion"). Like Rep. Bryan Hughes' HB 2263, Estes' bill would require a search warrant for law enforcement to access personal location data from a third-party cell service provider. Grits expects legislation to be filed in the House suggesting a full-blown Fourth Amendment warrant requirement for Stingray use before the bill filing deadline March 13.

While they're regulating Stingrays, let's hope the Lege formally disallows law enforcement from entering into non-disclosure agreements with vendors regarding use of surveillance equipment. It seems like a no-brainer to me that state open records law should trump such a spurious NDA. But the Attorney General hasn't made them give it up, so - by denying information even to prosecutors - HPD has probably made it necessary to pass a law in order to enforce the law.

RELATED: While we're on the topic, check out the recently upgraded website for the Texas Electronic Privacy Coalition, with which your correspondent is working to pass legislation to require warrants for electronic snooping.