by Christopher Izant
“[I]t would be very unfortunate if privacy protection in the 21st century were left primarily to the federal courts using the blunt instrument of the Fourth Amendment. Legislatures, elected by the people, are in a better position than we are to assess and respond to the changes that have already occurred and those that almost certainly will take place in the future.”[1]
The use of cell site simulators by law enforcement presents the most recent case of technology outpacing the law. Without a governing statute or Supreme Court ruling, law enforcement agencies’ procedures for using this technology vary across jurisdictions. The current reliance on these agencies’ own discretion to protect privacy rights presents a troubling conflict of interest that threatens to undermine the legitimacy of criminal investigations and prosecutions where evidence is obtained through the use of cell site simulators. Rather than wait for the Supreme Court to establish a rule based on Fourth Amendment jurisprudence, Congress should amend the Electronic Communications Protection Act to specifically address this technology and standardize procedures for its use across jurisdictions and levels of government.
I. IMSI-Catchers and Privacy Implications
IMSI-catchers, or “Stingrays,” are devices that emit the same signals as commercial cell towers to exploit the automatic process by which mobile phones search for and connect to cellular networks.[2] This process, known as “registration,” is programmed to occur roughly every seven seconds in order to maintain optimal connectivity.[3] Each time a phone registers, it sends individualized data, including International Mobile Subscriber Identity (“IMSI”—a number that identifies a specific device when it connects to a mobile network), electronic serial number, directional vector, and signal strength, to the cell site from which it receives the strongest signal connection.[4]
IMSI-catching devices exploit an inherent vulnerability: the Global System for Mobile Communications, the worldwide default network for transmitting voice and data signals between phones and towers, does not require authentication of the connection before a phone sends its data.[5] This vulnerability allows law enforcement, military, and intelligence agencies to employ IMSI-catchers, which they connect to mobile computers with specialized software, to locate a target based on a known phone number, or glean a previously unknown phone number when the location of the target is known.[6] Additional features can enable the device to intercept audio and data content while forwarding the intercepted content to the commercial cell site so the user remains unaware of this “man-in-the-middle” eavesdropping.[7]
An IMSI-catcher can only identify a phone number once it registers with a cell network, which means the devices needs to collect data from every cell phone within range in order to detect the target.[8] In the past decade, 50 local or state police and 13 federal law enforcement agencies have used IMSI-catchers to track the location of targets in real time, with an accuracy of up to two meters,[9] without a warrant, without disclosure to the public of its use, and without any legal protections for third-party data or privacy within the home.[10] Unlike IMSI-catchers’ dragnet collection of personal data from all cell phones in range, concerns by civil liberties and privacy advocates are warranted.
II. Current Surveillance Law Frameworks for IMSI-Catching Capabilities
The following statutes and doctrines, organized by function, provide context for the consideration of an appropriate legal standard for using IMSI-catching devices in criminal investigations.
Content Collection
Title III of the Omnibus Crime Control and Safe Streets Act of 1968, better known as the “Wiretap Act,” established procedures by which prosecutors could request authorization to eavesdrop on phone calls. Statutory obligations extended beyond approval, including routine progress reports to the court, 30-day time limits, minimization procedures, and record keeping to ensure adequate judicial oversight over the surveillance.[11] The use of IMSI-catchers equipped with add-on devices that collect the content of phone calls or text messages in a criminal investigation fits squarely within this category of surveillance that requires a judicial probable cause determination, a warrant, and oversight. Categorizing the use of IMSI-catchers to collect non-content information is less clear.
Call Log Data Collection
The Wiretap Act’s counterpart for non-content surveillance was the Pen Register and Trap and Trace Device Statute (“Pen/Trap Statute”).[12] In line with the Supreme Court’s decision in Smith v. Maryland,[13] which held that call log information was not protected under the Fourth Amendment, Congress passed the Pen/Trap Statute in 1986, and amended it shortly thereafter with the Electronic Communications Privacy Act (“ECPA”). The Pen/Trap Statute required an agency applying for a court order to install a device to specify the target phone number and show that the information to be collected would be “relevant to an ongoing criminal investigation.”[14] The statute also imposed a 60-day time limit, maintenance of records, and reporting requirements, including any information recorded by the device.[15] Since IMSI-catchers can collect this data in real time, the Pen/Trap Statute standards should be viewed as a bare minimum.
