Understanding New Surveillance Tools—Cell Phone

Transcription

Photo credit: US Patent & Trademark Office
Author:
Cover:
Design:
Linda Lye, Senior Staff Attorney, ACLU of Northern California
Gigi Pandian, ACLU of Northern California
Carey Lamprecht
Published by the ACLU of Northern California, June 27, 2014
The author wishes to thank Nanci Clarence, Josh Cohen, Catherine Crump, Hanni
Fakhoury, Carey Lamprecht, Robin Packel, Mindy Phillips, and Nate Wessler for
reviewing and commenting on drafts of this paper, and Christopher Soghoian for
providing an eye-opening education on IMSI catchers. Special thanks go to Daniel
Rigmaiden for his keen insights on legal and technological issues and for shedding
light on this important issue.
TABLE OF CONTENTS
I.
INTRODUCTION .....................................................................................................1
II.
StingRays: What do they do and how do they work? ...............................................2
III.
What kind of court authorization, if any, does the government currently obtain
to use the device? .......................................................................................................4
A.
No court authorization?..................................................................................4
B.
Pen register/trap and trace order? ..................................................................5
C.
Hybrid Order? ................................................................................................6
D.
Warrant? .........................................................................................................7
IV.
What guidance have courts offered on StingRays? ...................................................7
V.
How can you tell if the government used a StingRay in your case? ..........................9
VI.
A.
Terminology ........................................................................................... 9
B.
How did the government find out your client’s cell phone number? .......... 10
C.
How did the government locate your client? ............................................... 10
Key legal arguments to raise if an IMSI catcher was used ...................................... 10
A.
IMSI catchers trigger Fourth Amendment scrutiny ..................................... 11
1.
Use in connection with residences ................................................... 11
2.
Use in public .................................................................................... 12
B.
IMSI catchers engage in the electronic equivalent of a “general search”
and their use therefore violates the Fourth Amendment .............................. 13
C.
Statutory orders do not suffice to authorize IMSI catcher use..................... 14
D.
Even if the government obtained a warrant, use of an IMSI catcher is
still invalid ................................................................................................... 15
1.
The government’s omission of information about new
surveillance technology from a warrant application prevents
courts from exercising their constitutional oversight function
and would render a warrant invalid ................................................. 15
a.
A warrant that fails to disclose the government’s
intended use of an IMSI catcher is predicated on a
material omission ................................................................. 16
i
StingRays: The Most Common Surveillance Tool the Government Won’t Tell You About
b.
2.
VII.
A defendant is entitled to a Franks hearing ......................... 18
A warrant that accurately describes an IMSI catcher’s capabilities
would be facially invalid .................................................................. 19
CONCLUSION ........................................................................................................ 22
APPENDIX: Issues to Pursue in Discovery ....................................................................... 23
ENDNOTES ........................................................................................................................ 28
ii
I.
Introduction
Federal and state law enforcement entities across the country are using a powerful cell
phone surveillance tool commonly referred to as a “StingRay.” These devices are capable of
locating a cell phone with extraordinary precision, but to do so they operate in dragnet fashion,
scooping up information from a target device, as well as other wireless devices in the vicinity. In
addition, these devices can be configured to capture the content of voice and data
communications. Although the federal government has been using these devices since at least
1995, and use by state and local governments is quite widespread, there are only a handful of
opinions addressing their use.
At this juncture, few criminal defense attorneys are aware of these highly intrusive but
extremely common surveillance tools. This is entirely understandable because the federal
government has a policy of not disclosing information about this device. The government
appears to be withholding information from criminal defendants. It even appears to be providing
misleading information and making material omissions to judicial officers when it seeks
purported court authorization to use this device – inaccurately referring to it as a “confidential
source” or calling it a different kind of device (like a pen register), and failing to alert courts to
constitutionally material facts about the technology, such as the full breadth of information it
obtains from a suspect and its impact on third parties. As a result, courts are probably not aware
that they are authorizing use of this device and have not had an opportunity to rule on its legality,
except in very rare instances.
The secrecy surrounding these devices is deeply troubling because this technology raises
grave constitutional questions. There is a compelling argument that StingRays should never be
used. Because they operate in dragnet fashion, they engage in the electronic equivalent of the
“general searches” prohibited by the Fourth Amendment. But at a minimum, law enforcement
should obtain a warrant. Even in those instances when law enforcement obtains a warrant,
however, there are likely strong arguments that the warrant is invalid.
The purpose of this paper is to provide criminal defense attorneys with a basic
introduction to StingRays, allowing them to assess whether the devices may have been used in
their cases and to outline potential arguments for a motion to suppress.
Part II of this paper provides a brief overview of salient aspects of the technology and
uses for the device. Part III describes the types of court authorization, if any, the government
likely obtains to use the device. Part IV discusses the guidance courts have offered on the
technology. Part V suggests indicia for determining whether the device was used in a particular
case. Part VI outlines key constitutional arguments for a motion to suppress, focusing on Ninth
Circuit caselaw. Potential issues to pursue in discovery are set forth in an appendix to this paper.
Detailed footnotes are intended to assist attorneys preparing briefs.
1
II.
StingRays: What do they do and how do they work?
“StingRay” is the name for a line of “cell site simulator” technology sold by the Harris
Corporation.1 Other Harris cell site simulator models include the “TriggerFish,” “KingFish,”
and “Hailstorm.”2 The more generic term for the technology is “IMSI catcher,” in reference to
the unique identifier – or international mobile subscriber identity – of a wireless device.
Although IMSI catchers may be the most under-litigated surveillance tool in widespread use,
there is a fair amount of publicly available information about them.
The government has been using IMSI catchers for approximately two decades.
According to documents obtained by the Electronic Privacy Information Center (“EPIC”) in a
Freedom of Information Act (“FOIA”) lawsuit, the Federal Bureau of Investigation (“FBI”) has
been using the technology since 1995, agents have undergone extensive training on these
devices, and usage is dramatically increasing.3 A number of federal law enforcement agencies,
including the FBI, Drug Enforcement Administration, Bureau of Alcohol, Tobacco, Firearms and
Explosives, Secret Service, Marshals Service, and Immigration and Customs Enforcement, are
known to own and use cell site simulators.4 Use is not limited to the federal government. At
least 34 law enforcement agencies in 15 states have purchased IMSI catchers.5
Wireless carriers provide coverage through a network of base stations, also called cell
sites, that connect wireless devices to the regular telephone network. Cell phones periodically
identify themselves to the base station that has the strongest radio signal, which is often, but not
always, the nearest base station.6 A cell phone automatically transmits to the base station
“signaling data,” which includes the phone’s unique numeric identifier, as well as its cell site
code, which identifies its location.7 An IMSI catcher masquerades as a wireless carrier’s base
station, thereby prompting cell phones to communicate with it as though it were actually the
carrier’s base station.8 The equipment consists of “an antenna, an electronic device that
processes the signals transmitted on cell phone frequencies, and a laptop computer that analyzes
the signals and allows the agent to configure the collection of information.”9 It “can be carried
by hand or mounted on vehicles or even drones.”10
StingRays are capable of capturing the following types of information:
First, if the government knows a suspect’s location, it can use the device to determine the
unique numeric identifier associated with her cell phone. To do this, law enforcement agents
“position a StingRay in the vicinity of the target[’s phone],” which will then transmit to the IMSI
catcher the signaling information (including unique numeric identifier) it would normally
transmit to the carrier’s base station.11 There are a variety of unique numeric identifiers,
including International Mobile Subscriber Identity (“IMSI”),12 Electronic Serial Number
(“ESN”),13 and Mobile Identification Number (“MIN”).14 Obtaining a cell phone’s unique
numeric identifier facilitates the government’s efforts to obtain a wiretap or call records on a
target of an investigation.
Second, if the government knows a cell phone’s unique numeric identifier, it can use an
IMSI catcher to determine the phone’s location.15 The numeric identifier is programmed into the
2
IMSI catcher, which then sorts through the signaling data (including location) of cell phones in
the area until it finds a match.16 While law enforcement can also obtain location information
through requests to carriers for cell site location information,17 IMSI catchers vary from carrier
requests in at least two regards. IMSI catchers can typically be used without carrier assistance.18
In addition, IMSI catchers produce extremely precise location information, in some cases “within
an accuracy of 2 m[eters].”19 In one federal case, the government conceded that the IMSI
catcher located the defendant’s wireless device precisely within a specific apartment in an
apartment complex.20 In Florida, Tallahassee police testified that by “using portable equipment”
and going to “every door and every window” in a large apartment complex, they were able to
identify the “particular area of the apartment that that handset was emanating from.”21 While
carrier-provided cell site location information may under certain circumstances achieve similar
precision, it is entirely variable, and depends on a number of factors, including the density of cell
towers.22
Third, IMSI catchers are capable of capturing the content of communications, such as
voice calls and text messages.23 The devices used by the federal government are likely
configured to disable the content intercept function; as the United States Department of Justice
(“DOJ”) acknowledges, a wiretap order under the heightened Title III standard (18 U.S.C. §
2518) would otherwise be necessary.24 While some devices can be configured to intercept
content, we are not aware of instances in which law enforcement has deployed an IMSI catcher
in this fashion and the primary governmental uses appear to be identifying a phone’s unique
numeric identifier or location.
Several aspects of the technology are salient.
First, an IMSI catcher scoops up information from third parties, not just the target of an
investigation. The type of IMSI catcher currently used by law enforcement mimics a wireless
company’s network equipment, sending signals to and triggering an automatic response from
third parties’ mobile devices.25 DOJ concedes as much, as one of its template applications
pertaining to IMSI catchers builds in the contingency that “any cellular phone that is within close
proximity to the government device . . . may autonomously register with the device.”26 The
devices also may disrupt third parties’ network connectivity,27 although DOJ contends that its
policy is to take steps to “minimize any potential temporary disruption of service” to “non-target
telephones,” “by operating the device for limited duration and only when the cellsite information
acquired from the provider indicates that the Subject Telephone is operating nearby.”28
Second, the device broadcasts electronic signals that penetrate the walls of private spaces
not visible to the naked eye, including homes and offices.29 Depending on the device’s signal
strength, the broadcast radius can reach up to “several kilometers,”30 allowing the IMSI catcher
to scoop up information from any and all private locations in the area.
Third, an IMSI catcher forces cell phones to transmit signaling information.31 As one law
enforcement officer has described it, the government’s device “actually captures the phone” and
“direct[s] the signal from the [carrier’s] tower to [the government’s] equipment.”32
3
Fourth, an IMSI catcher operates in the same basic manner – mimicking a base station
and forcing an automatic response from devices in the immediate vicinity – regardless of the
type of signaling information captured (unique numeric identifier or location). As DOJ explains:
A cell site simulator, digital analyzer, or a triggerfish can electronically force a cellular
telephone to register its mobile identification number (“MIN,” i.e., telephone number)
and electronic serial number (“ESN,” i.e., the number assigned by the manufacturer of
the cellular telephone and programmed into the telephone) when the cellular telephone is
turned on. Cell site data (the MIN, the ESN, and the channel and cell site codes identify
the cell location and geographical sub-sector for which the telephone is transmitting) are
being transmitted continuously as a necessary aspect of cellular telephone call direction
and processing. The necessary signaling data (ESN/MIN, channel/cell site codes) are not
dialed or otherwise controlled by the cellular telephone user. Rather, the transmission of
the cellular telephone’s ESN/MIN to the nearest cell site occurs automatically when the
cellular telephone is turned on….If the cellular telephone is used to make or receive a
call, the screen of the digital analyzer/cell site simulator/triggerfish would include the
cellular telephone number (MIN), the call’s incoming or outgoing status, the telephone
number dialed, the cellular telephone’s ESN, the date, time, and duration of the call, and
the cell site number/sector (location of the cellular telephone when the call was
connected).33
Thus, an IMSI catcher operates in the same fashion, engaging in the same dragnet for
information, regardless of whether the government ultimately filters the information obtained for
a phone’s unique numeric identifier or its location.
III.
What kind of court authorization, if any, does the government currently obtain to
use the device?
Although the full extent of government use of IMSI catchers remains to be revealed, even
less is known about the legal process used by the government when deploying this technology.
With respect to federal use, there are a handful of public DOJ documents that reference this
technology.34 The guidance and best practices set forth in these documents are somewhat
internally inconsistent. DOJ has resisted disclosing further information about its policies,
practices, and procedures for using this device.35
A.
No court authorization?
In some instances, law enforcement entities, at least at the state and local level, are not
obtaining any court authorization to use the device. The police department in Tucson, Arizona,
has admitted in court-filed pleadings that while it has used IMSI catchers on at least five
occasions, it has never obtained a warrant to do so and has no records of having obtained any
other kind of court order authorizing use of the device; similar revelations have been made in
Sacramento, California where the Sheriff almost certainly has a IMSI catcher, but the District
Attorney’s Office and superior court judges state they have no knowledge of the device being
used.36
4
B.
Pen register/trap and trace order?
It appears that DOJ recommends that the government obtain an order under the Pen
Register/Trap and Trace Statute (“Pen/Trap Statute”) when using an IMSI catcher to identify a
target phone’s unique numeric identifier or location. The DOJ documents are somewhat
inconsistent and it is unclear if DOJ’s position is that a Pen/Trap order is necessary or merely a
“best practice.”
Under the Pen/Trap Statute, the government may obtain an order authorizing installation
of a pen register or trap and trace device upon an application certifying that “the information
likely to be obtained is relevant to an ongoing criminal investigation.” 18 U.S.C. § 3122(b)(2).
A pen register is typically understood to be a device that records the numbers dialed by a
particular telephone; a trap and trace device records the incoming numbers to a telephone.37 The
Pen/Trap Statute was amended in 2001 to expand the definition of pen/trap devices to include
not only devices that capture incoming and outgoing numbers, but also those that capture
“signaling information.” 38
DOJ has taken the following positions:

Pen/Trap order necessary and sufficient to obtain numeric identifier and location
information. DOJ’s 2005 Electronic Surveillance Manual states that a Pen/Trap order
“must be obtained by the government before it can use its own device to capture the
[unique numeric identifier] of a cellular telephone” and that a Pen/Trap order would
also suffice to obtain location information.39

Pen/Trap order merely considered a “best practice” to obtain numeric identifier and
location information. Elsewhere, however, the same manual states: DOJ “[does] not
concede that a device used to receive[s] radio signals, emitted from a wireless cellular
telephone” and that “identif[ies] that telephone to the network,” in other words, an
IMSI catcher, constitutes a ‘pen register’ or ‘trap and trace’ device,” but recommends
an application for court authorization “out of an abundance of caution.”40 A 2008
PowerPoint training on “Cellular Tracking and Other Legal Issues” produced by the
FBI in a FOIA lawsuit describes use of a Pen/Trap order as a “best practice” when
using “Cellsite Simulators” to “[i]dentify a target phone or . . . [l]ocate a phone.”41

Pen/Trap order necessary to obtain numeric identifier; position as to location
information unclear. A 2013 DOJ document asserts that a Pen Trap Order is
necessary (i.e., not merely a “best practice” or sought “out of an abundance of
caution”), at least when the government seeks to identify the unique numeric
identifier of a target phone using an IMSI catcher.42 The publicly available portion of
the 2013 document does not address DOJ’s position with respect to using a Pen/Trap
order to obtain a target phone’s location with an IMSI catcher.
5
Any argument that a Pen/Trap order suffices to obtain location information is noteworthy
in light of the Communications Assistance for Law Enforcement Act (“CALEA”). Congress
enacted CALEA in 1994 for the purpose of requiring telecommunications carriers to adopt the
technology necessary to provide, upon appropriate court order, content and “call-identifying
information” to law enforcement.43 The statute, however, expressly prohibits use of a Pen/Trap
order to obtain location information: “with regard to information acquired solely pursuant to the
authority for pen registers and trap and trace devices . . . such call-identifying information shall
not include any information that may disclose the physical location of the subscriber . . . . ”44
DOJ’s 2005 Electronic Surveillance Manual states that the government can, notwithstanding
CALEA, use an IMSI catcher to obtain location information because CALEA’s “prohibition
applies only to information collected by a provider and not to information collected directly by
law enforcement authorities.”45
C.
Hybrid Order?
Although some DOJ materials state that a Pen/Trap order suffices when the government
uses an IMSI catcher to obtain location information, other materials appear to recommend use of
a so-called “hybrid order” for this purpose.
A hybrid order is the same type of order that DOJ contends is sufficient to obtain
prospective, or real-time, cell site location information from a wireless carrier.46 As noted above,
CALEA prohibits the government from relying “solely” on a Pen/Trap order to obtain location
information from a carrier.47 Under the hybrid theory, the government justifies acquisition of
location information from wireless carriers by combining the Pen/Trap Statute with the Stored
Communications Act (“SCA”), 18 U.S.C. § 2703(d), which authorizes the government to obtain
records from a provider pertaining to certain kinds of records or information pertaining to
customers or subscribers. The relevant provision of the SCA requires the government to set forth
“specific and articulable facts showing that there are reasonable grounds to believe that the . . .
records or other information sought, are relevant and material to an ongoing criminal
investigation.”48 Notably, a significant majority of courts have held that a hybrid order does not
suffice to obtain prospective cell site location information, and that a warrant is instead
required.49
An IMSI catcher, like an order for prospective cell site information, obtains location
information in real time. DOJ’s 2005 Electronic Surveillance Manual includes a template
application for a hybrid order that authorizes use of a device that appears to be an IMSI catcher.50
Although the template application refers to the device as a “pen register,” the template’s brief
allusions to the manner in which the device operates strongly suggests that the device at issue is
actually an IMSI catcher.51
Note that although DOJ’s template application for a hybrid order provides some
description of how the device functions, actual IMSI catcher applications filed in court provide
no such information. In United States v. Rigmaiden, 844 F. Supp. 2d 982 (D. Ariz. 2012), for
example, the government ultimately acknowledged it used an IMSI catcher, but its affidavit in
support of the relevant court order nowhere referred to an IMSI catcher or explained how the
6
device functions. The affidavit instead made fleeting references to an unspecified “mobile
tracking device,” and the only description of how the device works stated that “[t]he mobile
tracking equipment ultimately generate[s] a signal that fixes the geographic position of the
Target [Device].”52
In short, DOJ appears to take the position that a hybrid order suffices to authorize use of
an IMSI catcher to identify a target phone’s location in real time, even though most courts have
rejected the related argument that a hybrid order suffices when the government seeks to obtain
real-time location information from a carrier. In addition, DOJ’s template application for an
order authorizing use of an IMSI catcher to obtain location information nowhere uses the term
“IMSI catcher” or any other related term, and instead is styled as an application to install a
“pen register.” Finally, even though DOJ’s template application for an IMSI catcher contains
some description (albeit minimal) of how the technology functions, actual IMSI catcher
applications filed in court do not.
D.
Warrant?
In at least some instances, the federal government has sought warrants to use a StingRay
to obtain location information.53 Warrants, of course, require, among other things, the
government to establish probable cause and to state with particularity the place to be searched,
and the persons or things to be seized.54
IV.
What guidance have courts offered on StingRays?
Only a handful of published decisions have addressed IMSI catchers.
The earliest reported decision involved an early-generation IMSI catcher called a “digital
analyzer.” See In re Application for an Order Authorizing Use of a Cellular Telephone Digital
Analyzer, 885 F. Supp. 197 (C.D. Cal. 1995) (hereinafter “In re Digital Analyzer”). The
government submitted an application for a Pen/Trap order to use the device to detect the unique
numeric identifier of the cell phones used by five subjects of a criminal investigation. See id. at
199. The opinion contains two main holdings, each somewhat difficult to reconcile with the
other. The government contended, and the court agreed, that no court order was required
because the device – which is not physically attached to a telephone – did not fall under the
statutory definition of a pen register or trap and trace device then in effect. See id. at 199-200
(citing 18 U.S.C. § 3127(3) & (4)). The court went on to hold, however, that to the extent some
procedure was required, the government’s proposed procedure lacked sufficient safeguards. See
id. at 201. The court then denied the application for an order authorizing use of the device,
without prejudice to a renewed application proposing greater safeguards. See id. at 202.
More recently, the court in In re Application for an Order Authorizing Installation and
Use of a Pen Register and Trap and Trace Device, 890 F. Supp. 2d 747 (S.D. Tex. 2012)
(hereinafter “In re StingRay”), also denied the government’s application for a Pen/Trap order to
use an IMSI catcher to ascertain a suspect’s telephone number. Although the statute had been
expanded in 2001, after In re Digital Analyzer, to set forth a broader definition of “pen
7
register,”55 the court still concluded that the statute was inapplicable. See id. It held that a
Pen/Trap order is only available for known telephone numbers, and not to ascertain unknown
numbers. See id. But, unlike the Central District of California, the Southern District of Texas
did not hold that, given the inapplicability of the Pen/Trap Statute, no court order was required.
Instead, it strongly suggested that a warrant would instead be necessary. See id. at 752. It also
criticized the government’s application for failing to “explain the technology, or the process by
which the technology will be used to engage in electronic surveillance” or to address key facts
about the government’s proposed operation of the device and handling of third-party data. Id. at
749.
This case suggests that even technology savvy magistrates, such as those in the Southern
District of Texas, are not familiar with the device and have many unanswered questions about
how it works. As discussed above, the template application to use an IMSI catcher in DOJ’s
Electronic Surveillance Manual nowhere explicitly mentions an IMSI catcher and instead refers
only to “pen register” devices, and actual applications and orders to use IMSI catchers filed in
court similarly make no explicit reference to IMSI catchers, let alone how they work.56 It is thus
very likely that judicial officers across the country are unaware that they are being presented
with requests and granting authorization to use IMSI catchers.
In Rigmaiden, a pro se defendant accused of electronic tax fraud succeeded through
creative discovery in forcing the government to concede what the government had not
acknowledged in any other criminal prosecution until that point, in particular, that:



