Why Police Should Be Required to Get a Warrant to Use Cell-Site-Simulators (aka, "stingrays")

Legislation heard this week in the Texas House Criminal Jurisprudence Committee, HB 352 (Blanco) would require warrants for Texas law enforcement to use so-called “stingrays” or “cell-site simulators” to track people's cell phones, and provide more transparency surrounding use of these devices.

So-called “Stingrays” or cell-site simulators are examples of relatively new surveillance techniques hovering at the bleeding edge of both cell-phone technology and Fourth Amendment jurisprudence. Because their use has been largely shrouded in secrecy and few clear precedents exist to model limits on this tech, the handful of law-enforcement agencies using it have until now operated in virtually a regulation-free zone.

Rep. Cesar Blanco, a third-term Democrat and former Navy intelligence office, understands signals intelligence better than probably any other legislator and is an excellent bill sponsor for this topic.

How Cell-Site Simulators Work
Cell-site simulators work by tricking your cell phone into believing it’s attaching to a legitimate cell-phone tower, which it “pings” periodically to make sure the phone is ready to make a call. This means that, when targeted users (or others in their vicinity) make a phone call, it’s routed through the cell-site simulator instead of the nearest tower. Representations by Houston PD at Monday’s hearing about the limited nature of the technology understated its capacity.

Cell-site simulators hijack and divert cell-phone signals from their commercial carrier’s network, making it more similar to a wiretap than a “pen register.” Some models of cell-site simulators allow full-blown wiretapping; others provide access to metadata from calls and callers; others may only provide information on signal strength and direction, allowing investigators to triangulate location with just a few measurements. It all depends on how much functionality an agency chose to pay for; the device is capturing the entire signal and can let investigators access any or all of it.

Movement toward ‘stingray’ warrant requirement
The US Supreme Court has not yet ruled on so-called “stingrays,” but several states already require warrants for cell-site simulator use with no ill effects. (Virginia, Washington, Utah, Minnesota, and California.)

On December 19, 2016, the U.S. House Committee on Oversight and Government Reform issued a comprehensive, bipartisan report on law-enforcement use of cell-site simulators and recommended legislation that would require “probable cause based warrants” to “ensure that the use of cell-site simulators and other similar tools does not infringe on the rights guaranteed in the Constitution.”

The US Department of Homeland Security established a policy of seeking a warrant for use of cell-site simulator technology with limited exceptions for exigent circumstances.

Finally, civil libertarians have persuasively argued that, when a cell phone inside someone’s home is targeted with signal interception via a cell-site-simulator device, it per se violates the Fourth Amendment right to security from unreasonable searches of one’s “houses, papers and effects.” (Traditionally, Fourth-Amendment protections inside the home have been much stronger than elsewhere.)

Secrecy breeds mistrust
At Monday’s hearing, police expressed fears that innocent people might be hurt if information from search warrant affidavits about how and when police used the technology ever surfaced. But search-warrant affidavits have been public records since the dawn of the Republic. The more significant concern is that law enforcement will use the technology unaccountably and secrecy will protect them.

Not only does the public deserve to know when the government is using invasive surveillance technology, undue secrecy creates systemic problems. In Houston, police have even kept prosecutors in the dark when stingray tech was used.

Texas legislators should extend the same warrant requirement mandated by the Supreme Court in US v. Carpenter to cell-site simulator devices. This shadowy practice has flourished for too long on the edges of modern technology and privacy law. HB 352 is Texas’ opportunity to begin to restrain and regulate it.

See prior, related Grits coverage.

Carpenter codification non-controversial so far

Rep. Cesar Blanco also filed a related piece of legislation, HB 353, which essentially codifies the US Supreme Court case US v. Carpenter requiring a search warrant for the government to access cell-phone location data held by wireless cell-phone carriers. (Readers may recall Grits' poetic ode to the case after the oral arguments.)

Unlike the stingray legislation, no one opposed this bill. There was a half-hearted effort by a cop speaking "on" the legislation to preserve the real-time vs. historic location information distinction that the Texas Court of Criminal Appeals tried to stake out in Sims v. Texas. But it's awfully hard to defend the idea that the government has a right to know where you are at any given time, in real time, without demonstrating probable cause. From the solitude of Judge Barbara Hervey's chambers at the Court of Criminal Appeals, one perhaps can make that strained argument without fear of recrimination. At a legislative hearing, nobody even tried. 

The reality is, even if they tried to do a Less-Than Carpenter Codification, this area of constitutional law is fluid and trending toward requiring more warrants for surveillance, not less. As such, Grits imagines that trying to short-change the warrant requirement could result in future federal court decisions rendering the language anachronistic. Rep. Blanco's approach is the wiser one.

As DRT-boxes track Texans from planes, considering options for restricting government cell-phone surveillance

The Texas National Guard is using so-called IMSI catchers, aka "Stingrays" or "DRT-boxes (read: Dirt Boxes, which are IMSI catchers attached to airplanes or drones), which are fake cell towers used to trick your phone into routing its call through government surveillance technology instead of your carrier. See an excellent article by Melissa del Bosque, with one caveat. She quoted Austin attorney Scott McCollough declaring:

“These DRT boxes are far more capable than the old Stingrays,” McCollough said, “The old-style Stingrays were not able to capture content. Guess what? The DRT box is. … These newer ones get everything.”

McCollough knows more than most about the law surrounding cell phone surveillance (some of his clients are small cell-phone companies which must comply with law enforcement requests for customer data). But he's wrong about the tech. The old Stingrays also gathered content, by definition, since the entire call including content is routed through the Stingray, bypassing commercial cell phone towers. And as of 2013, they were already selling an "interception model" of the Stingray for which gathering content was an option.

For several years, your correspondent was part of a coalition which, for a couple of sessions, made a big push at the Texas Legislature to require warrants for the government to gather people's cell-phone location data, which implicates how the Stingrays/DRT boxes are used. But despite more than 2/3 of the Texas House signing onto the bill, it couldn't clear the senate. So we dropped that bill in 2017, though the rise of a new Speaker could reinvigorate the effort in 2019. (Who knows, maybe one of the past supporters will become Speaker next. Most of them were supporters.)

Alternatively, the US Supreme Court is about to hear a case dubbed Carpenter which could end up deciding that warrants should be required for the government to gather and use personal cell-phone location data, which could moot the legislative push for a warrant.

Regardless, use of this tech has expanded beyond the capacity of existing constitutional and legislative structures to restrain it. Whether such restraints come from the judiciary or legislative sources, or more likely both, to me matters little. Folks like Orin Kerr who insist that only legislation is an appropriate solution are IMO disingenuously using the distinction to argue for doing nothing. In this situation, a vacuum of authority is what allowed the government to use these emerging technologies to track average Americans in the first place. Both branches  - legislatures and the judiciary - have a role to play in in preserving Fourth Amendment rights and updating their interpretation to match 21st century realities. It's not enough to protect our "papers" anymore, the cell-phone era exposes much more data about us than just what we write down.

The fact that, in light of that vacuum, the executive branch will use surveillance technology not forbidden to it shouldn't surprise anyone. Texas had a chance to restrict this sort of surveillance tech and didn't do it. So government surveillance is what we get, until one or both of the other two branches step up to stop it.

Forensic fails, and other stories

As your correspondent prepares for today's Exoneration Commission hearing, here are a number of items which likely won't make it into individual blog posts but which merit Grits readers' attention:

No clear way to track down junky bite-mark cases
The Dallas News has a high-powered team - Brandi Grissom and Jennifer Emily - covering the Steven Chaney bite mark case and the Forensic Science Commission review of bite mark cases. They reported Monday that "Tracking down dozens — maybe hundreds — of other potentially innocent victims of junk science won’t be ... easy. There is no central repository of cases in which bite-mark testimony was key. There’s no database of dentists who testified about bite marks. And the cases are mostly decades old, and experts, defense lawyers and prosecutors have moved on or died."