Retrospective Location Data Collection
Section 2703(d) of the Stored Communications Act, also passed as part of the ECPA, requires the government to show “specific and articulable fact” indicating that the desired business records of commercial service providers, which could include retrospective location data, are “relevant and material” to an ongoing criminal investigation.[16] Thus, at a somewhat heightened relevance standard but without a warrant, the government can obtain records of call log information that includes data showing where a target placed or received calls.[17]
Proscriptive Location Data Collection
In 1994, Congress passed the Communications Assistance to Law Enforcement Act (“CALEA”), which declares that any information disclosing the physical location of the subscriber could not be obtained solely on the authority of the Pen/Trap Statute.[18] However, CALEA offered no affirmative guidance on what standards or process would support such a request. Furthermore, Congress failed to anticipate the imminent technological development and use of IMSI-catchers that would allow law enforcement agencies to collect this information on their own.
Congress amended the Pen/Trap Statute in the USA PATRIOT Act in 2001, thereby broadening and modernizing the definition of the pen register/tap and trace device.[19] In 2005, the Department of Justice Electronic Surveillance Manual noted that the “signaling information” authorized for collection under the amended Pen/Trap appeared to include “all of the non-content information passed between a cell phone and the provider’s tower.”[20] This interpretation implied that location information, even in real time, could be collected merely pursuant to a Pen/Trap order, apparently contradicting CALEA.
Judicial guidance on the real-time collection of location data has been nearly as vague as the statutory guidelines. In United States v. Jones, the Supreme Court held that attaching a GPS device to a target’s vehicle was a search under the Fourth Amendment and required a warrant.[21] While the Court ultimately declined to rule on that issue, it did suggest that “achieving the same result through electronic means, without an accompanying trespass, [may be] an unconstitutional invasion of privacy.”[22] Prosecutors and law enforcement have subsequently been left to answer this question for themselves in the absence of clear directives from either the courts or Congress.
III. New Rules for IMSI-Catchers
The Court’s intentionally ambiguous answer in Jones must be asked again here: is the use of IMSI-catching devices to locate a target a search under the Fourth Amendment?[23] With respect to the foregoing statutory requirements for relevance, “specific and articulable fact” relevance, or probable cause, what standard must the government meet for authorization? What record keeping, reporting to the court, and minimization procedures are required to protect the privacy rights not only of the targets of criminal investigations, but also the third-party data necessarily swept up in IMSI-catching surveillance?
To protect privacy rights and provide clear rules for law enforcement, these questions require answers. But who should provide the answers?
Executive Branch Policy
In September 2015, the Department of Justice announced its official policy guidance on the use of cell site simulator technology.[24] The new rules, which apply to domestic criminal investigations, prohibit the use of add-ons enabling content collection; require judicial determination of probable cause and a warrant; and mandate that third-party data be deleted once a target is located or within specified time limits.
While such limitations could represent a victory for privacy rights advocates,[25] DOJ policy is not the law, nor is it binding on state or local law enforcement. In response to growing awareness of and concern about use of IMSI-catching technology by police, other agencies have also published official policies.[26] However, the policies of many state and local agencies are secret, and some that have been made public appear to be at odds with DOJ guidance.[27]
Moreover, relying on the executive branch to police its own policies hardly comports with traditional notions of separation and balance of powers. In a concurring opinion in Jones, Justice Sotomayor questioned the “appropriateness of entrusting to the Executive, in the absence of any oversight from a coordinate branch, a tool so amenable to misuse, especially in light of the Fourth Amendment’s goal to curb arbitrary exercises of police power to and prevent ‘a too permeating police surveillance.’”[28] The potential for abuse when an executive branch agency writes its own rules can undermine the balance of power among branches of government as well as the legitimacy of the policy.