the government used a “cell site simulator” to locate the defendant’s wireless device;
the cell site simulator “mimicked a Verizon Wireless cell tower and sent signals to, and
received signals from,” the defendant’s device; and
the cell site simulator “located [the defendant’s device] precisely within Defendant’s
apartment – Unit 1122 of the Domicilio Apartments.”
Id. at 995-96. In addition to these highly noteworthy factual concessions, the government also
conceded that the use of the cell site simulator was sufficiently intrusive to constitute a search
within the meaning of the Fourth Amendment. Id. This was highly significant, in light of the
position set forth in DOJ’s Electronic Surveillance Manual, that a Pen/Trap or hybrid order
suffices. See supra Section III.
Thereafter, Rigmaiden brought a motion to suppress on numerous grounds, including a
challenge to the use of the IMSI catcher. The government contended that it had obtained a
warrant to use the device. Rigmaiden, joined by amici ACLU and the Electronic Frontier
Foundation, contended, among other things, that the government had withheld constitutionally
material information from the issuing magistrate, rendering the order on which the government
relied an invalid general warrant. The application failed to alert the issuing magistrate that the
government intended to use an IMSI catcher and omitted constitutionally material information
about how the technology works, such as its impact on third parties.57 Emails obtained by the
ACLU of Northern California in a FOIA lawsuit suggest that the government’s failure to disclose
to the court information about IMSI catchers in its applications for authorization to use the
8
device was not isolated to the Rigmaiden case.58
Unfortunately, the court denied the motion to suppress. See United States v. Rigmaiden,
2013 WL 1932800 (D. Ariz. May 8, 2013). It held that information about how the IMSI catcher
operates was a mere “detail of execution which need not be specified.” Id. at *20. The court
also dismissed the significance of the government’s capturing of third-party information because
the government expunged the data. Id. at *22. Finally, although the court found that the
government did not violate the Fourth Amendment, it also found that the government acted in
good faith because the “agents were using a relatively new technology” and lacked legal
precedent on the type of warrant to be sought. Id. at *31.
In United States v. Espudo, 954 F. Supp. 2d 1029 (C.D. Cal. 2013), an IMSI catcher was
also used. But the court denied the motion to suppress, based on a government affidavit stating
that evidence from the IMSI catcher was not used to further the investigation. See id. at 1045. In
Thomas v. State, 127 So. 3d 658 (Fla. Dist. Ct. App. 2013), the police used unspecified
technology to track a cell phone to the defendant’s home. Id. at 659-60 & n.2. The ACLU
unsealed a transcript from a hearing in the court below and it confirms that the technology at
issue was an IMSI catcher.59 The appellate court in Thomas did not address the legality of the
use of the technology and resolved the case on other grounds. An IMSI catcher also was used in
Wisconsin v. Tate, No. 2012AP336 (Wis. Ct. App. June 5, 2011), a case now pending before the
Wisconsin Supreme Court.60 It is not clear if the court will reach the IMSI catcher issue, which
was not addressed by the court below.
V.
How can you tell if the government used a StingRay in your case?
There are very few cases addressing IMSI catchers, leaving the area ripe for litigation.
The challenge lies in determining whether an IMSI catcher was even used. Even in those
instances where the government obtains some kind of court authorization to use the device, the
application and order will very likely not refer to IMSI catcher technology. The FBI has publicly
acknowledged that it “has, as a matter of policy, for over 10 years, protected this specific
electronic surveillance equipment and techniques from disclosure, directing its agents that while
the product of the identification or location operation can be disclosed, neither details on the
equipment’s operation nor the tradecraft involved in use of the equipment may be disclosed.”61
There are, however, several indications that the government may have used an IMSI catcher in
any particular case.
A.
Terminology
While technologists use the term “IMSI catcher,” DOJ does not and instead uses widely
varying, inconsistent terms, including, but not limited to, digital analyzer, cell site simulator, cell
site emulator, cell site monitor, triggerfish, StingRay, kingfish, amberjack, hailstorm, and WITT,
in reference to the FBI’s Wireless Intercept Tracking Team. Be on the lookout for any of the
foregoing terms. But the government may also conceal use of an IMSI catcher by instead
referring to a “mobile tracking device” or “pen register,” even though the former term typically
refers to GPS devices (or so-called “bumper beepers”), and the latter to requests for information
9
from telephone service providers.62 In some instances, the government is even referring to an
unspecified “confidential source.”63 An indicator of potential IMSI catcher use, more reliable
than terminology, is how the government’s investigation actually unfolded.
B.
How did the government find out your client’s cell phone number?
IMSI catchers can be used to capture the unique numeric identifier, such as an Electronic
Serial Number or Mobile Identity Number, of a wireless device, and public DOJ documents
clearly contemplate use of this device for this purpose.64 The fact that applications and court
orders refer only to pen register devices does not rule out the possibility that an IMSI catcher was
used.
Obtaining the ESN, IMSI, MIN, or other identification number of a suspect’s phone is a
necessary predicate for a wiretap order or an order to a carrier for call records. If the government
obtained such orders in your case, but it is unclear how it obtained your client’s cell phone
number, or the only explanation is a highly cryptic reference to an unspecified “confidential
source” or “source of information” with no details as to the source, consider pursuing the issue of
an IMSI catcher in discovery. (An alternative possibility is that the government obtained the
number through another surveillance program known as the “Hemisphere project.”65)
C.
How did the government locate your client?
IMSI catchers are also used to locate targets of an investigation. The government is very
likely to offer alternative explanations for how it located a suspect to avoid disclosing that a
StingRay was used. One email from an FBI Special Agent in Rigmaiden read: “The tech guys
were able to narrow the signal to 3 apartments. Today, we will be doing as much follow up
research as we can. We need to develop independent probable cause of the search warrant…
FBI does not want to disclose the [redacted] (understandably so).” (Ellipsis in original).66 If
there was any point in the investigation when the government was able to identify the location of
your client, and even if the government offered non-StingRay related explanations for how it did
so, consider pursuing this issue in discovery.
VI.
Key legal arguments to raise if an IMSI catcher was used
There are several broad categories of constitutional concerns that arise from IMSI catcher
use. First, use of an IMSI catcher triggers Fourth Amendment scrutiny because it constitutes
both a search and a seizure within the meaning of the Fourth Amendment. Second, there is a
strong argument that IMSI catchers can never be used consistent with the Fourth Amendment
because they engage in the electronic equivalent of a “general search.” Third, law enforcement
must at least obtain a warrant; a statutory order does not suffice. Fourth, even if law
enforcement obtained a warrant, it is likely invalid. While precise legal arguments would vary
depending on the actual language of the warrant, one of two scenarios is likely. Any warrant
was likely based on an inaccurate affidavit that contained materially misleading statements or
omissions about the government’s intended use of an IMSI catcher; those material statements
and omissions render a warrant invalid. Alternatively, if the warrant is accurate in describing
10
the government’s intended and actual use of the IMSI catcher, then it almost certainly does not
satisfy particularity and breadth requirements and is facially invalid. Additional and more
specific legal arguments are almost certainly available, depending on the particular facts and
circumstance of each case.
A.
IMSI catchers trigger Fourth Amendment scrutiny
IMSI catchers are so intrusive that they violate both reasonable expectations of privacy
and property interests. Their use therefore constitutes a search within the meaning of the Fourth
Amendment. They also give rise to Fourth Amendment seizures.
1.
Use in connection with residences
IMSI catchers invade reasonable expectations of privacy because they can be used to
ascertain the location or unique numeric identifier of a suspect’s cell phone, while the suspect is
located inside her private residence or other private space.67 The use of an electronic device to
determine information about the interior of private residences and other constitutionally
protected spaces clearly constitutes a Fourth Amendment search. See United States v. Karo, 468
U.S. 705, 715 (1984) (placing beeper into can of ether that was taken into a residence constituted
a search because it “reveal[ed] a critical fact about the interior of the premises”); Kyllo v. United
States, 533 U.S. 27, 34 (2001) (thermal imaging to detect heat from home constituted search).
An IMSI catcher allows the government to ascertain whether a suspect is located inside a
residence or the number of the cell phone she chooses to use while inside. This is all information
“about the interior of the premises that the Government is extremely interested in knowing and
that it could not otherwise have obtained without a warrant.” Karo, 468 U.S. at 716.
To be sure, the Supreme Court has held that individuals lack a reasonable expectation of
privacy for incoming and outgoing telephone numbers because the information is “voluntarily”
conveyed to the third party telephone company. See Smith v. Maryland, 442 U.S. 735, 745-46
(1979) (use of pen register does not constitute search). Relying on this rationale, a number of
courts have held, in the context of government requests for cell site location information from
wireless carriers, that individuals lack a reasonable expectation of privacy in the location of their
phone because the information was voluntarily conveyed to the carrier. See, e.g., In re
Application for Historical Cell Site Data, 724 F.3d 600, 614-15 (5th Cir. 2013) (hereinafter
“Fifth Circuit Decision”); United States v. Skinner, 690 F.3d 772, 778-79 (6th Cir. 2012); but see
In re Application for an Order Directing a Provider of Electronic Comm. Serv. to Disclose
Records, 620 F.3d 304, 317 (3d Cir. 2010) (rejecting government’s argument that subscribers
lack reasonable expectation of privacy in cell site location information because they have shared
their information with third party communications provider).
But these cases are distinguishable. First, when the government uses an IMSI catcher, it
obtains the information directly, not from a third party. Cf. Smith, 442 U.S. at 744 (telephone
subscriber “assume[s] the risk that the company would reveal to police the numbers he dialed”);
Fifth Circuit Decision, 724 F.3d at 610 (“the Government . . . draws a line based on whether it is
11
the Government collecting the information . . . or whether it is a third party, of its own accord
and for its own purposes, recording the information”). Second, there is nothing “voluntary”
about the information obtained by an IMSI catcher, which “force[s]” cell phones to transmit
signaling data.68 Third, an individual has a reasonable expectation of privacy about her
information when she is inside a residence or other private location, even if she would have no
such expectation for the same type of information when in a public place. Compare United
States v. Knotts, 460 U.S. 276, 281 (1983) (use of bumper beeper to track suspect’s location did
not constitute search because “[a] person travelling in an automobile on public thoroughfares has
no reasonable expectation of privacy in his movements from one place to another.”), with Karo,
468 U.S. at 715 (use of beeper to determine suspect “was actually in the house” constituted
search: “[t]he case is thus not like Knotts, for there the beeper told the authorities nothing about
the interior of Knotts’ cabin”). When using an IMSI catcher to locate someone or to identify the
number of the phone she chooses to use while inside a private location, the government is
obtaining “a critical fact about the interior of the premises,” Karo, 468 U.S. at 715, rather than
information emitted from a phone while the suspect is “traveling on public thoroughfares.”
Skinner, 690 F.3d at 781. The Supreme Court has warned that even if a rudimentary form of
surveillance technology appears not to effect a “‘significant’ compromise of the homeowner’s
privacy,” “we must take the long view” when “the Government uses a device that is not in
general public use, to explore details of the home that would previously have been unknowable
without physical intrusion.” Kyllo, 533 U.S. at 40.
Relatedly, use of an IMSI catcher in connection with residences may constitute a Fourth
Amendment search under a property rationale. To the extent investigators use portable IMSI
catchers while walking within the curtilage of a home,69 the use constitutes a search because it
entails a physical intrusion on constitutionally protected areas. See Florida v. Jardines, 133 S.
Ct. 1409, 1417 (2013) (use of drug-sniffing dog on front porch of home constituted search under
trespass theory); United States v. Broadhurst, 2012 WL 5985615 at *6 (D. Or. Nov. 28, 2012)
(use of “Shadow,” a handheld device that scans wireless networks to determine devices
connected to it, while on front lawn constituted search under trespass theory). Even without a
physical intrusion into the curtilage by the operator of an IMSI catcher, the IMSI catcher itself
broadcasts electronic signals that penetrate the walls of private locations. See supra Section II &
n.29. This “unauthorized physical penetration into the premises” constitutes a search. Silverman
v. United States, 365 U.S. 505, 509 (1961) (finding search where government used “spike mike,”
a microphone attached to spike inserted into walls of house); but see United States v. Jones, 132
S. Ct. 945, 949, 953 (2012) (holding that installation and monitoring of GPS on suspect’s vehicle
constituted search because of “physical intrusion” “for the purpose of obtaining information” but
observing that “[s]ituations involving merely the transmission of electronic signals without
trespass would remain subject to [reasonable expectation of privacy] analysis”).
2.
Use in public
IMSI catcher use in public locations may also trigger Fourth Amendment scrutiny.
An “intrusion on possessory interests” gives rise to a Fourth amendment seizure, even
when it occurs in a public place. United States v. Place, 462 U.S. 696, 705 (1983); see also id. at
12
707 (seizure occurred when agent told defendant at airport he was going to take luggage). The
types of IMSI catcher currently used by the government “capture” a target cell phone and
“force” it to disconnect from the carrier’s base station and instead “to register” with the
government’s fake base station.70 By commandeering a target phone in this fashion, the
government seizes it.
IMSI catcher use in public places may also constitute a search, depending on the type of
data collected and the duration of the surveillance. For example, IMSI catchers are capable of
intercepting content. See supra Section II. Although DOJ materials make clear that such
functions should be disabled absent a Title III wiretap order (18 U.S.C. § 2518),71 little is known
about state and local government protocols for using these devices. In any event, it is essential to
obtain discovery about the type of data that was actually collected by the government and, to the
extent voice, email, text messages or other private communications were obtained, the Fourth
Amendment and Title III or analogous state wiretap statutes are triggered. See United States v.
U.S. Dist. Ct. for the E. Dist. of Michigan, S. Div., 407 U.S. 297, 313 (1972) (“[T]he broad and
unsuspected governmental incursions into conversational privacy which electronic surveillance
entails necessitate the application of Fourth Amendment safeguards.”); Katz v. United States,
389 U.S. 347, 352 (1967) (caller in phone booth had reasonable expectation of privacy: “To read
the Constitution more narrowly is to ignore the vital role that the public telephone has come to
play in private communication”); United States v. Warshak, 631 F.3d 266, 286 (6th Cir. 2010)
(reasonable expectation of privacy in content of emails).
In addition, if the government used the IMSI catcher to monitor location over a prolonged
period, its use may constitute a search.73
72
B.
IMSI catchers engage in the electronic equivalent of a “general search”
and their use therefore violates the Fourth Amendment
IMSI catchers engage in the electronic equivalent of the general searches prohibited by
the Fourth Amendment. The Fourth Amendment was “the product of [the Framers’] revulsion
against” “general warrants” that provided British “customs officials blanket authority to search
where they pleased for goods imported in violation of the British tax laws.” Stanford v. Texas,
379 U.S. 476, 481-82 (1965). “General searches have long been deemed to violate fundamental
rights. It is plain that the [Fourth] [A]mendment forbids them.” Marron v. United States, 275
U.S. 192, 195 (1927). “[T]he Fourth Amendment categorically prohibits the issuance of any
warrant except one ‘particularly describing the place to be searched and the persons or things to
be seized.’ The manifest purpose of this particularity requirement was to prevent general
searches.” Maryland v. Garrison, 480 U.S. 79, 84 (1987); see also Marron, 275 U.S. at 196
(particularity requirement prohibits general searches by “prevent[ing] the seizure of one thing
under a warrant describing another”). By scooping up all manner of information from a target
cell phone, as well as all nearby cell phones, an IMSI catcher engages in “general, exploratory
rummaging.” Coolidge v. New Hampshire, 403 U.S. 443, 467 (1971); see also United States v.
Tamura, 694 F.2d 591, 595 (9th Cir. 1982) (“[T]he wholesale seizure for later detailed
examination of records not described in a warrant . . . has been characterized as ‘the kind of
investigatory dragnet that the fourth amendment was designed to prevent.’”).
13
The device scoops up all signaling information from a suspect’s cell phone, rather than
targeting evidence of particular crimes as to which there is probable cause. See, e.g., Groh v.
Ramirez, 540 U.S. 551, 563 (2004) (finding invalid warrant that authorized seizure of suspect’s
house and that failed to identify any particular items and explaining that “a search warrant for
‘evidence of crime’ was ‘[s]o open-ended’ in its description that it could ‘only be described as a
general warrant’”) (quoting United States v. Stefonek, 179 F.3d 1030, 1032-33 (7th Cir. 1999));
United States v. Kow, 58 F.3d 423, 427-28 (9th Cir. 1995) (warrant overbroad where it
authorized widespread seizure of documents at business even though affidavit contained only
probable cause pertaining to profit skimming and tax violations); United States v. Cardwell, 680
F.2d 75, 77 (9th Cir. 1982) (warrant overbroad where it permitted seizure of all of “appellants’
business papers” that were “instrumentality or evidence of violation of the general tax evasion
statute”). For example, if an individual is suspected of using a phone to engage in criminal
activity in the park during the day, what is the probable cause to obtain signaling data from the
phone she uses when she is at home at night? The constitution “demands” that the surveillance
“be conducted in such a way as to minimize the” collection of information unsupported by
probable cause. United States v. Koyomejian, 970 F.2d 536, 542 (9th Cir. 1992) (adopting
minimization and other requirements, in addition to probable cause, for warrants to conduct
video surveillance).
In addition, an IMSI catcher also scoops up information from the devices of innocent
third parties as to whom the government has no probable cause, or reasonable suspicion,
whatsoever. See United States v. Whitney, 633 F.2d 902, 907 (9th Cir. 1980) (“The command to
search can never include more than is covered by the showing of probable cause to search.”)
(internal quotation marks, citation omitted).
In short, IMSI catchers operate in indiscriminate fashion, scooping up too much
information, from too many people. This is precisely the type of general rummaging prohibited
by the Fourth Amendment.
C.
Statutory orders do not suffice to authorize IMSI catcher use
At a minimum, however, the government should presumptively obtain a probable cause
warrant because the government’s use of an IMSI catcher constitutes a Fourth Amendment
search and/or seizure. See supra Section VI-A; Kyllo, 533 U.S. at 40 (surveillance that
constitutes “search” is “presumptively unreasonable without a warrant”).
DOJ contends that a Pen/Trap or hybrid order suffices. See supra Section III-B&C. But
these statutory orders – based on “relevant” or “relevant and material” standards (see 18 U.S.C. §
3122(b)(2); 18 U.S.C. § 2703(d)) – do not satisfy the Fourth Amendment’s probable cause
requirement or other safeguards.
Note also that DOJ materials suggest that the government seeks a Pen/Trap order when
using an IMSI catcher to obtain a device’s unique numeric identifier, but a hybrid order to obtain
location information. See supra Section III-B&C. Warrants, rather than statutory orders, should
14
be obtained in both cases. There is no reason to apply a different legal standard depending on
the government’s motivation in using the IMSI catcher. This is so because IMSI catcher
technology operates in the same fashion and captures the same type of signaling data – and thus
invades privacy expectations and property interests, and effects seizures to the same degree –
whether the government deploys the device for the purpose of obtaining the unique numeric
identifier of a suspect’s device in a known location, or the location of a suspect whose device’s
numeric identifier is known. In both instances, the IMSI catcher engages in the same dragnet.
D.
Even if the government obtained a warrant, use of an IMSI catcher is still
invalid
Even if a court were to conclude that IMSI catchers are not per se violative of the Fourth
Amendment and assuming law enforcement obtained a warrant, there are likely strong arguments
that use of an IMSI catcher was still illegal. It is impossible to anticipate all of the potential
arguments, which will depend on the language of the warrant and the execution of the search.
This section sets forth potential challenges that address two alternative scenarios, one in which
the warrant and application fail to describe the government’s intended use of an IMSI catcher
and another in which they do.
1.
The government’s omission of information about new surveillance
technology from a warrant application prevents courts from
exercising their constitutional oversight function and would
render a warrant invalid
A warrant application for authorization to use an IMSI catcher is very likely to be
inaccurate. See supra Section III-C & V at n.61 (discussing FBI policy of non-disclosure). In
particular, it may omit the critical fact that the government intends to use an IMSI catcher,
provide affirmatively misleading information that the government intends to use a pen register
instead, or fail to provide any information on what the technology is and how it works.74
New technology often raises complex and cutting edge constitutional questions. Cf., e.g.,
Jones, 132 S. Ct. at 946-47 (addressing whether installation and monitoring of GPS device
constitutes a “search” within the meaning of the Fourth Amendment). These are questions for
the courts, and not the government unilaterally, to decide. The Fourth Amendment assigns
judicial officers a critical role in ensuring that all aspects of a search are supported by probable
cause and are not overly intrusive. See United States v. Spilotro, 800 F.2d 959, 963 (9th Cir.
1986). Judicial supervision is particularly important with evolving technology, where there is a
heightened risk of overly intrusive searches. See United States v. Comprehensive Drug Testing,
Inc., 621 F.3d 1162, 1176 (9th Cir. 2010) (en banc) (hereinafter “CDT”).
Information about the government’s intended use of new technology, and how the
technology works, is material to pressing constitutional questions, such as whether all aspects of
the search are supported by probable cause. The courts cannot exercise their constitutional
oversight function if deprived of this information. A warrant application that fails to disclose the
15
government’s intended use of an IMSI catcher, or to provide basic information about the
technology, omits material information. Equally troubling is an application that refers to a “pen
register device” when the government actually intends to use an IMSI catcher. Both
circumstances require suppression. See United States v. Rettig, 589 F.2d 418, 422-23 (9th Cir.
1979) (suppressing information obtained from warrant procured on basis of material omission).
At a minimum, however, the defendant in such a case should be entitled to an evidentiary
hearing on whether the omission of information about the IMSI catcher is intentional and
material. See Franks v. Delaware, 438 U.S. 154 (1978).
a.
A warrant that fails to disclose the government’s intended
use of an IMSI catcher is predicated on a material omission
Information about the government’s intended use of an IMSI catcher is material. When
the government omits this information from its warrant application, it interferes with the court’s
ability to supervise the search and any evidence obtained from such a search should be
suppressed.
The misleading statements and/or omissions are likely to involve: (a) failure to state that
the government intends to use an IMSI catcher or, worse, an affirmative statement that the
government intends to use a “pen register” device, (b) failure to acknowledge that the IMSI
catcher will scoop up all signaling information from phones used by the target, including from
phones and at times and locations unrelated to suspected criminal activity, (c) failure to
acknowledge that the IMSI catcher will scoop up all signaling information from phones used by
third parties as to whom the government lacks probable cause or even reasonable suspicion,
and/or (d) failure to acknowledge that IMSI catchers are capable of capturing content and to
address whether that function has been disabled on the particular device.75
“Just as the Fourth Amendment prohibits warrantless searches generally, so too does it
prohibit a search conducted pursuant to an ill-begotten or otherwise invalid warrant.” Bravo v.
City of Santa Maria, 665 F.3d 1076, 1083 (9th Cir. 2011). One of the purposes of the Fourth
Amendment’s particularity requirement is to “ensure[] that the magistrate issuing the warrant is
fully apprised of the scope of the search and can thus accurately determine whether the entire
search is supported by probable cause.” Spilotro, 800 F.2d at 963. In Rettig, the Ninth Circuit
required suppression where the government withheld material information about the intended
scope of the search. 589 F.2d at 422-23 (after failing to obtain warrant for cocaine-related
evidence, government went to different magistrate seeking warrant for marijuana-related
evidence, and then conducted broad search including for cocaine-related items). “By failing to
advise the judge of all the material facts, including the purpose of the search and its intended
scope, the officers deprived him of the opportunity to exercise meaningful supervision over their
conduct and to define the proper limits of the warrant.” Id. at 422. “A judicial officer cannot
perform the function of issuing a warrant particularly describing the places to be searched and
things to be seized,” if “the agents withh[o]ld [material] information.” Id. at 423; see also Liston
v. Cnty. of Riverside, 120 F.3d 965, 974 (9th Cir. 1997) (finding information material where “the
magistrate would not have issued the warrant without requiring additional information and in
addition imposing specific restrictions on its execution”).76
16
Information that the government intends to use an IMSI catcher would prompt a
reasonable magistrate to “require[e] additional information.” Id. In ruling on a statutory
application to use an IMSI catcher, for example, one court conducted “an ex parte hearing . . .
with the special agent leading the investigation,” and faulted the government’s application for
not “explain[ing] the technology, or the process by which the technology will be used to engage
in the electronic surveillance.” In re StingRay, 890 F. Supp. 2d at 749. The court was
specifically troubled that the application contained “no discussion” about the manner in which
the government intended to operate the StingRay, and identified the numerous factual issues it
believed material to evaluating the government’s application. See id. This included information
about “how many distinct surveillance sites they intend to use, or how long they intend to
operate the StingRay equipment to gather all telephone numbers in the immediate area. It was
not explained how close they intend to be to the Subject before using the StingRay equipment.
They did not address what the government would do with the cell phone numbers and other
information concerning seemingly innocent cell phone users whose information was recorded by
the equipment.” Id.
In addition, some IMSI catchers are capable of capturing content. See supra Section II.
Notification that the government intends to use an IMSI catcher would prompt a reasonable
magistrate to inquire whether the device the government proposes to use has such a feature and,
if so, whether it has been disabled. Cf. 18 U.S.C. § 2518 (setting forth heightened standard for
wiretap orders).
Factual information of the type discussed above is necessary for the court to exercise its
constitutional duty to “define the proper limits of the warrant.” Rettig, 420 U.S. at 422. Such
limits include restrictions that would minimize the intrusive impact of the IMSI catcher on the
suspect, for example, by setting limits on when, where, and for how long the device is operated
(if the suspect is only believed to engage in criminal activity in parks in the afternoon, there is no
probable cause to collect information from the suspect when he is sleeping at home at night,
particularly when he may be using a different phone at that time and location), as well as by
prohibiting interception of content (absent compliance with requirements for a Title III wiretap).
These or similar limitations (e.g., prohibitions against using the device in dense
residential areas or at night when third parties are likely to be at home, restrictions on the size of
geographic area in which the device is used) would also serve to minimize the intrusion on third
parties. In addition to limiting the amount of third-party information collected, there is the
question of what to do with any such information (delete it immediately, segregate and redact).77
It is for the issuing magistrate, not the government, to determine how best to balance the
government’s need for information, third-party privacy, and the need to preserve evidence
“helpful to the accused.” United States v. Gamez-Orduno, 235 F.3d 453, 461 (9th Cir. 2000)
(“[S]uppression of material evidence helpful to the accused, whether at trial or on a motion to
suppress, violates due process if there is a reasonable probability that, had the evidence been
disclosed, the result of the proceeding would have been different.”).
17
Also noteworthy is any case in which the government submits an application seeking
authorization to use a “pen register device,” when the government actually intends to use an
IMSI catcher. See supra Section III & nn.50 & 51 (discussing template DOJ application). Such
an application would be especially misleading. A pen register device, by definition, is “a device
or process which records . . . signaling information transmitted by an instrument or facility, . . .
provided, however, that such information shall not include the contents of any communication.”
18 U.S.C. § 3127(3) (emphasis added). The statutory definition does not encompass a device
that records signaling information from multiple instruments in its vicinity, which is precisely
what an IMSI catcher does. Nor does it encompass devices, like IMSI catchers, which are
capable of capturing content. Relying on the statutory definition of “pen register,” a court would
be lulled into believing there were no need to seek additional information about the kind of data
intercepted by the IMSI catcher from the target, or to impose restrictions related to third parties.
In short, the failure to apprise the court that IMSI catchers scoop up all signaling
information from target and third-party cell phones leaves a court in the dark about the “intended
scope” of the search and thus deprives the court “of the opportunity to exercise meaningful
supervision over [the officers’] conduct and to define the proper limits of the warrant.” Rettig,
589 F.2d at 422.78 A warrant procured under these circumstances can “bec[o]me an instrument
for conducting a general search.” Id. at 423. As a result, “all evidence seized during the search
must be suppressed.” Id.79
b.
A defendant is entitled to a Franks hearing
Alternatively, a defendant should be entitled to an evidentiary hearing under Franks to
determine whether the affidavit misrepresented or omitted material facts. “To allow a magistrate
to be misle[]d . . . could denude the probable cause requirement of all meaning. Accordingly, a
Fourth Amendment violation occurs where the affiant intentionally or recklessly omitted facts
required to prevent technically true statements in the affidavit from being misleading.” Liston,
120 F.3d at 973 (internal quotation marks, citations omitted). A defendant seeking a Franks
hearing must “make[] a two-fold showing: intentional or reckless inclusion or omission, and
materiality.” United States v. Bennett, 219 F.3d 1117, 1124 (9th Cir. 2000).
Omissions or misrepresentations pertaining to the government’s intended use of an IMSI
catcher are material for the reasons discussed above. See supra Section VI-D-1-a. They are also
intentional.
In court-filed pleadings, the FBI has acknowledged that it has a longstanding policy of
not disclosing information about IMSI catchers.80 In addition, an internal email from the United
States Attorney’s Office for the Northern District of California shows that “many” law
enforcement agents in that district, under the auspices of pen register orders, were using the
device – but without “mak[ing] that explicit” in the application; even worse, this occurred after
the federal magistrates had expressed “collective concerns” that pen register orders would not
suffice to authorize use of the device.81 An email produced in discovery in Rigmaiden stated that
the investigative team “need[ed] to develop independent probable cause of the search warrant …
FBI does not want to disclose the [redacted] (understandably so).”82 In addition, the Sarasota
18
Police Department in Florida acknowledged, in an email obtained by the ACLU of Florida
through a public records request, that, “at the request of U.S. Marshalls,” local police officers
“simply refer to [information from an IMSI catcher] as ‘ . . . information from a confidential
source regarding the location of the suspect.’ To date this has not been challenged . . . .”83 All of
this demonstrates that the government’s omission of information about IMSI catchers – or
affirmative misrepresentation that it is instead using a “pen register” device or obtaining
information from a “confidential source” – is hardly innocent.84
Even in the absence of such stark revelations, it seems clear that misrepresentations and
omissions pertaining to the government’s use of IMSI catchers are intentional. The issue is not
whether the government should have followed-up on or disclosed facts not of its own making.
Cf. Bravo, 665 F.3d at 1087, 1088 (where officer obtained a warrant to search home, even
though he knew that suspect had received two-year prison sentence and thus not likely to be
living at his prior residence, officer’s “failure to . . . follow up and inquire about [the suspect’s]
custody status amounted to at least reckless disregard for the truth”). The government cannot
disclaim responsibility for knowing what device it has chosen to use.
Nor can ignorance about the technology excuse any omission. The functioning of the