Bad Ballistics?
The Texas Court of Criminal Appeals ordered an examination into overstated ballistics testimony from an expert in Arthur Brown, Jr.'s 22-year old capital murder trial, in which he was prosecuted along with an already-executed accomplice for a quadruple killing in a botched drug transaction. Reported the Houston Chronicle:

Brown was scheduled for execution in October 2013 but received a stay to allow for forensic testing of evidence. An accomplice, Marion Dudley, 33, was executed in 2006.

On Wednesday, the appeals court judges acted on Brown's November 2014 appeal in which he asserted that Houston Police Department ballistics expert C.E. Anderson "testified falsely or in a materially misleading manner" in his case. Judges held that the claim met state standards warranting review.

See the court's order.

Paging Antonin Scalia: On the right to confront the boss of your accuser
The Court of Criminal Appeals also ruled that the requirements of the Sixth Amendment's "Confrontation Clause" may be met for "batch DNA testing" by a crime lab supervisor testifying based on computer printouts instead of the lab workers who conducted the analysis. Judge David Newell is of course correct that neither the CCA nor SCOTUS have ever "squarely answered this question." SCOTUS said that sworn affidavits are insufficient, but not whether a supervisor can testify based on the work of her subordinates. But one certainly wonders what Antonin Scalia might say about it. It's hard for this non-attorney to understand why relying on data generated by non-testifying lab analysts is different from relying on an affidavit to which they did not testify.

Are black-box calculations problematic for DNA mixtures?
Next year, the Department of Public Safety and most other Texas labs will shift to "probabilistic genotyping" to analyze DNA mixture evidence, a method which supposedly is superior even to the adjusted calculations which are currently available. However, that method relies on proprietary programs with black-box systems for which the makers will not release their code, similar to the situation surrounding proprietary breathalyzer algorithms which accuse defendants based on computer code which their attorneys and the court cannot see nor evaluate. See good discussions of the topic from Slate and Ars Technica. Moreover, as Grits reported earlier, because of the nature of the calculations, results based on probabilistic genotyping will be different every time - they're not replicable, in addition to not being transparent. So, while the fact that the DWI equipment is still in use makes me think Texas courts would ultimately find a way to allow this sort of proprietary opacity, Grits continues to wonder if probabilistic genotyping is the best tool for the job when it comes to providing courtroom testimony, given that there are other methods available where the calculations are both transparent and replicable.

Finding housing with a felony record
There's a good article in the Houston Chronicle on the struggles poor people have renting an apartment with a felony record. Houston is closing a dangerous low-income apartment run by a slumlord who they've sued over "atrocious living conditions." Reporter Emma Henchliffe decided to pay attention to what happened to the ousted tenants, finding that the ones with a felony record had a terrible time locating new places that would take them. "Individual owners have the right to accept and reject applications as they choose, but the lack of alternatives for tenants who do not meet owners' standards causes many former offenders to end up at places like Crestmont," she wrote. "Some apartments where [one tenant] applied took her application fee and never got back to her." When you consider the volume of felons Texas produces - we release more than 70,000 prisoners from TDCJ every year - this is a much more important issue than one would think from the amount of coverage it receives. I was glad to see this article.

No surprise: 'Stingrays' really do intercept content
Turns out, contrary to public assertions by law enforcement, Stingrays are indeed able to intercept calls as well as cell-phone metadata, it's now been proven. This was obvious to anyone who thought about it: The devices trick your phone into routing through a fake cell phone tower; clearly they were intercepting the whole call, not just metadata. And experts have been telling us this for a while. Still, nice to see it confirmed, it's one less thing to argue about.

NOTE: A brief item about a murder case in Denton was removed from this roundup after a commenter informed me that the underlying news article improperly attributed a court action to DNA mixture protocols when the real issue was unrelated. Grits apologizes for the error and will perhaps revisit the topic when more accurate information is available.

Will Houston PD, DPS begin getting warrants for Stingray use now that feds require one?

Now that the US Justice Department and the Department of Homeland Security have begun requiring agents to obtain search warrants to use "Stingray" surveillance devices (fake-cell phone towers operated by police which trick your phone into routing calls through it), will Houston PD, Fort Worth PD, Texas DPS, and other Texas agencies we don't know about who own those devices start getting warrants, too?

Houston PD doesn't even tell local prosecutors when they use the device, much less seek warrants from a judge. But that approach now diverges significantly from federal practice. Can it be sustained?

The Texas Legislature this year failed to pass legislation by Rep. Duane Bohac and Sen. Craig Estes which would have installed a warrant requirement in state law. But there's an argument the Fourth Amendment to the US Constitution requires a warrant, anyway. So, with the feds backpedaling on the question in the face of numerous court challenges, Texas agencies should probably start seeking warrants, too, or else risk a federal benchslapping down the line.

Bar alleges DA misconduct in Willingham case, bad closed-records bill, auditing forfeitures, testing for steroids, diligent participation credits (federal and state) and other stories

Here are a few odds and ends that deserve readers' attention but didn't make it into individual posts during a busy week:

State bar accuses Willingham prosecutor of misconduct
Reported the Marshall Project, "the State Bar of Texas has filed a formal accusation of misconduct against the county prosecutor who convicted Cameron Todd Willingham, a Texas man executed in 2004 for the arson murder of his three young daughters." The bar "accuses [former Navarro County DA John] Jackson of having intervened repeatedly to help a jailhouse informant, Johnny E. Webb, in return for his testimony that Willingham confessed the murders to him while they were both jailed in Corsicana." From the bar complaint: "Before, during, and after the 1992 trial, [Jackson] knew of the existence of evidence that tended to negate the guilt of Willingham and failed to disclose that evidence to defense counsel. Specifically, [he] failed to make timely disclosure to the defense details of an agreement for favorable treatment for Webb, an inmate, in exchange for Webb's testimony at trial for the State."

SA4 case headed toward denouement
Again from the Marshall Project, a review of the San Antonio Four case and the difficulty of evaluating the veracity of child accusers who recant. Wrote Maurice Chammah, the SA4 cases "fall into an increasingly visible category of prisoners who have been freed due to evidence of a wrongful conviction but have not been formally declared 'innocent' by courts." This was also a case where Texas' new junk science writ came into play.

Making state employees DOB secret invites unchecked corruption
State Rep. Cindy Burkett has filed legislation to disallow people from accessing state employees birth dates under open records requests, the Dallas News reported, but this is a terrible idea that would dramatically reduce accountability in state government. As a practical matter, for an investigative reporter, a campaign opposition researcher, private investigators, citizen activists, or any independent fact finder investigating state government, date of birth is the main way one can viably distinguish individuals, especially if they have common names. (Is "Randy Jones" from the signature line of a state contract the same person as "Randall Jones" who seems to have received favorable terms on a land deal with the same company? You need a DOB to tell.) Remove that tool and much of the old-school paper trail work involving public information requests and courthouse records becomes nigh-on impossible. I understand the privacy-based impetus behind this bill, but it's profoundly misguided.

State auditor reviewing Dallas DA forfeiture expenditures
The State Auditor is investigating the asset forfeiture funds of former Dallas DA Craig Watkins following allegations that he improperly used the account to settle a civil suit over a car wreck he caused which included a gag order. The auditor's report is expected in May, reported the Dallas News.

Prison riot spurs busted contract
The feds are ending a contract with the South Texas prison where immigration detainees recently rioted, reported the Houston Chronicle. See more from Texas Prison Bidness.

State to stop steroid testing HS athletes, still no mandate to test cops
I've never understood why Texas chose to test high school athletes for steroids - despite little evidence there's a big problem with their use at that level - but never chose to test police officers, for whom there's ample evidence of significant steroid use. (To their credit, a few departments including Dallas and Arlington PD have begun testing on their own.) The state is finally going to ditch testing for high school athletes; I still think they'd expose a lot more problems by spending a fraction of that money testing police officers.

