New Docs: DOJ Admits that StingRays Spy on Innocent Bystanders

Documents recently obtained by the ACLU of Northern California from the Department of Justice confirm concerns about the federal government’s use of StingRays – a highly intrusive cell phone surveillance device – and underscore the need for transparency.

For years, the government has shrouded in secrecy its use of StingRays, also called “cell site simulators.” By mimicking a cell tower, cell site simulators trick nearby devices into transmitting their location and identifying information. When used to track a suspect’s cell phone, they also gather information about the phones of countless bystanders who happen to be nearby. In early September 2015, DOJ publicly announced guidelines for using the technology, a positive, though flawed, first step.

Two years ago, we filed a Freedom of Information Act lawsuit against DOJ for its policies and procedures about StingRays. The court ordered the government to produce some key documents, and the government has now finally done so. The documents we obtained include memos and “template” court applications that DOJ provides to federal prosecutors. While these documents have largely been superseded by DOJ’s new guidelines, they still shed light on important issues.

First, we’ve long been concerned that the government has not been up front with courts about the intrusive nature of these devices. A standard, internal form that DOJ provides to federal prosecutors validates that concern.

The cover memo to the form tells federal prosecutors that a cell site simulator can be used to identify the telephone number being used by a particular individual. It cautions that when the device is used for this purpose, “collection should be limited to device identifiers,” that is, the unique numeric identifiers associated with cell phones.

The internal memo then warns in unmistakable terms that other types of information, like the number someone dials, “should not” be collected, “as that would entail surveillance on the calling activity of all persons in the vicinity of the subject.” This DOJ memo thus acknowledges our longstanding concern – that StingRays spy on innocent bystanders.

But shockingly, the form that DOJ gives federal prosecutors to submit to courts fails to spell this out. To be sure, the form states that the device will be used “to detect radio signals emitted from wireless cellular telephones in the vicinity of the Subject that identify the telephones.” But this opaque language – two lines in a multi-page application – hardly provides an intelligible explanation of StingRay technology. DOJ realized it was important to educate its own prosecutors that cell site simulators can conduct “surveillance on the calling activity of all persons in the vicinity.” It should have said so in plain English to courts as well.

Second, the documents also raise questions about DOJ’s new guidelines. DOJ announced that going forward it will seek a warrant based on probable cause to use a StingRay, subject to certain exceptions. In addition to an exception for “exigent circumstances” (a well understood exception to the Fourth Amendment’s warrant requirement), the new guidelines also create a potentially expansive exception for undefined “exceptional” circumstances.

What does DOJ think might count as an “exceptional” but apparently not “exigent” circumstance? The documents from our FOIA litigation provide some insight. Those documents include procedures for “Emergency Installation” of cell site simulators. Situations that count as an “emergency” according to DOJ include “activity characteristic of organized crime” and “an ongoing attack of a protected computer (one used by a financial institution or U.S. government) where violation is a felony.” While such crimes are potentially serious, they simply do not justify bypassing the ordinary legal processes that were designed to balance the government’s need to investigate crimes with the public’s right to a government that abides by the law.

Third, DOJ decided not to appeal the court order requiring it to disclose these documents, but only after it announced its new StingRay guidelines, in other words, after the documents became in large part moot. DOJ could have avoided disclosure for years more, simply by appealing. The public should not have to spend years litigating FOIA cases just to obtain basic information about what the government is up to.

Instead, local communities should demand that their elected leaders follow a consistent and open process whenever considering new surveillance technology and adopt use policies that provide for transparency, oversight, and accountability.

Linda Lye is a senior staff attorney at the ACLU of Northern California.