Judicial Subsumption
Over the past few decades, the typical judicial response to technological developments has been to apply pre-existing doctrines to novel issues.[29] The tendency to subsume new issues into old rules is a natural effect of strong stare decisis norms.[30] Many commentators, including Supreme Court justices themselves, have observed the institutional limitations of the judiciary in applying the “blunt instrument of the Fourth Amendment” to law enforcement use of new technology.[31]
The Supreme Court’s attempt to forge a new rule from established Fourth Amendment jurisprudence in Kyllo v. United States demonstrates the inherent difficulty of judicial rule-making in the context of technological development.[32] Finding aerial thermal imaging of a home to constitute a search, the Court held that “obtaining by sense-enhancing technology any information regarding the interior of the home that could not otherwise have been obtained without physical ‘intrusion into a constitutionally protected area,’ constitutes a search—at least where (as here) the technology in question is not in general public use.”[33] Such a rule provides little clarity for law enforcement agencies ex ante.[34] Fifteen years after Kyllo, in a time when advanced aerial sensors are now regularly employed in public use,[35] it is unclear whether the use of the same technology today would be a search under the rule. Similarly, when a hobbyist with $1,500 can build and sell an IMSI-catching device,[36] or functionally intercept phone calls with equipment built on a $100 budget,[37] the Kyllo rule provides no clear guidance on whether IMSI-catching technology is in “general public use” or whether its use by law enforcement would be a search under the Fourth Amendment.
In the few cases where use of cell site tracking has been disclosed, state and federal courts have been inconsistent. While the emerging majority rule requires a warrant for location tracking through cell site data,[38] courts have yet to address privacy concerns unique to IMSI-catching, such as dragnet collection of personal communications data, and the ability to track a subject within the home. One solution would be for the judiciary to impose rules to reign in executive discretion in executing tracking warrants, for example, to require disclosure of the technology in the application for a warrant, protective minimization and data segregation procedures, record keeping, and reporting.[39] Yet, as Kyllo demonstrates, the judiciary is ill-suited for this type of rule-making, and it could be years of inconsistent practice before the Supreme Court rules on the issue.
Legislative Amendment
Congress has several advantages over the courts in Fourth Amendment rule-making in response to emergent technology. First, the nature of judiciary decision-making provides rules ex post facto, often long after a technology comes into use[40] or after the circumstances of the particular case have changed so as to be materially different.[41] The legislature, as it has in the Wiretap Act, Pen/Trap Statute, ECPA, CALEA, is able to proscribe prospective rules for procedure in specific criminal investigations.
Second, where stare decisis significantly limits the adaptability of judicial rule-making, the legislature is able to enact new rules or make amendments to existing law.[42] For example, the ECPA has been amended no less than eighteen times since its inception in 1986 to cope with rapid technological change in electronic communications. Furthermore, Congress can extend privacy protections to regulate both public and private parties, where the court’s application of the Fourth Amendment is confined to regulate the government.[43] Unique legislative mechanisms, such as the sunset clause in the USA PATRIOT Act, allow the legislature to impose temporal limits to require later review of the issues when the political and technological contexts may be different.[44]
Third, the legislature is much better positioned than the courts to process complex technological information in a timely fashion.[45] When legislating in the context of technology and privacy, Congress holds hearings to receive extensive expert testimony from numerous stakeholders, including the judiciary, on technological capabilities, regulatory strategies, and civil liberties.[46] Indeed, the Senate Judiciary Committee and House Subcommittee on Information Technology have held hearings on IMSI-catcher surveillance,[47] and on November 2, 2015 Chairman of the House Oversight Committee, Rep. Jason Chaffetz, introduced a “Cell-Site Simulator Privacy Act” to the house floor.[48] While the discussion draft of the bill merely establishes the requirement of a warrant for location tracking, more specific rules are necessary to fully ensure law enforcement use of this powerful technology is governed by adequate privacy protection and judicial oversight. As Congress has written specific rules for regulating wiretapping and other surveillance methods, it can and should proscribe similar procedures to ensure adequate protection of the collateral third-party data collected in IMSI-catching searches.