technology has constitutional significance. It is therefore incumbent on the government to
understand the technology and disclose it to the courts. See In re Application of the U.S. for an
Order Pursuant to 18 U.S.C. § 2703(D), Nos. C-12-670M, C-12-671M, 2012 WL 4717778 *702
(S.D. Tex. Sept. 26, 2012) (rejecting application for so-called “cell tower dump,” i.e., all
information from specified cell towers: “[I]t is problematic that neither the assistant United
States Attorney nor the special agent truly understood the technology involved in the requested
applications. Without such an understanding, they cannot appreciate the constitutional
implications of their requests. They are essentially asking for a warrant in support of a very
broad and invasive search affecting likely hundreds of individuals in violation of the Fourth
Amendment.”).
*
*
*
In short, to the extent the warrant application fails to alert the issuing magistrate that the
government intends to use an IMSI catcher, misleadingly states it intends to use a “pen register,”
or fails to provide basic information about what the technology is and how it works, the
omissions are intentional and material. The defendant in such a case is therefore entitled to
suppression or a Franks hearing, to ensure that the government is not permitted to conduct
searches “pursuant to an ill-begotten or otherwise invalid warrant.” Bravo, 665 F.3d at 1083.
2.
A warrant that accurately describes the IMSI catcher’s capabilities
would be facially invalid
For the reasons discussed above, a warrant and application that inaccurately describes the
government’s intended use of an IMSI catcher should be held invalid. But it is possible that a
warrant and application will accurately describe the proposed use of the device. In that,
somewhat less likely event, the warrant will almost certainly fail to satisfy particularity or
breadth requirements and should thus be held facially invalid.
19
Particularity. “Particularity is the requirement that the warrant must clearly state what is
sought.” In re Grand Jury Subpoenas v. United States, 926 F.2d 847, 856 (9th Cir. 1991). This
means that the warrant must contain “limitations on which [items] within each category [can] be
seized [and] suggest[] how they relate[] to specific criminal activity.” Kow, 58 F.3d at 427. A
warrant is not sufficiently particular if it “provide[s] the search team with discretion to seize
records wholly unrelated to the” “crimes and individuals under investigation.” United States v.
SDI Future Health, Inc., 568 F.3d 684, 705 (9th Cir. 2009). A warrant that expressly authorizes
the search that an IMSI catcher will actually perform – a dragnet for all signaling information
from the suspect’s wireless device and all other devices in the vicinity of the IMSI catcher –
contains no practical limitations on the scope of the search and will authorize the government to
search and seize information entirely unrelated to the specific criminal activity of which the
target is suspected, as well as information from innocent third parties.
To be sure, courts will sustain warrants with “generic descriptions” of the information to
be searched and seized “where the government lacked information necessary to describe the
items to be seized more precisely.” Spilotro, 800 F.2d at 966. But warrants involving IMSI
catchers involve impermissibly “generic descriptions” because of the government’s choice to use
a technology that scoops up far more information than what actually “relate[s] to specific
criminal activity.” Kow, 58 F.3d at 427. That knowing choice does not excuse reliance on
“generic descriptions.” Indeed, the fact that searches performed by IMSI catchers are not
susceptible of being described with particularity underscores the grave concern that IMSI
catchers engage in the very general rummaging prohibited by the Fourth Amendment. See
Garrison, 480 U.S. at 85 (“By limiting the authorization to search to the specific areas and things
for which there is probable cause to search, the [particularity] requirement ensures that the search
will be carefully tailored to its justification, and will not take on the character of the wideranging exploratory searches the framers intended to prohibit.”); CDT, 621 F.3d at 1176 (noting,
in context of searches for electronic information, “serious risk that every warrant for electronic
information will become, in effect, a general warrant, rendering the Fourth Amendment
irrelevant”).
Overbreadth. Any warrant that accurately describes the search performed by an IMSI
catcher but that fails to impose explicit restrictions on how and when it is used would also be
overbroad because it would authorize the government to search and seize information from the
defendant unrelated to specific suspected criminal activity and also information pertaining to
third parties as to whom it lacks any probable cause.
“Courts have repeatedly invalidated warrants authorizing a search which exceeded the
scope of the probable cause shown in the affidavit.” In re Grand Jury Subpoenas, 926 F.2d at
857. A warrant is overbroad where the affidavit establishes probable cause to seize some but not
all materials from the target of an investigation. See, e.g., Kow, 58 F.3d at 427-28 (warrant
overbroad where it authorized widespread seizure of documents at business even though affidavit
contained only probable cause pertaining to profit skimming and tax violations); Center Art
Galleries-Hawaii, Inc. v. United States, 875 F.2d 747, 750 (9th Cir. 1989) (warrant overbroad
where it “failed to limit the warrants to items [at art gallery] pertaining to the sale of Dali artwork
despite the total absence of any evidence of criminal activity unrelated to Dali”); Spilotro, 800
20
F.2d at 965 (warrant invalid and “authorization to seize ‘gemstones and other items of jewelry’
[from business] was far too broad” because affidavit only established probable cause pertaining
to a few stolen diamonds).
Absent explicit restrictions on how and when it is used, an IMSI catcher would intercept
all information from a target’s phone about location and calls made, not merely location and calls
pertaining to suspected criminal activity. If used to identify the numeric identifier of the
phone(s) used by a suspect, it would also intercept the information from all phones used by the
suspect, not only the phone used in connection with suspected criminal activity.85 See supra
Section VI-A (discussing why interception of this information gives rise to a search and seizure).
While the suppression analysis will focus largely on the information obtained from the
defendant, it is also worth noting the impact on third parties. Courts are sensitive to overbreadth
issues when the search extends to third parties as to whom there is no probable cause at all. In
Maryland v. Garrison, the affidavit established probable cause to search the residence of one
individual, who was identified as living on the third floor of a particular apartment building; the
building, it turned out, had two units on the third floor and the question was whether the search
of the second unit was lawful. 480 U.S. at 81. “Plainly,” the Court emphasized, “if the officers
had known, or even if they should have known, that there were two separate dwelling units on
the third floor of [the building], they would have been obligated to exclude respondent’s
apartment from the scope of the requested warrant.” Id. at 85. Garrison thus makes clear that
officers are obligated to exclude from the scope of a requested warrant third parties as to whom
they lack probable cause.86
Severability and suppression. The Ninth Circuit “follow[s] the rule that where invalid
portions of a warrant may be stricken and the remaining portions held valid, seizures pursuant to
the valid portions will be sustained.” Spilotro, 800 F.2d at 967. But “[i]f no portion of the
warrant is sufficiently particularized to pass constitutional muster, then total suppression is
required. Otherwise the abuses of a general search would not be prevented.” Cardwell, 680 F.2d
at 78 (citation omitted). When confronted with an insufficiently particularized or an overbroad
warrant, a court must therefore first determine whether the defective portions of the warrant are
severable.
Relevant to the analysis is whether improperly authorized “items were set forth in
textually severable portions.” Spilotro, 800 F.2d at 968. It is exceedingly unlikely that a warrant
authorizing use of an IMSI catcher would use a formulation that distinguishes between signaling
information from the suspect’s device that pertains to suspected criminal activity and signaling
information that does not, or distinguishes between signaling information from the target device
and third-party devices. To the extent the warrant does not contain “identifiable portions [that
are] sufficiently specific and particular to support severance,” severance is not available. Id. at
967.
In addition, “severance is not available when the valid portion of the warrant is ‘a
relatively insignificant part’ of an otherwise invalid search.” In re Grand Jury Subpoenas, 926
F.2d at 858 (quoting Spilotro, 800 F.2d at 967); accord Kow, 58 F.3d at 428. To the extent the
21
government used an IMSI catcher to conduct a dragnet search for all signaling information from
the target (even from phones and at times and locations unrelated to suspected criminal activity)
and for all signaling information from all cell phones in the vicinity of the target (even from third
parties as to whom the government lacks probable cause), the information from the target cell
phone pertaining to criminal activity would be a “relatively insignificant part” of the warrant and
severance would not be available.87
Where a warrant is not severable, the remedy is blanket suppression. See Spilotro, 800
F.2d at 968 (ordering blanket suppression where warrant not severable); Cardwell, 680 F.2d at
78 (same); Kow, 58 F.3d at 428, 430 (same).
Good faith exception inapplicable. Courts have typically rejected the argument that the
“good faith” exception to the suppression doctrine, see United States v. Leon, 468 U.S. 897
(1984), applies where the warrant is facially invalid. See United States v. Clark, 31 F.3d 831,
836 (9th Cir. 1994) (where warrant was facially overbroad, “the officers could not reasonably
rely on it under the objective test of Leon”); Center Art Galleries-Hawaii, 875 F.2d at 753
(declining to apply good faith exception where “the warrants contained no meaningful restriction
on which documents could be seized”); Kow, 58 F.3d at 429 (“when a warrant is facially
overbroad, absent specific assurances from an impartial judge or magistrate that the defective
warrant is valid despite its overbreadth, a reasonable reliance argument fails”). Depending on
its language, a warrant authorizing the use of an IMSI catcher is likely “so overbroad that absent
some exceptional circumstance, no agent could reasonably rely on them.” Center Art GalleriesHawaii, 875 F.2d at 753.
VI.
CONCLUSION
Federal, state, and local law enforcement agencies have been using IMSI catchers to
engage in dragnet searches and seizures of information from cell phones without disclosing this
use to the courts or criminal defendants. By shrouding this technology in secrecy, the
government has succeeded in deploying a highly intrusive form of surveillance. In cases where
the government may have used an IMSI catcher, vigorous advocacy is necessary to obtain full
discovery and suppression of tainted evidence. Unless criminal defense attorneys pursue these
issues aggressively, the government will continue to write its own rules for conducting
surveillance, without the benefit of court oversight or an adversarial process.
22
APPENDIX
Issues to Pursue in Discovery
The following is a non-exhaustive list of issues to pursue in discovery broken into two
main topics. One set of issues is intended to ferret out whether the government used an IMSI
catcher, and the other presses on the constitutional implications of its use.
A.
Was an IMSI catcher used?
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
All subpoenas, court orders, and warrants, as well as applications and
affidavits in support thereof, for electronic surveillance, and returns
thereto.
All information obtained via each such subpoena, court order, or warrant.
All documents identifying equipment used to [identify the unique numeric
identifier associated with defendant’s cell phone] or [identify the
geographic location of the defendant’s cell phone].
All emails, notes, logs, reports (including but not limited to Investigation
Details Reports), and any other documents regarding efforts to [identify
the unique numeric identifier associated with defendant’s cell phone] or
[identify the geographic location of the defendant’s cell phone].88
All documents describing or reflecting categories of data (e.g., incoming
or outgoing telephone numbers; IP addresses; date, time and duration of
call; cell site ID; cell site sector; location area code; signal strength; angle
of arrival; signal time difference of arrival; ESN or MIN) obtained through
real-time tracking of the location of the defendant’s cell phone.89
All documents reflecting the cell site ID and location area code of the
device used to monitor the defendant’s cell phone.90
All documents reflecting the cell site IDs and location area codes collected
by the device used to monitor the defendant’s cell phone.91
All documents reflecting the GPS coordinates of any device while it was
mobile and was used to monitor the defendant’s cell phone.92
All information obtained through real-time tracking of the location of the
defendant’s cell phone.93
All reports of investigation, location calculations, and other relevant
documents authored and/or signed by the individuals who participated in
the investigation to [identify to the unique numeric identifier associated
with defendant’s cell phone] or [identify the geographic location of the
defendant’s cell phone].
All operator’s logs, training records, score sheets, certification records,
training standards, and training manuals related to the device used to
[identify to the unique numeric identifier associated with defendant’s cell
phone] or [identify the geographic location of the defendant’s cell
phone].94
23
12.
13.
14.
B.
All reports of investigation, location calculations, and other relevant
documents reflecting the agencies that participated in the investigation to
phone] or [identify the geographic location of the defendant’s cell
phone].95
All test protocols and results of tests performed on the device used to
phone] or [identify the geographic location of the defendant’s cell phone],
prior to deploying the device on the defendant’s cell phone. These test
results shall include, but not be limited to, base station survey results of
the immediate area where the defendant’s cell phone was [identified] or
[located].96
All experts’ qualifications, summary of expected testimony, list of cases in
which any such expert(s) has testified, and summary of the bases for any
expert opinion related to testimony regarding the [identification of the
unique numeric identifier associated with defendant’s cell phone] or
[identification of the geographic location of the defendant’s cell phone].
If an IMSI catcher was used, the following issues are material to a potential
motion to suppress.
1.
Topics and document requests that would shed light on the intrusive
nature of the IMSI catcher and why its use constituted a search:
a.
b.
Where was the IMSI catcher used? Was it used to determine that
the defendant was inside a private location such as a residence?
Was there a trespass to property in connection with its use?
(i)
All documents reflecting capacity of IMSI catcher to locate
cell phones while inside physical structures.
(ii)
All documents reflecting geographic accuracy with which
the IMSI catcher is able to locate the target cell phone.
All documents reflecting path movement of the IMSI
(iii)
catcher, including both the path the device traveled if used
on the inside of a vehicle or mounted on an aerial vehicle,
and the path the device traveled if carried by a human on
foot.
What kind of information did the IMSI catcher scoop up from the
defendant (relevant to whether use constituted a search and also
whether search was overbroad, i.e., not limited to information
pertaining to defendant’s suspected criminal activity)?
(i)
All documents describing categories of data (e.g., incoming
or outgoing telephone numbers; date, time and duration of
call; cell site number/sector or other information pertaining
to geographic location of cell phone; signal strength; ESN
24
c.
2.
or MIN; ping time; content of communications) collected
by the IMSI catcher from the defendant’s cell phone.
(ii)
All underlying data obtained by the IMSI catcher from the
defendant’s cell phone.
(iii)
[If defendant has more than one cell phone and one or more
has no connection to any criminal activity:] All documents
reflecting the numeric identifiers obtained from defendant’s
cell phones.
How long was the IMSI catcher used and at what times of day
(relevant to whether use constituted a search and also whether
search was overbroad, i.e., not limited to information pertaining to
defendant’s suspected criminal activity)?
(i)
All documents reflecting times during which IMSI catcher
was used.
Topics and document requests that would shed light on the intrusive
nature of the IMSI catcher and why its use constituted a seizure.
a.
Did the IMSI catcher interfere with the defendant’s possessory
interest in the cell phone?
(i)
Did the government’s use of the IMSI catcher deny the
target phone service?
(a)
All documents related to any agreements or
arrangements with the wireless carrier authorizing
the IMSI catcher to become part of its network or
authorizing the IMSI catcher to monitor a phone
that receives service through its network.
(b)
All documents pertaining to any forwarding of data
from defendant’s phone to the wireless carrier’s
network while the IMSI catcher was in operation.97
(c)
All documents reflecting impact of the use of the
IMSI catcher on access by the defendant’s cell
phone to cellular service.
(ii)
Try to document the fact that the IMSI catcher forces the
phone to establish a connection with it and in the process
forces the phone to transmit at full power, thus draining the
battery faster.98
(a)
All training materials, including but not limited to
training records, certification records, training
standards, and training manuals related to the device
used to [identify to the unique numeric identifier
associated with defendant’s cell phone] or [identify
the geographic location of the defendant’s cell
phone].99
25
(b)
3.
All user manuals related to the device used [identify
to the unique numeric identifier associated with
defendant’s cell phone] or [identify the geographic
location of the defendant’s cell phone].
Topics and document requests that would shed light on the
constitutionality of any warrant obtained:
a.
b.
c.
What kind of information did the IMSI catcher scoop up from the
defendant? See supra B-1-b.
What was the impact on third parties?100
(i)
All underlying data obtained by the IMSI catcher, whether
or not pertaining to the defendant’s cell phone.
(ii)
All documents reflecting the broadcast radius of the IMSI
catcher.
(iii) All documents reflecting the number of third-party cell
phones with which the IMSI catcher exchanged
information.
(iv)
All documents describing categories of data (e.g., incoming
or outgoing telephone numbers; date, time and duration of
call; cell site number/sector or other information pertaining
to geographic location of cell phone; signal strength; ESN
or MIN; ping time) collected by the IMSI catcher from the
third-party cell phones.
(v)
All underlying data obtained by the IMSI catcher from
third-party cell phones, replacing any actual unique
numeric identifiers with substitute numeric identifiers, to
protect third-party privacy interests.
(vi)
All documents regarding subsequent use or destruction of
third-party data obtained by the IMSI catcher.
(vii) All documents reflecting impact of the use of the IMSI
catcher on access by third-party cell phones to cellular
service.
(viii) All documents reflecting the data gathered by the IMSI
catcher while it conducted base station surveys prior to
being used to identify or locate the target cell phone.
Other
(i)
All policies and procedures governing IMSI catcher use,
including instructions about what court orders if any to
seek, what information to present to courts in seeking court
authorization, and standard operating procedures for using
IMSI catchers to [identify a unique numeric identifier
associated with a suspect’s cell phone] or [identify the
geographic location of a suspect’s cell phone].101
26
The government’s obligations under Brady v. Maryland, 373 U.S. 83 (1963), and Fed. R.
Crim. P. 16 extend to information relevant to a Fourth Amendment motion to suppress. Rule 16
requires the government to disclose in discovery items that are “material to preparing the
defense,” Fed. R. Crim. P. 16(a)(1)(E), including items that are materials to a possible motion to
suppress. See, e.g., United States v. Thomas, 726 F.3d 1086, 1096 (9th Cir. 2013) (reversing
conviction where government failed to disclose records regarding training and experience of
drug-detecting dog); see also United States v. Budziak, 697 F.3d 1105, 1111-12 (9th Cir. 2012)
(“Materiality is a low threshold; it is satisfied so long as the information in the [document] would
have helped [the defendant] prepare a defense.”); United States v. Feil, 2010 WL 3834978 *1
(N.D. Cal. Sept. 29, 2010) (finding defendants “entitled to discovery on the limited issue of
whether the investigation that led to this indictment is tainted by [an illegal] search”).
Defendants should be entitled to disclosure of the full extent of the electronic surveillance
used against them. Given the grave constitutional concerns raised by IMSI catchers, defendants
should have a right to information showing whether the government relied on them; for if it did,
defendants would have more than a reasonable probability of prevailing on a motion to suppress.
See Gamez-Orduno, 235 F.3d at 461 (“[S]uppression of material evidence helpful to the accused,
whether at trial or on a motion to suppress, violates due process if there is a reasonable
probability that, had the evidence been disclosed, the result of the proceeding would have been
different.”).
Note that the defendant in Rigmaiden sought in discovery highly “detailed technical
information related to the devices and techniques used during the [location tracking] mission.”
844 F. Supp. 2d at 998. The government opposed the discovery, invoking the qualified law
enforcement privilege recognized in Rovario v. United States, 353 U.S. 53 (1957) (qualified
privilege for identity of confidential informants). To avoid disclosure, the government made
significant factual and legal concessions – that a StingRay was used and that the device was
sufficiently intrusive to constitute a search within the meaning of the Fourth Amendment. See
844 F. Supp. 2d at 996. Based on these concessions, the defendant did not obtain all of the
information he had sought in discovery. See Rigmaiden, 844 F. Supp. 2d at 999 (“Because each
of Defendant’s reasons for obtaining this information has been satisfied by the government’s
concessions, no additional disclosure will be required.”). But the broad disclosure requests did
result in the government making significant factual concessions that were crucial to the
defendant’s ability to formulate a motion to suppress.
27
ENDNOTES
1
Harris, Wireless Products Group Price List, 4 (Sept. 2008),
https://info.publicintelligence.net/Harris-SurveillancePriceList.pdf (StingRay line of products
includes “Intercept Software Package” for GSM phones).
2
See Ryan Gallagher, Meet the Machines That Steal Your Phone’s Data, Ars Technica, (Sept.
25, 2013), http://arstechnica.com/tech-policy/2013/09/meet-the-machines-that-steal-yourphones-data/ (describing various models of Harris Corporation’s cell site simulators and related
equipment); see also Harris, Wireless Products Group, StingRay & AmberJack Product
Descriptions, http://egov.ci.miami.fl.us/Legistarweb/Attachments/34769.pdf (last visited June
18, 2014); Harris, Wireless Products Group, KingFish (Preliminary) Product Description, 2,
http://egov.ci.miami.fl.us/Legistarweb/Attachments/34771.pdf (last visited June 18, 2014).
3
See Electronic Privacy Information Center (“EPIC”), EPIC v. FBI – Stingray/Cell Site
Simulator, http://epic.org/foia/fbi/stingray/. A 2008 PowerPoint on “Cell Site Simulators”
includes a slide with the headline: “Increased Investigative Use of Technique” and a large arrow
pointing upward (the remainder of the text on the slide is redacted). See Letter from FBI to EPIC
Releasing Documents Pursuant to FOIA Request regarding Stingray/Cell Site Simulator Devices,
56 (Dec. 7, 2012), http://epic.org/foia/fbi/stingray/FBI-FOIA-Release-12072012-OCR.pdf
[hereinafter “FBI FOIA Release to EPIC”] (including “Cellular Tracking and Other Legal
Issues,” June 2008 PowerPoint, Slide 28).
4
See American Civil Liberties Union (“ACLU”), Stingray Tracking Devices: Who’s Got them?,
https://www.aclu.org/maps/stingray-tracking-devices-whos-got-them (last visited June 18, 2014).
5
For a compilation of known uses of this device by local law enforcement, see ACLU,
https://www.aclu.org/maps/stingray-tracking-devices-whos-got-them (last visited June 18, 2014).
See also, e.g., John Kelly, Cellphone data spying: It’s not just the NSA, USA TODAY, Dec. 8,
2013, http://www.usatoday.com/story/news/nation/2013/12/08/cellphone-data-spying-nsapolice/3902809/ (records from more than 125 police agencies in 33 states revealed that at least
25 departments own a StingRay); Michael Bott & Thom Jensen, 9 Calif. law enforcement
agencies connected to cellphone spying technology, SACRAMENTO NEWS 10, Mar. 6, 2014,
http://www.news10.net/story/news/investigations/watchdog/2014/03/06/5-california-lawenforcement-agencies-connected-to-stingrays/6147381/.
6
See generally Hearing on Electronic Communications Privacy Act (“ECPA”) Reform and the
Revolution in Location Based Technologies and Services Before the Subcomm. on the
Constitution, Civil Rights, and Civil Liberties of the H. Comm. on the Judiciary, 111th Cong., 4
(2010) [hereinafter “Blaze Congressional Testimony”] available at
http://www.crypto.com/papers/blaze-judiciary-20100624.pdf (statement of Professor Matt
Blaze).
7
Letter from US Department of Justice (“DOJ”) to ACLU of Northern California attaching USA
Book, Electronic Surveillance Manual Chapter XIV, 2 (Aug. 22, 2013), available at
https://www.aclunc.org/sr03 [hereinafter USA Book, Electronic Surveillance Manual Chapter
XIV] (obtained by the ACLU of Northern California in FOIA litigation).
8
See Stephanie K. Pell & Christopher Soghoian, A Lot More Than a Pen Register, and Less
Than a Wiretap: What the StingRay Teaches Us About How Congress Should Approach the
Reform of Law Enforcement Surveillance Authorities, 16 YALE J. OF L. & TECH. 134, 145-46
28
(2013-14) [hereinafter Pell & Soghoian]; Daehyun Strobel, IMSI Catcher, Ruhr-Universität,
Bochum, Germany, 13 (July 13, 2007) available at
http://www.emsec.rub.de/media/crypto/attachments/files/2011/04/imsi_catcher.pdf [hereinafter
Strobel] (“An IMSI Catcher masquerades as a Base Station and causes every mobile phone of the
simulated network operator within a defined radius to log in.”). IMSI catchers vary in their
operation, depending on among other things, whether the target phone is on a “GSM” (e.g.,
AT&T) or “CDMA” (e.g., Verizon) network. This paper focuses on the type of StingRays
currently in use.
9
DOJ Electronic Surveillance Unit, Electronic Surveillance Manual, 44 (June 2005) [hereinafter
Electronic Surveillance Manual], http://www.justice.gov/criminal/foia/docs/elec-sur-manual.pdf.
10
Jennifer Valentino-DeVries, Judge Questions Tools That Grab Cellphone Data on Innocent
People, WALL ST. J., Oct. 22, 2012, http://blogs.wsj.com/digits/2012/10/22/judge-questionstools-that-grab-cellphone-data-on-innocent-people/. See also Transcript of Hearing on Motion to
Suppress at 16, 23, Florida v. Thomas, Fla. Cir. Leon Cnty. Ct. (2010) (No. 2008-CF-3350A),
https://www.aclu.org/files/assets/100823_transcription_of_suppression_hearing_complete_0.pdf
[hereinafter “Florida v. Thomas, Hearing on Motion to Suppress”].
11
Pell & Soghoian, supra note 8, at 147 & n.43 (“Investigators can position a StingRay in the
vicinity of the target to capture the unique serial number of the target’s phone.”); see also
Executive Office for United States Attorneys, Electronic Investigative Techniques, 45 U.S.
ATTORNEYS’ BULLETIN 5, Sept. 1997 [hereinafter Electronic Investigative Techniques],
http://www.justice.gov/usao/eousa/foia_reading_room/usab4505.pdf at 13; In re Application for
an Order Authorizing the Installation and Use of a Pen Register and Trap and Trace Device,
890 F. Supp. 2d 747, 748 (S.D. Tex. 2012) (addressing request to use an IMSI catcher to identify
telephone number of subject of investigation; application for court order stated that device would
“detect radio signals emitted from wireless cellular telephones in the vicinity of the [Subject] that
identify the telephones (e.g., by transmitting the telephone’s serial number and phone number) to
the network for authentication” and that “[b]y determining the identifying registration data at
various locations in which the [Subject’s] Telephone is reasonably believed to be operating, the
telephone number corresponding to the [Subject’s] Telephone can be identified”); Criminal
Complaint, United States v. Arguijo, No. Under Seal (D. Ill. Feb. 13, 2012), Affidavit in support
of Criminal Complaint at 8 ¶10 n.1,
http://www.justice.gov/usao/iln/pr/chicago/2013/pr0222_01d.pdf (“On or about July 27, 2012,
pursuant to the Court’s Order, law enforcement officers familiar with Chaparro’s appearance,
having previously viewed photographs of him and observed him during prior surveillance, used a
digital analyzer device on three occasions in three different locations where Chaparro was
observed to determine the IMSI associated with any cellular telephone being carried by
Chaparro. Using the digital analyzer device, in conjunction with surveillance of Chaparro, law
enforcement determined that the telephone number bearing IMSI 316010151032079 was in the
same vicinity in the three separate locations where Chaparro was observed.”).
12
IMSI is “a unique number burned into a removable security identify module (SIM) card that
identifies a cell phone subscriber used in GSM and UMTS networks.” Thomas A. O’Malley,
Using Historical Cell Site Analysis Evidence in Criminal Trials, 59 U.S. ATTORNEYS’ BULLETIN
6, Nov. 2011 [hereinafter O’Malley],
http://www.justice.gov//usao/eousa/foia_reading_room/usab5906.pdf at 16, 20.
29
13
The ESN, used in a CDMA network, consists of a unique 32-bit number assigned to the phone
by the manufacturer. It is stored within the phone’s permanent memory, rather than on a
removable SIM card, and typically cannot be changed by the phone’s user. See
Telecommunications Industry Association, Electronic Serial Number Manufacturer's Code
Assignment Guidelines and Procedures Ver. 2.0, 6-7, 12 (Aug. 2008),
http://ftp.tiaonline.org/wcd/WCD%20Meeting%20Sept.%204%202008/WCD-20080904002_ESN_Guidelines_v2.0.pdf. The ESN is used by a carrier to connect the phone to a
subscriber account. See MobileBurn, What is “ESN?”,
http://www.mobileburn.com/definition.jsp?term=ESN (last visited June 18, 2014); Andy
Hellmuth, What is an ESN, and Why Should I Care?, (Sept. 16, 2011)
http://www.buymytronics.com/blog/post/2011/09/16/What-Is-An-ESN-And-Why-Should-ICare.aspx.
14
The MIN is a “34-bit number that is a digital representation of the 10-digit [telephone] number
assigned to a [cell phone].” 3rd Generation Partnership Project 2 “3GPP2”, Over-the-Air
Service Provisioning of Mobile Stations in Spread Spectrum Systems, § 1.2.1, 1.2 (Dec. 1999),
http://www.3gpp2.org/public_html/specs/c.s0016-0with3gcover.pdf. The MIN is “a unique
provider-assigned number for each cell phone in the cellular provider’s network.” O’Malley at
20.
15
See DOJ, Office of Enforcement Operations Criminal Division, Electronic Surveillance Issues,
153 (Nov. 2005) [hereinafter Electronic Surveillance Issues],
http://www.justice.gov/criminal/foia/docs/elec-srvlnce-issuse.pdf; Letter from Harris
Corporation to Raul Perez, City of Miami PD, Law Enforcement Trust Fund Sole Source Vendor
Letter, 6 (Aug. 25, 2008), http://egov.ci.miami.fl.us/Legistarweb/ Attachments/48003.pdf (Harris
Corporation “AmberJack” operates with other Harris products, “enabling tracking and location
of targeted mobile phones”).
16
See Florida v. Thomas, Hearing on Motion to Suppress, supra note 10, at 14; USA Book,
Electronic Surveillance Manual Chapter XIV, supra note 7, at 1.
17
Electronic Surveillance Manual, supra note 9, at 41 (“In order to provide service to cellular
telephones, providers have the technical capability to collect information such as the cell tower
nearest to a particular cell phone, the portion of that tower facing the phone, and often the signal
strength of the phone. Depending on the number of towers in a particular area and other factors,
this information may be used to identify the location of a phone to within a few hundred yards . .
. Carriers generally keep detailed historical records of this information for billing and other
business purposes.”).
18
See Pell & Soghoian, supra note 8, at 146-47 (“[U]nlike carrier-assisted surveillance, in which
the third-party provider necessarily has knowledge of surveillance performed and copies of
records disclosed at the request of law enforcement, the unmediated nature of the StingRay
dictates that only the operator of the device has: (1) knowledge that an interception ever took
place; and (2) . . . access to the information intercepted. Thus, to the extent that telephone
companies are able to act as a proxy for their customers’ privacy interests and may ‘push back’
against overbroad or otherwise improper government surveillance, no such advocate exists for
the target when a StingRay is used.”) (footnotes omitted).
19
See, e.g., PKI Electronic Intelligence, GSM Cellular Monitoring Systems (product brochure),
12, http://www.docstoc.com/docs/99662489/GSM-CELLULAR-MONITORING-SYSTEMS--PKI-Electronic-# (last visited June 23, 2014) (device can “locat[e] . . . a target mobile phone with
30
an accuracy of 2 m[eters]”); Bahia 21 Corporation, Resp. to National Telecommunications
Information Administration Notice of Inquiry (Doc. #100504212-0212-01) Requesting
Information on Preventing Contraband Cell Phone Use in Prisons, 3 (June 11, 2010),
http://www.ntia.doc.gov/files/ntia/comments/100504212-021201/attachments/BAHIA21%20resposne%20to%20NTIA%20NOI.pdf (a US surveillance vendor
offering fixed IMSI catchers to be installed in prisons to detect contraband cell phones,
promising 10-15m accuracy of geolocation identification).
20
See United States v. Rigmaiden, 844 F. Supp. 2d 982, 996 (D. Ariz. 2012).
21
Florida v. Thomas, Hearing on Motion to Suppress, supra note 10, at 15.
22
See Blaze Congressional Testimony, supra note 6, at 12 (cell site location information “[i]n
legacy systems or in rural areas . . . [may] specify only a radius of several miles, while in a dense
urban environment with microcells, it could identify a floor or even a room within a building.
How precise sector identity is depends on the particular location of the target and on the layout
of the particular carrier’s network.”).
23
See Pell & Soghoian, supra note 8, at 146 & n.36; Electronic Surveillance Manual at 41;
Harris, Wireless Products Group Price List, supra note 1, at 8 (StingRay line of products
includes “Intercept Software Package” for GSM phones); Active GSM Interceptor, Ability
http://www.interceptors.com/intercept-solutions/Active-GSM-Interceptor.html (last visited June
18, 2014) (describing IBIS II device: “The user can control the level of service to the target
mobiles, selectively Jam specific mobiles, perform silent calls, call or SMS on behalf of target
mobile, change SMS messages ‘on the fly,’ detect change of SIM card or change of handset, and
support Direction Finding system and many additional operational features); see also Juliam
Dammann, Presentation at the University of Bonn Seminar on Mobile Security: IMSI-Catcher
and Man-in-the-Middle Attacks, 5 (Feb. 9, 2011), http://cosec.bit.unibonn.de/fileadmin/user_upload/teaching/10ws/10ws-sem-mobsec/talks/dammann.pdf
[hereinafter Dammann] (“is able to eavesdrop”).
24
See Electronic Surveillance Manual, supra note 9, at 41. A wiretap order under Title III
requires, among other things, the government to show probable cause to believe that an
individual is committing a statutorily enumerated offense, probable cause to believe that
“particular communications concerning that offense will be obtained through such interception,”
and “normal investigative procedures have been tried and have failed or reasonably appear to be
unlikely to succeed if tried or to be too dangerous.” 18 U.S.C. § 2518(3).