Cornyn backs aggressive sentence reductions for program participation, will Texas?
See an update on federal sentencing reforms being pushed by Texas Sen. John Cornyn. Under his bill, "Medium and low risk prisoners could earn a 25 percent sentence reduction or transfer to a halfway house or home confinement through completion of programs." That's slightly more generous, even, than the (up to) 20 percent sentence reduction which would be available to state jail felons for "diligent participation" in programming under SB 589 by Sen. Jose Rodriguez, which was heard on Wednesday in the Senate Criminal Justice Committee. Perhaps Sen. Cornyn endorsing an even more aggressive version of the same idea will help Mr. Rodriguez's cause.

Stingrays and non-disclosure agreements
The New York Times this week ran a feature on the worrisome requirement that local police departments which by "StingRays" and other surveillance devices from the Harris Corporation must file non-disclosure agreements which they claim trump open records laws or, in the case of Houston PD, even a duty to disclose to prosecutors how they use the devices. These issues will soon be prominently raised in Texas as Dwayne Bohac's HB 3165, which would require law enforcement to get a warrant to target an individual's phone using the device. His bill also trumps these sorts of NDAs, making information about Stingrays subject to the usual provisions of the Public Information Act.

How jailhouse snitch testimony can 'backfire,' even with corroboration
Vice.com has a thoughtful discussion of problems with overuse jailhouse informants, even in states like California which require corroboration of their testimony (a provision, writer Kevin Munger could have added, which Texas passed two years before the Golden State).

Reining in 'cellphone snoops'

The Houston Chronicle published a staff editorial this week ("Cellphone Snoops," March 4) lamenting Houston PD's opacity surrounding their use of international mobile subscriber identity (IMSI) catchers, known by the trade name "Stingray." The article opened, "For about seven years, HPD has been spying on Houstonians by using devices that mimic cellphone towers and trick phones into connecting through them." Moreover:

the whole history of law enforcement using Stingrays has been tarnished by a pattern of secrets and cover-ups. Police departments across the nation have relied on non-disclosure agreements to keep citizens in the dark about what the devices are capable of. Harris County prosecutor Bill Exley told Chronicle reporter Karen Chen that even prosecutors were out of the loop on HPD's Stingray use.

The paper also mentioned the useful fact bite that:

State Supreme Courts in Florida and Massachusetts have required police to seek warrants before engaging in real-time cellphone tracking. Eight states - Illinois, Indiana, Maryland, Minnesota, Tennessee, Utah, Virginia and Wisconsin - have passed laws specifically requiring warrants.

Real-time cell phone tracking probably is the closest analogy to what an IMSI catcher is doing, so I agree it should require a warrant. But the Chronicle repeated a misconception that dogs the Stingray debate - mostly because of misinformation spread by law enforcement - and which deserves correction. Said the editorial, "These briefcase-sized gadgets ... allow officers to look at the metadata on any nearby cellphone - such as whom you call and where you travel - all without needing a warrant."

The "without a warrant" part is accurate. But, while it's technically correct to say the device collects "metadata," it's also incomplete and misleading. A Stingray gathers more than "metadata," a term more applicable to information from phone companies about their customers. Instead, IMSI catchers hijack the phone call entirely, using fraudulent identifiers to convince your device that it's a real, commercial cell phone tower instead of a covert device performing a man-in-the-middle hacking attack. Stingrays don't just collect "metadata," they collect content, similar to an interloper climbing up a pole to listen in on a telegraph line in the 19th century. That's how they work.

Law enforcement claims they do not use Stingrays for wiretapping but that's not because an IMSI catcher cannot perform that function. Some models sold by the vendor, Harris Corporation can tap phones as well as gather "metadata," but non-disclosure agreements prevent anyone - even prosecutors - from knowing whether the model purchased by the City of Houston has that functionality.

Basically, HPD is telling you: Trust us, we're the government. But as Ronald Reagan advised, it's always best to "trust, but verify."

Legislation filed this week by state Senators Craig Estes and Rodney Ellis (SB 942) would require judicial oversight of Stingrays, but treating them as "pen registers" which require a lower standard than a probable-cause warrant ("reasonable suspicion"). Like Rep. Bryan Hughes' HB 2263, Estes' bill would require a search warrant for law enforcement to access personal location data from a third-party cell service provider. Grits expects legislation to be filed in the House suggesting a full-blown Fourth Amendment warrant requirement for Stingray use before the bill filing deadline March 13.

While they're regulating Stingrays, let's hope the Lege formally disallows law enforcement from entering into non-disclosure agreements with vendors regarding use of surveillance equipment. It seems like a no-brainer to me that state open records law should trump such a spurious NDA. But the Attorney General hasn't made them give it up, so - by denying information even to prosecutors - HPD has probably made it necessary to pass a law in order to enforce the law.

RELATED: While we're on the topic, check out the recently upgraded website for the Texas Electronic Privacy Coalition, with which your correspondent is working to pass legislation to require warrants for electronic snooping.

Houston PD conceals Stingray use details from prosecutors, citing NDA; warrant for cell-phone location data bill filed

"For about seven years, the Houston Police Department has owned devices that can trick your cellphone into sharing its location and call log by pretending to be a cell tower," reported Karen Chen at the Houston Chronicle (Feb. 27).

But little is known about how they are deployed, only what they are capable of: telling law enforcement where you are and to whom you've been talking.

In Texas, police are not required to obtain a warrant before using a Stingray, and the net is indiscriminate. The devices sweep up all nearby information, regardless of whether the cellphone is involved in a crime.

Your correspondent was quoted briefly in the story. The most interesting news was something told to me several weeks ago by the Harris DA's office, but made public in this story for the first time: That the Houston PD refuses to tell even the District Attorney's office, much less local judges, what they're doing with this technology, citing a non-disclosure agreement with the Harris Corporation which makes the device. 

Harris County prosecutor Bill Exley said the arrangement doesn't put people's minds at ease. As far as he is aware, Stingrays do not amount to wiretaps, which reveal the content of what's being communicated. That said, Exley said, the nondisclosure agreement has prevented him, too, from knowing what exactly Stingrays are capable of or being used for. He said he has never offered evidence in court that was produced by a Stingray.

HPD has told him that Stingrays are most useful in catching fugitives.

"If there's a warrant for your arrest, the cops should be able to do anything lawful to find you," Exley said. "The question becomes, at what level do you start requiring police officers to ask judges so they can do things they are otherwise legally able to do?"

Exley said as far as he knows the Stingrays aren't wiretapping. But the truth is, the Stingray captures private calls and routes them through a fake cell phone tower operated by the police, and that includes call content as well as metadata. So we have nothing but HPD's say so to support the assertion that they're not accessing content, it's not because the technology they have isn't capable of doing so. If "trust us, we're the government" is good enough for you, you ought to be okay with this.

In Florida, where much more has been made public about how law enforcement uses these devices, "agencies have been using stingrays thousands of times since at least 2007 to investigate crimes as small as a 911 hangup." For example, "A third of the listed stingray cases, in a list provided by the Tallahassee Police Department (TPD), show that the most frequently cited crimes were robbery, burglary, and theft." Most uses did not involve a warrant. The open records gurus at Muckrock.com have been tracking this topic: check out their latest missive, including examples from the NDAs between Harris Corp and local police departments. (This has garnered them fans at the FBI.)

In related news, State Rep. Bryan Hughes yesterday filed HB 2263 - a reprise of his HB 1608 last session which garnered 107 joint and coauthors in the House - which would require warrants for law enforcement to access cell phone location data, and there is interest (including among law enforcement interests) in potentially amending the bill language to include Stingrays (a trade name, the technical term is "IMSI catchers") before everything is said and done.