Politics aside, the legislature is not without its limitations. Questions about the efficacy of congressional action and oversight have arisen in light of recent revelations, such as the executive branch’s secret and expansive interpretation of statutes that authorize government surveillance programs.[49] Even the unregulated use of IMSI-catching technology over the past decade may be evidence that a more structural problem persists.[50] Some commentators have pointed to the Privacy and Civil Liberties Oversight Board (“PCLOB”), which monitors government counter-terrorism programs and issues recommendations to Congress, as a model for more extensive and effective legislative oversight in the domestic realm.[51] Perhaps expanding the scope of the PCLOB to monitor the emergence and use of new technology in criminal investigations could improve legislative response time for issuing rules to law enforcement.[52] Alternatively, Congress could reinstate the Office of Technology Assessment (“OTA”), whose role, until it was stripped of funding in 1995, was to provide Congress with independent expertise on emerging technological threats and opportunities.[53] Although a recent proposal to refund OTA was voted down in the House of Representatives,[54] such efforts demonstrate continued support.[55] At the very least, further investigation is warranted to find other possible means of improving legislative responsiveness to technological development.
IV. Conclusion
Private citizens have the constitutional right “to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures.”[56] To preserve this right, law enforcement needs concrete guidance; the lines drawn by the Fourth Amendment “must be not only firm but also bright—which requires clear specification of those methods of surveillance that require a warrant.”[57] In the face of rapid technological development, Congress is in the best position to define these lines.
[1] Riley v. California, 134 S. Ct. 2473, 2497–98 (2014) (J. Alito, concurring).
[2] Ryan Gallegher, Meet the Machines that Steal Your Phone’s Data, Ars Technica, Sept. 25, 2013, http://arstechnica.com/tech-policy/2013/09/meet-the-machines-that-steal-your-phones-data/. “Stingray” is the brand name IMSI-catcher manufactured by Harris Corporation, which is commonly used to refer to the entire class of cell site simulators.
[3] Kevin McLaughlin, The Fourth Amendment and Cell Phone Location Tracking: Where Are We? 29 Hastings Comm. & Ent L.J. 421, 426 (2007).
[4] Brian L. Owsley, Triggerfish, Stingrays, and Fourth Amendment Fishing Expeditions. 66 Hastings L.J. 183, 191 (2014).
[5] Id.
[6] Department of Justice Policy Guidance: Use of Cell-Site Simulator Technology. Sept. 3, 2015, https://www.justice.gov/opa/file/767321/download
[7] Stephanie K. Pell & Christopher Soghoian, Your Secret Stingray’s No Secret Anymore: The Vanishing Government Monopoly Over Cell Phone Surveillance and Its Impact on National Security and Consumer Privacy. 28 Harv. J.L. & Tech. 1 (2014).
[8] Signal strength varies depending on terrain and antennas, but can extend to a mile or farther. See John Kelly, Cellphone Data Spying: It’s Not Just the NSA, USA Today (Dec. 8, 2013), http://www.usatoday.com/story/news/nation/2013/12/08/cellphone-data-spying-nsa-police/3902809.
[9] Andrew Hemmer, Duty of Candor in the Digital Age: The Need for Heightened Judicial Supervision .of Stingray Searches, 91 Chi.-Kent L. Rev. 295, 300 (2016).
[10] Stingray Tracking Devices: Who’s Got Them? American Civil Liberties Union https://www.aclu.org/map/stingray-tracking-devices-whos-got-them
[11] 18 U.S.C. § 2511.
[12] 18 U.S.C. § 3121–3127.
[13] Smith v. Maryland, 442 U.S. 735 (1979). The court in Smith established the “Third Party Doctrine,” which denies Fourth Amendment protection to information voluntarily turned over to a third party.
[14] 18 U.S.C. § 3121–3123.
[15] 18 U.S.C. § 3123.
[16] 18 U.S.C. § 2701-2712.
[17] See, e.g., United States v. Graham, No. 12-4659, 2016 WL 3068018 (4th Cir. May 31, 2016).
[18] 47 U.S.C. § 1002(a)(2) (2012).
[19] Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act (USA PATRIOT Act) of 2001, PL 107–56, October 26, 2001, 115 Stat 272.