25
See, e.g., Pell & Soghoian, supra note 8, at 145-46; HANNES FEDERRATH, PROTECTION IN
MOBILE COMMUNICATIONS 5 (Günter Müller et al. eds., Multilateral Security in
Communications) (1999), available at http://epub.uniregensburg.de/7382/1/Fede3_99Buch3Mobil.pdf; Strobel, supra note 8, at 13 (“possible to
determine the IMSIs of all users of a radio cell”). This paper focuses on “active IMSI catchers,”
which are the type of IMSI catcher currently and predominantly used by law enforcement. Early
models of IMSI catchers were “passive” and merely read transmissions, but did not simulate
base stations and force devices to connect with them.
26
Electronic Surveillance Manual, supra note 9, at 182.
27
Dammann, supra note 23, at 19.
28
Electronic Surveillance Manual, supra note 9, at 182 n.48.
29
The devices send signals like those emitted by a carrier’s own base stations. See, e.g., Harris,
Wireless Products Group, StingRay & AmberJack Product Descriptions, 1
31
http://egov.ci.miami.fl.us/Legistarweb/Attachments/34769.pdf (last visited June 19, 2014)
(“Active interrogation capability emulates base stations”). Those signals, of course, “penetrate
walls” (necessarily, to provide connectivity indoors). AT&T, What You Need to Know About
Your Network, http://www.att.com/gen/press-room?pid=14003 (last visited June 19, 2014); see
also E.H. Walker, Penetration of Radio Signals Into Buildings in the Cellular Radio
Environment, 62 THE BELL SYSTEMS TECHNICAL J. 2719 (1983) available at http://www.alcatellucent.com/bstj/vol62-1983/articles/bstj62-9-2719.pdf.
30
Strobel, supra note 8, at 13.
31
See USA Book, Electronic Surveillance Manual Chapter XIV, supra note 7, at 1 (“A cell site
simulator, digital analyzer, or a triggerfish can electronically force a cellular telephone to
register its mobile identification number (“MIN,” i.e., telephone number) and electronic serial
number (“ESN,” i.e.,, the number assigned by the manufacturer of the cellular telephone and
programmed into the telephone) when the cellular telephone is turned on”) (emphasis added).
32
Florida v. Thomas, Hearing on Motion to Suppress, supra note 10, at 15; see also id. at 12
(“[W]e emulate a cellphone tower. [S]o just as the phone was registered with the real verizon
tower, we emulate a tower; we force that handset to register with us.”) (emphasis added).
33
USA Book, Electronic Surveillance Manual Chapter XIV, supra note 7, at 1.
34
See Electronic Investigative Techniques, supra note 11, at 13-15, 23; Electronic Surveillance
Manual, supra note 9, at 41; USA Book, Electronic Surveillance Manual Chapter XIV, supra
note 7, at 1; see generally Electronic Surveillance Issues, supra note 15.
35
The ACLU of Northern California has filed two FOIA lawsuits to obtain DOJ’s polices,
practices, and procedures regarding location tracking in general and StingRays in particular.
DOJ has resisted producing the materials and the litigation is on-going. See ACLU of Northern
California et al. v. Dep’t of Justice, No. 12-cv-4008-MEJ (N.D. Cal. filed July 31, 2012) and
ACLU of Northern California v. Dep’t of Justice, No. 13-cv-3127-MEJ (N.D. Cal. filed July 8,
2013); see also Linda Lye, Fighting for Transparency, ACLU of Northern California Blog (July
31, 2012), https://www.aclunc.org/blog/fighting-transparency and Linda Lye, ACLU Sues
Government for Information About “Stingray” Cell Phone Tracking, ACLU of Northern
California Blog (July 8, 2013), https://www.aclunc.org/blog/aclu-sues-government-informationabout-stingray-cell-phone-tracking.
36
Reporter Beau Hodai, represented by the ACLU of Arizona, has sued the city of Tucson and
the Tucson Police Department for failing to disclose IMSI catcher documents in response to a
public records request. See Hodai v. City of Tucson, No. C20141225 (Ariz. Super. Ct. filed Mar.
4, 2014). An affidavit by Lieutenant Kevin Hall of the Tucson Police Department attached to the
defendants’ verified answer, filed on April 14, 2014, states: “I am not aware of a use of this
equipment by the Tucson Police Department wherein a warrant was obtained by the Tucson
Police Department” and “In each of the five cases where I personally know that the technology
was used, there is no written record of that use in the respective case reports and other
documents, and no public record that I can find documenting the use of the technology in those
cases.” Hall Aff. at ¶¶10, 14, available at
http://bloximages.chicago2.vip.townnews.com/azstarnet.com/content/tncms/assets/v3/editorial/6/
7f/67fb460f-c2f6-51b9-8639-a36371622133/537d2509b468c.pdf.pdf. And in Sacramento,
“[d]espite evidence showing the sheriff's department is utilizing the device, the Sacramento
County District Attorney’s Office and Sacramento Superior Court judges said they have no
knowledge of StingRays or similar tools being used in Sacramento.” Thom Jensen & Michael
32
Bott, Is sheriff's department using tracking and data-collecting device without search warrants?,
SACRAMENTO NEWS 10, June 23, 2014,
http://www.news10.net/story/news/investigations/2014/06/23/is-sacramento-county-sheriff-deptusing-stingray-to-track-collect-data/11296461/.
37
See Smith v. Maryland, 442 U.S. 735, 736 & n.1 (1979); United States v. Garcia-Villalba, 585
F.3d 1223, 1226 (9th Cir. 2009).
38
18 U.S.C. § 3127(3) & 3127(4), amended by Patriot Act, Pub. L. No. 107-56, Title II, §
216(c)(2)(A) & (3)(A), 215 Stat. 290 (2001).
39
See Electronic Surveillance Manual, supra note 9, at 41, 47-48.
40
See id. at 182 n.48.
41
See FBI FOIA Release to EPIC, supra note 3, at 32-33, 36-37 (Slides 1-2, 5-6).
42
See USA Book, Electronic Surveillance Manual Chapter XIV, supra note 7, at 1 (“a pen
register/trap and trace order must be obtained by the government before it can use its own device
to capture the ESN or MIN of a cellular telephone, even though there will be no involvement by
the service provider”) (emphasis added).
43
47 U.S.C. § 1002(a)(2); H.R. Rep. 103-827(I) (1994), reprinted in 1994 U.S.C.C.A.N. 3489,
3489-90.
44
47 U.S.C. § 1002(a)(2)(B).
45
Electronic Surveillance Manual, supra note 9, at 47.
46
See id. at 42-44; see also RICHARD M. THOMPSON, CONG. RESEARCH SERV., R42109,
GOVERNMENTAL TRACKING OF CELL PHONES AND VEHICLES: THE CONFLUENCE OF PRIVACY,
TECHNOLOGY, AND LAW, 12 (2011) [hereinafter Thompson], available at
https://www.fas.org/sgp/crs/intel/R42109.pdf.
47
See 47 U.S.C. § 1002(a)(2)(B).
48
18 U.S.C. § 2703(d).
49
See In re Application for an Order Directing a Provider of Elec. Commc’n Serv. to Disclose
Records to the Gov’t, 620 F.3d 304, 310 n.6 (3d Cir. 2010) (citing cases); Espudo, 954 F. Supp.
2d at 1038-39 (“A significant majority of courts have rejected the hybrid theory and has found
that real-time cell site location data is not obtainable on a showing of less than probable cause. A
minority of courts, on the other hand, have found that it is.”) (citations omitted); Thompson,
supra note 46, at 13-14 (citing cases).
50
See Electronic Surveillance Manual, supra note 9, at 175-87 (“Combined 3123/2703
Application”).
51
One of the requests built into the template is authorization to permit installation and use of the
“pen register and trap and trace device not only on the Subject Telephone Number[s], but also . .
. on any cellular phone that is within close proximity to the government device that may
autonomously register with the device . . . . ” See id. at 181-82 (emphasis added). A pen register
or trap and trace device would not cause cellular phones within a target phone’s vicinity to
register autonomously; an IMSI catcher would. The footnote to this template request goes on to
describe the device as one that is “used to receive radio signals, emitted from a wireless cellular
telephone, that merely identify that telephone to the network (i.e., registration data).” See id. at
n.48. This, too, appears to describe the operation of an IMSI catcher. Notably, the footnote also
takes the position that the device does not constitute a pen register or trap and trace device (and
that the application is nonetheless submitted “out of an abundance of caution”), and cites one of
the few known cases expressly addressing use of an IMSI catcher. See id. (citing In the Matter
33
of the Application of the U.S. for an Order Authorizing the Use of a Cellular Telephone Digital
Analyzer, 885 F. Supp. 197, 201 (C.D. Cal. 1995). See infra Section IV discussing this and other
cases on IMSI catchers.
52
Affidavit in Support of N.D. Cal. Order 08-90330 ¶42, at 34, United States v. Rigmaiden, No.
08-cr-00814-DGC (D. Ariz. Jan. 4, 2012), ECF No. 920-1 (Lye Decl., Exh. 2), available at
https://www.aclunc.org/sr04. Sample IMSI catcher orders introduced by the government in the
same case similarly provided no information about the unique and intrusive ways in which an
IMSI catcher functions. See, e.g., Supplemental Memorandum to Government’s Response to
Defendant’s Motion to Suppress, Exhibit 1 ¶¶3-4, at 2, United States v. Rigmaiden, No. 08-cr00814-DGC (D. Ariz. Jan. 4, 2012) [hereinafter “Sample IMSI Catcher Order”], ECF No. 986-1
(Sample IMSI Catcher Order Application from a Warrant for a Tracking Device in District of
Arizona proceeding, case number redacted), available at https://www.aclunc.org/sr05,
(“Applicant requests . . . authorization to install, operate, and monitor the mobile tracking device.
. . . The United States seeks the cellular telephone location information on an ongoing and realtime basis, including but not limited to identifying the specific nearest cell sites activated or
accessed by the target[’]s cellular telephone, and identifying the signal direction and strength of
communications between the activated cell site(s) and the targets[’]s cellular telephone. The
United States does not seek the content of any wire or electronic communications. Used in this
manner, the cellular telephone location information will generate data to track the general
location of the user of the target cellular telephone.”). There is no reference in these filed
applications and orders to the fact that “any cellular phone that is within close proximity to the
government device . . . may autonomously register with the device.” Electronic Surveillance
Manual, supra note 9, at 182 (sample application for hybrid order to use IMSI catcher).
53
See Sample IMSI Catcher Order, supra note 52.
54
U.S. CONST. amend IV.
55
See 18 U.S.C. §§ 3127(3), (4) (defining pen register and trap and trace devices to include not
only incoming and outgoing numbers but also “signaling information”).
56
See supra Section III-C (discussing hybrid orders).
57
See Brief Amici Curiae in Support of Daniel Rigmaiden’s Motion to Suppress at 7, United
States v. Rigmaiden, No. 08-cr-00814-DGC (D. Ariz. Jan 4, 2012), ECF No. 904-3, available at
https://www.aclu.org/files/assets/rigmaiden_amicus.pdf.
58
See, e.g., Jennifer Valentino-Devries, Judges Questioned Use of Cellphone Tracking Devices,
WALL ST. J., Mar. 27, 2013, http://blogs.wsj.com/digits/2013/03/27/judges-question-use-ofcellphone-tracking-devices/; Ellen Nakashima, Little-known surveillance tool raises concerns by
judges, privacy activists, WASH. POST, Mar. 27, 2013,
http://www.washingtonpost.com/world/national-security/little-known-surveillance-tool-raisesconcerns-by-judges-privacy-activists/2013/03/27/8b60e906-9712-11e2-97cd3d8c1afe4f0f_story.html; Linda Lye, DOJ Emails Show Feds Were Less Than ‘Explicit’ With
Judges On Cell Phone Tracking Tool, ACLU of Northern California Blog (Mar. 27, 2013),
https://www.aclu.org/blog/national-security-technology-and-liberty/doj-emails-show-feds-wereless-explicit-judges-cell.
59
See Florida v. Thomas, Hearing on Motion to Suppress, supra note 10, at 12 (“[W]e emulate a
cellphone tower. So just as the phone was registered with the real Verizon tower, we emulate a
tower; we force that handset to register with us. We identify that we have the correct handset
34
and then we’re able to, by just merely direction finding on the signal emanating from that
handset – we’re able to determine a location.”).
60
The brief filed by the defendant in the intermediate appellate court stated that “The ESN and
initial location data obtained from the cell phone company, together with the Stingray antenna
mounted on the police vehicle, led officers to the corner of a private apartment building where
the defendant’s cellular phone was located.” Brief of Defendant-Appellant at 8, Wisconsin v.
Tate, No. 2012AP336 (Wis. Ct. App. June 5, 2011), available at https://www.aclunc.org/sr02.
The case was argued in the state Supreme Court on October 3, 2013, but as of the date of this
publication, no opinion had yet issued. See Wisconsin Court System, State v. Bobby L. Tate
Case History,
http://wscca.wicourts.gov/appealHistory.xsl;jsessionid=1FC6F48B94D421C1C2ED4BA85548A
B98?caseNo=2012AP000336&cacheId=B14C504915CF7D52C2700564DA05E6C8&recordCo
unt=1&offset=0&linkOnlyToForm=false&sortDirection=DESC (last visited June 27, 2014).
61
See City’s Verified Answer, Hodai v. City of Tucson, No. C20141225 (Ariz. Super. Ct. filed
Mar. 4, 2014) (aff. of Bradley S. Morrison at 2), available at
7f/67fb460f-c2f6-51b9-8639-a36371622133/537d2509b468c.pdf.pdf.
62
See supra Section III.
63
According to emails obtained by the ACLU of Florida through a public records request, police
officers with the Sarasota Police Department in Florida “[i]n reports or depositions” “simply
refer [to information from an IMSI catcher] as ‘… information from a confidential source
regarding the location of the suspect.” They have done so “at the request of the U.S.
Marshalls.” See Email from Kenneth Castro, Sergeant, Sarasota Police Department, to Terry
Lewis, (Apr. 15, 2009, 11:25 EST) [hereinafter “Email from Kenneth Castro”], available at
https://www.aclu.org/sites/default/files/assets/aclu_florida_stingray_police_emails.pdf.
64
DOJ’s Electronic Surveillance Manual contains a template “Application for Order Permitting
Government To Use Its Own Pen Register/Trap and Trace Equipment (Triggerfish/Digital
Analyzer or Similar Device),” which states that the application seeks “an order authorizing the
installation and use of a pen register to identify the Electronic Serial Number (ESN) and Mobile
Identification Number (MIN) of a cellular telephone (being used by_ (if known)_) (within a
(color, make, model of vehicle) (bearing _ state license plate number_)).” Note that although the
internal DOJ title for the template refers to the “Triggerfish/Digital Analyzer or Similar Device,”
the actual text of the template application nowhere references any device other than a pen
register/trap and trace. See Electronic Surveillance Manual, supra note 9, at 171-72.
65
Particularly in the context of a drug case where a defendant used so-called “burner” phones,
frequently replacing one phone with another, the government may have obtained the new
telephone number through the “Hemisphere Project,” in which the “government pays AT&T to
place its employees in drug-fighting units around the country. Those employees sit alongside
Drug Enforcement Administration agents and local detectives and supply them with the phone
data from as far back as 1987.” Scott Shane & Colin Moynihan, Drug Agents Use Vast Phone
Trove Eclipsing N.S.A.’s, N.Y. TIMES, Sept. 1, 2013 at A1, available at
http://www.nytimes.com/2013/09/02/us/drug-agents-use-vast-phone-trove-eclipsing-nsas.html.
By matching calling patterns, the Hemisphere Project is able to identify replacement phone
numbers as targets of an investigation discard old ones. Do not expect to find any reference to
the Hemisphere Project, as law enforcement agents are trained “to never refer to Hemisphere in
35
any official document” and to “keep the program under the radar.” Office of Nat’l Drug Control
Policy, Los Angeles Hemisphere, Slides 8, 12, available at Synopsis of the Hemisphere Project,
N.Y. TIMES, Sept. 1, 2013, http://www.nytimes.com/interactive/2013/09/02/us/hemisphereproject.html.
66
First Submission of Consolidated Exhibits Relating to Discovery and Suppression Issues,
Exhibit 34 at 51, United States v. Rigmaiden, No. 08-cr-00814-DGC (D. Ariz. Jan 4, 2012), ECF
No. 587-2, (Email from Denise L Medrano, Special Agent, Phoenix Field Office, to Albert A.
Childress (July 17, 2008 6:01 AM)) (emphasis added), available at https://www.aclunc.org/sr06;
see also id. Exhibit 38 at 12, ECF No. 587-3, (Email from Fred Battista, Assistant United States
Attorney, to Shawna Yen (July 17, 2008 3:56 PM): “The main effort now may be to tie the target
to the case without emphasis on the [redacted].”), available at https://www.aclunc.org/sr07.
67
See, e.g., Thomas v. State, 127 So. 3d 658, 659-60 (Fla. Ct. App. 2013) (technology used to
track suspect to his apartment in a large apartment complex); United States v. Rigmaiden, 2013
WL 1932800 *3 (D. Ariz. 2013) (technology used to track suspect to “unit 1122 of the Domicilio
apartment complex in Santa Clara”).
68
See USA Book, Electronic Surveillance Manual Chapter XIV, supra note 7, at 1; Florida v.
Thomas, Hearing on Motion to Suppress, supra note 10, at 12 (“So just as the phone was
registered with the real Verizon tower, we emulate a tower; we force that handset to register with
us.”); id. at 17 (“once the equipment comes into play and we capture that handset, to make
locating it easier, the equipment forces that handset to transmit at full power”) (emphases added).
69
See Florida v. Thomas, Hearing on Motion to Suppress, supra note 10, at 15 (“[U]sing
portable equipment we were able to actually basically stand at every door and every window in
that [apartment] complex and determine, with relative certainty you know, the particular area of
the apartment that that handset was emanating from”).
70
See id. at 12, 15.
71
See USA Book, Electronic Surveillance Manual Chapter XIV, supra note 7, at 1.
72
We are not currently aware of IMSI catchers being used over prolonged periods, but this is an
issue that should be pursued in discovery.
73
Five justices of the Supreme Court agree that prolonged electronic location tracking, even
while a suspect travels in public areas, violates reasonable privacy expectations because it
generates a “precise [and] comprehensive” record about intimate details, such as “familial,
political . . . and sexual associations.” See Jones, 132 S. Ct. at 955 (Sotomayor, J., concurring);
accord id. at 964 (Alito, J., concurring). See also Commonwealth of Massachusetts v. Augustine,
467 Mass. 230, 254 (2014) (government’s collection of two weeks’ worth of cell site location
information from cellular provider invaded reasonable expectations of privacy); State of New
Jersey v. Earls, 214 N.J. 564, 588 (2013) (holding that New Jersey Constitution “protects an
individual’s privacy interest in the location of his or her cell phone”); People of the State of New
York v. Weaver, 12 N.Y.3d 433, 444-45 (2009) (installation and monitoring of GPS device on
vehicle to monitor suspect’s movements over 65-day period constitute search requiring a warrant
under New York Constitution); State of Washington v. Jackson, 150 Wash. 2d 251, 262, 264
(2003) (installation and use of GPS on vehicle constitutes search and seizure under Washington
Constitution because “24-hour a day surveillance possible through use of” device “intru[des] into
private affairs”); State of Oregon v. Campbell, 306 Or. 157, 172 (1988) (“use of radio transmitter
to locate defendant’s automobile” constituted search under Oregon Constitution; “[a]ny device
that enables the police quickly to locate a person or object anywhere within a 40-mile radius, day
36
or night, over a period of several days, is a significant limitation on freedom from scrutiny”);
State of South Dakota v. Zahn, 812 N.W.2d 490, 497-98 (2012) (installation and monitoring of
GPS device on suspect’s vehicle over 26-day period invaded reasonable expectations of privacy
and constituted search within meaning of Fourth Amendment).
74
In Rigmaiden, the government ultimately acknowledged it used an IMSI catcher, but its
affidavit in support of the warrant nowhere referred to the device. The affidavit instead made
fleeting references to an unspecified “mobile tracking device” and the only description of how
the device works stated “[t]he mobile tracking equipment ultimately generate[s] a signal that
fixes the geographic position of the Target [Device].” Affidavit in Support of N.D. Cal. Order
08-90330 ¶42, at 34, United States v. Rigmaiden, No. 08-cr-00814-DGC (D. Ariz. Jan. 4, 2012),
ECF No. 920-1 (Lye Decl., Exh. 2), available at https://www.aclunc.org/sr04. Similarly, in In re
StingRay, the government’s application requested authorization to install and use “a pen register
and trap and trace device”; apparently it was only after the court conducted an ex parte hearing
with the special agent leading the investigation that the agent “indicated that this equipment
designed to capture these cell phone numbers was known as a ‘stingray.’” 890 F. Supp. 2d at
748. The application did “not explain the technology, or the process by which the technology
will be used to engage in the electronic surveillance to gather the Subject’s cell phone number.”
Id. at 749.
75
Depending on the language of the warrant, a separate argument turning on scope may also be
available. See United States v. Hurd, 499 F.3d 963, 964 (9th Cir. 2007) (in evaluating whether
search falls outside the scope of a warrant, court looks to “the circumstances surrounding the
issuance of the warrant, the contents of the warrant, and the circumstances of the search”)
(internal quotation marks, citation omitted). If the contents of the warrant nowhere reference an
IMSI catcher, it may be possible to argue that the government’s use of the IMSI catcher fell
outside the warrant’s scope and was thus warrantless.
76
Bravo and Liston are civil cases, but claims by a criminal defendant about materially
misleading statements in an affidavit and civil claims of “judicial deception” are governed by the
same legal standard. See Liston, 120 F.3d at 972.
77
In Rigmaiden, the government deleted third-party information immediately after it used the
IMSI catcher to locate the defendant. See 2013 WL 1932800 at *20. Immediate deletion of this
information may mitigate some of the harm to third-party privacy interests, but it also deprives
the defendant of concrete evidence regarding the impact of IMSI catchers on third parties as to
which the government lacked probable cause, and the extent to which information about the
defendant was or was not a “relatively insignificant part of” the government’s overall dragnet.
Spilotro, 800 F.2d at 967. These issues bear directly on the warrant’s overbreadth and whether
blanket suppression is the appropriate remedy. A magistrate alerted to the existence of the third
party issue may choose to develop a procedure other than wholesale data purging, such as
“[s]egregation and redaction” of third-party information “by specialized personnel or an
independent third party.” See CDT, 621 F.3d at 1180 (Kozinski, C.J., concurring).
78
In Rigmaiden, the court denied the motion to suppress, opining that the application’s failure to
“disclose that the mobile tracking device would capture from other cell phones,” was a mere
“detail of execution which need not be specified under” Dalia v. United States, 441 U.S. 238,
258 (1979). Rigmaiden, 2013 WL 1932800 at *20. The court distinguished Rettig on the ground
that in the case before it, the “agents . . . did not seek to capture third-party cell phone and aircard
information so they could use it in a criminal investigation, nor is there any evidence that they
37
used the third-party information in that manner.” Id. But the Ninth Circuit in Rettig explicitly
faulted the government for failing to disclose not only the purpose of the search but also its
intended scope. See 589 F.2d at 422 (“By failing to advise the judge of all the material facts,
including the purpose of the search and its intended scope, the officers deprived him of the
opportunity to exercise meaningful supervision over their conduct and to define the proper limits
of the warrant.”) (emphasis added). Moreover, it is difficult to reconcile core Fourth
Amendment prohibitions on searches lacking in probable cause with the Rigmaiden’s court’s
characterization of this issue as a mere “detail of execution.”
79
In Rigmaiden, the court found that the Leon good faith doctrine applied because the “‘agents
were using a relatively new technology, and they faced a lack of legal precedent regarding the
proper form of a warrant to obtain the location information they sought.’” 2013 WL 1932800 at
*31. “There is no precedent,” the court stated, “suggesting that the agent was required to include
in his warrant application technical details about the operation of the mobile tracking device.”
Id. at *32. But it is precisely the lack of legal precedent about IMSI catcher technology and its
intrusive effect on third parties that imposes a duty on the officers to seek guidance from the
judicial officer. See Ctr. Art Galleries-Haw., 875 F.2d at 753 (“When the officer seeking a
warrant is aware of an overbreadth problem, . . . we can reasonably expect the officer to bring the
problem to an impartial magistrate’s or judge’s attention and to seek specific assurances that the
possible defects will not invalidate the warrant.”); see also CDT, 621 F.3d at 1178 (Kozinski,
C.J., concurring) (discussing “the government’s duty of candor in presenting a warrant
application”).
80
See City’s Verified Answer, Hodai v. City of Tucson, No. C20141225 (Ariz. Super. Ct. filed
Mar. 4, 2014) (aff. of Bradley S. Morrison at 2), available at
7f/67fb460f-c2f6-51b9-8639-a36371622133/537d2509b468c.pdf.pdf. (“[T]he FBI has, as a
matter of policy, for over 10 years, protected this specific electronic surveillance equipment and
techniques from disclosure, directing its agents that while the product of the identification or
location operation can be disclosed, neither details on the equipment’s operation nor the
tradecraft involved in use of the equipment may be disclosed.”).
81
The May 23, 2011 email chain was obtained by the ACLU of Northern California through a
FOIA request and is available at https://www.aclu.org/technology-and-liberty/us-v-rigmaidendoj-emails-stingray-applications; see also Linda Lye, DOJ Emails Show Feds Were Less Than
‘Explicit’ With Judges On Cell Phone Tracking Tool, ACLU of Northern California Blog (Mar.
27, 2013), https://www.aclu.org/blog/national-security-technology-and-liberty/doj-emails-showfeds-were-less-explicit-judges-cell.
82
First Submission of Consolidated Exhibits Relating to Discovery and Suppression Issues,
Exhibit 34 at 51, United States v. Rigmaiden, No. 08-cr-00814-DGC (D. Ariz. Jan 4, 2012), ECF
No. 587-2, (Email from Denise L Medrano, Special Agent, Phoenix Field Office, to Albert A.
Childress (July 17, 2008 6:01 AM)) (emphasis added), available at https://www.aclunc.org/sr06.
83
Email from Kenneth Castro, supra note 63.
84
Id.
85
As DOJ explains, an IMSI catcher intercepts “necessary signaling data” consisting of a target
device’s unique numeric identifier and location whenever the phone is on, and even if it is not
being used; when the phone makes or receives a call, an IMSI catcher captures not only the
device’s unique numeric identifier and location, but also “the call’s incoming or outgoing status,
38
the telephone number dialed, [and] the date, time, and duration of the call.” USA Book,
Electronic Surveillance Manual Chapter XIV, supra note 7, at 1.
86
See also Bravo, 665 F.3d at 1084-85 (reversing grant of summary judgment for government
defendants in civil challenge to lawfulness of search warrant where officer obtained warrant to
search home where suspect had previously resided but officer had no evidence that current
residents were involved in crime); Liston, 120 F.3d at 973-74 (officer not entitled to qualified
immunity where he obtained warrant to search home and “for sale” and “sold” signs in front yard
indicated third parties other than suspect occupied home).
87
While the government is likely to argue that criminal defendants do not have standing to raise
third party issues, the argument could be made that information about the IMSI catcher’s the
impact on third parties bears on questions of overbreadth and severability.
88
In Rigmaiden, references to “StingRays” appeared in documents pertaining to the
investigation. See Response to Government’s Memorandum Regarding Law Enforcement
Privilege, Exhibit 39 at 62, United States v. Rigmaiden, No. 08-cr-00814-DGC (D. Ariz. Jan 4,
2012), ECF No. 536-4 (rough notes prepared by IRS-CI Agent Denise L. Medrano) (handwritten
checklist: “utility search[,]…tax return search[,] Post office – verifying forwarding info[,] Run
plates[,] Review Video[,] Accurint[,] StingRay”), available at https://www.aclunc.org/sr08; First
Submission of Consolidated Exhibits Relating to Discovery and Suppression Issues, Exhibit 26
at 32, United States v. Rigmaiden, No. 08-cr-00814-DGC (D. Ariz. Jan 4, 2012), ECF No. 587-2
(United States Postal Inspection Service Investigation Details Report) (“During the course of this
investigation and conferring with TSD agents with the FBI and USPIS, we determined that doing
a normal ‘Trap and Trace’ on the aircard would suffice. [redacted] Essentially we would ping
the number associated to the card instead of collecting data from the aircard’s connection. . . . On
7/16/08, we were informed that they were able to track a signal and were using a ‘Stingray’ to
pinpoint the location of the aircard.”), available at https://www.aclunc.org/sr09.
89
A Pen/Trap device would capture the following types of data: phone numbers/IP addresses,
location area code (which identifies a group of cell sites and is not related to a phone number
area code), cell site ID, cell site sector, and possibly signal strength, singal angle of arrival, and
signal time difference of arrival (also called signal time of flight). An IMSI catcher would also
capture the foregoing types of data, except cell site IDs and location area codes being accessed
by the target phone. When a phone connects with and accesses the carrier’s network, it accesses
cell site IDs and location area codes. When it instead connects with an IMSI catcher, it is no
longer accessing the carrier’s network and hence is no longer accessing cell site IDs and location
area codes. If the data produced by the government in response to this request includes cell site
IDs and location area codes – and those cell site IDs and location area codes match those of the
carrier – the device used was a Pen/Trap.
90
A Pen/Trap device collects cell site IDs and location area codes but would not have its own
cell site ID and location area code. An IMSI catcher, however, has its own cell site ID and
location area code – and this cell site ID and location area code would not typically match any in
the wireless carrier’s network infrastructure. If the government provides data in response to this
request, the device used was an IMSI catcher. This assumes, however, that the prosecution
correctly understood the request and did not mistakenly provide cell site IDs and location area
codes collected by the surveillance device, rather than the cell site ID and location area code of
the surveillance device. It would be prudent to couple discovery on this issue with a subpoena to
the carrier for all location area codes, active cell sites, locations of active cell sites, and the
39
approximate coverage areas of each active cell site within range of where the defendant’s phone
was located or identified at the time it was monitored. This would allow comparison between
any cell site ID/location area code provided in response to this request with that of the actual
carrier.
91
See supra n. 90.
92
A typical Pen/Trap device will not log its own GPS coordinates, but an IMSI catcher would. It
may not however be programmed to retain its GPS coordinates. If the government provides GPS
coordinates of the device used to monitor the target phone – and those coordinates reflect
multiple geographical locations, or a single geographical location that is not the location of an
actual cell site – the device is an IMSI catcher.
93
It may be prudent to propose that identifying information pertaining to third parties be
redacted and replaced with unique numeric identifiers.
94
See United States v. Cedano-Arellano, 332 F.3d 568, 571 (9th Cir. 2003) (narcotics dog’s
training logs and certification discoverable under Rule 16). Training materials and reports
signed by individuals participating in the investigation (requests 10 and 11) would facilitate the
identification of the individuals involved in deploying the IMSI catcher.
95
If the investigation were led by a local police department but the FBI or United States
Marshals Service participated in tracking the phone, this might be an indication that a federal
agency provided its IMSI catcher.
96
Law enforcement may use an IMSI catcher to collect information on the carrier’s network. An
IMSI catcher can be used to conduct a base station survey. A Pen/Trap device would not. If a
base station survey is produced in response to this request, an IMSI catcher was used.
97
To prevent an interference with service to the defendant’s phone, the government would have
had to make some kind of arrangement with the carrier that would allow the IMSI catcher to
become part of its network or develop a mechanism to forward data from the phone to the
carrier’s network. If one of these arrangements occurred, some documentation should exist.
98
See Florida v. Thomas, Hearing on Motion to Suppress, supra note 10, at 17 (“[O]nce the
equipment comes into play and we capture that handset, to make locating it easier, the
equipment forces that handset to transmit at full power.”) (emphasis added.)
99
See Cedano-Arellano, 332 F.3d at 571 (narcotics dog’s training logs and certification
discoverable under Rule 16). Training materials may provide information regarding the
operation of the device, which might in turn shed light on forced registration and increased
power output.
100
While the government will likely argue that a defendant has no standing to raise third party
issues, there is an argument that the impact on third parties is relevant to overbreadth and
severability. See supra at Section VI-D-2.
101
This may shed light on whether any omission about IMSI catchers from a warrant affidavit is
intentional.
40
This publication can be found online at:
https://www.aclunc.org/publications/stingrays-most-common-surveillance-tool-governmentwont-tell-you-about
41
Case: 12-12928
Date Filed: 11/17/2014
Page: 1 of 32
Case No. 12-12928
_____________________________________________________________
IN THE UNITED STATES COURT OF APPEALS
FOR THE ELEVENTH CIRCUIT
____________________________________________________
UNITED STATES OF AMERICA
Plaintiff-Appellee,
v.
QUARTAVIOUS DAVIS,
Defendant-Appellant
_____________________________________________________________
On Appeal from the United States District Court
for the Southern District of Florida
The Honorable Joan A. Leonard
Case No. 1:10-cr-20896-JAL-2
______________________________________________________________
EN BANC BRIEF OF AMICUS CURIAE
ELECTRONIC FRONTIER FOUNDATION
IN SUPPORT OF APPELLANT
_____________________________________________________________
Hanni Fakhoury
Jennifer Lynch
815 Eddy Street
San Francisco, California 94109
(415) 436-9333
[email protected]
[email protected]
Counsel for Amicus Curiae
!
Case: 12-12928
Page: 2 of 32
United States v. Quartavious Davis
Case No. 12-12928
CERTIFICATE OF INTERESTED PERSONS
Pursuant to 11th Cir. R. 26.1-1, undersigned counsel for amicus curiae
Electronic Frontier Foundation certifies that the following list includes all persons
and entities having an interest in the outcome of this case, as well as all persons
and entities listed on all certificates filed in the appeal prior to the filing date of this
amicus curiae brief.
Agarwal, Amit
Altman, Roy
American Civil Liberties Union Foundation
American Civil Liberties Union Foundation of Florida, Inc.
Bankston, Kevin
Brown, Hon. Stephen T.
Caruso, Michael
Center for Democracy & Technology
Colan, Jonathan
Crump, Catherine
Davis, Quartavious
Dube, Hon. Robert L.
Electronic Frontier Foundation
!
C-1 of 5
Case: 12-12928
Page: 3 of 32
Case No. 12-12928
Fakhoury, Hanni
Ferrer, Wifredo A.
Fisher, Sylvester
Garber, Hon. Barry L.
Gold, Hon. Alan S.
Golembe, Stephen J.
Hayes, Anne M.
Kayanan, Maria
Korchin, Paul M.
Lenard, Hon. Joan A.
Lynch, Jennifer
Malone, Omar
Markus, Davis Oscar
Martin, Jahmal A.
Martin, Michael
Mayor’s Jewelers
McAliley, Hon. Chris M.
Michaels, Alexander J.
!
C-2 of 5
Case: 12-12928
Page: 4 of 32
Case No. 12-12928
Moss, Jr., Reginald A.
National Association of Criminal Defense Lawyers
Nojeim, Greg
O’Sullivan, Hon. John J.
Palermo, Hon. Peter R.
Perwin, Amanda
Quencer, Kevin S.
Reid, Jamarquis T.
Salyer, Kathleen M.
Schultz, Anne R.
Shapiro, Jacqueline E.
Sibila, Jorge A.
Smith, Willie
Stevenson, Benjamin James
Torres, Hon. Edwin G.
Turnoff, Hon. William C
Ungaro, Hon. Ursula
Wessler, Nathan Freed
!
C-3 of 5
Case: 12-12928
Page: 5 of 32
Case No. 12-12928
White, Hon. Patrick A.
Williams, Hon. Kathleen M.
Wizner, Ben
Zelman, Michael
!
C-4 of 5
Case: 12-12928
Page: 6 of 32
CORPORATE DISCLOSURE STATEMENT