There's nothing wrong with law enforcement using the latest available technology, where appropriate, but there's also nothing wrong with judges exercising oversight over its use to ensure that new technological advances don't unwittingly dissolve old constitutional protections.

Roundup: Of drones, drugs, and DA elections

Here are several items that merit Grits readers attention but haven't made it into individual posts:

Craig Watkins' fumbling Dallas DA campaign
Grits mentioned earlier that the Dallas, Harris and Bexar County DA's races interested me as potentially close, competitive toss-up races, in Bexar because a single donor dropped $600K on the Democratic challenger. In Dallas, where I'd already thought the race would be close, Gromer Jeffers at the Dallas News reported that challenger Susan Hawk has out-fundraised Craig Watkins roughly 5-1 and is running TV ads, which are "a rarity for a countywide race, and will be following up with direct mail and other contacts to nudge voters to go to the polls. She’s actively trying to peel Democratic voters away from the incumbent." Meanwhile, Watkins team "lacks a professional campaign manager and field director, perhaps because there is no money to pay them." In 2010, Watkins raised $750K and won by about 5,000 votes. He appears more vulnerable now and I wouldn't be surprised to see Hawk upset the favored incumbent.

Corrupt cop escorted drug loads in Houston
A former Houston police officer, Marcos Carrion, pled guilty to escorting drug shipments through town on behalf of a drug cartel, the Houston Chronicle reported. See an FBI press release and the plea agreement.

Montgomery Sheriff will drone again
The Montgomery County Sheriff's Office will replace the quarter-million dollar drone they sank in Lake Conroe with insurance money. This was the second time they'd crashed the thing in as many years.

Listen to Texas Tribune crimjust panels
I'd neglected to link to the Texas Tribune's online postings of two criminal justice related panels at their recent festival on criminal justice reform and the death penalty (because we don't talk about that enough!). Go here to listen.

5th Circuit Judge: Innocents executed analogous to collateral damage from drone strikes
A complaint against 5th Circuit Court of Appeals Judge Edith Jones for alleged has been dismissed by her fellow 5th D.C. Circuit jurists, which doesn't seem like the most impartial group to evaluate the challenge to one of their peers. Reported the Houston Chronicle:

the dismissal order released this week says Jones herself admitted to describing mental disability as a "red herring" in death penalty appeals, though it is a defense approved by the U.S. Supreme Court.

She admitted she used an analogy to drone strikes in rebuttal to the argument "that the death penalty kills innocents."

She agreed she'd said something about how Mexican nationals might prefer American death row to prison in their own country, even though Mexico does not have capital punishment, and that she said both blacks and Hispanics sadly "seem to commit more heinous crimes."

But none of those comments were considered misconduct by the investigating judges.

Private foundations fund police surveillance tech
Police departments are looking to private foundations to pay for Stingray surveillance devices and other equipment they don't want to have to justify through the formal budgeting process, reported ProPublica. 

Feds force cops to mislead re: fake cell phone towers

The Washington Post published a remarkable and disturbing story (Sept. 23) revealing that not just the Harris Corporation but the FBI required local police using IMSI catchers (or "stingrays") to monitor cell phone traffic to sign non-disclosure agreements (NDAs) about their use. The article opened:

The FBI requires state and local police to keep quiet about the capabilities of a controversial type of surveillance gear that allows law enforcement to eavesdrop on cellphone calls and track individual people based on the signals emitted by their mobile devices, according to a bureau document released recently under a Freedom of Information Act request.

The December 2012 document is a heavily redacted letter between the FBI and police in Tacoma, Wash., as the local department sought to acquire an IMSI catcher, sometimes described as a “fake cellphone tower” because it tricks individual phones into routing their calls and other data through the surveillance equipment. The Tacoma police were buying gear produced by Harris Corp., a Florida-based company that makes the StingRay and other IMSI catchers used by law enforcement agencies across the country.

The FBI letter, which was not classified but was designated as "law enforcement sensitive," told the Tacoma police chief that the Federal Communications Commission authorizes the sale of such surveillance equipment to state and local police departments on the condition that they first sign an FBI “non-disclosure agreement.”

The details of the agreement are redacted from the letter as released; the blacked-out portions stretch across the bulk of a six-page document, which was first published on Monday by MuckRock, a news site that helps journalists, researchers and others submit Freedom of Information Act requests and publishes the results.

It had earlier been reported that the manufacturer of the device, the Harris Corporation, required its customers to sign nondisclosure agreements. But now we discover the feds have one, too - one that's apparently required by the FCC according to the letter Muckrock uncovered, though apparently not in its public rules. The Associated Press had written earlier (June 12) about the feds' attempts to conceal information about stingray use by local police, including a detail that foreshadowed this recent news:

Harris Corp., a key manufacturer of this equipment, built a secrecy element into its authorization agreement with the Federal Communications Commission in 2011. That authorization has an unusual requirement: that local law enforcement "coordinate with the FBI the acquisition and use of the equipment." Companies like Harris need FCC authorization in order to sell wireless equipment that could interfere with radio frequencies.

A spokesman from Harris Corp. said the company will not discuss its products for the Defense Department and law enforcement agencies, although public filings showed government sales of communications systems such as the Stingray accounted for nearly one-third of its $5 billion in revenue. "As a government contractor, our solutions are regulated and their use is restricted," spokesman Jim Burke said.

To judge from that account, the NDA requirement stems from an "authorization agreement" with the FCC rather than a formal public rule. (A report from the Daily Caller alleged that the Harris Corporation misled the FCC, claiming the tech would only be used in "emergency situations" as opposed to routine investigations.) But the document discovered by Muckrock is the first we've learned of NDAs between the police and the FBI. It seemed grotesque when it was thought the Harris Corp. was requiring the NDAs. Now we know that the Department of Justice is not just complicit in that deceit but a formal party to the contract. And the FCC, instead of requiring phone companies to fix security vulnerabilities, are licensing private companies to exploit them for profit.

Indeed, it appears federal agencies actively encouraged local law enforcement to lie when they find evidence using the technology, claiming the information came from an informant. Again from the Post:

E-mails collected through a separate Freedom of Information Act request, by the ACLU, showed in June that the U.S. Marshals Service had asked police in Florida to not reveal that they had used IMSI catchers in determining the locations of criminal suspects. Instead, the police were instructed to say that they had learned the whereabouts of suspects using “a confidential source.”

Has the US Marshals Service never heard of Brady v. Maryland?

I wonder, given passage of the Michael Morton Act, with its pro-active requirement to disclose inculpatory as well as exculpatory evidence, whether Texas police are following the feds' advice and lying in official documents when they use these devices?  One would hope not, but then one would also hope the cops would have better sense than to sign a non-disclosure agreement that contradicts with state open records law. (We know the Fort Worth and Houston PDs own IMSI catchers, and probably DPS: Likely other agencies in Texas own them, too.)

Either way, it's no wonder there hasn't been a wider public outcry about the use of such spy tech without warrants nor public disclosure: The government has gone to tremendous lengths to conceal these activities.

Tim Cole statue unveiled in Lubbock, and other stories

Here are a few items from the last week that may interest Grits readers but which lost out in the competition for time with my paid work:

Tim Cole memorialized by VIPs at statue unveiling
Lubbock this week unveiled a 13-foot tall statue of Timothy Cole, who was falsely convicted of rape in that county and died in prison before his innocence could be proven. Lots of VIPs there, including Gov. Perry and both the Democratic and Republican nominees to succeed him. See CNN's coverage, AP, and the Lubbock Avalanche-Journal. Perhaps the best way politicians could honor Timothy Cole next session would be to pass the final, unfinished recommendation from the Timothy Cole Advisory Panel: Requiring police to record custodial interrogations for serious offenses.