[20] Elec. Surveillance Unit, U.S. Dep’t of Justice, Electronic Surveillance Manual: Procedures and Case Law Forms, 41 (2005).
[21] 132 S. Ct. 945 (2012). The property-based paradigm in Fourth Amendment jurisprudence considers privacy to be violated when the intrusion was physical.
[22] Id. at 954.
[23] The question of how to regulate law enforcement use of add-ons enabling collection of content will not be discussed further for two reasons: (1) Title III standards for content collection can be readily applied; and (2) there is a growing consensus in the law enforcement community, emerging through publicized policies, that such add-ons are inappropriate for domestic criminal investigations.
[24] Department of Justice Policy Guidance: Use of Cell-Site Simulator Technology, Sept. 3, 2015, https://www.justice.gov/opa/file/767321/download.
[25] Nate Cardozo, Finally! DOJ Reverses Course and Requires Warrants for Stingrays! Electronic Frontier Foundation, Sept. 3, 2015, https://www.eff.org/deeplinks/
2015/09/finally-doj-reverses-course-and-will-get-warrants-stingrays.
[26] See Department of Homeland Security, Policy Directive 047-02: Department Policy Regarding the Use of Cell-Site Simulator Technology, Oct. 19, 2015, https://oversight.house.gov/wp-content/uploads/sites/13/2015/10/15-3959-S2-DHS-Signed-Policy-Directive-047-02-Use-of-Cell-Site-Simulator-Tech.pdf; Detective II Mark Castillo, “FACT SHEET,” Los Angeles Police Department, Major Crimes Division, https://reason.com/assets/db/13657861316760.pdf.
[27] See Sophia Hollander and Pervaiz Shallwani, NYPD Defends Its Use of Surveillance Technology, The Wall Street Journal, Feb. 11, 2016, http://www.wsj.com/articles/nypd-defends-its-use-of-surveillance-technology-1455243710; Shawn Musgrave, Public kept in the dark about BPD’s use of covert cell trackers, The Boston Globe, Feb. 24, 2016 https://www.bostonglobe.com/metro/2016/02/24/boston-police-cast-veil-warrants-uses-for-cellphone-trackers/fENx8a6nZd33UxttCHKlFJ/story.html.
[28] United States v. Jones, 132 S. Ct. 945, 956 (2012) (J. Sotomayor concurring) (quoting United States v. Di Re, 332 U.S. 581, 595 (1948)).
[29] See, e.g., Kyllo v. United States, 533 U.S. 27 (2001), infra.
[30] For example, Third Party Doctrine announced in Smith and has been challenged for its questionable applications in the digital age when the privacy norms are not necessarily about data secrecy, but data control. See, e.g., Daniel J. Solove, A Taxonomy of Privacy, 154 U. Pa. L. Rev. 477, 529 (2006).
[31] See, e.g., Riley, supra (J. Alito concurring).
[32] Kyllo v. United States, 533 U.S. 27 (2001).
[33] Id. at 34 (quoting Silverman v. United States, 365 U.S. 505, 512 (1961)).
[34] Orin S. Kerr, The Fourth Amendment and New Technologies: Constitutional Myths and the Case for Caution. 102 Mich. L. Rev. 801, 875 (2004).
[35] For example, aerial surveillance is commonly used to determine soil composition in agriculture or survey for real estate development. See Sean Gallagher, The Kite Man cometh: Ars does DIY open-source aerial surveillance, Ars Technica, Dec. 18, 2013. http://arstechnica.com/information-technology/2013/12/
the-kite-man-cometh-ars-does-diy-open-source-aerial-surveillance/.
[36] 66 Hastings L.J. at 191.
[37] 28 Harv. J.L. & Tech. at 5.
[38] In re the Application of the United States for an Order Authorizing the Installation & Use of a Pen Register & Trap & Trace Device, 890 F. Supp. 2d 747, 752 (S.D. Tex. 2012) (denying government application to employ IMSI-catching device pursuant to Pen/Trap Statute without prejudice) (“Based on the statutory language and the limited case law analyzing this issue, a pen register does not apply to this type of electronic surveillance). See also United States v. Rigmaiden, No. CR 08-814-PHX-DGC, 2013 WL 4525252 (D. Ariz. Aug. 27, 2013) (denying defendant’s motion to suppress evidence obtained by IMSI-catching device with a warrant); State v. Earls, 214 N.J. 564, 589 (2013) (announcing “new rule of law by imposing a warrant requirement” for location tracking based on cell site data obtained by service providers).