Pursuant to Rule 26.1 of the Federal Rules of Appellate Procedure, amicus
curiae Electronic Frontier Foundation states that it does not have a parent
corporation and that no publicly held corporation owns 10% or more of the stock
of amicus.
!
C-5 of 5
Case: 12-12928
Page: 7 of 32
TABLE OF CONTENTS
CERTIFICATE OF INTERESTED ENTITIES ................................................... C-1
!
CORPORATE DISCLOSURE STATEMENT .................................................... C-5
!
TABLE OF CONTENTS .......................................................................................... i
!
TABLE OF AUTHORITIES .................................................................................... ii
!
STATEMENT OF INTEREST................................................................................. 1
!
STATEMENT OF THE ISSUE................................................................................ 2
!
SUMMARY OF ARGUMENT ................................................................................ 2
!
ARGUMENT ............................................................................................................ 4
I.
!
Americans Have a Subjective Expectation of Privacy in Location
Information. .................................................................................................... 4
A.
!
!
II.
!
III.
!
B.
Research Shows Americans Believe the Data on and Generated by
their Cell Phones is Private. ................................................................. 5
Courts Recognize the Privacy Implications of Location Information. 6
An Expectation of Privacy in Cell Phone Data Is Objectively Reasonable
Even Though the Data Is Held by a Phone Company. ................................... 9
The Nationwide Trend Toward Greater Protection for Privacy in Phone
Records and Location Information Shows Society Recognizes that a
Privacy Interest in this Data is Reasonable. ................................................. 13
CONCLUSION....................................................................................................... 17
!
CERTIFICATE OF COMPLIANCE ...................................................................... 18
!
CERTIFICATE OF SERVICE ............................................................................... 19
!
i
Case: 12-12928
Page: 8 of 32
TABLE OF AUTHORITIES
!
Federal Cases
Bond v. United States,
529 U.S. 334 (2000) ....................................................................................... 5
!
Doe v. Broderick,
225 F.3d 440 (4th Cir. 2000) ........................................................................ 13
!
Katz v. United States,
389 U.S. 347 (1967) ................................................................................. 3, 15
!
Kyllo v. United States,
533 U.S. 27 (2001) ..................................................................................... 2, 3
!
Oliver v. United States,
466 U.S. 170 (1984) ................................................................................. 4, 13
!
Oregon Prescription Drug Monitoring Program v. DEA,
998 F. Supp. 2d 957 (D. Ore. 2014) ............................................................. 11
!
Rehberg v. Paulk,
611 F.3d 828 (11th Cir. 2010) ...................................................................... 10
!
Riley v. California,
134 S. Ct. 2473 (2014) .......................................................................... passim
!
Smith v. Maryland,
442 U.S. 735 (1979) .............................................................................. passim
!
United States v. Brown,
743 F.2d 1505 (11th Cir. 1984) .................................................................... 13
!
United States v. Davis,
754 F.3d 1205 (11th Cir. 2014) .............................................................. 3, 8, 9
!
United States v. Jones,
132 S. Ct. 945 (2012) ............................................................................ passim
!
!
!
!
ii
Case: 12-12928
Page: 9 of 32
United States v. Lopez,
895 F. Supp. 2d 592 (D. Del. 2012) ............................................................. 16
!
United States v. Maynard,
615 F.3d 544 (D.C. Cir. 2010)...................................................................... 13
!
United States v. Nerber,
222 F.3d 597 (9th Cir. 2000) ........................................................................ 14
!
United States v. Powell,
943 F. Supp. 2d 759 (E.D. Mich. 2013) ....................................................... 16
!
United States v. Robinson,
414 U.S. 218 (1973) ..................................................................................... 10
!
United States v. Warshak,
631 F.3d 266 (6th Cir. 2010) ........................................................................ 11
!
Virginia v. Moore,
553 U.S. 164 (2008) ..................................................................................... 13
!
State Cases
Commonwealth v. Augustine,
4 N.E. 3d 846 (Mass. 2014) ................................................................... passim
!
Commonwealth v. Melilli,
555 A.2d 1254 (Pa. 1989)............................................................................. 14
!
Commonwealth v. Rousseau,
990 N.E.2d 543 (Mass. 2013) ....................................................................... 15
!
Commonwealth v. Rushing,
71 A.3d 939 (Pa. Sup. Ct. 2013)................................................................... 15
!
Ellis v. State,
353 S.E.2d 19 (Ga. 1987) ............................................................................. 14
!
People v. Blair,
602 P.2d 738 (Cal. 1979) .............................................................................. 14
!
!
iii
Case: 12-12928
Page: 10 of 32
People v. DeLaire,
610 N.E.2d 1277 (Ill.Ct.App. 1993) ............................................................. 14
!
People v. Sporleder,
666 P.2d 135 (Colo. 1983) ........................................................................... 14
!
People v. Weaver,
909 N.E.2d 1195 (N.Y. 2009) ...................................................................... 15
!
State v. Brereton,
826 N.W.2d 369 (Wis. 2013) ....................................................................... 16
!
State v. Campbell,
759 P.2d 1040 (Or. 1988) ............................................................................. 15
!
State v. Earls,
70 A.3d 630 (N.J. 2013) ..................................................................... 8, 11, 16
!
State v. Gunwall,
720 P.2d 808 (Wash. 1986) .......................................................................... 14
!
State v. Hunt,
450 A.2d 952 (N.J. 1982) ............................................................................. 14
!
State v. Jackson,
76 P.3d 217 (Wash. 2003) ............................................................................ 15
!
State v. Rothman,
779 P.2d 1 (Haw. 1989) ................................................................................ 14
!
State v. Shaktman,
553 So.2d 148 (Fla. 1989) ...................................................................... 12, 14
!
State v. Thompson,
760 P.2d 1162 (Id. 1988) .............................................................................. 14
State v. Zahn,
812 N.W.2d 490 (S.D. 2012) ........................................................................ 16
!
Tracey v. State,
--- So.3d ---, 2014 WL 5285929 (Fla. 2014) ...................................... 8, 12, 16
!
iv
Case: 12-12928
Page: 11 of 32
Winfield v. Div. of Pari-Mutuel Wagering, Dep’t of Bus. Regulation,
477 So.2d 544 (Fla. 1985) ............................................................................ 12
!
State Statutes
Colo. Rev. Stat. Ann. § 16-3-303.5(2) .................................................................... 16
Haw. Rev. Stat. § 803-44.7(b) ................................................................................ 15
Ind. Code 35-33-5-12.............................................................................................. 16
Maine Rev. Stat. Ann. § 648................................................................................... 16
Minn. Stat. Ann. § 626A.28(3)(d), 626A.42(2) ...................................................... 16
Minn. Stat. Ann. § 626A.42(2) ............................................................................... 16
Mont. Code Ann. § 46-5-110(1)(a)......................................................................... 16
Okla. Stat. Ann. tit. 13, § 177.6(A)......................................................................... 15
Or. Rev. Stat. Ann. § 133.619(6) ............................................................................ 15
Pa. Cons. Stat. Ann. § 5761(c)(4) ........................................................................... 15
S.C. Code Ann. § 17-30-140(b)(2) ......................................................................... 15
Utah Code Ann. § 77-23c-102(1)(a) ....................................................................... 16
Wis. Stat. Ann. § 968.373(2) .................................................................................. 16
Constitutional Provisions
!
U.S. Const., amend. IV .................................................................................... passim
Other Authorities
Janice Y. Tsai, et al. “Location-Sharing Technologies: Privacy Risks and Controls”
Carnegie Mellon University, (Feb. 2010)....................................................... 6
!
v
Case: 12-12928
Page: 12 of 32
National Journal, “Americans Continue to Drop Their Landline Phones”
(December 18, 2013) ...................................................................................... 4
Pew Research Center, “Cell Phone Ownership Hits 91% of Adults” (June 6,
2013) ............................................................................................................... 4
Pew Research Center, “Public Perceptions of Privacy and Security in the PostSnowden Era” (Nov. 2014) ............................................................................ 5
Pew Research Internet Project, “Location-Based Services” (Sept. 12, 2013) .......... 6
Pew Research Internet Project, “Privacy and Data Management on Mobile
Devices,” (Sept. 5, 2012) ................................................................................ 5
Stephen E. Henderson, Learning From all Fifty States: How to Apply the Fourth
Amendment and its State Analogs to Protect Third Party Information from
Unreasonable Search, 55 Cath. U. L. Rev. 373 (2006) ............................... 14
Truste, “TRUSTe Study Reveals Smartphone Users More Concerned About
Mobile Privacy Than Brand or Screen Size” (Sept. 5, 2013) ......................... 6
United States Census Bureau, “Quick Facts” ......................................................... 15
!
vi
Case: 12-12928
Page: 13 of 32
STATEMENT OF INTEREST OF AMICUS1
EFF is a member-supported civil liberties organization based in San
Francisco, California and works to protect innovation, free speech, and privacy in
the digital world. With more than 23,000 dues-paying members nationwide, EFF
represents the interests of technology users in both court cases and in broader
policy debates surrounding the application of law in the digital age. As part of its
mission, EFF has served as amicus curiae in landmark cases addressing Fourth
Amendment issues raised by emerging technologies. See, e.g., Riley v. California,
134 S. Ct. 2473 (2014); United States v. Jones, 132 S. Ct. 945 (2012); City of
Ontario v. Quon, 560 U.S. 746 (2010).
EFF has particular expertise and interest in location-based tracking
technologies such as GPS and the collection of cell-site tracking data, and has
served as amicus in numerous federal and state cases involving historical cell site
information, including this specific case. See United States v. Davis, 754 F.3d 1205
(11th Cir. 2014); In re Appl. of U.S. for Historical Cell Site Data, 724 F.3d 600
(5th Cir. 2013); In re Appl. of U.S. for an Order Directing a Provider of Elec.
Commc’n Serv. to Disclose Records to Gov’t, 620 F.3d 304 (3d Cir. 2010);
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
1
No party’s counsel authored this brief in whole or in part. No party or party’s
counsel contributed money that was intended to fund preparing or submitting the
brief. No person—other than amicus curiae, its members, or its counsel—
contributed money that was intended to fund preparing or submitting the brief.
Counsel for Appellee United States does not oppose this motion. Counsel for
Appellant Quartavious Davis consents to this motion.
!
1
Case: 12-12928
Page: 14 of 32
Commonwealth v. Augustine, 4 N.E.3d 846 (2014); United States v. Jones, 908 F.
Supp. 2d 203 (D.D.C. 2012). EFF has also been appointed to serve as amicus in a
case involving a government application to obtain historical cell site data. See In re
Appl. of U.S. for an Order Authorizing Disclosure of Historical Cell Site Info. for
Telephone No. [Redacted], --- F. Supp. 2d ---, 2014 WL 1395082 (D.D.C. April
17, 2014) (Facciola, M.J.).
STATEMENT OF THE ISSUE
Whether the government violated the Fourth Amendment when it obtained
67 days’ worth of Defendant’s cell phone location information without a warrant.
SUMMARY OF ARGUMENT
In the 35 years since the Supreme Court decided Smith v. Maryland, 442
U.S. 735 (1979), the capacity for technology to reveal unexpectedly detailed
information about our lives has increased exponentially. Where, in Smith, the
government recorded the numbers dialed and received on one phone at one
location for three days, today the government can obtain not just those numbers but
also all the locations the phone’s owner traveled while the phone was able to make
or receive a call. This technology was “nearly inconceivable just a few decades
ago.” Riley v. California, 134 S. Ct. 2473, 2484 (2014). As the Supreme Court
recognized in Kyllo v. United States, given advances in technology, courts must
!
2
Case: 12-12928
Page: 15 of 32
increasingly address “what limits there are upon this power of technology to shrink
the realm of guaranteed privacy.” Kyllo, 533 U.S. 27, 34 (2001).
Courts and legislatures across the country are responding to changing
technologies by pushing beyond the case law of 35 years ago and recognizing
greater privacy protections for the data—including location information—we store
on our devices, in the “cloud,” and with third parties. As more Americans have a
subjective expectation of privacy in their location data, these expectations
necessarily become ones that “society is prepared to recognize [are] ‘reasonable,’”
and thus protected by the Fourth Amendment. Katz v. United States, 389 U.S. 347,
361 (1967) (Harlan, J., concurring).
The panel opinion below recognized this reality, finding “the exposure of the
cell site location information [(“CSLI”)] can convert what would otherwise be a
private event into a public one,” thus triggering a Fourth Amendment reasonable
expectation of privacy. United States v. Davis, 754 F.3d 1205, 1216 (11th Cir.
2014). The en banc court should affirm the panel opinion and require the
government to use a probable cause search warrant to obtain historical CSLI.
!
!
3
Case: 12-12928
Page: 16 of 32
ARGUMENT
I.
AMERICANS HAVE A SUBJECTIVE EXPECTATION OF
PRIVACY IN LOCATION INFORMATION.
Owning a cell phone is not a luxury; today more than 90%2 of all American
adults have a cell phone, and landline phones are becoming increasingly obsolete.3
Cell phones generate a staggering amount of data about where the phone’s owner
has travelled throughout her daily life, including through CSLI. Society is
increasingly recognizing that location data like this deserves “the most scrupulous
protection from government invasion.” Oliver v. United States, 466 U.S. 170, 178
(1984) (citation omitted).
Many federal and state courts have recognized an expectation of privacy in
location and phone records generally and CSLI specifically. As more people live in
states where these records are deemed private, the government cannot assert it is
unreasonable to expect privacy in them. Thus, the panel was correct to require a
probable cause search warrant to obtain CSLI.
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2
Pew Research Center, “Cell Phone Ownership Hits 91% of Adults,” (June 6,
2013)
http://www.pewresearch.org/fact-tank/2013/06/06/cell-phone-ownershiphits-91-of-adults/.
3
See National Journal, “Americans Continue to Drop Their Landline Phones,”
(December 18, 2013) http://www.nationaljournal.com/hotline-on-call/americanscontinue-to-drop-their-landline-phones-20131218 (citing CDC statistics finding
36.5% of U.S. adults live in household with no landline phone).
!
4
Case: 12-12928
A.
Page: 17 of 32
Research Shows Americans Believe the Data on and Generated by
their Cell Phones is Private.
For the Fourth Amendment to apply, a person must have “exhibited an
actual expectation of privacy.” Bond v. United States, 529 U.S. 334, 338 (2000).
Recent studies show Americans expect privacy in the data stored on and generated
by their cell phones, including location information. Just this month, the Pew
Research Center found that 82% of Americans consider the details of their physical
location over time to be sensitive information—more sensitive than their
relationship history, religious or political views, or the content of their text
messages.4 In 2012, the Pew Center found that cell phone owners take a number of
steps to protect access to their personal information and mobile data, and more
than half of phone owners with mobile apps have uninstalled or decided to not
install an app due to concerns about the privacy in their personal information.5 In
addition, more than 30% of smart phone owners polled took affirmative steps to
safeguard their privacy: 19% turned off location tracking on their phones and 32%
cleared their browsing or search history.6 The numbers are higher for teenagers,
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
4
Pew Research Center, “Public Perceptions of Privacy and Security in the PostSnowden Era,” 36-37 (Nov. 2014) http://www.pewinternet.org/2014/11/12/publicprivacy-perceptions/ (50% of respondents believed location information was “very
sensitive”).
5
Pew Research Internet Project, “Privacy and Data Management on Mobile
Devices,” (Sept. 5, 2012) http://www.pewinternet.org/2012/09/05/privacy-anddata-management-on-mobile-devices/.
6
Id.
!
5
Case: 12-12928
Page: 18 of 32
with Pew reporting 46% of teenagers turned location services off.7 A 2013 survey
conducted on behalf of the Internet company TRUSTe found 69% of American
smart phone users did not like the idea of being tracked.8 And a 2009 Carnegie
Mellon survey of perceptions about location-sharing technologies showed that
participants believed the risks of location-sharing technologies outweighed the
benefits and were “extremely concerned” about controlling access to their location
information.9
These studies show Americans have a subjective expectation of privacy in
their phone records and location information.
B.
Courts Recognize
Information.
the
Privacy
Implications
of
Location
Given these statistics, it is unsurprising that courts around the country have
also recognized the privacy implications of location information. In 2012, the
Supreme Court suggested in United States v. Jones, that people expect their
otherwise public movements on the street to remain private. 132 S. Ct. 945 (2012).
Although the Court ultimately held that placing a GPS tracking device on a car was
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
7
Pew Research Internet Project, “Location-Based Services” (Sept. 12, 2013)
http://www.pewinternet.org/2013/09/12/location-based-services/.
8
Truste, “TRUSTe Study Reveals Smartphone Users More Concerned About
Mobile Privacy Than Brand or Screen Size,” (Sept. 5, 2013)
http://www.truste.com/blog/2013/09/05/truste-study-reveals-smartphone-usersmore-concerned-about-mobile-privacy-than-brand-or-screen-size/.
9
Janice Y. Tsai, et al. “Location-Sharing Technologies: Privacy Risks and
Controls,”
Carnegie
Mellon
University,
12
(Feb.
2010)
http://cups.cs.cmu.edu/LBSprivacy/files/TsaiKelleyCranorSadeh_2009.pdf.
!
6
Case: 12-12928
Page: 19 of 32
a “search” because it was a physical trespass onto private property, in two separate
concurring opinions, five members of the Supreme Court recognized that location
tracking could violate a reasonable expectation of privacy. Justice Sotomayor
questioned “whether people reasonably expect that their movements will be
recorded and aggregated in a manner that enables the Government to ascertain . . .
their political and religious beliefs, sexual habits, and so on.” Id. at 956
(Sotomayor, J., concurring). And Justice Alito wrote on behalf of three other
justices, “society’s expectation has been that law enforcement agents and others
would not . . . secretly monitor and catalogue every single movement of an
individual’s car for a very long period.” Id. at 964 (Alito, J., concurring).10
In the wake of Jones, several state and federal courts—including, most
recently, the Florida Supreme Court—have recognized the privacy implications of
location information and historical CSLI specifically. In protecting historical cell
site data in Commonwealth v. Augustine, the Massachusetts Supreme Judicial
Court—like the panel below in this case—recognized that this data may raise even
greater privacy concerns than GPS tracking devices placed on a car because cell
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
10
Earlier this year, the Supreme Court in Riley v. California specifically cited
Justice Sotomayor’s concurring opinion in Jones as a reason to limit police searches
of cell phones incident to arrest. 134 S. Ct. at 2490. Riley recognized the privacy
implications of location information, noting that cell phones store data that can
“reveal where a person has been,” making it possible to “reconstruct someone’s
specific movements down to the minute, not only around town but also within a
particular building.” Id. (citing Jones, 132 S. Ct. at 955 (Sotomayor, J., concurring)).
!
7
Case: 12-12928
Page: 20 of 32
site data can track “the user’s location far beyond the limitations of where a car can
travel”—including into “constitutionally protected areas” like a home. 4 N.E. 3d
846, 861-62 (Mass. 2014); see also Davis, 754 F.3d at 1216 (“while it may be the
case that even in light of the Jones opinion, GPS location information on an
automobile would be protected only in the case of aggregated data, even one point
of cell site location data can be within a reasonable expectation of privacy”).
Augustine also noted historical cell site data gave police access to something it
would never have with traditional law enforcement investigative methods: the
ability “to track and reconstruct a person’s past movements.” Id. at 865.
Similarly, in State v. Earls, the New Jersey Supreme Court noted users
should be “entitled to expect confidentiality in the ever-increasing level of detail
that cell phones can reveal about their lives” and adopted a warrant requirement for
historical CSLI. 70 A.3d 630, 644 (N.J. 2013). And just last month, the Florida
Supreme Court noted “the close relationship an owner shares with his cell phone”
makes “a cell phone’s movements its owner’s movements.” Tracey v. State, --So.3d ---, 2014 WL 5285929, *18, (Fla. 2014). The court found a subjective
expectation of privacy “in the location signals transmitted solely to enable the
private and personal use of his cell phone, even on public roads.” Id. at *19.
!
8
Case: 12-12928
II.
Page: 21 of 32
AN EXPECTATION OF PRIVACY IN CELL PHONE DATA IS
OBJECTIVELY REASONABLE EVEN THOUGH THE DATA IS
HELD BY A PHONE COMPANY.
This subjective expectation of privacy in CSLI is not defeated simply
because this location information is exposed to the telephone company. Before the
panel, the government relied on Smith to argue cell phone users have no
expectation of privacy in historical CSLI because that data has been exposed to a
third party. See Davis, 754 F.3d at 1216 (citing Smith, 442 U.S. at 742-44).
According to the government, when a person voluntarily uses a cell phone, she
knows the phone is sending information about her location to the phone company
and thus cannot expect the phone company to keep that information private. But
Smith does not alter the calculus here for two reasons.
First, the data here is significantly more revealing than the limited three days
worth of call records at issue in Smith. The Supreme Court in Riley v. California
recognized that cell phones store “qualitatively different” types of data compared
to physical records and noted that because today’s advanced technology can
disclose much more revealing personal information than technologies of the past,
the “scope of the privacy interests at stake” far exceeds that of any analogue in the
physical world. 134 S. Ct. at 2490, 2491. Although, the government argued in Riley
that cellphones are “materially indistinguishable” from physical items that may be
searched without a warrant incident to arrest like the pack of cigarettes at issue in
!
9
Case: 12-12928
Page: 22 of 32
United States v. Robinson, 414 U.S. 218, 236 (1973), the Court refused to equate
the two. Riley, 134 S. Ct. at 2488-89. It believed comparing a search of all data on
a cell phone to the search of physical items is “like saying a ride on horseback is
materially indistinguishable from a flight to the moon. Both are ways of getting
from point A to point B, but little else justifies lumping them together.” Riley, 134
S. Ct. at 2488.
Similarly, here, because the data generated by CSLI is so different in
quantity and quality from the data generated by a simple landline phone, this Court
cannot rely only on antiquated cases to determine how to protect cell phone data,
especially data that reveals sensitive location information. Id. at 2488-89. This
Court has already recognized that “whether the analytical framework, much less
the rationale” of Smith applies to modern technologies “is questionable and far
from clearly established.” Rehberg v. Paulk, 611 F.3d 828, 847 (11th Cir. 2010).
Instead, this Court should look to actual societal understandings of privacy in cell
phone data and location information to determine the protections necessary to
satisfy the Fourth Amendment.
Second, Smith does not reflect the realities of modern society. Today we
share much more information about ourselves with third parties merely as a
byproduct of the differences in how we perform tasks today versus in the past—
whether it is writing emails instead of letters; collaborating on document drafting
!
10
Case: 12-12928
Page: 23 of 32
online instead of through hard-copy printouts, or buying and reading books on our
phones or Kindles versus purchasing a physical book at a bookstore to read later in
the privacy of our own homes. As Justice Sotomayor noted in Jones, Smith’s basic
“premise” is “ill suited to the digital age, in which people reveal a great deal of
information about themselves to third parties in the course of carrying out
mundane tasks.” Jones, 132 S. Ct. at 957 (Sotomayor, J., concurring). Honing in on
subjective expectations of privacy, Justice Sotomayor doubted “people would
accept without complaint the warrantless disclosure” of information to the
government like URLs they visit or the phone numbers they dial or text. Id.
Other courts have reached the same conclusions, both before and after Jones,
finding expectations of privacy in data stored by third parties, including emails
stored on a service provider’s servers, United States v. Warshak, 631 F.3d 266 (6th
Cir. 2010); patient prescription records stored in an online database, Oregon
Prescription Drug Monitoring Program v. DEA, 998 F. Supp. 2d 957 (D. Ore.
2014); and even CSLI itself. Augustine, 4 N.E.3d at 850; Earls, 70 A.3d at 644.
This includes the Florida Supreme Court, which has found an expectation of
privacy in real-time CSLI notwithstanding Smith in part because cell phones are so
“indispensable” that “cell phone tracking can easily invade the right to privacy in
!
11
Case: 12-12928
Page: 24 of 32
one’s home or other private areas.” Tracey, 2014 WL 5285929 at *17. 11 Tracey
noted a person did not “voluntarily convey that information to the service provider
for any purpose other than to enable use of his cell phone for its intended purpose”
and rejected the “fiction” that people consent to warrantless cell phone tracking as
a condition of carrying a cell phone. Id. at *17, *19.
For this reason, the government’s argument that cell phone users—
especially those within this Court’s jurisdiction in Florida—cannot expect location
information to remain private once the data has been exposed to the phone
company is incorrect. On the contrary, at a minimum all Floridians have been
promised that, because cell phone data reveals detailed personal information, cell
phone customers have a reasonable expectation of privacy in that data, even though
it is held by a third party. Tracey, 2014 WL 5285929 at *17. Ultimately, that
means Smith does not control the outcome of this case. Just because technology is
capable of disclosing what is otherwise private information about a person’s
specific location does not mean that a person has a lesser expectation of privacy
under the Fourth Amendment.
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
11
The Court in Tracey analyzed the issue solely under the Fourth Amendment. See
Tracey, 2014 WL 5285929 at *5. But earlier Florida Supreme Court cases
interpreting Florida’s state constitution have also rejected Smith to find an
expectation of privacy in phone and banking records, even though those records
are held by a third party. See State v. Shaktman, 553 So.2d 148 (Fla. 1989)
(expectation of privacy in phone records); Winfield v. Div. of Pari-Mutuel
Wagering, Dep’t of Bus. Regulation, 477 So.2d 544 (Fla. 1985) (expectation of
privacy in banking records).
!
12
Case: 12-12928
III.
Page: 25 of 32
THE NATIONWIDE TREND TOWARD GREATER PROTECTION
FOR PRIVACY IN PHONE RECORDS AND LOCATION
INFORMATION SHOWS SOCIETY RECOGNIZES THAT A
PRIVACY INTEREST IN THIS DATA IS REASONABLE.
Having established that people generally have a subjective expectation of
privacy in their location, that advances in technology require changes in legal
analyses, and that Floridians specifically have an expectation of privacy in phone
records, the question remains whether broader society is prepared to recognize that
subjective expectation of privacy as reasonable. The answer is yes.
A court reviewing the appropriate Fourth Amendment limits to be placed on
searches must necessarily look to “societal understandings” of what should be
considered private to determine reasonable expectations of privacy. Oliver, 466
U.S. at 178; see also United States v. Brown, 743 F.2d 1505, 1507 (11th Cir.
1984). Further, while the Fourth Amendment is not “a redundant guarantee of
whatever limits on search and seizure legislatures might have enacted,” Virginia v.
Moore, 553 U.S. 164, 168 (2008), the existence of both federal and state statutory
protection for certain kinds of information helps inform whether society has
determined that a particular expectation of privacy is reasonable. See, e.g., United
States v. Maynard, 615 F.3d 544, 564 (D.C. Cir. 2010) (“state laws are indicative
that prolonged GPS monitoring defeats an expectation of privacy that our society
recognizes as reasonable”); Doe v. Broderick, 225 F.3d 440, 450 (4th Cir. 2000)
(federal statutory protection “is relevant to the determination of whether there is a
!
13
Case: 12-12928
Page: 26 of 32
‘societal understanding’” of a legitimate expectation of privacy in medical
records); United States v. Nerber, 222 F.3d 597, 604-05 (9th Cir. 2000) (federal
wiretap statute is “strong evidence” that society would find warrantless video
surveillance unreasonable).
The societal recognition of privacy in phone records and location
information is reflected in federal and state cases and state statutes deeming this
data to be private. After Smith was decided, courts in California, Colorado, Hawaii,
Idaho, Illinois, New Jersey, Pennsylvania, Washington and Florida all rejected
Smith, finding those states’ residents had a reasonable expectation of privacy under
their state constitutions in dialed phone numbers—notwithstanding the fact those
records are held by the phone provider.12 By statute, Georgia and Oregon required
police to demonstrate probable cause to install and operate a pen register to obtain
dialed phone numbers.13
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
12
See People v. Blair, 602 P.2d 738, 746 (Cal. 1979); People v. Sporleder, 666
P.2d 135, 141-43 (Colo. 1983); State v. Rothman, 779 P.2d 1, 7-8 (Haw. 1989);
State v. Thompson, 760 P.2d 1162, 1165-67 (Id. 1988); People v. DeLaire, 610
N.E.2d 1277, 1282 (Ill.Ct.App. 1993); State v. Hunt, 450 A.2d 952, 955-57 (N.J.
1982); Commonwealth v. Melilli, 555 A.2d 1254, 1256-59 (Pa. 1989); State v.
Gunwall, 720 P.2d 808, 813-17 (Wash. 1986); State v. Shaktman, 553 So.2d 148
(Fla. 1989); see generally Stephen E. Henderson, Learning From all Fifty States:
How to Apply the Fourth Amendment and its State Analogs to Protect Third Party
Information from Unreasonable Search, 55 Cath. U. L. Rev. 373 (2006).
13
See Ellis v. State, 353 S.E.2d 19, 21-22 (Ga. 1987) (pen register is “device”
under Ga. Code Ann. § 16-11-64(b) whose installation requires probable cause
search warrant); O.R.S. § 165.663.
!
14
Case: 12-12928
Page: 27 of 32
Then, as technology continued to advance but before Jones was decided, the
state supreme courts of New York, Oregon, and Washington held that people could
reasonably expect privacy in their location, meaning that using technology to track
a person’s movements was a Fourth Amendment “search.”14 Five state legislatures
passed statutes requiring police to obtain a probable cause search warrant to track a
person’s location with a tracking device like a GPS—even when the person is
traveling in public places. 15 This meant that even before the Supreme Court
addressed the question of whether Americans have a reasonable expectation of
privacy in their location information, seven states—representing nearly 20% of the
United States population16—already recognized this privacy right.
After Jones, the number of people across the country reasonably expecting
privacy in their location has increased, as more courts have recognized that an
expectation of privacy in a person’s location means technologies like GPS or realtime cell phone tracking are Fourth Amendment “searches” under Katz.17 That
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
14
See, e.g., People v. Weaver, 909 N.E.2d 1195, 1201 (N.Y. 2009) (GPS); State v.
Campbell, 759 P.2d 1040, 1048-49 (Or. 1988) (use of radio transmitter to locate
automobile); State v. Jackson, 76 P.3d 217, 223-24 (Wash. 2003) (GPS).
15
See Haw. Rev. Stat. § 803-44.7(b); Okla. Stat. Ann. tit. 13, § 177.6(A); Or. Rev.
Stat. Ann. § 133.619(6); 18 Pa. Cons. Stat. Ann. § 5761(c)(4); S.C. Code Ann.
§ 17-30-140(b)(2).
16
This figure is based on 2013 population data for each state, as projected by the
U.S. Census. See United States Census Bureau, “Quick Facts,”
http://quickfacts.census.gov/qfd/index.html.
17
Commonwealth v. Rousseau, 990 N.E.2d 543, 552-53 (Mass. 2013) (GPS);
Commonwealth v. Rushing, 71 A.3d 939, 961-64 (Pa. Sup. Ct. 2013), appeal
!
15
Case: 12-12928
Page: 28 of 32
includes the Florida Supreme Court’s decision in Tracey, discussed above, which
requires police to obtain a search warrant to track a cell phone’s location in real
time. Tracey, 2014 WL 5285929 at *19-20.
Courts and state legislatures have also extended privacy protections to
historical CSLI. The high courts in Massachusetts and New Jersey—relying in part
on Justice Sotomayor’s concurrence in Jones—recognized a reasonable
expectation of privacy in historical CSLI under their respective state constitutions
and required police use a search warrant to obtain that information. Augustine, 4
N.E.3d at 850; Earls, 70 A.3d at 644. Five more states legislated privacy
protections for historical cell site data, with Colorado, Maine, Minnesota, Montana
and Utah passing statutes expressly requiring law enforcement to apply for a
search warrant to obtain this data.18
In sum, the number of people in the United States—and in Florida
specifically—who have been promised by court decision or legislation that
information about where they have been is private has never been higher. The
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
granted on other grounds 84 A.3d 699 (2014) (cell phone signal); State v.
Brereton, 826 N.W.2d 369, 379 (Wis. 2013) (GPS); United States v. Powell, 943 F.
Supp. 2d 759, 776-77 (E.D. Mich. 2013) (real time cell site tracking); State v.
Zahn, 812 N.W.2d 490, 496-499 (S.D. 2012) (GPS); United States v. Lopez, 895 F.
Supp. 2d 592, 602 (D. Del. 2012) (GPS).
18
See Colo. Rev. Stat. Ann. § 16-3-303.5(2); 16 Maine Rev. Stat. Ann. § 648;
Minn. Stat. Ann. §§ 626A.28(3)(d), 626A.42(2); Mont. Code Ann. § 46-5110(1)(a); Utah Code Ann. § 77-23c-102(1)(a). A number of states have passed
laws requiring police obtain a search warrant only to track a cell phone in real time.
See, e.g., Ind. Code 35-33-5-12; Wis. Stat. Ann. § 968.373(2).
!