Texas Association of Business goes 'Smart on Crime'
A left-right "Smart on Crime" coalition formally announced this week including the Texas Public Policy Foundation, my part-time employers at the Texas Criminal Justice Coalition, the Texas Association of Business, and Goodwill Industries. The big news here really is the Texas Association of Business stepping up to the plate more seriously on the subject. Their interests are mainly in continuing adequate supply in the labor market, but at this moment in history that aligns their interests with less-government reformers on the left and right who think limited state resources should be spent on more productive endeavors than incarceration.

Abuses reveal Houston cops' mercenary view of ticket writing
Prosecutors in Houston will dismiss hundreds of Class C charges, reported the Houston Chronicle (Sept. 18), because four police officers lied on the tickets, claiming their colleagues were present at the stop so they could cheat on their overtime records. The four officers were recently "relieved of duty" and are "being investigated for criminal conduct." One frequently hear politicians claim the purpose of ticket writing is to enforce the law, not generate revenue.  But for these cops it was about generating revenue: overtime, for themselves.

Harris DA candidates: End key-man system of grand jury selection
Both R and D District Attorney candidates in Harris County believe the key man system of selecting grand juries should be eliminated, reported HouChron columnist Lisa Falkenberg (Sept. 18). So do I. Problem is, judges make those appointments and nobody can tell them what to do but the Legislature. So if you want to change how grand juries are picked, the candidates might be running for the wrong office. I'm old fashioned that way, but I'd prefer the candidates debate stuff that's actually part of the DA's job.

The Driver Responsibility surcharge is still a catastrophe
The Texas Observer's Forrest Wilder has a column decrying Texas' Driver Responsibility surcharge; nothing regular Grits readers haven't heard before but he outlines the problem well and expresses the appropriate level of outrage at one of the most dysfunctional programs in all of state government.

Who is operating fake cell phone towers in Texas, US?
Popular Science wondered, "Who is running the phony cell-phone towers around the US?" (Sept. 15). Like me, they think it's probably cops and spooks. See prior Grits coverage.

Making slime
Off topic, but this was a lot of fun to do with the granddaughter this morning. A big hit. Eight year olds love to make slime.

Cops, prosecutors, raise white flag, vow to fight on warrants for cell-phone location data

I only saw two news outlets covering electronic privacy debates at the Texas Senate State Affairs Committee meeting yesterday:

• Dallas Observer: Texas cops are going to fight like hell against cell phone privacy protections
• Austin American Statesman: Balancing privacy, police needs tricky, Senate panel hears

The meeting was led by new Chairman Craig Estes who last session sponsored legislation to require a warrant for cell phone location data. See my own written testimony to the committee on behalf of the Texas Electronic Privacy Coalition. The key TXEPC recommendations, fleshed out in greater detail in the full written testimony, included themes familiar to Grits readers.:

• Require law enforcement to obtain a search warrant to obtain historic cell-phone location data.
• Require a warrant to install GPS tracking devices on vehicles.
• Centralize use of 'stingrays,' aka, IMSI catchers at DPS the way the state does wiretaps and require a warrant for their use.
• Limit data retention on innocent drivers for automatic license plate readers, limit access to the databases to trained, authorized personnel, and restrict sale of data.
• Evaluate the Department of Public Safety's unilateral decision to take all ten fingerprints when drivers obtain or renew their licenses based on potential privacy violations involving personal electronic devices using fingerprints in lieu of passcodes.

A big highlight for me was expert testimony by Chris Soghoian, a tech expert now working for national ACLU whose dissertation (pdf) first broke open this issue and spawned my own interest in these location-data issues. Thanks, Chris, for coming down!

The hearing took a strange turn, as prosecutors and a detective from the Houston Police Department insisted that changes to state law last session meant law enforcement already had to get a warrant to access cell phone location data. I'm not a lawyer, but that seems downright bizarre since the bill to require a warrant for location data failed; only content, not "metadata" (as it has come to be called post-Edward Snowden), was protected in the language that passed in HB 2268.

The prosecutors' new stance is especially odd because two different Texas appellate courts ruled in recent months affirming no warrant is currently required in Texas to obtain historical cell-phone location data. The US Fifth Circuit Court of Appeals ruled the same way, creating a federal circuit split. (See a related, earlier Grits discussion.) Indeed, the portion of Sec. 5 in Art. 18.21 of the Code of Criminal Procedure that the Fourth Texas Court of Appeals decision in Ford v. State relied upon was not changed in the amendment to HB 2268 requiring warrants for content. I just don't understand how that claim can be justified.

A case summary of Ford on the prosecutors association website even recommended their members rely on the case for precedent in the future ("Because there is precious little caselaw that construes Article 18.21, this decision could turn out to be helpful to others on that basis as well"). And in Barfield v. State, police obtained cell-phone location with an administrative subpoena and Texas' 14th Court of Appeals in Houston upheld it being admitted into evidence. (The Department of Insurance testified that it, too gets cell-phone location data with only a subpoena.)

There appear to be no court cases supporting this novel view that Texas law already requires a warrant to access cell-phone location data. Its proponents could not even provide examples of local district judges suppressing location data, nor of any jurist denying police access to this information. All they offered were hypotheticals.

But no matter how often they kept repeating that the law requires a warrant now, your correspondent simply sees no evidence for the claim. Again, I'm not a lawyer. But attorneys for service providers like Data Foundry and Golden Frog also insisted that warrants are not required in Texas presently for law enforcement to access location data. And that was certainly the universal, contemporary understanding at the time the 83rd session ended. Just a weird debate to have.

The Observer piece by Eric Nicholson summed up the odd tenor of the event thusly: "The debate over whether warrants are currently required is a bit of a head spinner. (Cops are in the paradoxical position of arguing both that warrants are necessary to obtain cell-phone metadata and that they will fight efforts during the 2015 legislative session to require warrants for cell-phone metadata.)" To be sure, I hope they're right and I'm wrong. I want a warrant requirement for these records in Texas (and nationally, though your lowly correspondent can't do anything about that). But until the judiciary agrees a warrant is required, it's hard to buy what police and prosecutors were selling at yesterday's State Affairs hearing.

Go here if you'd like to watch the whole thing online.

MORE: I was interviewed this afternoon along with Rep. Bryan Hughes on the Texas Public Radio show The Source about yesterday's hearing and location tracking issues generally. Go here to listen to the broadcast.

Texas site of four mysterious fake cell towers: Who's using them?

Grits has discussed police use of fake cell-phone towers (or "IMSI catchers," colloquially known by the brand name "Stingrays") by police, but it turns outs cops may not be the only ones using this technology. Seventeen different fake cell tower devices have been identified around the country - four of them in Texas - by a company specializing in making secure mobile phones. CBS News quoted:

Ross Rice, a former FBI agent, [who] said it’s likely [they are] being used illegally.

“I doubt that they are installed by law enforcement as they require a warrant to intercept conversations or data and since the cell providers are ordered by the court to cooperate with the intercept, there really would be no need for this,” Rice said.

“Most likely, they are installed and operated by hackers, trying to steal personal identification and passwords.”

I wouldn't be too sure about that: Some law enforcement do have Stingrays - Fort Worth PD definitely owns one and several people have told me Houston PD does too, though I've never confirmed it. Departments must sign non-disclosure agreements when they purchase Stingrays so it's impossible right now to know which agencies have them. And Texas law does not specifically regulate the devices.

Given that, IMO most IMSI catchers the company found are likely run by law enforcement or spooks (many of the devices are located near military bases, reported Computer World).  Perhaps it's just the NSA doing their thing. The feds have even used wearable Stingray devices to covertly monitor political demonstrations. Who knows?

Still, it's notable that, while criminals can't buy the necessary equipment pre-fabbed from the Harris Corporation (Stingray's manufacturer), the tech involved isn't particularly high end stuff and there's nothing to stop someone with nefarious motives from making their own if they have the technical chops.