[39] See 91 Chi.-Kent L. Rev. 295.
[40] 102 Mich. L. Rev. at 868. Kerr notes that pen registers in widespread use by the 1960s, while the Supreme Court did not deliver its decision in Smith until 1979.
[41] See Riley, supra at 2484 (“A smart phone of the sort taken from Riley was unheard of ten years ago; a significant majority of American adults now own such phones. . . . Even less sophisticated phones. . . which have already faded in popularity since. . . 2007, have been around for less than 15 years. Both phones are based on technology nearly inconceivable just a few decades ago, when [cases providing relevant rules] were decided.”).
[42] 102 Mich. L. Rev. at 871.
[43] Id. at 872.
[44] Id. at 871.
[45] See id. at 875-82. See also Cass R. Sunstein & Adrian Vermeule, Interpretation and Institutions, 101 Mich. L. Rev. 885, 943 (2003) (“There is little reason to believe that generalist judges, devoting a brief time to the subject and possessed of limited information, can form even a plausible view of the relevant complexities.”).
[46] 102 Mich. L. Rev. at 881.
[47] Nicky Woolf, Congressman Introduces Bill to End Warrantless Stingray Surveillance, The Guardian, Nov. 4, 2015. http://www.theguardian.com/world/2015/
nov/04/house-bill-end-warrantless-stingray-surveillance-jason-chaffetz; Subcommittee on Information Technology, Hearing Examining Law Enforcement Use of Cell Phone Tracking Devices, https://oversight.house.gov/hearing/examining-law-enforcement-use-of-cell-phone-tracking-devices/.
[48] Cell-Site Simulator Bill, H.R. ___, 114th Cong. § 3119 (2015), http://chaffetz.house.
gov/sites/chaffetz.house.gov/files/Cell%20Site%20Simulator%20Bill.pdf.
[49] Stephanie K. Pell & Christopher Soghoian, A Lot More Than A Pen Register, and Less Than A Wiretap: What the Stingray Teaches Us About How Congress Should Approach the Reform of Law Enforcement Surveillance Authorities (Fn2), 16 Yale J. L. & Tech. 134, 137-42 (2014). See also Charlie Savage, Power Wars, 221-23 (2015).
[50] 16 Yale J. L. & Tech. at 166 (“The StingRay, therefore, illustrates a larger gap in congressional oversight insofar as new, invasive surveillance technologies and collection methods not directly authorized by Congress can be used, often for decades, without any reliable notice to Congress about their use. Simply put, before Congress can begin to regulate new surveillance technologies and methods, it must have some notice of their nature and actual or likely use.”).
[51] Id. at 167-71.
[52] Id.
[53] See Kim Zetter, Of Course Congress Is Clueless About Tech—It Killed Its Tutor, Wired (April 21, 2016), http://www.wired.com/2016/04/office-technology-assessment-congress-clueless-tech-killed-tutor.
[54] See Kim Zetter, Law Makers Reject Proposal That Would’ve Schooled Them on Tech, Wired (June 13, 2016), https://www.wired.com/2016/06/lawmakers-reject-proposal-wouldve-schooled-tech/.
[55] Id. See also Press Release, Office of U.S. Representative Bill Foster, Foster, Chaffetz Send Bipartisan Letter Urging Speaker Ryan to Restore Office of Technology Assessment (Dec. 11, 2015), https://foster.house.gov/media-center/press-releases/foster-chaffetz-send-bipartisan-letter-urging-speaker-ryan-to-restore; Letter available at https://foster.house.gov/sites/foster.house.gov/files/2015-12-11%20Ltr%20to%20Speaker%20Ryan%20on%20OTA.pdf.
[56] U.S. Const. amend. IV.
[57] 533 U.S. at 40.