16
Case: 12-12928
Page: 29 of 32
growing number of people protected by the warrant requirement, while not
dispositive of whether there is a Fourth Amendment expectation of privacy in
historical CSLI, is compelling proof of “societal understandings” as to what level
of privacy and security is reasonable. Thus the panel’s decision should be affirmed.
CONCLUSION
For more than 90% of Americans, a cell phone is the only phone they have.
As anyone who moves about in society recognizes, cell phones are constantly in
use in both public and private spaces. At the same time, they are also “constantly
connecting to cell sites, and those connections are recorded” by cell phone
companies. Augustine, 4 N.E.3d at 860. This means that Americans are constantly
and automatically generating an almost unfathomable wealth of information about
their whereabouts.
When it comes to historical cell site records, it is clear that Americans
generally, and Floridians specifically, expect that the location information revealed
by these records remain private. Given the trend in legislatures and courts across
the country to protect this privacy interest by requiring a warrant, society
understands this expectation of privacy is reasonable.
This Court should follow the Supreme Court’s lead in Riley v. California
and recognize that, given the vast amount of data generated by cell phones,
coupled with the trend toward greater privacy protections for that data, outdated
!
17
Case: 12-12928
Page: 30 of 32
cases cannot govern the outcome here. Americans have a reasonable expectation of
privacy in the location data generated by CSLI, and, as the Court noted in Riley,
the answer to the question of what police must do before they may obtain that data
is “simple—get a warrant.” 134 S. Ct. at 2495.
Dated: November 17, 2014
Respectfully submitted,
/s/ Hanni Fakhoury
Hanni Fakhoury
Jennifer Lynch
ELECTRONIC FRONTIER
FOUNDATION
815 Eddy Street
San Francisco, CA 94109
Telephone: (415) 436-9333
Counsel for Amicus Curiae
ELECTRONIC FRONTIER
FOUNDATION
!
18
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
Linda Lye (CA SBN 215584)
[email protected]
AMERICAN CIVIL LIBERTIES UNION
FOUNDATION OF NORTHERN CALIFORNIA
39 Drumm Street, 2nd Floor
Telephone: 415-621-2493
Facsimile:
415-255-8437
ATTORNEYS FOR AMICUS AMERICAN CIVIL
LIBERTIES UNION OF NORTHERN CALIFORNIA
Ezekiel Edwards ([email protected])
Nathan Freed Wessler ([email protected])
FOUNDATION
125 Broad Street, 18th Floor
New York, NY 10004
Telephone: 212-549-2500
Facsimile:
212-549-2654
ATTORNEYS FOR AMICUS
Hanni M. Fakhoury (CA SBN 252629)
[email protected]
815 Eddy Street
Telephone:
415-436-9333
Facsimile:
415-436-9993
ATTORNEYS FOR AMICUS
UNITED STATES DISTRICT COURT
FOR THE NORTHERN DISTRICT OF CALIFORNIA
SAN FRANCISCO DIVISION
20
21
22
UNITED STATES OF AMERICA,
23
24
25
v.
Plaintiff,
DIAZ-RIVERA, et al.,
26
27
28
Defendants.
CASE No.: 12-cr-00030-EMC/EDL
BRIEF AMICI CURIAE OF ACLU, ACLU
OF NORTHERN CALIFORNIA AND
IN SUPPORT OF DEFENDANTS’
MOTION TO COMPEL DISCOVERY
Hearing Date: November 5, 2013
Time:
9:00 a.m.
Location:
San Courtroom E, 15th Floor
United States v. Diaz-Rivera, et al., Case No. 12-CR-00030-EMC/EDL
AMICI BRIEF IN SPT OF DEFS’ MOT. TO COMPEL DISCOVERY
TABLE OF CONTENTS
1
2
I.
INTRODUCTION .....................................................................................................1
3
II.
ARGUMENT .............................................................................................................1
4
A.
5
The NSA Mass Call-Tracking Program, The Hemisphere
Project, And Stingray Devices Are Unconstitutional ....................................1
1.
6
7
The National Security Agency’s Mass Call-Tracking
Program ..............................................................................................1
a.
The Federal Government Has Amassed A Vast
Database Of Americans’ Call Records ..................................1
b.
The Warrantless Bulk Collection Of Phone
Records Is Unconstitutional ...................................................3
8
9
10
2.
11
The Hemisphere Project .....................................................................5
a.
The Federal Government Has Amassed Yet
Another Vast Database Of Americans’ Call
Records ..................................................................................5
b.
The Government Cannot Launder Its
Unconstitutional Bulk Collection Of Phone
Records Through AT&T ........................................................6
12
13
14
15
3.
16
17
18
19
Stingrays ............................................................................................8
a.
Stingrays Scoop Up Information From Innocent
Third Party Wireless Devices ................................................8
b.
Stingrays Raise Myriad Fourth Amendment
Problems .............................................................................. 10
21
Brady and Rule 16 Require The Government To Disclose The
Full Extent Of The Electronic Surveillance Used In This
Investigation ................................................................................................. 12
22
1.
The Government Has Failed To Disclose Significant
Sources Of Information On Which It Relied To
Obtain Wiretaps ............................................................................... 12
2.
This Investigation Is Consistent With Unconstitutional
Surveillance Programs Such As Hemisphere .................................. 14
3.
Information About The Electronic Surveillance Used In
This Case Is Material To The Defense ............................................ 16
20
B.
23
24
25
26
27
28
Page ii
C.
1
2
3
4
III.
By Shrouding Its Surveillance Practices In Secrecy, The
Government Stifles Public Debate And Prevents Courts
from Reviewing Its Practices ....................................................................... 19
CONCLUSION ........................................................................................................ 22
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Page iii
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
TABLE OF AUTHORITIES
Cases
Page(s)
Brady v. Maryland,
373 U.S. 83 (1963) ..............................................................................................12, 16, 17, 18
Florida v. Harris,
133 S. Ct. 1050 (2013) ..........................................................................................................17
Florida v. Jardines,
133 S. Ct. 1409 (2013) ..........................................................................................................11
Franks v. Delaware,
438 U.S. 154 (1978) ..............................................................................................................18
Giglio v. United States,
405 U.S. 150 (1972) ..............................................................................................................17
In re Application for an Order Authorizing Installation and Use of a Pen Register and Trap
and Trace Device, 890 F. Supp. 2d 747, 749 (S.D. Tex. 2012)............................................11
In re Application for an Order Pursuant to 18 U.S.C. § 2703(d),
930 F. Supp. 2d 698 (S.D. Tex. 2012) ..................................................................................11
In re Application of the FBI for an Order Requiring the Production of Tangible
Things from Verizon Bus. Network Servs., Inc. on Behalf of MCI Commc’n Servs.,
Inc. d/b/a Verizon Bus. Servs., No. BR 13-80 at 2 (FISA Ct. Apr. 25, 2013) ........................2
In re Application of U.S. for Historical Cell Site Data,
724 F.3d 600 (5th Cir. 2013) ................................................................................................14
In re Sealing and Non-Disclosure of Pen/Trap/2703(d) Orders,
562 F. Supp. 2d 876 (S.D. Tex. 2008) ..................................................................................20
Jewel v. Nat’l Sec. Agency,
673 F.3d 902 (9th Cir. 2011) ..................................................................................................7
Kyllo v. United States,
533 U.S. 27 (2001) ................................................................................................................10
NAACP v. Alabama ex rel. Patterson,
357 U.S. 449 (1958) ................................................................................................................4
Silverman v. United States,
365 U.S. 505 (1961) ..............................................................................................................10
Page iv
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Stanford v. Texas,
379 U.S. 476 (1965) ..............................................................................................................10
United States v. Barton,
995 F.2d 931 (9th Cir. 1993) ................................................................................................18
United States v. Comprehensive Drug Testing, Inc.,
621 F.3d 1162 (9th Cir. 2010) ........................................................................................11, 12
United States v. Cortez–Rocha,
394 F.3d 1115 (9th Cir. 2005) ..............................................................................................17
United States v. Gamez-Orduno,
235 F.3d 453 (9th Cir. 2000) ..........................................................................................12, 16
United States v. Guzman-Padilla,
573 F.3d 865 (9th Cir. 2009) ................................................................................................16
United States v. Jones,
132 S. Ct. 945 (2012) ....................................................................................................4, 7, 11
United States v. Karo,
468 U.S. 705 (1984) ..............................................................................................................10
United States v. Mandel,
914 F.2d 1215 (9th Cir. 1990) .............................................................................................. 17
United States v. Reed,
15 F.3d 928 (9th Cir. 1994) ....................................................................................................7
United States v. Rettig,
589 F.2d 418 (9th Cir. 1978) ................................................................................................12
United States v. Rigmaiden,
2013 WL 1932800 (D. Ariz. May 8, 2013) ......................................................................9, 10
United States v. Ruby,
2013 WL 544888 (S.D. Cal. Feb. 12, 2013) ...........................................................................6
United States v. Spilotro,
800 F.2d 959 (9th Cir. 1986) ................................................................................................10
United States v. Stanert,
762 F.2d 775 (9th Cir. 1985) ................................................................................................18
United States v. Stever,
603 F.3d 747 (9th Cir. 2010) ................................................................................................16
Page v
1
2
3
4
5
6
United States v. Strifler,
851 F. 2d 1197 (9th Cir. 1988) .............................................................................................17
United States v. Thomas,
726 F.3d 1086 (9th Cir. 2013) ..............................................................................................17
Statutes
18 U.S.C. § 2518 .........................................................................................................................12
7
18 U.S.C. § 2703 .....................................................................................................................6, 14
8
Rules
9
Fed. R. Crim. P. 16 ............................................................................................................. passim
10
Congressional Materials
11
Oversight of FISA (Foreign Intelligence Surveillance Act) Surveillance Programs:
Hearing of the Senate Judiciary Committee on Strengthening Privacy Rights and
National Security, 113th Cong. (2013) (oral testimony of Sean Joyce) ..................................2
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Other Authorities
Ability, “Active GSM Interceptor: IBIS II - In-Between Interception System - 2nd
Generation,” ............................................................................................................................9
ADMINISTRATION WHITE PAPER: BULK COLLECTION OF TELEPHONY METADATA UNDER
SECTION 215 OF THE USA PATRIOT ACT 1 (Aug. 9, 2013) .....................................................2
Federal Bureau of Investigation, Press Release, San Diego Division, San Diego Jury Convicts
Four Somali Immigrants of Providing Support to Foreign Terrorists
(Feb. 22, 2013) ........................................................................................................................3
Glenn Greenwald, NSA Collecting Phone Records of Millions of Verizon Customers
Daily, THE GUARDIAN (June 5, 2013) .....................................................................................2
Hannes Federrath, Protection in Mobile Communications, MULTILATERAL SECURITY IN
COMMUNICATIONS, 5 (Günter Müller et al. eds., 1999) ..........................................................9
Harris Wireless Products Group, Product Description, 1 .............................................................8
Office of the Director of National Intelligence, DNI Statement on Recent
Unauthorized Disclosures of Classified Information (June 6, 2013) ......................................2
Office of the Director of National Intelligence, Press Release, Foreign Intelligence
Surveillance Court Renews Authority to Collect Telephony Metadata (July 19, 2013) ........2
Page vi
1
PKI Electronic Intelligence GmbH, GSM Cellular Monitoring Systems, 12 ...............................9
2
Scott Shane & Colin Moynihan, Drug Agents Use Vast Phone Trove, Eclipsing N.S.A.’s, N.Y.
TIMES (Sept. 1, 2013) ..............................................................................................................5
3
4
5
6
7
John Shiffman & Kristina Cooke, U.S. Directs Agents To Cover Up Programs
Used To Investigate Americans, REUTERS (Aug. 5, 2013) ...................................3, 15, 18, 20
Stephen Wm. Smith, Gagged, Sealed & Delivered: Reforming ECP’s Secret Docket,
6 Harv. L. & Pol’y Rev. 313, 322 (2012) .............................................................................20
8
Daehyun Strobel, IMSI Catcher, Seminararbeit, Ruhr-Universität, Bochum, Germany, 13
(July 13, 2007) ........................................................................................................................9
9
Synopsis of the Hemisphere Project, N.Y. TIMES (Sept. 1, 2013) ................................................5
10
11
12
13
Jennifer Valentino-DeVries, How ‘Stingray’ Devices Work, WALL STREET JOURNAL
(Sept. 21, 2011) .......................................................................................................................8
E.H. Walker, Penetration of Radio Signals Into Buildings in the Cellular Radio
Environment, 62 THE BELL SYSTEMS TECHNICAL JOURNAL 2719 (1983) ..............................8
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Page vii
1
2
3
4
5
6
7
8
9
I.
INTRODUCTION
This case likely involves one or more highly controversial surveillance programs: the
National Security Agency’s Mass Call-Tracking Program and the Hemisphere Project, both of
which involve vast databases of Americans’ phone records, as well as so-called “stingray”
devices, sophisticated tools that mimic a cell tower and thereby scoop up information from
wireless devices in the vicinity. Amici submit this brief, in support of Defendants’ Motion to
Compel Discovery, in order to provide important context and to underscore the larger
implications of this case.
First, the NSA Mass Call-Tracking Program, the Hemisphere Project, and stingray
10
11
devices are highly intrusive and unconstitutional. Second, due process and Federal Rule of
12
Criminal Procedure 16 require the government to disclose to Defendants information that would
13
allow them to challenge in a motion to suppress unconstitutional forms of electronic
14
surveillance used to further this investigation. Third, disclosure of the information sought by
15
Defendants has a wider significance beyond this case. The government shrouds its surveillance
16
practices in secrecy, but that secrecy undermines democratic governance and prevents the
17
federal courts from reviewing the legality of intrusive and unconstitutional forms of surveillance.
18
II.
19
20
21
22
23
ARGUMENT
A.
The NSA Mass Call-Tracking Program, The Hemisphere Project, And
Stingray Devices Are Unconstitutional
1.
The National Security Agency’s Mass Call-Tracking Program
The Federal Government Has Amassed A Vast Database Of
a.
Americans’ Call Records
On June 5, 2013, The Guardian disclosed a previously secret order from the Foreign
24
Intelligence Surveillance Court directing Verizon Business Network Services to produce to the
25
National Security Agency “on an ongoing daily basis . . . all call detail records or ‘telephony
26
metadata’” relating to every domestic and international call placed on its network between April
27
28
Page 1
1
2
3
4
5
6
7
8
25, 2013 and July 19, 2013; the order specified that telephony metadata include, for each phone
call, the originating and terminating telephone number as well as the call’s time and duration. 1
On the day the order expired, the Director of National Intelligence issued a statement
indicating that the Foreign Intelligence Surveillance Court had renewed it.2 The order was
issued as part of a broader program that has been in place for seven years and that involves the
collection of information about virtually every phone call, domestic and international, made or
received in the United States.3
The government has utilized its mass call-tracking database in the course of
9
10
investigations that resulted in criminal prosecutions. For example, the government searched its
11
database when investigating a planned bombing of the New York City subway and then
12
prosecuted the investigative targets. 4 The government also utilized the program in the course of
13
investigating an individual named Basaaly Moalin,5 who was subsequently convicted of
14
providing material support to a terrorist group.6
15
16
17
18
19
20
21
22
23
24
25
26
27
28
1
In re Application of the FBI for an Order Requiring the Production of Tangible Things from
Verizon Bus. Network Servs., Inc. on Behalf of MCI Commc’n Servs., Inc. d/b/a Verizon Bus.
Servs., No. BR 13-80 at 2 (FISA Ct. Apr. 25, 2013)), available at
http://www.theguardian.com/world/interactive/2013/jun/06/verizon-telephone-data-court-order;
see also Glenn Greenwald, NSA Collecting Phone Records of Millions of Verizon Customers
Daily, THE GUARDIAN (June 5, 2013), available at
http://www.theguardian.com/world/2013/jun/06/nsa-phone-records-verizon-court-order. In the
days after The Guardian disclosed the Secondary Order, Director of National Intelligence James
Clapper acknowledged its authenticity. See Press Release, Office of the Director of National
Intelligence, DNI Statement on Recent Unauthorized Disclosures of Classified Information
(June 6, 2013), available at http://1.usa.gov/13jwuFc.
2
Press Release, Office of the Director of National Intelligence, Foreign Intelligence
Surveillance Court Renews Authority to Collect Telephony Metadata (July 19, 2013), available
at http://1.usa.gov/12ThYlT.
3
ADMINISTRATION WHITE PAPER: BULK COLLECTION OF TELEPHONY METADATA UNDER
SECTION 215 OF THE USA PATRIOT ACT 1 (Aug. 9, 2013), available at http://bit.ly/15ebL9k;
Dep’t of Justice, Report on the National Security Agency’s Bulk Collection Programs for USA
PATRIOT Act Reauthorization 3 (Feb. 2, 2011), available at http://1.usa.gov/1cdFJ1G.
4
ACLU v. Clapper, S.D.N.Y. Case No. 13-cv-03994, Defs’ Mem. of Law in Opposition to Pls.’
Motion for a Preliminary Injunction at10-11, ECF No. 61 (Oct. 1, 2013) (excerpts attached as
Lye Decl., Exh. 1).
5
Oversight of FISA (Foreign Intelligence Surveillance Act) Surveillance Programs: Hearing of
the Senate Judiciary Committee on Strengthening Privacy Rights and National Security, 113th
Cong. (2013) (oral testimony of Sean Joyce), available at http://icontherecord.tumblr.com/post/
57811913209/hearing-of-the-senate-judiciary-committee-on (“As you mentioned another
Page 2
1
2
3
4
5
6
7
8
9
10
Although the nature and extent of data flows from the NSA to other federal law
enforcement agencies is largely secret, it is clear that NSA-derived information is provided to
other law enforcement entities. In the New York City subway investigation, the NSA supplied
data derived from the mass call-tracking database to the FBI.7 Also, the Drug Enforcement
Administration (“DEA”) has institutionalized the dissemination of NSA-derived information to
other law enforcement agencies through its Special Operations Division (“SOD”).8 According
to Reuters, SOD is tasked with “funneling information” from intelligence sources to “authorities
across the nation to help them launch criminal investigations of Americans.”9
Although it is unclear whether information obtained by the NSA’s mass call-tracking
11
program is disseminated by the SOD, that lack of clarity is attributable to the DEA’s deliberate
12
efforts to conceal the origins of intelligence-derived information. A document obtained by
13
Reuters “specifically directs agents to omit the SOD’s involvement from investigative reports,
14
affidavits, discussions with prosecutors and courtroom testimony. Agents are instructed to then
15
use ‘normal investigative techniques to recreate the information provided by SOD.’”10
b.
The Warrantless Bulk Collection Of Phone Records Is
Unconstitutional
16
17
18
The NSA’s warrantless collection of all domestic telephony metadata violates Fourth
Amendment privacy rights and First Amendment associational rights.
19
20
21
22
23
24
25
26
27
28
instance when we used the business record 215 program, as Chairman Leahy mentioned,
Basaaly Moalin.”).
6
Press Release, Federal Bureau of Investigation, San Diego Division, San Diego Jury Convicts
Four Somali Immigrants of Providing Support to Foreign Terrorists (Feb. 22, 2013), available
at http://www.fbi.gov/sandiego/press-releases/2013/san-diego-jury-convicts-four-somaliimmigrants-of-providing-support-to-foreign-terrorists.
7
ACLU v. Clapper, S.D.N.Y. Case No. 13-cv-03994, Defs’ Mem. of Law in Opposition to Pls.’
Motion for a Preliminary Injunction at10-11, ECF No. 61 (Oct. 1, 2013) (“NSA received [a
suspect’s] telephone number from the FBI and ran it against the telephony metadata, identifying
and passing additional leads back to the FBI for investigation.”).
8
John Shiffman & Kristina Cooke, U.S. Directs Agents To Cover Up Programs Used To
Investigate Americans, REUTERS (Aug. 5, 2013), available at
http://www.reuters.com/article/2013/08/05/us-dea-sod-idUSBRE97409R20130805.
9
Id.
10
Id.
Page 3
1
2
3
4
5
6
7
8
9
The program permits the government to assemble a richly detailed profile of every
person living in the United States and to draw a comprehensive map of their associations with
one another. The long-term recording and aggregation of telephony metadata achieves
essentially the same kind of privacy intrusion that led five Justices of the Supreme Court to
conclude in United States v. Jones, 132 S. Ct. 945 (2012), that the long-term recording and
aggregation of location information constituted a search. In Jones, the Supreme Court
considered whether police had conducted a Fourth Amendment search when they attached a
GPS-tracking device to a vehicle and monitored its movements over a period of 28 days. The
10
Court held that the installation of the GPS device and the use of it to monitor the vehicle’s
11
movements constituted a search because it involved a trespass “conjoined with . . . an attempt to
12
find something or to obtain information.” Id. at 951 n.5. In two concurring opinions, five
13
Justices concluded that the surveillance constituted a search because it “impinge[d] on
14
expectations of privacy.” Id. at 964 (Alito, J., concurring in judgment); id. at 955 (Sotomayor, J.,
15
concurring). As with the long-term location tracking in Jones, the surveillance at issue here
16
“enables the Government to ascertain, more or less at will, [every person’s] political and
17
religious beliefs, sexual habits, and so on.” Id. at 956 (Sotomayor, J., concurring).
18
The mass call-tracking program also violates the First Amendment. The Supreme Court
19
has recognized that the government’s surveillance and investigatory activities can infringe on
20
associational rights protected by the First Amendment. Thus in NAACP v. Alabama ex rel.
21
Patterson, 357 U.S. 449 (1958), a case in which the Supreme Court invalidated an Alabama
22
23
24
25
26
27
28
order that would have required the NAACP to disclose its membership lists, the Court wrote,
“[i]t is hardly a novel perception that compelled disclosure of affiliation with groups engaged in
advocacy” may operate as “a restraint on freedom of association.” Id. at 462. The
government’s mass call-tracking program raises precisely the same specter of associational
harm by permitting the government to track every one of Defendants’ telephone contacts.
//
//
Page 4
2.
1
2
a.
3
The Federal Government Has Amassed Yet Another Vast
Database Of Americans’ Call Records
In September 2013, the New York Times reported the existence of the Hemisphere
4
5
The Hemisphere Project
Project, a previously hidden program in which the “government pays AT&T to place its
6
employees in drug-fighting units around the country. Those employees sit alongside Drug
7
Enforcement Administration agents and local detectives and supply them with the phone data
8
from as far back as 1987.”11 The report was based on a set of training slides obtained by the
9
Times. See Defs’ Exh. L (ECF No. 242-1) (hereinafter “Hemisphere Slide Deck”).12
The Hemisphere Project involves a massive database of call detail records (“CDRs”) for
10
11
every phone call that travels through an AT&T switch, whether placed using AT&T or another
12
telephone carrier. See id. at 2. The CDRs in the Hemisphere database include not only
13
information about dialed telephone numbers and other call routing data, but also information
14
about the locations of callers. See id. at 3, 13. The database contains CDRs dating from 1987
15
to the present, and a search of the database will “include CDRs that are less than one hour old at
16
the time of the search.” See id. at 3. A staggering four billion CDRs are added to the
17
Hemisphere database each day. See id. at 2. The government, which funds Hemisphere,
18
obtains CDRs from the database by directing administrative subpoenas at embedded AT&T
19
20
employees, who then query the system for records and return them in the government’s
preferred format. See id. at 2-3.
21
22
23
“Hemisphere is most often used by DEA and DHS in the Northwest [High Intensity
Drug Trafficking Area] to identify replacement/additional phones.” Id. at 4. The project is
24
25
26
27
28
11
Scott Shane & Colin Moynihan, Drug Agents Use Vast Phone Trove, Eclipsing N.S.A.’s, N.Y.
TIMES (Sept. 1, 2013), available at http://www.nytimes.com/2013/09/02/us/drug-agents-usevast-phone-trove-eclipsing-nsas.html.
12
The training slides were posted by the New York Times on its website. See Office of Nat’l
Drug Control Policy, Los Angeles Hemisphere, available at Synopsis of the Hemisphere Project,
N.Y. TIMES (Sept. 1, 2013), http://www.nytimes.com/interactive/2013/09/02/us/hemisphereproject.html.
Page 5
1
2
3
4
5
6
7
8
9
“coordinated” from California. Id. at 2. DEA-funded AT&T employees search the contents of
the database of call records using algorithms and other techniques to identify new phones whose
calling patterns are similar to a person’s old or existing phone; thus when the target of an
investigation ceases using one phone and/or acquires an additional one, Hemisphere provides
the government with a list of “candidates for the replacement phone . . . ranked by probability.”
Id. at 5-6, 7.
Troublingly, the government has engaged in a systematic campaign to conceal the
existence and use of the Hemisphere Project from the public, including from defense attorneys
10
and their clients. Law enforcement agents are “instructed to never refer to Hemisphere in any
11
official document” and to “keep the program under the radar.” Id. at 8, 12. In cases where
12
agents use Hemisphere to obtain CDRs and identify a suspect’s new or additional phone, they
13
are directed to submit a second administrative subpoena to the suspect’s carrier (whether AT&T
14
or another provider) for the CDRs related to the new phone number and to make reference only
15
to those records in any public materials, thus “walling off” the Hemisphere Project from
16
disclosure. Id. at 10.
17
18
19
20
b.
The Hemisphere Project Is Unconstitutional
Like the NSA mass call-tracking program, Hemisphere violates the Fourth and First
Amendments.
The Hemisphere Project is unlike typical government requests to phone companies for
21
CDRs. In run-of-the-mill investigations, the government seeks a judicial order to the phone
22
company and then awaits the results of the company’s compliance. See, e.g., United States v.
23
24
25
26
27
28
Ruby, 2013 WL 544888, at *3 (S.D. Cal. Feb. 12, 2013) (government acquired call detail
records from service provider after obtaining and serving order pursuant to 18 U.S.C. §
2703(d)). Here, however, the government funds and directs the entire process by paying AT&T
to embed its employees within DEA operational units, directing their search of the Hemisphere
system, and then obtaining CDRs in a format requested by the DEA. This constitutes state
action, as the government has created an agency relationship with embedded AT&T employees
Page 6
1
2
3
4
5
6
7
8
9
and has directed their searches of trillions of call records without warrants. See United States v.
Reed, 15 F.3d 928, 931 (9th Cir. 1994) (“[T]he Fourth Amendment does prohibit unreasonable
intrusions by private individuals who are acting as government instruments or agents.”).
Hemisphere is functionally indistinguishable from mass surveillance programs where the
government installs agents and monitoring equipment in phone company facilities and searches
incoming or transiting phone traffic. Cf. Jewel v. Nat’l Sec. Agency, 673 F.3d 902, 906 (9th Cir.
2011) (holding that plaintiffs have standing to bring Fourth Amendment challenge to NSA
surveillance program that diverted all internet traffic passing through AT&T facilities into a
10
“SG3 Secure Room” in those facilities, where “information of interest [was] transmitted from
11
the equipment in the SG3 Secure Rooms to the NSA based on rules programmed by the NSA”
12
(alteration in original) (internal quotation marks omitted)).
13
At a minimum, Hemisphere raises similar constitutional concerns as the NSA mass call-
14
tracking database. The government is querying the stored call records of millions of people in
15
the United States in order to identify patterns in the communications and associations of a few
16
individuals. But the program sweeps up the records of millions of individuals who are not the
17
subject of any investigation, amassing their call records even though there is no suspicion they
18
have engaged in criminal wrongdoing, and analyzing their records without a warrant, and hence,
19
without any judicial oversight. This violates the Fourth and First Amendments. Supra Part II-
20
A-1-b. But Hemisphere goes even further than the NSA’s mass call-tracking program, as the
21
CDRs stored in the Hemisphere database contain location information about callers (see
22
23
24
25
26
27
28
Hemisphere Slide Deck at 3, 13), thus implicating the specific concerns raised by five Justices
in Jones. See 132 S. Ct. at 955 (Sotomayor, J., concurring) (“wealth of detail about [a person’s]
familial, political, professional, religious, and sexual associations” revealed through “trips to the
psychiatrist, the plastic surgeon, the abortion clinic,” etc.) (internal quotation marks, citation
omitted); id. at 964 (Alito, J., concurring).
Because the existence of the Hemisphere Project had been deliberately kept secret from
the Defendants and the public at large until last month, despite use of the program in numerous
Page 7
1
2
3
4
drug cases (see Hemisphere Slide Deck at 4, 14-26), a suppression motion by Defendants would
be the first opportunity of which amici are aware for the judiciary to assess the constitutionality
of Hemisphere surveillance.
3.
Stingrays
5
6
Stingrays Scoop Up Information From Innocent Third Party
Wireless Devices
7
“Stingray” is the name for the Harris Corporation’s line of “cell site simulator” devices,
a.
8
also called “IMSI catchers,” in reference to the unique identifier – or international mobile
9
subscriber identity – of wireless devices.13 Wireless carriers provide coverage through a
10
network of base stations that connect wireless devices on the network to the regular telephone
11
network. An IMSI catcher masquerades as a wireless carrier’s base station, prompting wireless
12
devices to communicate with it. Stingrays are commonly used in two ways: to collect unique
13
numeric identifiers associated with phones in a given location or to ascertain the location of a
14
phone “when the officers know the numbers associated with it but don’t know precisely where
15
it is.”14 Several features of stingrays are noteworthy.
16
First, the devices broadcast electronic signals that penetrate the walls of private locations
17
not visible to the naked eye, including homes, offices, and other private locations of the target
18
and third parties in the area.15
19
Second, the devices can pinpoint an individual with extraordinary precision, in some
20
21
22
23
24
25
26
27
28
13
Although “Stingray” refers to a specific line of Harris Corporation products, see infra at note
15, amici use the term “stingray” in this brief generically to refer to IMSI catchers.
14
Jennifer Valentino-DeVries, How ‘Stingray’ Devices Work, WALL STREET JOURNAL (Sept. 21,
2011), available at http://blogs.wsj.com/digits/2011/09/21/how-stingray-devices-work/.
15
The devices send signals like those emitted by a carrier’s own base stations. See, e.g., Harris
Wireless Products Group, Product Description, 1 (“Active interrogation capability emulates
base stations”), http://servv89pn0aj.sn.sourcedns.com/~gbpprorg/2600/Harris_StingRay.pdf .
Those signals “penetrate walls” (necessarily, to provide connectivity indoors). What You Need
to Know About Your Network, AT&T, http://www.att.com/gen/press-room?pid=14003; see also
E.H. Walker, Penetration of Radio Signals Into Buildings in the Cellular Radio Environment,
62 THE BELL SYSTEMS TECHNICAL JOURNAL 2719 (1983), http://www.alcatellucent.com/bstj/vol62-1983/articles/bstj62-9-2719.pdf.
Page 8
1
2
3
4
5
6
cases “within an accuracy of 2 m[eters].”16 United States v. Rigmaiden, a tax fraud prosecution,
is one of the few cases in which the government’s use of the device has come to light. In it, the
government conceded that agents used the device while wandering around an apartment
complex on foot, and that the device ultimately located the suspect while he was inside his unit.
See United States v. Rigmaiden, 2013 WL 1932800, at *15 (D. Ariz. May 8, 2013).17
Third, stingrays impact third parties on a significant scale. In particular, they capture
7
8
9
10
information from third parties by mimicking a wireless company’s network equipment and
thereby triggering an automatic response from all mobile devices on the same network in the
vicinity.18 The government in Rigmaiden conceded as much. See id. at *20.
Fourth, the devices can be configured to capture the actual content of phone calls or text
11
12
messages.19
Fifth, the government has failed to disclose crucial details about its use of stingray
13
14
technology – even to the magistrate judges who oversee and approve electronic surveillance
15
applications. In the Rigmaiden matter, the government sought court authorization from then-
16
Magistrate Judge Seeborg to use a stingray, but the application did not indicate that the device
17
at issue was a stingray and “did not disclose that the … device would capture signals from other
18
19
20
21
22
23
24
25
26
27
28
16
See, e.g., PKI Electronic Intelligence GmbH, GSM Cellular Monitoring Systems, 12 (device
can “locat[e] ... a target mobile phone within an accuracy of 2 m[eters]”),
http://www.docstoc.com/docs/99662489/GSM-CELLULAR-MONITORING-SYSTEMS--PKI-Electronic-#.
17
Although the criminal prosecution is pending in the District of Arizona, the orders
authorizing use of the stingray device were issued in the Northern District of California by thenMagistrate Judge Seeborg. See Rigmaiden, 2013 WL 1932800 at *3.
18
See, e.g., Hannes Federrath, Protection in Mobile Communications, MULTILATERAL
SECURITY IN COMMUNICATIONS, 5 (Günter Müller et al. eds., 1999) (“possible to determine the
IMSIs of all users of a radio cell”), available at http://epub.uniregensburg.de/7382/1/Fede3_99Buch3Mobil.pdf; Daehyun Strobel, IMSI Catcher,
Seminararbeit, Ruhr-Universität, Bochum, Germany, 13 (July 13, 2007) (“An IMSI Catcher