The Federal Communications Commission recently established a task force to study whether these devices are being misused. But Grits agrees with this expert quoted by the Washington Post that the FCC shouldn't seek to regulate the devices (let courts and legislatures do that) but to eliminate the vulnerabilities that allow them to operate:

Stephanie K. Pell, a cyber-ethics fellow at the Army Cyber Institute at the U.S. Military Academy, said the FCC should investigate not only the illegal uses of IMSI catchers but the network vulnerabilities that allow them to work.

“I think it would be prudent to assume that the Chinese government and criminal gangs don’t care if IMSI catchers are illegal,” said Pell, who has written extensively about the technology. “Ultimately if we are going to get to the root of the problem, we will have to deal with this from a network vulnerability perspective.”

Law enforcement won't like that suggestion because it would eliminate one of their favorite new toys, but technology is value neutral. An IMSI catcher doesn't care if it's used to catch crooks or commit crimes. So if cops want to stop the bad guys from using them, the tradeoff will be that they must also remove this tool from their own toolbox.

Until a technical solution is in place, Grits will continue to support laws regulating the use of IMSI catchers by government. But the safer approach would be for the FCC to require companies to fix the vulnerability and, eventually, make the issue moot.

Timely panel on online privacy: Assessing prospects for Texas legislation

One wouldn't fancy Grits would be asked to address a roomful of computer geeks, but I'm headed later today to participate on a panel at Texas Linux Fest dubbed an "Online Privacy Discussion" along with Ron Yokubaitis, Co-CEO of Golden Frog, attorney Scott McCollough, and Brian Hauss, a Legal Fellow from the national ACLU.

Very timely topic, considering all that's going on in the world. The federal Eleventh Circuit Court of Appeals this week ruled a warrant is required to access historic cell-phone location data, a ruling which contradicted the Fifth Circuit (which includes Texas) and frustrated Orin Kerr to no end. (A pretty obvious pickup for SCOTUS, one would think, with blatantly conflicting circuit rulings.) The governor of Tennessee recently signed legislation requiring state and local law enforcement to gets warrants for cell-phone location data in that state, joining Montana, Maine, Utah, and Virginia in the club of states who did so through the legislative process. Supreme Courts in New Jersey and Massachusetts have implemented state-level warrant requirements in those states.

Everywhere you turn, electronic privacy is a hot button issue. Motherboard has a story this morning about stingrays or "IMSI catchers" (see prior Grits coverage) titled "Stealing cell phone data is so easy, even police departments can do it."

Grits knows little about Linux beyond some inept and so far fruitless fumbling with a Raspberry Pi. I'm joining the LinuxFest panel on behalf of the Texas Electronic Privacy Coalition (whose website is in woeful need of updating!) to talk about why Texas' legislation requiring warrants for cell-phone location data didn't pass, why an amendment requiring warrants for email and other cloud-based content did, interim charges on the topic prescribed by Lt. Gov. David Dewhurst in the senate, and prospects for electronic privacy gains in the 84th Texas Legislature next spring.

The main difference between 2013 and 2015 is that, when Texas' bills protecting location data and cloud-based content were filed and heard in committee in early 2013, Edward Snowden hadn't changed the world yet. If his revelations had come two months earlier, legislation by Rep. Bryan Hughes in the House and/or bills by Senators Juan Hinojosa and Craig Estes in the Senate would have easily passed, I've little doubt. Nobody in the political class had ever heard of "metadata." The issue was (relatively) new to everyone whose name was not Christopher Soghoian; it had to be explained, repeatedly, often laboriously. Once legislators understood the bill, it was popular (107 joint and co-authors in the House). An amendment containing the bill language passed 126-4 in the House, but was left off the final version of the bill to which it was amended thanks to a legislative maneuver by the senate author (who incidentally was defeated in a primary and is not coming back - Adios, John Carona!).

The interim charges on electronic privacy in the Texas Senate State Affairs Committee that looked so promising when David Dewhurst announced them are now in limbo and nobody knows when or even if there may be hearings. Heck, nobody knows who would even call such hearings. State Affairs Chairman Robert Duncan was appointed to be chancellor at Texas Tech, vacating his seat, which awaits his replacement via special election. The vice chair, Robert Deuell, lost his primary and probably isn't real motivated to aggressively pick up the mantle. Dewhurst could appoint someone else, but he's a lame duck, too. And with elections in November, there's not a lot of time for someone to come in new and start from scratch - these aren't the only issues on the committee's plate.

So, while State Affairs staff is working on the interim report (because somebody has to), there may be no interim hearing unless a few senate dominoes fall in the near future, I'm disappointed to report. Nobody knows anything for sure. But even if the State Affairs Committee remains temporarily dormant, electronic privacy issues are bubbling up in the news almost daily and the Lege can count on being asked again to address them next year.

Body-worn IMSI catcher takes covert phone snooping to next level

IMSI catchers, known more commonly by the biggest selling trade name, "Stingray" devices," are fake cell-phone towers that police use to capture nearby cell traffic and fool it into running calls through a police-operated device small enough to deploy in a squad car. Now they're big enough to wear as clothing.

ACLU's Chris Soghoian described the feds' deployment of Stingray-type technology (that's a trade name, the technical term is "IMSI catcher") worn by law enforcement as a vest at the conference on Location Tracking and Biometrics, an event Grits attended at the Yale Law School, thanks to with reader support) earlier this year, which was the first I'd heard of it. Now we learn more about the body-worn tech in a new report from Ars Technica ("The body worn 'IMSI catcher' for all your covert snooping needs," Sept. 1), which opened:

Recently leaked brochures advertising next generation spy devices give outsiders a glimpse into the high-tech world of government surveillance. And one of the most tantalizing of the must-have gizmos available from a company called GammaGroup is a body-worn device that surreptitiously captures the unique identifier used by cell phones.

"The unit is optimized for short range covert operation, designed to allow users to get close to Target(s) to maximize the changes of only catching the Target(s') identities and minimal unwanted collateral," one of the marketing pamphlets boasts. "The solution can be used as a standalone device or integrated into wider data-gathering and geo-tracking systems."

At just 41 x 33 x 18 centimeters, the device is small enough to fit under a shirt. It needs from one to 90 seconds to capture the international mobile subscriber identity (IMSI) or international mobile equipment identity (IMEI) of the person being tracked. It works on all GSM-based networks regardless of country and is fully operational even when functioning in a moving vehicle. The same brochure advertises several other varieties of IMSI catchers, including some that work in a totable briefcase and one that receives signals from a covert vehicle roof bar antenna. The James Bond spying tools are sold to government agencies and law enforcement organizations.

Soghoian described experiments by the feds having agents with body-worn IMSI vests walking through crowds at political rallies and recording the ID of every cell phone that pinged,. That gave them a lot of baseline data about who was at the event, how to target their phone if need be in the future, etc., Combined with the rise of license plate readers, continued warrantless access to historic location data (at least for now), a national facial recognition database about to come online, and near ubiquitous surveillance in most public places, the potential uses and misuses of such more-or-less unregulated police technology boggles the mind.

Read the whole thing.

Does this count as a 'drone'? If cell-phone towers can fly, why not a 'Stingray'?

Via Ars Technica

Does a flying cell-phone tower count as a drone? You decide. The bill Texas just passed that's awaiting a decision by Gov. Perry would regulate images captured by "unmanned aircraft." And under that statute, " 'image' means any capturing of sound waves, thermal, infrared, ultraviolet, visible light, or other electromagnetic waves, odor, or other conditions existing on or about real property in this state or an individual located on that property." So arguably this use would be illegal under Texas' bill. Should it be? Grits is not so sure. I'm less concerned with cell-phone companies using drones this way than, say, if law enforcement were to install a Stingray device on an unmanned aircraft. The latter should be outright banned. The former may be perfectly appropriate in a regulated environment and could be a tremendous boon to rural areas with poor cell-phone coverage.

