In a post last spring, I discussed the growing use of “Stingrays” by law enforcement officers. These devices (technically known as International Mobile Subscriber Identity (“IMSI”) catchers) simulate a cell phone tower and thus “trick” a cell phone into sending it data. These devices are critical for law enforcement surveillance purposes, since criminals will frequently use a specific cell phone for a brief period of time before discarding it and obtaining a new one. Thus, police officers who know that a suspect is involved in criminal activity and who have have sufficient evidence to obtain a Title III order to wiretap the suspect’s phone are faced with a dilemma–they have the legal right to listen in on the suspect’s cell phone conversations, but they are unable to do so because there is no way to tell the phone company which phone needs to be tapped. Armed with a Stingray, the law enforcement officers can fool the suspect’s phone into connecting to the simulated cell phone tower and sharing its identifying information. The police are able to then take this information and give it to the cell service provider, who can then set up a wiretap for the suspect’s phone.
The problem is that a Stingray will usually gather not just the suspect’s identifying phone information, but also the identifying phone information of everyone else in the area. Practically, police solve this problem by following the suspect from location to location with the Stingray and determining which cell phone is consistently among the group that is being detected–essentially using process of elimination to determine which piece of identifying data belongs to the suspect’s phone. But legally, this method raises Fourth Amendment concerns, since the government is gathering information from many innocent people in the process.
I argued earlier that the government should not need a warrant to use Stingrays in this manner, because all they learn about these third parties is the IMSI of the third party’s cell phone–mere “address” information that is already shared with third parties and which does not contain any remotely private information about the user (indeed, the vast majority of cell phone users do not even know their cell phone’s IMSI, nor would they notice or care if other people knew it). Thus, using a Stingray to obtain a suspect’s IMSI does not implicate the Fourth Amendment in any way.
However, the federal government is taking no chances, and the Department of Justice issued a memo in September of this year that requires its agents to obtain a search warrant prior to using a Stingray device, unless an emergency situation exists. Consistent with this policy, the government has conceded this point in recent court cases. This concession makes sense in most situations–if the government already has sufficient information to obtain a Title III wiretap order against an individual, then the government surely has sufficient information to obtain a search warrant,. Unfortunately, this self-imposed requirement does limit the usefulness of Stingrays in some contexts. In many cases, the government only has reasonable suspicion that the suspect is committing a crime, and may only want to obtain a pen/trap order to determine whom the suspect is calling and how often–information which is not constitutionally protected but which can be very useful in developing probable cause. But by requiring probable cause at the outset, the government is denying itself the ability to use this basic investigative tool if the suspect is sophisticated enough to frequently switch cell phones.
More recently, a federal magistrate court imposed even more restrictions on the use of Stingray devices. In a recent order, Magistrate Judge Iain D. Johnston of the Northern District of Illinois summarized the restrictions that he placed on law enforcement officers when he grants a warrant for using a Stingray. Essentially Judge Johnston sets three requirements for law enforcement:
(1) Officers must make reasonable efforts to minimize the collection of third party cell phone identification information.
(2) Officers must destroy all third party identifying information that they do collect within 48 hours of its collection.
(3) Any data obtained from the Stingray device can only be used to identify the target’s identifying cell phone information and for no other purpose.
The first two limitations are sensible enough and do not seem to affect the effectiveness of the surveillance. The use limitation of the third requirement, however, seems unnecessary–there may be a number of legitimate and useful other ways for law enforcement to use the information. For example, once the police know the target’s IMSI, they can use the Stingray device at a later time to determine the suspect’s general location (This information is not protected under the Fourth Amendment unless it is continuously protected over a long period of time, as in the Jones case). And some versions of the Stingray device may be able to operate as a pen register, telling the police the numbers the target is calling and the length of those calls. This information is also unprotected under the Fourth Amendment (there are statutory restrictions on such information, but they are far lower than the probable cause that the police have already developed before they get a warrant). But for now, the federal government seems content to live with these restrictions and as far as we know, has not challenged them in court.