masquerades as a Base Station and causes every mobile phone of the simulated network
operator within a defined radius to log in.”), available at
http://www.emsec.rub.de/media/crypto/attachments/files/2011/04/imsi_catcher.pdf.
19
See, e.g., Ability, “Active GSM Interceptor: IBIS II - In-Between Interception System - 2nd
Generation” (“Real Time Interception for voice and SMS”), available at
http://www.interceptors.com/intercept-solutions/Active-GSM-Interceptor.html.
Page 9
1
2
3
4
5
6
7
8
9
cells phones … in the area.” Id. A May 23, 2011 email obtained from the U.S. Attorney’s
Office for the Northern District of California through a Freedom of Information Act lawsuit
indicates that the Rigmaiden application was not unique: The email describes how federal
agents in this judicial district were using stingray “technology in the field” even though
applications submitted to the court did “not make that explicit”; the email further indicates that
magistrates in the Northern District of California had expressed “collective concerns” about
some aspects of the government’s use of this technology. See Defs’ Exh. O (ECF No. 230) at 1.
b.
Stingrays Raise Myriad Fourth Amendment Problems
10
Stingray technology gives rise to numerous constitutional violations.
11
First, there is a serious question whether stingray technology – because of its inevitable
12
impact on third parties – can ever be used consistent with the Fourth Amendment. The Fourth
13
Amendment was “the product of [the Framers’] revulsion against” “general warrants” that
14
provided British “customs officials blanket authority to search where they pleased for goods
15
imported in violation of the British tax laws.” Stanford v. Texas, 379 U.S. 476, 481-82 (1965).
16
Stingrays, however, inevitably scoop up information about innocent third parties as to whom
17
there is no probable cause. See United States v. Spilotro, 800 F.2d 959, 963 (9th Cir. 1986)
18
(Fourth Amendment “prevents general, exploratory searches and indiscriminate rummaging
19
through a person’s belongings”).
20
21
22
23
24
25
26
27
28
Second, and at a minimum, the government’s use of these devices constitutes a search
within the meaning of the Fourth Amendment. By pinpointing suspects and third parties when
they are inside homes and other private locations, stingrays invade reasonable expectations of
privacy. See Kyllo v. United States, 533 U.S. 27, 34 (2001) (thermal imaging to detect heat
from home constituted search); United States v. Karo, 468 U.S. 705, 715 (1984) (monitoring of
beeper placed into can of ether that was taken into residence constituted search). In addition,
stingrays involve a trespass; they send electronic signals to penetrate the walls of everyone
living nearby in order to seek information about interior spaces. See Silverman v. United States,
365 U.S. 505, 509 (1961) (use of “spike mike,” a microphone attached to spike inserted into
Page 10
1
2
3
4
5
6
7
8
9
10
11
12
walls of house, constituted “unauthorized physical penetration into the premises” giving rise to
a search); Jones, 132 S. Ct. at 949 (installation and monitoring of GPS on suspect’s vehicle
constituted search because of “physical intrusion” “for the purpose of obtaining information”).
Further, to the extent the government uses stingray devices while walking on foot immediately
outside people’s homes to ascertain information about interior spaces, it impermissibly intrudes
on constitutionally protected areas. See Florida v. Jardines, 133 S. Ct. 1409 (2013)
(government’s entry into curtilage with trained dogs to sniff for drugs inside home constitutes
search). As a result, use of a stingray is presumptively invalid unless the government obtains a
warrant.
Third, assuming stingray use is not per se unconstitutional, and even in those instances
where the government obtains a warrant, the warrant materials must be reviewed to ensure that
13
the government provided the magistrate with material information about the technology. Given
14
the heightened risk of intrusive searches posed by advances in technology, “the government’s
15
duty of candor in presenting a warrant application,” United States v. Comprehensive Drug
16
17
18
Testing, Inc., 621 F.3d 1162, 1178 (9th Cir. 2010), requires it to explain to magistrates the
technology and “the process by which the technology will be used to engage in the electronic
19
surveillance.” See In re Application for an Order Authorizing Installation and Use of a Pen
20
Register and Trap and Trace Device, 890 F. Supp. 2d 747, 749 (S.D. Tex. 2012) (denying
21
application pursuant to pen register statute to use stingray device where application failed to
22
23
24
“explain the technology”). An understanding of “the technology involved” is necessary to
“appreciate the constitutional implications of” the warrant application, particularly where, as
25
with stingrays, the technology entails “a very broad and invasive search affecting likely
26
hundreds of individuals in violation of the Fourth Amendment.” In re Application for an Order
27
Pursuant to 18 U.S.C. § 2703(d) (In re Cell Tower Dump), 930 F. Supp. 2d 698, 702 (S.D. Tex.
28
2012) (denying statutory application for request for cell site records of all subscribers from
Page 11
1
several cell towers). A magistrate cannot exercise her constitutional function of supervising the
2
search, unless presented with all material facts. Information about how the technology works is
3
4
5
necessary for the magistrate to craft “explicit limitations … to prevent an overly intrusive
search.” United States v. Rettig, 589 F.2d 418, 423 (9th Cir. 1978).20 Thus, evidence that a
6
search warrant was obtained pursuant to an affidavit that deliberately omitted key information is
7
material to a defendant’s suppression motion. See infra at Part B-3.
8
B. Brady and Rule 16 Require The Government To Disclose To Defendants The
Full Extent Of The Electronic Surveillance Used In This Investigation
9
The government’s obligations under Brady v. Maryland, 373 U.S. 83 (1963), and Fed. R.
10
11
Crim. P. 16 extend to information relevant to a Fourth Amendment motion to suppress.
12
Defendants are therefore entitled to disclosure of the full extent of the electronic surveillance
13
used in this case, in particular, any reliance on NSA-derived call data, the Hemisphere Project,
14
and/or stingrays. Given the unconstitutionality of these intrusive surveillance programs and
15
devices, see supra Part II-A, defendants have a right to information showing whether the
16
government relied on them; for if it did, defendants would have more than a reasonable
17
probability of prevailing on a motion to suppress. See United States v. Gamez-Orduno, 235
18
F.3d 453, 461 (9th Cir. 2000) (“[S]uppression of material evidence helpful to the accused,
19
whether at trial or on a motion to suppress, violates due process if there is a reasonable
20
probability that, had the evidence been disclosed, the result of the proceeding would have been
21
different.”).
22
23
24
25
26
27
28
1.
The Government Has Failed To Disclose Significant Sources Of
Information On Which It Relied To Obtain Wiretaps
The information provided to defendants about the investigation contains obvious and
substantial gaps.
20
Such limitations might include judicially developed protocols for how to handle third-party
data, cf., e.g., CDT, 621 F.3d at 1180 (proposing “[s]egregation and redaction” of third-party
information “by specialized personnel or an independent third party”) (Kozinski, C.J.,
concurring), and an express prohibition on capturing content absent compliance with the
heightened requirements for a wiretap set forth in 18 U.S.C. §2518.
Page 12
1
2
3
4
5
6
7
8
9
This case is a multi-defendant prosecution for drug distribution and other drug-related
offenses. See Defs’ Mot. to Compel (ECF No. 226) at 3. The investigation spanned from San
Francisco to the Pacific Northwest. See, e.g., Defs’ Exh. P (ECF No. 230) ¶ 8.
In the course of this investigation, the government obtained call detail records for
742,907 phone calls. It produced to defendants a spreadsheet with the call data, which consisted
of the “target” phone number (or other unique identifying number), number dialed or dialing in,
date, time, and duration of the call, and in some cases location information. The spreadsheet
revealed that at least 643 different unique identifying numbers are listed as ‘target’ phones, but
10
the government produced court orders authorizing collection of call data for only 52 numbers.
11
Thus, the government acquired CDRs on 591 numbers not identified in any of the court orders
12
produced to defendants. See Defs’ Mot. to Compel (ECF No. 226) at 23-24. This enormous
13
discrepancy between the call data actually collected and the court orders authorizing such
14
collection raises substantial questions about whether the government has failed to produce
15
documents or information identifying the source of much of the call data.
16
When queried about how the government acquired such voluminous call data, the
17
Assistant United States Attorney suggested that the data had been obtained by “administrative
18
subpoena.” Id. at 24.
19
While there are large gaps in what the government has produced to date, the orders that
20
have been disclosed are telling. At various points in the investigation when a target ceased
21
using a particular phone that was being monitored, the government was quickly able to identify
22
23
24
25
26
27
28
the target’s new phone – yet it has hardly explained how it accomplished this feat, saying only
that it relied on undisclosed “confidential source[s].” See, e.g., Defs’ Exh. Q (ECF No. 230) at
Bates 01001350 ¶ d (Sprint suspended service on target’s phone on August 8, 2009; two days
later “a confidential source (previously identified as SOI-1) provided investigating agents with a
new cellular telephone number”).
It is thus clear that the government has not disclosed all sources of cell phone data. Such
sources consist at a minimum of the following two types of information (1) all sources of
Page 13
1
2
3
4
5
6
7
8
9
10
11
12
information for the approximately 750,000 calls involving at least 643 target numbers and (2)
the sources of information that mysteriously and quickly allowed the government to ascertain
replacement phones, and for which the government then sought additional court orders
authorizing it to obtain additional call data. This is despite the fact that the government relied
heavily on the cell phone data in obtaining authorization for the wiretaps. See Defs’ Mot. to
Compel (ECF No. 226) at 20-23.
2.
The Government’s Disclosures Strongly Suggest Its Investigation
Relied On Unconstitutional Surveillance Programs Such As
Hemisphere
At the same time, the evidence strongly suggests that the government relied in this
investigation on the unconstitutional surveillance programs described above, including
Hemisphere.
This case involved the investigation of a drug trafficking ring in California and the
13
14
15
Northwest – exactly the geographic and subject-matter focus of the Hemisphere Project, as
detailed in the training slides disclosed by the New York Times. See Hemisphere Slide Deck at
16
1-2, 4. The government acquired call detail records for almost three-quarters of a million phone
17
calls. Cf. id. at 2 (4 billion CDRs populate Hemisphere each day). It appears to have acquired
18
at least some of these CDRs by administrative subpoena (see Defs’ Mot. to Compel (ECF No.
19
226) at 24), the process contemplated by Hemisphere. See Hemisphere Slide Deck at 2
20
(“Hemisphere provides electronic call detail records (CDRs) in response to federal, state, and
21
local administrative/grand jury subpoenas.”). 21
Perhaps most significantly, the government in this investigation was able to quickly
22
23
24
25
26
27
28
21
To the extent these CDRs contained location information, using an administrative subpoena
would be at odds with the government’s public position on the appropriate legal process for
acquiring cell site location information from a carrier – a court order under 18 U.S.C. §2703(d).
See, e.g., In re Application of U.S. for Historical Cell Site Data, 724 F.3d 600 (5th Cir. 2013).
While amici contend that the Fourth Amendment instead requires the government to obtain a
probable cause warrant for such data, a Section 2703(d) order is in any event different than a
subpoena; the standard for disclosure is greater and it requires judicial action. See 18 U.S.C.
§2703(d) (which requires “specific and articulable facts” that “the records or other information
sought, are relevant and material to an ongoing criminal investigation”).
Page 14
1
2
3
4
5
6
7
8
9
identify replacement phones as the targets of its drug investigation discarded old ones. See,
e.g., Defs’ Exh. Q (ECF No. 230). That ability is one of Hemisphere’s “[u]nique [p]roject
[f]eatures.” See Hemisphere Slide Deck at 5. Indeed, “Hemisphere is most often used by DEA
… in the Northwest [High Intensity Drug Trafficking Area] to identify replacement/additional
phones.” Id. at 4; see also id. at 5 (“the program” can “find the new number” when target
drops a phone; “the program can often determine cell phones the target is using that are
unknown to law enforcement”). And, consistent with Hemisphere, here Defendants’ new
phone numbers were identified because they were being “used by [Defendants] in a similar
10
fashion, with similar calling patterns and similar common callers to [their old phones].” Defs’
11
Mot. to Compel (ECF No. 226) at 21 (quoting Bates 1000051-53).
12
The fact that the government’s affidavits nowhere mention Hemisphere or other
13
surveillance programs is not surprising. “All requestors are instructed to never refer to
14
Hemisphere in any official document.” Id. at 12. In much the same way, recently disclosed
15
government training materials show that DEA agents who receive tips based on NSA
16
surveillance are instructed to manufacture an alternative basis for their investigation and the
17
resulting evidence, in order to obscure the original source of the information. See “U.S. Directs
18
Agents To Cover Up Programs,” supra note 8 (Document obtained by Reuters “specifically
19
directs agents to omit the SOD’s involvement [in funneling NSA-derived information] from
20
investigative reports, affidavits, discussions with prosecutors and courtroom testimony. Agents
21
are instructed to then use ‘normal investigative techniques to recreate the information provided
22
23
24
25
26
27
28
by SOD.’”). This practice effectively covers up the true source of the government’s
investigation, ensuring that the defendant never has the opportunity to challenge the legality of
controversial tactics, such as the surveillance programs at issue here. See id. (describing
example where federal agent sought to conceal reliance on NSA intercept).
The ease with which the government in this investigation identified new phone numbers
used by its targets would also be consistent with its use of stingrays. See “How ‘Stingray’
Devices Work,” supra note 14 (by “point[ing] the antenna at a location,” stingray can collect
Page 15
1
2
3
4
5
number associated with phone “in a given place at a given time”).
3.
Information About The Electronic Surveillance Used In This Case Is
Material To The Defense
As discussed above, the government obtained information from sources it has not
6
disclosed to the defense, but which it used to obtain wiretaps. See supra Part II-B-1. This
7
Court should order disclosure of information pertaining to these sources, whether they belong to
8
Hemisphere or any other surveillance program or device not previously disclosed. Information
9
about the sources of the extensive cell phone data acquired and relied upon by the government
10
11
in this case is material to the defense, in particular, a motion to suppress.
The Fifth Amendment’s guarantee of due process requires the government to disclose to
12
the defense any evidence “favorable to an accused” and “material either to guilt or to
13
punishment.” Brady, 373 U.S. at 87. Evidence is “material” if “there is a reasonable
14
probability that its disclosure would have affected the outcome of the proceedings.” United
15
States v. Guzman-Padilla, 573 F.3d 865, 890 (9th Cir. 2009) (internal quotation marks, citation
16
omitted). Federal Rule of Criminal Procedure 16 helps effectuate these constitutional rights by
17
granting “criminal defendants a broad right to discovery,” including the requirement that the
18
government disclose “documents” or “data” in “the government’s possession, custody, or
19
20
21
22
23
24
25
26
27
28
control” that are “material to preparing the defense.” United States v. Stever, 603 F.3d 747, 752
(9th Cir. 2010) (quoting Fed. R. Crim. P. 16(a)(1)(E)(i)). Brady’s discovery obligations extend
to facts relevant to raising Fourth Amendment challenges. See Gamez-Orduno, 235 F.3d at 461
(“The suppression of material evidence helpful to the accused, whether at trial or on a motion to
suppress, violates due process”).
The information sought by defendants is material for three reasons.
First, information that sheds light on whether the government relied on NSA-derived
data, Hemisphere, or stingrays is material to a motion to suppress because it would allow
defendants to challenge the constitutionality of any intrusive surveillance programs to which
Page 16
1
2
3
4
5
6
7
8
9
10
they were subjected. There are significant gaps in the sources of the cell phone information
obtained by the government, gaps that are likely explained by the government’s reliance on
Hemisphere or other forms of electronic surveillance. See supra at Part II-B-1&2. These
intrusive surveillance programs and devices are unconstitutional. See supra at Part II-A. “Rule
16 permits discovery that is ‘relevant to the development of a possible defense.’” United States
v. Mandel, 914 F.2d 1215, 1219 (9th Cir. 1990). Defendants should therefore be permitted to
develop through discovery information about the extent of the government’s reliance on
unconstitutional electronic surveillance in this investigation.
Second, Brady requires the disclosure of evidence that “bears on the credibility of a
11
significant witness in the case.” United States v. Strifler, 851 F. 2d 1197, 1201 (9th Cir. 1988);
12
see also Giglio v. United States, 405 U.S. 150, 154 (1972). This requirement applies even if the
13
“witness” is electronic surveillance.
14
Disclosure obligations apply to information about the reliability of “witnesses” the
15
government does not call at trial and that are not human. For example, the government must
16
disclose records about a drug detecting dog, including training and certification records and the
17
“handler’s log,” in order to allow the defense to assess the dog’s reliability and effectively
18
cross-examine the handler at a suppression hearing. United States v. Thomas, 726 F.3d 1086,
19
1096 (9th Cir. 2013) (citing United States v. Cedano–Arellano, 332 F.3d 568, 570-71 (9th Cir.
20
2003)); see also United States v. Cortez–Rocha, 394 F.3d 1115, 1118 n.1 (9th Cir. 2005)
21
(disclosure of drug detecting dog evidence is “mandatory”). The Supreme Court explained
22
23
24
25
26
27
28
earlier this year that a criminal defendant must be able to challenge the reliability of a drug
detecting dog, noting specifically that the dog’s performance in the field may be relevant.
Florida v. Harris, 133 S. Ct. 1050, 1057 (2013). “[C]ircumstances surrounding a particular
alert may undermine the case for probable cause” in some instances. Id. at 1057-58.
Brady and Rule 16 disclosure requirements apply equally to dogs and the covert use of
surveillance programs. A drug detecting dog’s performance is relevant to assessing the dog’s
credibility for purposes of a suppression motion. To the extent Hemisphere or other
Page 17
1
2
3
4
5
6
7
8
9
surveillance programs served as the “confidential source … provid[ing] investigating agents
with … new cellular telephone number[s]” of the targets of the investigation, Defs’ Exh. Q
(ECF No. 230) at Bates 01001350, so too is information about how these programs function.
And just as the “circumstances surrounding a particular alert” may undermine probable cause in
a dog sniff situation, Harris, 133 S. Ct. at 1057, the same is true of information about the
“algorithm and advanced search features” used by Hemisphere “to find the new number.” See
Hemisphere Slide Deck at 5. Indeed, the government acknowledges that the replacement phone
numbers identified by Hemisphere are only “ranked by probability.” Id. at 7. Under Brady and
10
Rule 16, the defense is entitled to information that would allow cross-examination over the
11
reliability of these surveillance programs.
12
Third, due process prohibits the government’s deliberate omission of information
13
necessary to bring a suppression motion. In United States v. Barton, 995 F.2d 931, 934 (9th Cir.
14
1993), the Ninth Circuit held that the deliberate destruction of evidence that would allow a
15
defendant to impeach the officer who submitted a search warrant affidavit violates “the due
16
process principles announced in Brady.” Id. at 935. Barton relied on Franks v. Delaware, 438
17
U.S. 154 (1978), which held that defendants have a right to challenge deliberately falsified
18
statements submitted in support of a search warrant application. Barton, 995 F.2d at 934-35.
19
The underlying rationale of both Barton and Franks is that “an officer” should not be permitted
20
to “feel secure that false allegations in his or her affidavit for a search warrant could not be
21
challenged.” Barton, 995 F.3d at 935; see also Franks, 438 U.S. at 168 (Fourth Amendment’s
22
23
24
25
26
27
28
probable cause requirement “would be reduced to a nullity if a police officer was able to use
deliberately falsified allegations to demonstrate probable cause, and, having misled the
magistrate, then was able to remain confident that the ploy was worthwhile”).
This same rationale prohibits the deliberate omission of information necessary for a
successful motion to suppress. Cf. United States v. Stanert, 762 F.2d 775, 780-81 (9th Cir.
1985) (“[W]e expressly hold that the Fourth Amendment mandates that a defendant be
permitted to challenge a warrant affidavit valid on its face when it contains deliberate or
Page 18
1
2
3
4
5
6
7
8
9
reckless omissions of facts that tend to mislead.”). Here, publicly available evidence suggests
that law enforcement agents are intentionally omitting relevant information about their
investigations, even in “official document[s].” Hemisphere Slide Deck at 12 (“never refer to
Hemisphere”); see also “U.S. Directs Agents To Cover Up Programs,” supra note 8 (agents
directed to omit reference to NSA-derived information and instead “recreate” information
provided). An internal email from the U.S. Attorney’s Office in this district indicates that
federal agents were using stingray technology “without making that explicit” in pen register
applications to this Court. See Defs’ Exh. O (ECF No. 230) at 1. Due Process should prohibit,
10
and not reward, such intentional omissions, as they would allow the government to “feel secure”
11
that its reliance on unlawful forms of electronic surveillance “could not be challenged.” Barton,
12
995 F.2d at 935.
13
In sum, Brady and Rule 16 require disclosure of all of the sources of the cell phone data
14
obtained by the government in this investigation. This includes the sources of the 750,000 calls
15
identified on the spreadsheet produced to defendants and the “confidential sources” that
16
supplied new phone numbers. The Fourth Amendment right to be free from unconstitutional
17
electronic surveillance “would be reduced to a nullity” (Franks, 438 U.S. at 168) if the
18
government were permitted to conceal from Defendants and the Court factual information about
19
the extent to which the government relied on Hemisphere or other unconstitutional forms of
20
electronic surveillance to further the investigation.
21
22
23
C.
By Shrouding Its Surveillance Practices In Secrecy, The Government
Prevents Courts from Reviewing Its Practices
Information about the intrusive and powerful surveillance techniques used to investigate
24
Defendants is clearly essential to this criminal proceeding. But it also has a significance far
25
beyond this case. Disclosure of the information sought is necessary to prevent the government
26
from immunizing controversial surveillance practices from judicial and public scrutiny.
27
“It may very well be that, given full disclosure of” the government’s surveillance
28
practices, “the people and their elected representatives would heartily approve without a second
Page 19
1
2
3
4
5
6
7
thought. But then again, they might not.” In re Sealing and Non-Disclosure of
Pen/Trap/2703(d) Orders, 562 F. Supp. 2d 876, 886 (S.D. Tex. 2008) (“In re Sealing”).22
While access to this information is fundamental to our open system of government in
general, it is particularly important where the government seeks to use new technology to
engage in surveillance. This is so because new forms of technology often raise novel
constitutional questions. See supra at Part A.
But the government goes to great lengths to keep its surveillance practices secret not
8
9
only from the public, but even from the courts. It takes affirmative measures to obscure its
10
reliance in criminal investigations on controversial surveillance sources, like Hemisphere or
11
NSA-derived intelligence, in documents presented to the Court. See Hemisphere Slide Deck at
12
12 (agents “instructed to never refer to Hemisphere in any official document”); “U.S. Directs
13
Agents To Cover Up Programs,” supra note 8 (Document obtained by Reuters directs agents to
14
omit reference to NSA-derived information from affidavits and courtroom testimony and to use
15
“‘normal investigative techniques to recreate the information provided’”). Agents in this
16
district have apparently used stingray technology “without making that explicit” in
17
accompanying applications to this Court. See Defs’ Exh. O (ECF No. 230) at 1. Even in those
18
instances when the government sets forth its surveillance practices in applications for court
19
orders, the public has few methods for accessing this information.23
20
21
22
23
24
25
26
27
28
22
Judge Smith has identified a troubling phenomenon of permanently sealed electronic
surveillance dockets in district courts around country. Government applications for electronic
surveillance are typically filed under seal “until further order of the Court”; but because the
government rarely moves to unseal these orders, they typically remain sealed indefinitely. See
id. at 877-78; see also Stephen Wm. Smith, Gagged, Sealed & Delivered: Reforming ECP’s
Secret Docket, 6 Harv. L. & Pol’y Rev. 313, 322 (2012) (estimating that federal magistrate
judges issued more than 30,000 orders for electronic surveillance under seal in 2006, “more
than thirty times the annual number of [Foreign Intelligence Surveillance Act] cases”). Based
on the First Amendment and common law right of access to judicial records, Judge Smith
therefore announced that he would follow a new protocol, sealing electronic surveillance orders
only for six months, after which sealing orders would automatically expire absent a showing of
need by the government for continued sealing. Id. at 895.
23
The Department of Justice is at present vigorously opposing Freedom of Information Act
litigation seeking applications for electronic surveillance involving location tracking and filed
Page 20
1
2
3
4
5
6
7
8
9
By keeping this information secret, the government, whether intentionally or not,
immunizes itself from popular, legislative, and legal challenges to its surveillance practices.
Because the government seeks court authorization – either statutory orders or probable cause
warrants – to engage in location tracking in ex parte proceedings, magistrates reviewing such
applications lack the benefit of the adversarial process in deciding these complex legal issues.
This has the potential to create serious distortions in the development of surveillance law, by
allowing the executive branch excessive authority in “making” the law.
Perhaps it is not surprising that the government actively resists disclosure of information
10
about its surveillance practices in Freedom of Information Act cases. But if the government is
11
able to hide this information even from criminal defendants who have been subjected to
12
intrusive surveillance, then these practices will escape all court review and the executive will
13
effectively be allowed to make surveillance law unilaterally and secretly. Our constitutional
14
system does not tolerate such a result.
15
//
16
//
17
//
18
//
19
//
20
//
21
22
23
24
25
26
27
28
by the United States’ Attorneys Office for the Northern District of California in this Court.
DOJ has asserted that it should not even have to search for records (let alone produce them)
because most of the records are under seal and it has no process for systematically ascertaining
“whether the conditions requiring sealing continue.” See ACLU of Northern California v. Dep’t
of Justice, N.D. Cal. Case No. 12-cv-04008-MEJ, ECF Nos. 43 at 18; 43-1 ¶ 9 (excerpts
attached as Lye Decl., Exhs. 2 & 3. The government is thus keeping its surveillance practices
secret, long after the actual need for secrecy dissolves. Judge Smith’s observation about the
Southern District of Texas is thus equally apt in this judicial district: “indefinitely sealed means
permanently sealed.” In re Sealing, 562 F. Supp. 2d at 878.
Page 21
1
2
3
4
5
III.
CONCLUSION
For the foregoing reasons, the Court should grant Defendants’ motion to compel.
Dated: October 15, 2013
Respectfully Submitted,
By:
6
7
8
9
10
11
12
13
14
15
16
17
18
19
/s/ Linda Lye
Linda Lye
Linda Lye
FOUNDATION OF NORTHERN CALIFORNIA
39 Drumm Street, 2nd Floor
Telephone:
415-621-2493
Facsimile:
415-255-8437
Attorneys for Amicus American Civil Liberties Union
of Northern California
Ezekiel Edwards ([email protected])
Nathan Freed Wessler ([email protected])
FOUNDATION
125 Broad Street, 18th Floor
New York, NY 10004
Telephone: 212-549-2500
Facsimile:
212-549-2654
Attorneys for Amicus American Civil Liberties
Union
22
Hanni M. Fakhoury
815 Eddy Street
Telephone:
415-436-9333
Facsimile:
415-436-9993
23
Attorneys for Amicus Electronic Frontier Foundation
20
21
24
25
26
27
28
Page 22
IMSI-CATCHER SAMPLE DISCOVERY REQUEST
Pursuant to RELEVANT RULE/STATUTE, Defendant JOHN DOE requests the
following discovery concerning electronic devices capable of identifying the location of a
cellular telephone. These devices, known as an International Mobile Subscriber Identity
(“IMSI”) catcher or cell site simulator, are operated under brand names including, but not limited
to “Stingray,” “Triggerfish,” “Kingfish” and “DRTbox.”
JOHN DOE believes an IMSI catcher or cell site simulator (collectively “device(s)”) was
used in this case and seeks discovery of the following records about such device(s), regardless of
its name or label:
1. Details concerning the device(s), whether in written form or not, including:
a. the manufacturer and brand of the device(s) and any additional equipment used in
connection with the device(s);
b. the capabilities of the device(s);
c. descriptions of the information captured by the device(s) and whether and how it
is retained;
2. Physical access to any and all devices used in this case by any federal, state or local law
enforcement official;
3. Copies of the raw data produced by the device(s) and utilized by law enforcement;
4. For all law enforcement agencies and officers involved in this case, copies of any and all
a. arrest reports from any officers who used any device during this case, regardless
of whether the device(s) is specifically referenced in the report or not;
b. logs, sign out sheets or other records documenting who used the device(s) and the
circumstances on its deployment;
c. training or certification records of the officers that used the device(s);
d. training materials in the possession of law enforcement agencies for the device(s);
e. contracts, memorandums of understanding and agreements, including but not
limited to nondisclosure agreements, concerning the device in the possession of,
or that bind the law enforcement agencies;
f. internal policies, guidelines, training manuals, or presentations concerning use or
disclosure of the devices;
g. administrative or grand jury subpoenas, pen registers, search warrants and any
other judicial order, including the application, affidavit and orders, applied for,
whether granted or not, by law enforcement in this case concerning
i. Customer(s) CLIENT/CO-DEFENDANT NAME;
ii. Phone number XXX-XXX-XXXX AND ANY OTHER RELEVANT
NUMBERS;
iii. Cell phone provider VERIZON/SPRINT/ETC.
h. records produced as a result of the orders described above used;
Los Angeles Hemisphere
LAW ENFORCEMENT SENSITIVE
Hemisphere Summary
  The Hemisphere Project is coordinated from the Los Angeles
Clearinghouse and is funded by ONDCP and DEA.
  Hemisphere provides electronic call detail records (CDRs) in
response to federal, state, and local administrative/grand
jury subpoenas.
  The Hemisphere database contains CDRs for any telephone
carrier that uses an AT&T switch to process a telephone call.
  Hemisphere is an unclassified program.
  Hemisphere provides de-confliction within the Hemisphere
database.
  4 billion CDRs populate the Hemisphere database on a daily
basis.
Hemisphere Summary
  Hemisphere results can be returned via email within an hour
of the subpoenaed request and include CDRs that are less
than one hour old at the time of the search
  The Hemisphere program has access to long distance and
international CDR’s data going back to 1987
  Hemisphere data contains roaming information that can
identify the city and state at the time of the call
  Results are returned in several formats that aid the analyst/
investigator (I2, Penlink, GeoTime, Target Dialed Frequency
report, Common Calls report, etc)
Facts and Figures
  Since its inception in September 2007, the Los Angeles
Hemisphere Program has processed over 4,400 requests and
over 11,200 individual telephone numbers
  As of June 2013 Hemisphere has processed 679 requests from
the Northwest HIDTA
  Hemisphere is most often used by DEA and DHS in the
Northwest HIDTA to identify replacement/additional phones
  The Northwest HIDTA has recently utilized Hemisphere to
track known Canadian phones roaming in the U.S. on the
AT&T network
Unique Project Features
  “Dropped Phones” - the program uses an algorithm
and advanced search features to find the new number.
  “Additional Phones” – the program can often
determine cell phones the target is using that are
unknown to law enforcement.
  “International Phones” – the program provides
CDRs for a tremendous amount of international
numbers that place calls through or roam on the AT&T
network. The information is provided in response to
the standard Hemisphere administrative subpoena.
Advanced Results
Analysis
Searching For Dropped Phones
  Dropped Phone Requests: A service provided by
Hemisphere, requestors can ask for analysts to find
possible replacement phones that are no longer active
  To do this, you must mention “Dropped Phone Request”
in the special instructions on your request form
  A dropped phone report will be returned in paragraph
form and either written out in the returned email or
attached with the results as a word file
Advanced Results
Analysis
Searching For Dropped Phones
  The method for identifying the replacement phone for
the dropped phone involves careful analysis of the
developed advanced results
  By systematically grading the common calls report and
scrutinizing the date ranges, candidates for the
replacement phone are ranked by probability
Protecting The Program
Protecting the Hemisphere program is a formidable challenge.
We have taken the following steps to try and keep the program
under the radar.
" 
Training – All Hemisphere training modules are inundated
with instruction regarding how to protect Hemisphere data.
" 
Use - Hemisphere requests are vetted. Requestors must have
either attended Hemisphere training or be directly connected to
a HIDTA Initiative/Agency or intelligence center familiar with
the program.
Hemisphere data will likely produce a variety of different
leads for an array of cases.
Hemisphere data will only indicate calls that hit an AT&T
switch
Therefore, the only way to get a complete and accurate
picture of the target’s phone activity is to subpoena and
review a complete set of the carrier’s CDRs.
When a complete set of CDRs are subpoenaed from the
carrier, then all memorialized references to relevant and
pertinent calls can be attributed to the carrier’s records,
thus “walling off” the information obtained from
Hemisphere. In other words, Hemisphere can easily be
protected if it is used as a pointer system to uncover
relevant numbers.
-Exigent
Circumstances-
In special cases, we realize that it might not be possible to
obtain subpoenaed phone records that will “wall off”
Hemisphere.
In these special circumstances, the Hemisphere analyst
should be contacted immediately. The analyst will work
with the investigator and request a separate subpoena to
AT&T.
-Official Reporting-