Grits believes there are a vast number of potential uses for "drones," far more than most people, and certainly most Texas legislators, have properly considered. The Texas bill's principle saving grace is that, even if Gov. Perry signs it into law, it'll be a couple of years before the Federal Aviation Administration allows civilian drones in commercial airspace. So Texas will get another chance to get it right in 2015.

MORE: From EFF: How we need to regulate drones.

Related:

• National expert laments Texas' drone bill
• Top Five Things Wrong With Texas' Drone Bill
• A path forward for state drone regulation

Electronic privacy roundup

Here are several national electronic privacy stories that relate to presently pending Texas legislation.

Hint at possible litigation over Fort Worth PD's acquisition of 'KingFish' fake-cell-tower device

On their March 5 agenda, the Fort Worth City Council considered an item in closed, executive session described only as "Legal issues related to acquisition of KingFish software from Harris Corporation." Harris Corporation is the company that makes surveillance devices with the trade name "Stingray" (see here and here) of which the KingFish system is one model in that line. These are fake cell towers that trick nearby phones into sending their signal through a police surveillance system instead of the nearest, privately operated network. The Obama Administration claims their use should not require a probable cause warrant. Privacy advocates and some courts have so far disagreed. This is yet another situation where technology has leaped far ahead of the legal framework that theoretically constrains it.

What might the Fort Worth City Council be discussing behind closed doors? The only clue comes from boilerplate language on the agenda covering several distinct items which declares that the council will "Seek the advice of its attorneys concerning the following pending or contemplated litigation or other matters that are exempt from public disclosure under Article X, Section 9 of the Texas State Bar Rules, as authorized by Section 551.071 of the Texas Government Code." Does that mean there is litigation pending or contemplated related to the acquisition of the Fort Worth PD's KingFish system, or a settlement offer under Government Code 551.071? If so I'd be interested to know more detail about who is suing who over what! Lately some other jurisdictions have gotten into hot water for failing to disclose to judges that they were using Stingray/KingFish-type technology when they'd only received orders approving traditional pen register/trap and trace devices. Has Fort Worth found itself in a similar situation? ¿Quien sabe?

A titillating tidbit: Perhaps there's a story there waiting to be ferreted out.

Fort Worth is the only non-federal agency we know of in Texas that owns one of these devices, but that's mainly because no one has comprehensively searched for more. Anecdotally, most non-federal agencies that own them appear to have purchased them with grants from the Departments of Justice or Homeland Security but tracking them all down would be a sizable open-records project. I could think of three potential ways to approach it: First, combing through federal grant reports to find agencies that specifically solicited money for the devices, Second, filing open records requests with various agencies for invoices paid to the Harris Corporation, which has more or less cornered the US law enforcement market selling this technology. Finally, at the Yale Law School conference I attended, Dr. Chris Soghoian said he'd had the most luck tracking these devices through their licensure at the Federal Communications Commission. (Federal FOIA's take longer than Texas public information requests, but that may be the most comprehensive route.) Then, once you'd identified owners of the technology, you'd want to check county courthouses in those jurisdictions (and the federal PACER system) for civil litigation and perhaps file a second round of open records requests related to policies, correspondence, etc,. about the device. That'd be a good project for a group with a smart intern or two to assign to it for a semester.

H/T: Chris Soghoian.

Feds say 'Stingray' use is 'very common practice'

Since Grits had written about Stingray technology following the Yale Law School's conference on Location Tracking and Biometrics, I thought I should point out this item from the Washington Times ("Can you hear me now? Feds admit FBI warrantless cellphone tracking 'very common'," which opened:

FBI investigators for at least five years have routinely used a sophisticated cellphone tracking tool that can pinpoint callers’ locations and listen to their conversations — all without getting a warrant for it, a federal court was told this week.

The use of the “Stingray,” as the tool is called, “is a very common practice” by federal investigators, Justice Department attorneys told the U.S. District Court for Arizona Thursday, according to the American Civil Liberties Union.

Installed in an unmarked van, Stingray mimics a cellphone tower, so it can pinpoint the precise location of any mobile device in range and intercept conversations and data, said Linda Lye, staff attorney at the ACLU of Northern California in a blog post about the case.

In a rare public discussion of federal electronic surveillance capabilities and authorities, Justice Department lawyers told the court hearing that, instead of a warrant, the FBI operates Stingray and other cellphone-mimicking technology under the authority of “pen register” orders. These court orders, also known as “tap and trace” orders, are generally issued to allow investigators to collect only so-called “metadata” — like all phone numbers calling to or called from a particular number.

But Stingray collects much more than just phone numbers and also “sweep[s] up the data of innocent people who happen to be nearby,” according to the ACLU filing.

Given the broad nature of the information Stingray collects and its ability to eavesdrop on conversations, many federal judges insisted that they should be told when its use was envisaged under a tap and trace order, the ACLU filing says.

Here's the blog post from ACLU on the topic titled "DOJ emails show feds were less than 'explicit' with judges on cell phone tracking tool."  That exact same lamentation was expressed by federal Magistrate Judge Brian Owsley (Texas Southern District - Houston) at the Yale conference, who said, to an untrained eye, orders for Stingrays look just like those for much-less invasive pen registers. He thought he'd only ever seen two Stingray requests, but in retrospect said he's not completely sure for exactly the reasons described above: They're frequently presented as workaday trap and trace orders. A judge can't oversee activities about which s/he is never told. In Judge Owsley's cases, the federal prosecutors themselves did not understand the technology for which they were requesting an order.

Fort Worth PD owns a Stingray device but little is known about what other state or local agencies in Texas have them. Mostly local agencies purchase them with DOJ or DHS grants. To me it seems like wiretap equipment that they shouldn't possess, at least unless the unnecessary and ill-considered SB 188 passes. That bill, which gives wiretapping authority to the state's largest municipal police departments without DPS as their intermediary, cleared the senate last week. Detectives I've spoken to from the largest departments expect a sharp increase in the number of wiretap warrants requested statewide if SB 188 passes. At that point, you can be sure they'll all want a Stingray device.

MORE: From Simple Justice.

Location Tracking and Biometrics conference: Roundup of Grits posts

Thanks to readers who donated for Grits to attend the March 3 conference on Location Tracking and Biometrics at the Yale Law School and especially to the Texas Civil Rights Project for a particularly generous contribution. It took two weeks, but today I finally finished the last two posts summarizing my notes from panels at the conference. Here they are all in one place for easy reference:

• Cell phone tracking by government: How it's done
• On the Fourth Amendment implications of location tracking
• Secrecy and federal court dockets: On the nuts and bolts of authorizing government surveillance
• Bypassing the telecoms: 'Stingrays' allow direct government phone surveillance with little oversight 
• Biometrics and profiling: The door to the phone booth is now open
• Debating Drones: Final panel from Yale Law School conference 
• Video, resources from location tracking conference

Bypassing the telecoms: 'Stingrays' allow direct government phone surveillance with little oversight

The third panel at Yale Law School's Location Tracking and Biometrics conference last weekend focused on so-called "Stingray" devices, which is a trade name for a fake cell-phone tower operated by police that tricks your phone into sending its signal to them instead of your cell-phone carrier. (Go here to see the video; the panel on Stingrays begins at the 6:01:28 mark.) The panel was moderated by Jennifer Valentino-Devries, a reporter from the Wall Street Journal who has written extensively about the devices and who I was pleased to learn is a transplanted Texan from San Antonio and a fellow Daily Texan alum. (See her initial WSJ story, and followups here and here, from which Grits first learned about the technology.)

