The U.S. Department of Justice has issued an enhanced policy for cell-site simulators, surveillance technology that locates individuals and can collect call data by mimicking cellphone towers. The new policy, which went into effect Sept. 3, aims to provide “standard guidance” on use of the devices by the department.
Cell-site simulators go by a variety of different names – StingRays, DRT boxes, Hailstorms – depending on their capabilities and manufacturers. For the past few years, they’ve drawn criticism from privacy advocates who say the devices can capture data from private citizens not suspected of crimes.
Meanwhile, the government has in some cases maintained that because most cell-site simulators don’t collect the content of calls and text messages, law enforcement agencies can employ them without first obtaining a probable-cause search warrant – the kind that would be needed to collect call or data intercepts from electronic communications.
So what’s the significance of the new DOJ rules on cell-site simulators? We asked Reveal reporter Ali Winston for insight into the announcement, how it could affect federal use of the devices, and whether it will change the practices of local law enforcement.
What is the overall significance of DOJ’s new guidelines on handling and deleting data collected from cell-site simulators?
The requirements related to data handling and deletion did not exist previously for federal authorities, and this is the first time I’ve seen such matters discussed. For years, privacy advocates – and journalists – have asked what data is collected and stored by these devices, and what policies govern these practices. Even though these requirements are now in place, questions remain about what sort of information can be and is gathered by these devices.
What levels of law enforcement are affected by the DOJ’s new policy? What about local police agencies using cell-site simulators?
The guidelines issued by the Justice Department on Sept. 3 only apply to federal law enforcement agencies under DOJ’s supervision, such as the FBI, ATF (Bureau of Alcohol, Tobacco, Firearms, and Explosives), DEA (Drug Enforcement Administration) and U.S. Marshals Service. Local police are not covered by such guidelines. This does not cover the Department of Homeland Security, the National Guard, the U.S. Special Operations Command or the Pentagon, which all use cell-site simulators.
Over the past few years, a number of states have passed laws requiring search warrants, including California, to use cell-site simulators. These laws still cover law enforcement in those states. However, in states without such laws, local police working alongside federal law enforcement in task forces devoted to organized crime, counterterrorism or gangs are now able to use such devices without violating the DOJ’s new rules.
What do we know about the ubiquity – and frequency of use – of cell-site simulators at local agencies across the country?
Because of the secrecy surrounding the purchase and use of these devices, driven by the nondisclosure agreements the manufacturers and the FBI have required law enforcement to sign before purchasing cell-site simulators, it is extremely difficult –if not impossible – to get an accurate count of who uses these devices around the country outside of federal agencies. And again, the guidelines issued last week only apply to certain federal agencies and do not cover the use of such devices by police and local law enforcement, which have been buying cell-site simulators with federal grants and asset forfeiture funds for at least a decade.
In its press release, the Justice Department says the new policy “reaffirms its commitment to hold itself to the highest standards.” What were the old standards, and how are these different?
DOJ did not have standards for the use of cell-site simulators for its law enforcement agencies, with the exception of the Federal Bureau of Investigation. Last year, the FBI for the first time issued a set of guidelines for how cell-site simulators could be used and began to require agents to obtain a warrant to use such devices. By and large, federal and state judiciaries have been kept in the dark about the use of such devices, because the nondisclosure agreements (I mentioned those above) bar the disclosure of such information. The nondisclosure agreements also call for criminal cases to be dropped if information about the cell-site simulators’ use could be disclosed. However, these guidelines also require new annual reporting about the use of cell-site simulators by the Department of Justice that will provide further, but limited, insight into how federal law enforcement conducts cellphone surveillance.
The new policy emphasizes that communications like emails, texts and contacts may not be collected. Were they before?
There hasn’t been confirmation to date that Stingrays, DRT boxes or other cell-site simulators have been used to intercept calls, texts or data. What these devices do track and log are the location of a cellphone, the unique identifying number assigned to each mobile phone as well as the cellphone number, and a log of which devices have contacted the targeted phone. The best evidence I’ve been able to unearth about the interception capabilities of these devices is in Chicago, where product descriptions of the software package for the devices the Chicago Police Department use indicate they are able to intercept, record and play back audio calls.
Federal law enforcement agents must now have a warrant indicating probable cause before using a cell-site simulator. What implications might this have for pending cases where a warrant was not acquired?
This policy does not appear to apply to previous cases where cell-site simulators were or may have been used. Moreover, the policy is not enforceable in court, as referenced in a footnote on the second page of DOJ’s guidelines, and they do not provide requirements for notification in current or past cases. And again, this has no impact at all on state cases or local law enforcement.
Republish our articles for free, online or in print, under a Creative Commons license.