All requestors are instructed to never refer to Hemisphere
in any official document.
If there is no alternative to
referencing a Hemisphere request, then the results should be
referenced as information obtained from an AT&T subpoena.
What’s new with Hemisphere?
 First court order from Washington submitted in Dec
2012
 AT&T legal approved use of Court orders from Washington state
 Allows Local agencies to utilize Hemisphere through court orders
 Hemisphere began providing subscriber
information in July 2012 for AT&T phones
 Began IMSI and IMEI searches in July 2012 if
equipment is utilizing AT&T’s wireless network
 Started offering mapping through the GeoTime
software in July 2012
 Introduced limited pinging for some phones in May
2013
Hemisphere 2012 Requests 543
617
Atlanta
Houston
Los Angeles
1610
Hemisphere Requests By HIDTA 2012-‐2013 Central Valley HIDTA
28
4
Hawaii HIDTA
85
Los Angeles HIDTA
304
183
Nevada HIDTA
Northern California HIDTA
Northwest HIDTA
19
Oregon HIDTA
152
59
4
Southwest Border HIDTA: Arizona
Southwest Border HIDTA: California
Hemisphere Requests By Agency Northwest HIDTA 2012-‐2013 4
1 1
DEA
DHS
69
77
FBI
Tacoma Pd
Washington DOC
Request by Type Northwest HIDTA 2012-‐2013
46
106
BASIC
DROPPED PHONE
Hemisphere Drug Types Northwest HIDTA 2012-‐2013
4% 4%
26%
28%
10%
21%
7%
COCAINE
HEROIN
MARIJUANA
METH
POLYDRUG
ECSTASY
*OTHER
* Fugi'ves, Homicides, Kidnappings, Missing Persons, Etc.
Northwest HIDTA
Hemisphere
SUCCESS
STORIES
DEA- Seattle 2011
• During a wire intercept conducted from Jan
2011 to April 2011, targets would continually
rotate their pre-paid phones
• Utilized Hemisphere extensively to
identify dropped phones and verify targets
• Hemisphere identified a significant
amount of the new numbers
• Based on this wire intercept investigation DEA
was able to seize;
•  136 kilos of cocaine
• 2000 pounds of marijuana
• Approximately 2.2 million dollars
• Several residences, vehicles, and other
assets.
• “Plus, we really pissed off the Hells
Angel’s in Canada”
2012-2013
Hemisphere
SUCCESS
STORIES
Montclair PD- Los Angeles
2012
• Men wearing ski masks smashed cases inside the Ben
Bridge store at Montclair Plaza and grabbed 30 Rolex
watches while holding employees and customers at
gunpoint
• Police officers worked with law enforcement in
Henderson, Nev., after discovering two similar heists
occurred there
•  Through Hemisphere, detectives identified a new target
number being used by the main suspect
• Montclair PD quickly tracked the new target number and the
suspect and six others were apprehended
• Seven people were arrested and officers seized two
motorcycles and $180,000, believed to be bought with
cash from the robberies
• They also found evidence that they were planning to rob
the Glendale Galleria that day and another jewelry store in
San Francisco later
Redondo Beach PD-Los Angeles
2012
• A warrant was issued for Rene Avina's arrest
Monday after authorities identified him as a second
man wanted in connection with the June 2 death of
49-year-old bar bouncer Terie Colecchi
• Through Hemisphere detectives identified a target
number being used by the main suspect
• He was arrested on suspicion of murder
DEA- Los Angeles/South Carolina
Feb 2013
• Melissa Ann Griggs made repeated bomb threats to
hospitals, schools, banks and county offices in South
Carolina
• The local authorities were having great difficulty
finding the number being used and reached out for
federal assistance
• One of the numbers presented on the caller id was
the cell phone number of a local drug trafficker
• Analysis of subpoenaed toll records indicated
this phone was not making the calls.
• Hemisphere toll record analysis of the threatened
businesses showed the calls were coming from a
Verizon Wireless customer
• With this knowledge, calls to destination
searches were requested of Verizon Wireless
revealing the actual number making the calls.
• She was arrested Feb. 14 at the Walmart in Seneca
on a trespassing charge, and charged with 30 counts
of making bombing threats
DEA- Arizona
2013
• Numerous dropped phone searches were
conducted over the course of a continuous
investigation with multiple replacement phones
identified
• Multiple Mexican phones roaming in the U.S.
were identified
• Since early 2012 the investigation has yielded
the following seizures
• 100lbs of meth
• 225 lbs of hashish
• 9kg of cocaine
• $190,000
• 5 assault rifles
• Bullet proof vest
• Investigation is ongoing with more seizures
expected
NCIS- San Diego
March 2013
• Kennard Walters, allegedly impersonating a 2 Star
General, was asked to show an identification card at
Naval Base San Diego
• He stated he left the card in his vehicle and
drove off
• Walters physically assaulted and subsequently ran
over a Naval Criminal Intelligence Service Special
Agent and fled the base
• After the initial incident the suspect changed his
phone number and drove to northern California
• After a return to the Los Angeles area, he then
drove to Tehama County in Northern California
where he was apprehended
• Hemisphere was able determine his new telephone
number, and provide cell site data leading to his
arrest
Questions?
Case: 1:10-cr-00747 Document #: 126 Filed: 08/29/12 Page 1 of 13 PageID #:379
UNITED STATES DISTRICT COURT
NORTHERN DISTRICT OF ILLINOIS
EASTERN DIVISION
UNITED STATES OF AMERICA
vs.
ANTONIO EVANS
)
)
)
)
)
)
)
Case No. 10 CR 747-3
Judge Joan H. Lefkow
OPINION AND ORDER
This matter is before the court on the government’s motion in limine to admit cell site
evidence and analysis through the testimony of Special Agent Joseph Raschke. (Dkt. #97.) On
August 17, 2011, defendant Antonio Evans and two co-defendants were charged with conspiracy
to kidnap in violation of 18 U.S.C. § 1201(c) (Count I) and kidnapping in violation of 18 U.S.C.
§ 1201(a)(1) (Count II).1 (Dkt. #41.) The kidnapping allegedly took place on April 23 and 24,
2010. The government proposes to call Special Agent Raschke to testify about the operation of
cellular networks and how to use historical cell site data to determine the general location of a
cell phone at the time of a particular call. Applying a theory called “granulization,” Special
Agent Raschke proposes to testify that calls placed from Evans’s cell phone during the course of
the conspiracy could have come from the building where the victim was held for ransom.
On August 21 and 23, 2012, this court held an evidentiary hearing pursuant to Federal
Rule of Evidence 702 and Daubert v. Merrell Dow Pharmaceuticals, Inc., 509 U.S. 579, 113 S.
Ct. 2786, 125 L. Ed. 2d 469 (1993), to determine whether the government’s proposed evidence
1
The two co-defendants, Jerry Zambrano and Jose Antonio Lopez, pleaded guilty on April 27,
2012 and August 7, 2012 respectively. (See Dkt. #95, #115.)
and analysis are admissible. After the hearing, Evans moved for disclosure of expert evidence
under Federal Rule of Criminal Procedure 16. (Dkt. #122.) For the reasons set forth herein, the
government’s motion in limine (dkt. #97) will be granted in part and denied in part and Evans’s
motion (dkt. #122) will be denied as moot.
LEGAL STANDARD
The admission of lay witness testimony is governed by Federal Rule of Evidence 701,
which limits lay opinion testimony to that which is (1) rationally based on the witness’s
perception; (2) helpful to clearly understanding the witness’s testimony or to determining a fact
in issue; and (3) not based on scientific, technical, or other specialized knowledge within the
scope of Rule 702. Fed. R. Evid. 701. The admission of expert opinion testimony is governed
by Federal Rule of Evidence 702 and Daubert. See Bielskis v. Louisville Ladder, Inc., 663 F.3d
887, 893 (7th Cir. 2011). Rule 702 states that a witness who is qualified as an expert by
knowledge, skill experience, training or education may testify in the form of opinion or
otherwise provided that “(1) the expert’s scientific, technical, or other specialized knowledge
will help the trier of fact to understand the evidence or to determine a fact in issue; (2) the
testimony is based on sufficient facts or data; (3) the testimony is the product of reliable
principles and methods; and
(4) the expert has reliably applied the principles and methods to the facts of the case.” Fed. R.
Evid. 702. To admit expert testimony under this rule, the court must determine that (1) the
witness is qualified; (2) the expert’s methodology is scientifically reliable; and (3) the testimony
will assist the trier of fact to understand the evidence or to determine a fact in issue. Myers v. Ill.
Cent. R.R. Co., 629 F.3d 639, 644 (7th Cir. 2010).
2
In Daubert the United States Supreme Court set out four factors the court may consider
when assessing the reliability of an expert’s methodology, including (1) whether the theory is
based on scientific or other specialized knowledge that has been or can be tested; (2) whether the
theory has been subjected to peer review; (3) the known or potential rate of error and the
existence of standards controlling the theory’s operation; and (4) the extent to which the theory
is generally accepted in the relevant community. Daubert, 509 U.S. at 593–94; see also Kumho
Tire Co. v. Carmichael, 526 U.S. 137, 151, 119 S. Ct. 1167, 143 L. Ed. 2d 238 (1999).
The Rule 702 inquiry “is a flexible one.” Daubert, 509 U.S. at 594. As such,
“[d]eterminations on admissibility should not supplant the adversarial process; ‘shaky’ expert
testimony may be admissible, assailable by its opponents through cross-examination.” Gayton v.
McCoy, 593 F.3d 610, 616 (7th Cir. 2010). The proponent of the testimony bears the burden of
proving that the proffered testimony meets these requirements, and the Seventh Circuit grants the
district court “wide latitude in performing its gate-keeping function.” Bielskis, 663 F.3d at 894
(internal quotation marks and citation omitted).
BACKGROUND
The government has obtained what it alleges are the call data records for the phone
registered to Evans during the time of the alleged conspiracy. The data contained in these
records includes the date and time of calls originating from Evans’s phone, the duration of each
call, and the originating and terminating cell tower (also known as cell site) used by the phone to
place the call. Using these records, Special Agent Raschke testified that he could apply the
granulization theory to estimate the general location of Evans’s phone during the time calls were
3
placed. To understand the theory of granulization it is necessary to understand how a cellular
network operates.
According to Special Agent Raschke, when a cell phone is in idle mode, it regularly
communicates with cell towers in its network. Using radio frequency waves, the phone tries to
determine which cell tower has the strongest signal. In urban areas, cell towers are often located
on top of buildings or water towers. A cell tower emits radio frequency waves in all directions,
providing cell phone coverage in a 360 degree radius around the tower. Three antennas typically
comprise each tower; each antenna covers a 120 degree area. When a cell phone places a call, it
typically connects to the tower in its network with the strongest signal. This is usually the tower
nearest to the phone, although a variety of factors including physical obstructions and
topography can determine which tower services a particular phone. Once the call reaches the
tower, this interaction is recorded by the network provider. The call then proceeds to a mobile
switching center, which may choose to reroute the call to a different tower based on network
traffic. The call may also be rerouted to a different tower if the caller changes location during
the duration of the call. These data are recorded by the network and maintained as call data
records.
To determine the location of a cell phone using the theory of granulization, Special Agent
Raschke first identifies (1) the physical location of the cell sites used by the phone during the
relevant time period; (2) the specific antenna used at each cell site; and (3) the direction of the
antenna’s coverage. He then estimates the range of each antenna’s coverage based on the
proximity of the tower to other towers in the area. This is the area in which the cell phone could
connect with the tower given the angle of the antenna and the strength of its signal. Finally,
4
using his training and experience, Special Agent Raschke predicts where the coverage area of
one tower will overlap with the coverage area of another.
Applying this methodology, Special Agent Raschke testified that he could estimate the
general location of Evans’s cell phone during an 18 minute period (from 12:54 p.m. to 1:12 p.m.)
on April 24, 2010, during which time Evans’s phone used two cell towers to place nine calls.
According to Special Agent Raschke, based on his estimate of the coverage area for each of the
antennas, the calls made from Evans’s phone could have come from the location where the
victim was held for ransom. In support, the government proposes to admit summary exhibit 6,
which is a map of the two towers used by Evans’s phone and a drawing of the estimated
coverage overlap of the two towers. The building where the victim was held falls squarely
within the coverage overlap of the two towers. (See Gov’t Summ. Ex. 6.) In addition to this
exhibit, the government also proposes to introduce maps indicating the location of cell towers
used by Evans’s phone in relation to other locations relevant to the crime (Gov’t Summ. Exs.
1–5),2 maps showing the topography of the area between the two towers indicated in summary
exhibit 6 (Gov’t Summ. Ex. 7–8), and a listing of the total number of calls placed by Evans’s
phone during the relevant time period that originated or terminated with one of the two towers
(Gov’t Summ. Ex. 9).3
2
Government summary exhibit 1 also contains a line from the location of one of the cell towers
used by Evans’s phone to the location where the victim was kidnnapped, demonstrating the close
proximity of the two locations.
3
The government has also moved to admit the call data records under the business record
exception to the hearsay rule. See Fed. R. Evid. 803(6). Assuming the proper foundation is laid, these
records are likely admissible. See United States v. Graham, 846 F. Supp. 2d. 384, 389 (D. Md. 2012)
(stating that historical cell site location records are “created by cellular providers in the ordinary course of
business”).
5
ANALYSIS
I.
Admissibility of maps containing cell tower locations and other locations relevant to
the crime
As an initial matter, the government argues that a portion of Special Agent Raschke’s
testimony is admissible under Rule 701, specifically, his testimony concerning maps he created
indicating the location of certain cell towers used by Evans’s phone during the course of the
conspiracy in relation to other locations relevant to the crime. (See Gov’t Summ. Exs. 1–5.) The
court agrees that using Google Maps to plot these locations does not require scientific, technical,
or other specialized knowledge and that these exhibits are admissible through lay opinion
testimony under Rule 701.
The relevancy of these exhibits, however, is primarily based on the premise that a cell
phone connects to the tower in its network with the strongest signal, and the tower with the
strongest signal is usually the one closest to the cell phone at the time the call is placed.
Although this is the general rule, there are a variety of factors that determine the tower to which
a cell phone will connect. See Aaron Blank, The Limitations and Admissibility of Using
Historical Cellular Site Data to Track the Location of a Cellular Phone, 18 RICH. J. L. & TECH.
3, at *7 (Fall 2011) (identifying factors that affect a tower’s signal strength to include the
technical characteristics of the tower, antennas and phone, environmental and geographical
features and indoor or outdoor usage); Matthew Tart et al., Historic cell site analysis - Overview
of principles and survey methodologies, 8 DIGITAL INVESTIGATION 1, 186 (2012) (“In a perfectly
flat world with equally spaced and identical masts, a mobile phone user would generally connect
to the closest mast. In the real world, however, this is not necessarily the case.”). Indeed,
6
Special Agent Raschke himself testified that topography, physical obstructions and the signal
strength of other towers can impact whether a cell phone connects to the tower closest to it.
Lay witness testimony is admissible under Rule 701 when it is “rationally based on [a]
witness’s perception” or based on “a process of reasoning familiar in everyday life.” Fed. R.
Evid. 701 & advisory comm. notes (2000 amends.); see also United States v. Conn, 297 F.3d
548, 554 (7th Cir. 2002) (“Lay opinion testimony is admissible only to help the jury or the court
to understand the facts about which the witness is testifying and not to provide specialized
explanations or interpretations that an untrained layman could not make if perceiving the same
acts or events.” (quoting United States v. Peoples, 250 F.3d 630, 641 (8th Cir. 2001)).
Understanding how the aforementioned factors affect a cell phone’s ability to connect a
particular tower, however, cannot be said to be within the perception of the untrained layman.
Rather, this type of understanding demands “scientific, technical, or other specialized
knowledge” of cellular networks and “results from a process of reasoning which can be mastered
only by specialists in the field.” Fed. R. Evid. 701 & advisory comm. notes (2000 amends.);
Conn, 297 F.3d at 554 (“Expert opinion . . . brings to an appraisal of those facts . . . that the lay
person cannot be expected to possess.”)4 Special Agent Raschke may therefore provide lay
4
As recently explained by the Seventh Circuit,
[a] law-enforcement officer’s testimony is a lay opinion if it is limited to what he observed
. . . or to other facts derived exclusively from [a] particular investigation. On the other hand,
an officer testifies as an expert when he brings the wealth of his experience as [an] officer
to bear on those observations and ma[kes] connections for the jury based on that specialized
knowledge.
United States v. Christian, 673 F.3d 702, 709 (7th Cir. 2012) (internal quotation marks and citations
omitted); see Compania Administradora de Recuperacion de Activos Administradora de Fondos de
Inversion Sociedad Anonima v. Titan Int’l, Inc., 533 F.3d 555, 561 (7th Cir. 2008) (“Testimony based
(continued...)
7
opinion testimony concerning (1) the call data records obtained for Evans’s phone and (2) the
location of cell towers used by Evans’s phone in relation to other locations relevant to the crime;
but if he wishes to testify concerning (1) how cellular networks operate, i.e., the process by
which a cell phone connects to a given tower or (2) granulization theory he must first meet the
demands of Rule 702 and Daubert.5
II.
Admissibility of testimony concerning how cellular networks operate and the theory
of granulization under Rule 702 and Daubert
A.
Whether Special Agent Raschke is qualified to testify as an expert
Special Agent Raschke testified that he has been a member of the Federal Bureau of
Investigation for 14 years and currently serves on the agency’s Violent Crimes and Fugitive Task
Force. He has received over 350 hours of training and instruction in the use of cellular phones
and investigations and spends approximately 70 percent of his time in his current position
analyzing cell phone records. He has instructed approximately 700 officers in basic techniques
for utilizing cell phones in investigations and has been qualified as an expert in the use of
historical cell site data in five state court cases in the past two years. (See Gov’t Ex. CV.)
(...continued)
solely on a person’s special training or experience is properly classified as expert testimony, and therefore
it is not admissible under Rule 701.”)
5
On this point, the court respectfully disagrees with those courts that have allowed law
enforcement officers to provide lay opinion testimony as to how cellular networks operate or the use of
call data records to determine the location of a cell phone. See, e.g., United States v. Feliciano, 300 F.
App’x. 795, 801 (11th Cir. 2008) (allowing officer to provide lay opinion testimony based on his
“particularized knowledge garnered from years of experience in the field,” but relying on Tampa Bay
Shipbuilding & Repair Co. v. Cedar Shipping Co., 320 F.3d 1213, 1223 (11th Cir. 2003) for a position
that has been called into doubt in this district, see Chen v. Mayflower Transit, Inc., 224 F.R.D. 415, 419
(N.D. Ill. 2004)); United States v. Henderson, No. CR 10-117 BDB, 2011 WL 6016477, at **4–5 (N.D.
Okla. Dec. 2, 2011) (allowing agent to provide lay opinion testimony that cell phone records “identif[y]
the cell tower that was nearest to the location of the cell phone at the time a particular call was made or
received”).
8
Special Agent Raschke testified that he has received training from Sprint-Nextel on how their
cellular network operates and is familiar with the operation of this and similar networks. He also
stated that he has successfully used historical cell site data on a number of occasions to locate
people (both dead and alive) in the course of other FBI investigations.
Based on this testimony, the court is satisfied that Special Agent Raschke is qualified to
testify as an expert concerning the operation of cellular networks and granulization theory. See
United States v. Allums, No. 2:08–CR–30 TS, 2009 WL 806748, at **2–3 (D. Utah Mar. 24,
2009) (holding that FBI agent was qualified to provide expert testimony on historical cell site
analysis where he underwent two official FBI training courses on how cell technology and cell
networks function, five training courses on radio frequency theory, and was obtaining a master’s
degree in geospatial technology); see also United States v. Schaffer, 439 F. App’x. 344, 347 (5th
Cir. 2011) (finding that lower court did not err in allowing FBI agent to provide expert testimony
where agent taught courses on historical cell site analysis, his students had qualified as experts,
and he had used the technique without error on at least 100 occasions).
B.
Whether Special Agent Raschke’s testimony concerning how cellular
networks operate is admissible under Rule 702
Rule 702 instructs that when a qualified expert provides testimony regarding general
principles, without trying to apply those principles to the facts of the case, the expert’s testimony
need only (1) address a subject matter on which the factfinder can be assisted by an expert; (2)
be reliable; and (3) “fit” the facts of the case. Fed. R. Evid. 702 advisory comm. notes (2000
amends.). Here, testimony concerning how cellular networks operate would be helpful because
it would allow the jury to narrow the possible locations of Evans’s phone during the course of
the conspiracy. Although Special Agent Raschke is not an engineer and has never worked for a
9
network provider, he has received extensive training on how cellular networks operate and is in
regular contact with network engineers. He also spends a majority of his time analyzing cell site
records, which requires a thorough understanding of the networks themselves. The court
concludes that his testimony on this subject is reliable. Finally, it is undisputed that a phone
registered to Evans used certain cell towers to place a number of calls during the course of the
conspiracy and, as such, Special Agent Raschke’s testimony on this topic fits squarely within the
facts of this case.6
C.
Whether Special Agent Raschke’s testimony concerning the theory of
granulization is admissible under Rule 702
Special Agent Raschke testified that using a theory of granulization he can estimate the
range of certain cell sites based on a tower’s location to other towers. This in turn allows him to
predict the coverage overlap of two closely positioned towers. Special Agent Raschke testified
that he has used this theory numerous times in the field to locate individuals in other cases with a
zero percent rate of error. He also testified that other agents have successfully used this same
method without error. No evidence was offered, however, beyond Special Agent Raschke’s
6
Evans’s proposed expert, Manfred Schenk, contested Special Agent Raschke’s opinion
regarding which cell towers get recorded in the call data records. According to Schenk, the only cell
tower that gets recorded is the tower that ultimately services the call (i.e., the tower assigned by the
mobile switching center, not the tower that the phone initially connects to before being routed to the
mobile switching center.) This factual disagreement goes to the weight not the admissibility of Special
Agent Raschke’s testimony. See, e.g., Traharne v. Wayne Scott Fetzer Co., 156 F. Supp. 2d 717, 723
(N.D. Ill. 2001) (“Factual inaccuracies are to be explored through cross-examination and go toward the
weight and credibility of the evidence not admissibility.” (citing Walker v. Soo Line R.R. Co., 208 F.3d
581, 586–89 (7th Cir. 2000)). The same is true for the line connecting the location of the kidnapping to
the cell tower used by Evans’s phone on April 23, 2010 contained in summary exhibit 1. Evans is free to
solicit on cross examination factors other than proximity that may have caused Evans’s phone to connect
with that particular tower.
10
testimony, to substantiate the FBI’s successful use of granulization theory or its rate of error in
the field.
Despite Special Agent Raschke’s assurances, the court remains unconvinced that
granulization theory is reliable. First, in determining the coverage overlap of the two towers
used by Evans’s cell phone on August 24, 2010, Special Agent Raschke assumed that Evans’s
cell phone used the towers closest to it at the time of the calls. But as previously discussed, there
are a number of factors that could have caused Evans’s phone to connect to these towers even
though another tower was closer. For example, a building could have obstructed the phone’s
access to the closest tower7 or the call could have been rerouted due to network traffic. Special
Agent Raschke acknowledged these factors but did not fully account for them in his analysis.
Rather, he relied on his training and experience to estimate the coverage overlap between the
two. Estimating the coverage area of radio frequency waves requires more than just training and
experience, however, it requires scientific calculations that take into account factors that can
affect coverage. Special Agent Raschke presented no scientific calculations and did not consider
a variety of relevant factors. Although the call data records upon which he relied are undisputed,
the link between those records and his conclusions is deficient. See United States v. Mamah,
332 F.3d 475, 478 (7th Cir. 2003) (“It is critical under Rule 702 that there be a link between the
facts or data the expert has worked with and the conclusion the expert’s testimony is intended to
7
Special Agent Raschke testified that he has driven this area many times and there are no
buildings that would obstruct cell phone access to nearby towers. It is unclear when he drove this area
and whether he drove it with the specific purpose of determining whether any such obstructions exist. Cf.
Allums, 2009 WL 806748, at *1 (finding methodology reliable where agent drove around cell towers
using a cell phone from defendant’s provider and device called a “Stingray” to determine the approximate
range of coverage for each tower).
11
support. . . . The court is not obligated to admit testimony just because it is given by an expert.”
(internal citation omitted)).
Second, the granulization theory remains wholly untested by the scientific community,
while other methods of historical cell site analysis can be and have been tested by scientists.
See, e.g., Matthew Tart et al., Historic cell site analysis - Overview of principles and survey
methodologies, 8 DIGITAL INVESTIGATION 1, 193 (2012) (reviewing techniques for collecting
radio frequency data for historic cell site analysis and concluding that “[a]rea [s]urveys around
the location of interest . . . provide the most accurate and consistent method for detecting
servicing [c]ells at a location”). The Seventh Circuit has stated that “[a] very significant Daubert
factor is whether the proffered scientific theory has been subjected to the scientific method.”
Chapman v. Maytag Corp., 297 F.3d 682, 688 (7th Cir. 2002). This is because “the scrutiny of
the scientific community . . . increases the likelihood that the substantive flaws in methodology
will be detected.” Daubert, 509 U.S. at 593; see also Charles Alan Wright et al., 29 FEDERAL
PRACTICE & PROCEDURE - EVIDENCE § 6266 (1st ed.) (“[J]udicial interference with the jury’s
power to weigh [expert] evidence may be warranted where expert testimony is based on
emerging scientific theories that have not gained widespread acceptance within the scientific
community.”). Granulization theory has not been subject to scientific testing or formal peer
review and has not been generally accepted in the scientific community. These factors weigh
against a finding of reliability.
Given that multiple factors can affect the signal strength of a tower and that Special
Agent Raschke’s chosen methodology has received no scrutiny outside the law enforcement
community, the court concludes that the government has not demonstrated that testimony related
12
to the granulization theory is reliable. As such, testimony concerning this theory, along with the
estimated range of coverage for each of the towers indicated on summary exhibit 6, will be
excluded under Rule 702 and Daubert. Because summary exhibits 7 through 9 do not contain
estimated ranges of coverage, they will be admitted.
CONCLUSION AND ORDER
To summarize, the government’s motion in limine to admit cell site evidence and analysis
(dkt. #97) is granted in part and denied in part. Special Agent Raschke is qualified to provide
expert testimony concerning how cellular networks operate. Based on this testimony, summary
exhibits 1 through 5 and 7 through 9 are admissible at trial. Special Agent Raschke may not
testify concerning the theory of granulization, which the court finds to be unreliable. In addition,
the estimated coverage areas contained in summary exhibit 6 must be removed before the court
will admit this exhibit. Evans’s motion for disclosure of expert evidence under Rule 16 (dkt.
#122) is denied as moot.
Dated: August 29, 2012
Enter:___________________________
JOAN HUMPHREY LEFKOW
United States District Judge
13
<Omaha, 5.27.15>
Understanding New
Surveillance Tools
Hanni M. Fakhoury
EFF Senior Staff Attorney
<Omaha, 5.27.15>
<Omaha, 5.27.15>
http://www.usatoday.com/story/news/nation/2013/12/08/cellphone-data-spying-nsa-police/3902809/
<Omaha, 5.27.15>
<Omaha, 5.27.15>
https://www.aclu.org/maps/stingray-tracking-devices-whos-got-them
<Omaha, 5.27.15>
<Omaha, 5.27.15>
<Omaha, 5.27.15>
https://www.aclu.org/sites/default/files/assets/aclu_florida_stingra
y_police_emails.pdf
<Omaha, 5.27.15>
https://www.aclu.org/sites/default/files/assets/aclu_florida_stingra
y_police_emails.pdf
“In the past, and at the request of the U.S.
Marshalls, the investigative means utilized to
locate the suspect have not been revealed so
that we may continue to utilize this technology
without knowledge of the criminal element, in
reports or depositions we simply refer to the
assistance as ‘received information from a
confidential source regarding the location of the
suspect.’”
<Omaha, 5.27.15>
https://www.aclu.org/technology-and-liberty/us-v-rigmaiden-doj-emails-stingray-applications
<Omaha, 5.27.15>
US v. Rigmaiden, 844 F. Supp. 2d 982 (D. Ariz. 2012) & 2013 WL 1932800
(D. Ariz. 2013)
<Omaha, 5.27.15>
<Omaha, 5.27.15>
<Omaha, 5.27.15>
<Omaha, 5.27.15>
<Omaha, 5.27.15>
<Omaha, 5.27.15>
<Omaha, 5.27.15>
<Omaha, 5.27.15>
Hemisphere
• Database of CDRs available in near real time
regardless of carrier
– Includes records made 2 hours after a call
– Results returned in hours for exigent
circumstances and 2-5 days for routine requests
– At least 10 years worth of records
• Used to
– Find dropped/new/additional phones
– Determine some location information
– CDRs on international numbers
<Omaha, 5.27.15>
Hemisphere
<Omaha, 5.27.15>
“Protecting” Hemisphere
• Administrative subpoena to get Hemisphere
records
• “Parallel subpoening”
– Hemisphere used as a “pointer” system to be
followed up by a subpoena to carrier
• No reference to Hemisphere in official reports
or court documents
– Just reference to follow up subpoenas
<Omaha, 5.27.15>
US v. Ortiz, 12cr119 (NDCal)
• Defense obtained 17(c)
subpoena ordering
disclosure of:
– Court orders authorizing
HIDTA to release CDRs to
law enforcement
– Correspondence between
law enforcement and
Hemisphere
http://www.sfweekly.com/2014-01-15/news/hemisphere-at-and-t-wiretapping-gangs/
<Omaha, 5.27.15>
DEA Bulk Records Collection
• Collection of phone records made from US to
116 countries from 1992-2013
– numbers, time and date of call and length of call
• Database queried if reasonable articulable
suspicion phone associated with criminal
activity
• DEA’s SOD passed info as tips to field agents
and local law enforcement
– Database not referenced in official reporting
<Omaha, 5.27.15>
Discovery
• Other “Stingray” Terminology
– IMSI catcher, digital analyzer, cell site
simulator, triggerfish, stingray, kingfish,
amberjack, hailstorm, WITT (FBI’s
“wireless intercept tracking team”)
• Descriptions of the Technique
–
–
–
–
Cellular or cell phone tracking
Pinging
“Ride by”
“Known investigative technique”
<Omaha, 5.27.15>
US v. Kincaid, 13cr818 (NDCal)
<Omaha, 5.27.15>
US v. Kincaid, 13cr818 (NDCal)
<Omaha, 5.27.15>
State v. Taylor, 114140031
<Omaha, 5.27.15>
Expectations of Privacy
• Rakas v. Illinois, 439 U.S. 128, 143 n. 12
(1978)
– Must “have a source outside of Fourth
Amendment” by reference to “understandings that
are recognized and permitted by society”
• Riley v. California, 134 S.Ct. 2473 (2014)
– Privacy interests depend on the quality and quality
of information revealed
– Older cases involving physical items or less
intrusive government action don’t control digital
searches or surveillance
<Omaha, 5.27.15>
Expectations of Privacy
• US v. Knotts, 460 U.S. 276 (1983)
– No expectation of privacy in public movements
“voluntarily conveyed” to others
– Reserved right to consider “dragnet-type law
enforcement practices”
• Smith v. Maryland, 442 U.S. 735 (1979)
– Use of pen register to capture outgoing phone
calls made over three days
– No expectation of privacy in dialed phone
numbers
<Omaha, 5.27.15>
Location Privacy
• Subjective expectation of privacy
– Location info revealing when aggregated
– Phone records may be protected under state
constitution
• Expectation is objectively reasonable
– Growing body of case law and statutory protection
reflect changing “understanding”
• Smith Doesn’t Apply
– Nature of intrusion matters
<Omaha, 5.27.15>
Location Privacy
• US v. Cooper, 2015 WL 881578, at *8 (N.D.
Cal. Mar. 2, 2015)
– “Society's expectation of privacy in historical cell
site data is also evidenced by many state statutes
and cases which suggest that this information
exists within the ambit of an individual's personal
and private realm… While state law is, of course,
not dispositive on this question, ‘the recognition of
a privacy right by numerous states may provide
insight into broad societal expectations of
privacy.’”
<Omaha, 5.27.15>
Location Privacy
• Warrant to track car with a GPS device
– U.S. v. Maynard, 644 F.3d 544 (D.C. Cir. 2010); People v.
Weaver, 909 N.E.2d 1195 (N.Y. 2009); State v. Campbell,
759 P.2d 1040 (Or. 1988); State v. Jackson, 76 P.3d 217
(Wash. 2003); Commonwealth v. Rousseau, 990 N.E.2d 543
(Mass. 2013); State v. Brereton, 826 N.W.2d 369 (Wis.
2013); State v. Zahn, 812 N.W.2d 490 (S.D. 2012); U.S. v.
Lopez, 895 F. Supp. 2d 592 (D. Del. 2012)
• Warrant statutorily required to track cell
phone
– Historical & real time: CO, ME, MN, MT, UT
– Real time only: IL, IN, MD, VA, WI
<Omaha, 5.27.15>
Location Privacy
• Warrant required to obtain cell phone location
records
– Tracey v. State, 152 So.3d 504 (Fla. 2014); Commonwealth
v. Augustine, 4 N.E.3d 846 (Mass. 2014); State v. Earls, 70
A.3d (NJ 2013); Commonwealth v. Rushing, 71 A.3d 939,
961-64 (Pa. Sup. Ct. 2013), appeal granted on other
grounds 84 A.3d 699 (2014); United States v. Powell, 943 F.
Supp. 2d 759, 776-77 (E.D. Mich. 2013); United States v.
White, --- F.Supp.3d ---, 2014 WL 6682645 (E.D.Mich. 2014)
(real time)
– But see U.S. v. Davis, --- F.3d ---, 2015 WL 2058977 (11th
Cir. 2015) (en banc); In re US for Historical Cell Site Data,
724 F.3d 600 (5th Cir. 2013); In re US for an Order, 620 F.3d
304 (3d Cir. 2010)
<Omaha, 5.27.15>
Questions?
[email protected]
@hannifakhoury
415 436 9333 x. 117
www.eff.org

Understanding New Surveillance Tools—Cell Phone

Transcription

Similar documents

surveillanceCulture

Cordomatic Clothes Dryer

Gunnison Stingrays

(ZJTABLITE2) Toastabag LITE

The Michigan Softball All Skills Camp is a great opportunity for

Super-cool, calculating character sheet

eYe Catcher™ -- Frequency Agile Modulators

Petra Warman: Crime prevention through Environmental Design

L-3 Nautronix Spec Sheet