A Stingray device, via the Wall Street Journal

Researcher and electronic privacy activist Christopher Soghoian began the discussion with an overview of the device, the technical name for which is an IMSI catcher. The technology, which came out of Germany and the UK, was the subject of extended patent litigation over who owns the rights from its development. (The ultimate ruling was the tech was not original enough to merit a patent.) The US military utilizes similar technology developed by Boeing and it's also used extensively by American intelligence services. An outfit called Harris Corporation has captured the US law enforcement market with devices costing $60,000 to $175,000. (See prior Grits coverage; in Texas, the Fort Worth PD purchased one.) Most local agencies which have purchased them have done so through grants from the Department of Justice. Soghoian struck out on FOIA requests submitted to the DOJ but learned more from the Federal Communications Commission which must approve their use. Most requests for FCC approval are boilerplate language distributed by Harris, he said. The government uses the devices either when a target is routinely and quickly changing phones to thwart a wiretap, he said, or when phone companies deny law enforcement personal subscriber information and police don't have sufficient cause for a warrant.

The devices exploit a security flaw in cell phone communications that, to my mind, sounds essentially like wiretapping one's phone, intercepting the signal in a man-in-the-middle style attack, contents and all. Standards for 3G and 4G phones include encryption but your smart phone will also use a 2G connection if that's the strongest, nearest signal. Anyone who wants to exploit this security flaw can do it, said Soghoian. Even if it's illegal, there's not an easy way to stop it, though there may be ways to detect when the device is being used. Some hackers in Berlin created  an "IMSI catcher catcher" using a $20 prepaid phone they modified. It works becuse Stingrays look like a normal tower to your cell phone but it doesn't act like one. The German hackers designed software that looks for Stingrays' tell-tale signature

The FCC knows about  these  flaws because they approve local use of "Stingrays" but won't require phone companies to fix these vulnerabilities because they're "in on the deal," said Soghoian, which means the flaws will "stick with us for a long time." Though Harris charges tens of thousands of dollars for the devices, US hackers have demonstrated it's possible to build one for around $1,000. The "age of low cost stingrays is fully on the horizon," he said.

Alan Butler, Appellate Advocacy Counsel for the Electronic Privacy Information Center, said the legal standards for using stingrays are not clear but thinks they have constitutional privacy implications. The SCOTUS cases US v Karo and Kyollo v US are the closest to being on point, he said. Both are about revealing personal details in protected spaces. There are also arguably statutory implications, he said, in 47 USC Sec 222(f) and 47 USC Sec 1002(a).

The Department of Justice claims Stingrays are similar to pen registers and authorized by the same court precedents and statutes, but it's obvious the devices' capabilities are far more sweeping than merely collecting incoming and outgoing phone numbers. The federal Communications Act regulates technology that interferes with communication but courts have not yet found that Stingrays violate that law.

Similar to cell tower dumps, where non-suspects' information is collected along with the surveillance targets, Stingrays raise the question, "What happens to data regarding innocent devices?" On this subject we know next to nothing. The government has exercised extreme controls and secrecy regarding how it uses the technology. Huge swaths of response to FOIA requests are routinely withheld or redacted, said Butler. (Last month, Slate.com covered the most recent of Butler's FOIA requests on Stingrays, the results of which may be accessed here.)

Federal Magistrate Judge Brian Owsley of the Texas Southern District spoke next, calling Stingrays "cell tower dumps on steroids." He said judges don't see many Stingray requests: He's seen two that he knows of (since it's only been relatively recently that he or anyone else outside the tech companies and law enforcement understood what they were). Documentation coming before a judge on these orders looks essentially like a pen register application and many judges simply don't understand what they're seeing. Magistrate judges are not usually very tech savvy, said Owsley. Upon receiving his second request regarding the technology, he sent an email to every magistrate judge in the country telling them about the devices. About 10% of judges responded. Most hadn't noticed them before or had only seen one or two. Hardly anyone understood them. Indeed, he said, often DOJ officials don't understand the tech  any more than  magistrate judges; the AUSAs just submit a standardized form, which for the most part are rubber stamped.

Owsley first delved into details of the device when a request was submitted to locate and track smuggled cell phones in and out of a prison with the device. He told the AUSA he needed more information and the prosecutor promised to send a memo. He did not submit it for six weeks by which time prison officials located the phone without the device. An order was never issued. Owsley's second run-in with Stingrays  involved a drug case where the target was changing phones faster than the feds could submit warrants to tap them.

The moderator, Valentino-Devries, noted that boilerplate pen register orders name a target, asking "What do stingray orders look like?" Owsley referred her to the DOJ's electronic surveillance manual (pdf) and said to search under "triggerfish," which is the analog version of the device. The main difference is that pen register orders are directed at a third party because that's who controls the technology. However, sometimes AUSAs simultaneously request vendor information to narrow the Stingray's target, which also has the effect of making them appear on the surface to the judge more like a routine pen register case.

Soghoian argued that use of these devices comes close to a "general  warrant" of the type the Fourth Amendment was explicitly created to prevent. The government is sending signals through  people's walls clothes, etc., and inevitably most of those whose information is captured are innocent people. that's not much different than using invasive technology to search every house on the block, he argued. (The fact that the signal penetrates walls of homes and private spaces made Grits wonder if there may be implications for Stingrays from SCOTUS Justice Antonin Scalia's opinion in US v. Jones relying on "trespass" by the government to restrict use of mobile tracking devices attached to personal vehicles.)

Butler noted that one problem with the government's pen register theory is the location limit on pen registers (Stingrays are mobile, fitting in a squad cars or even embedded in clothing.) Owsley added that a pen register order must have a target number, while Stingrays are looking for a target number. The distinction is important because pen registers operate under lesser legal standards than are applied to cell tower dumps, for example.

The even bigger difference, though, is that Stingrays and IMSI catchers can actually capture content. Harris doesn't have marketing materials online, but according to their price list (which has been made public), they sell an interception module that's actually capable of tapping phones just like an old-fashioned wiretaps, but no one knows which  agencies have purchased it. Vendors from other countries advertise interception more aggressively. DOJ tells its employees not to intercept content, said Butler, but the fact that they need to say so implies that the ability exists. Owsley said that AUSA's may not undestand the tech but they do know they're not supposed to intercept content. By contrast, he thinks FBI agents don't understand the same limits the AUSA's seem to and may be using the technology more broadly.

Other agencies use the information even more broadly. Immigration and Customs Enforcement (ICE) purchased $3 million worth of Stingrays over several years, and are purchasing airborne mounting kits for both drones and manned aircraft. The FBI has said in response to FOIAs on the topic that they have 20,000 documents related to Stingrays but could provide just two public court orders related to them. Soghoian thinks there's intentional concealment by law enforcement about the devices. (The exclusionary rule doesn't apply in immigration contexts, an audience member noted, citing a case out of the Fourth Circuit, so for now ICE's use of the devices remains entirely beyond court review.)

Butler said DOJ has a strong belief that this is a law-enforcement sensitive method they should keep secret to the greatest extent possible, so it's hard to establish case law underlying use of technique. The government uses similar tech in war zones, often mounted on drones. As a result, we've now ended up in a weird situation where small town sheriffs and intelligence agencies are using same gear, mostly in secret.

The moderator asked why more information hadn't been revealed when evidence from Stingrays is used in criminal court. Owsley replied that the burden falls on criminal defense attorneys who may not understand the tech or what questions to ask. (Grits would have added that since most convictions stem from plea bargains, often the government never has to show its cards.) ACLU's Catherine Crump added from the audience that she'd been told the feds often use it for hunting fugitives, where there's no risk of a suppression hearing.

Next up: Biometrics and Drones.

See prior, related Grits posts from the conference:

• Cell phone tracking by government: How it's done
• On the Fourth Amendment implications of location tracking
• Secrecy and federal court dockets: On the nuts and bolts of authorizing government surveillance
• Video, resources from location tracking conference