Florida Police Secret Weapon: Warrantless Cellphone Tracking

POLICE IN FLORIDA have offered a startling excuse for having used a controversial “stingray” cellphone tracking gadget 200 times without ever telling a judge: the device’s manufacturer made them sign a non-disclosure agreement that they say prevented them from telling the courts.

The shocking revelation came during an appeal over a 2008 sexual battery case in Tallahassee in which the suspect also stole the victim’s cellphone. Using the stingray — which simulates a cellphone tower in order to trick nearby mobile devices into connecting to it and revealing their location — police were able to track him to an apartment.

During recent proceedings in the case, authorities revealed that they had used the equipment at least 200 additional times since 2010 without disclosing this to courts and obtaining a warrant.

Although the specific device and manufacturer are identified in neither the one court document available for the 2008 case, nor in a video of a court proceeding, the ACLU says in a blog post today that the device is “likely a stingray made by the Florida-based Harris Corporation.”

Harris is the leading maker of stingrays in the U.S., and the ACLU has long suspected that the company has been loaning the devices to police departments throughout the state for product testing and promotional purposes. As the court document notes in the 2008 case, “the Tallahassee Police Department is not the owner of the equipment.”

The ACLU now suspects these police departments may have all signed non-disclosure agreements with the vendor and used the agreement to avoid disclosing their use of the equipment to courts.

“The police seem to have interpreted the agreement to bar them even from revealing their use of Stingrays to judges, who we usually rely on to provide oversight of police investigations,” the ACLU writes.

Harris refused to comment, instead redirecting questions to law enforcement.

The secretive technology is generically known as a stingray or IMSI catcher, but the Harris device is also specifically called the Stingray. When mobile phones — and other wireless communication devices like air cards — connect to the stingray, it can see and record their unique ID numbers and traffic data, as well as information that points to the device’s location. By moving the stingray around, authorities can triangulate the device’s location with much more precision than they can get through data obtained from a mobile network provider’s fixed tower location.

The government has long asserted that it doesn’t need to obtain a probable-cause warrant to use the devices because they don’t collect the content of phone calls and text messages but rather operate like pen-registers and trap-and-traces, collecting the equivalent of header information.

This is the first time, however, that a contract with the vendor has been cited as a reason for not obtaining a warrant. The discovery of this hidden detail was made by CNET reporter Declan McCullagh earlier this year.

The 2008 Florida case — State v. Thomas (.pdf) — is currently sealed, though the ACLU has filed a motion to unseal the records.

The case involves James L. Thomas who was convicted of sexual battery and petit theft.

According to the appellate court judges, after a young woman reported on September 13, 2008 that she had been raped and that her purse, containing a cellphone, had been stolen, police tracked the location of her phone about 24 hours later to the apartment of Thomas’ girlfriend.

“The investigators settled on a specific apartment ‘shortly after midnight’ or ‘approximately 1:00 to 2:00 a.m.’ on September 14, 2008,” the court wrote. “For the next few hours, six or seven police officers milled around outside the apartment, but made no effort to obtain a search warrant.”

They did not want to obtain a search warrant to enter the apartment “because they did not want to reveal information [to a judge] about the technology they used to track the cellphone signal,” the appellate judges note.

Around 5 a.m., police knocked on the apartment door, but the suspect’s girlfriend refused to let them in without a warrant. They forced their way in, ordered her and Thomas to exit, then searched the apartment. After they found the victim’s purse and cellphone, they arrested Thomas.

Authorities opted not to get a warrant either for the use of the Stingray or the search of the apartment, simply because they didn’t want to tell the judge what they were using to locate the suspect, a matter the ACLU finds troubling.

“Potentially unconstitutional government surveillance on this scale should not remain hidden from the public just because a private corporation desires secrecy. And it certainly should not be concealed from judges,” the ACLU noted.

Authorities even refused to tell Thomas’s attorney how they had tracked his client to the apartment. A judge finally forced the government to disclose the surveillance technique they had used, but only after the government insisted the court be closed. The proceedings were also sealed to prevent the information from leaking to the public.

The truth came out only after Thomas appealed his conviction, asserting that the police violated his Fourth Amendment right in seizing evidence.

It was in the unsealed appellate opinion that the ACLU discovered the reason for the secrecy.

The judges revealed that the reason authorities didn’t obtain a search warrant and didn’t want to disclose their surveillance technique in an open court was because of the NDA. But that wasn’t all. A video of oral arguments before the appellate judges revealed more.

When the government attorney tried to argue in court that the police had planned to obtain a warrant to enter the apartment, one of the judges interrupted.

“No, no, no, no, no,” he said. “I think this record makes it very clear they were not going to get a search warrant because they had never gotten a search warrant for this technology.”

His fellow judge then interjected loudly, “Two-hundred times they have not.”

The ACLU was surprised by the admission.

“[Wh]en police use invasive surveillance equipment to surreptitiously sweep up information about the locations and communications of large numbers of people, court oversight and public debate are essential,” the group noted in its post.

But the possibility that an NDA may have been the excuse for not disclosing the technology was an even greater concern. [A video of the oral arguments is available on the court’s web site. Discussion of the technology begins at 9:15; mention of the 200 times they used the technology without a warrant occurs around 18:00.]

The ACLU has filed a Freedom of Information Act request with 30 police and sheriff departments in Florida to determine how widespread the use of the stingray is and how often its use has been concealed from courts.

Use of stingray technology goes back at least 20 years. In a 2009 Utah case, an FBI agent described using a cell site emulator more than 300 times over a decade and indicated that they were used on a daily basis by U.S. Marshals, the Secret Service, and other federal agencies.

The systems are not cheap. According to a 2008 price list obtained by Public Intelligence, the Harris Stingray was priced at $75,000 for the basic device, plus an additional $22,000 – $5,000 for various software packages for use with it. But the police in Florida appear to have obtained the devices for free or on lease from the maker.

While the government has argued in other cases that it does not need a warrant to use the devices, it conceded in one case in Arizona that it did need a warrant to use the device in that particular casebecause it involved locating a Verizon air card being used inside the suspect’s apartment.

In the Thomas case in Florida, however, the appellate judges noted that they were considering the suspect’s appeal only on grounds that police did not obtain a search warrant for his apartment, not on grounds that they did not obtain a search warrant for the use of the surveillance device.

“For purposes of decision, however, we assume the police acted lawfully up to the point that they forcibly entered the apartment,” they wrote in their November opinion. “It is not clear that there was ever a ruling on the legality of the cellphone tracking methods used below.”

The trial court initially ruled that the apartment search was legal, due to exigent circumstances, and therefore evidence obtained in the search was legal, but the appellate court reversed this and found that the girlfriend had only given her consent after she was forced to leave the apartment and stand outside in her night clothes, and after police had already begun to search the apartment.