A state Senate committee got its first look this week at a bill that would regulate how law enforcement officers use cellphone surveillance devices like the kind Tacoma police have deployed for years.
The original bill targeted cell site simulators, which can mimic a cellphone tower and force nearby cellphones to connect with it. But in recent weeks, those working on the bill have expanded the definition of the device.
The revised definition includes devices that locate suspects, intercept information, jam signals or install malicious software.
“We wanted to reinforce (the definition) with technical specifics about how these devices work,” Jared Friend said Friday. He is the technology and liberty director for the American Civil Liberties Union in Seattle.
The bill would prevent police from deploying a cell site simulator, sometimes called a Stingray, unless they first disclose their plans to a judge and obtain a court order authorizing its use.
The state House unanimously passed its version of the legislation, House Bill 1440, this month. It also requires police to destroy data collected on people who are not surveillance targets.
State Rep. David Taylor, R-Moxee, said news reports have documented the use of these devices on the East Coast.
“We were a little surprised last summer when we saw suddenly they showed up in Pierce County,” he said.
There were no procedures governing the legal use of these devices, Taylor said, so he authored the bill “to protect the rights of our citizens, and frankly, the personal data that could be collected through the use of these devices.”
Now the bill has moved on to the Senate, where a technology expert testified Thursday to the Committee on Law and Justice. Nobody from law enforcement testified at the hearing.
Christopher Soghoian, principal technologist for the ACLU in Washington, D.C., said Stingrays pretend to be cell towers operated by traditional cellphone companies. The device sends signals indiscriminately into private spaces like homes, cars and purses, and it forces cellphones to connect with it.
“Even if law enforcement is looking for one particular phone that they know the number of, they also get information about a vast number of other people’s telephones in the area, and there is no way for the device to not collect that information,” Soghoian told the committee.
A Stingray, small enough to fit in a car, can be driven through a neighborhood to pinpoint a surveillance target’s location more accurately. It also has the capability to collect metadata — who you call or text, when you contact them and for how long you talk — from every cellphone in the area.
Tacoma police have been reluctant to talk about the Stingray’s capability because the department has signed a nondisclosure agreement with the Federal Bureau of Investigation. The FBI would not confirm or deny the existence of a nondisclosure agreement with Tacoma.
Police around the country, including Tacoma, have said if “bad guys” know how police find them, surveillance methods won’t work anymore.
State Senate committee members asked questions Thursday about how the technology works and how police deploy it.
Ramona Brandes, a public defender in Seattle, told the committee that technology is advancing by “leaps and bounds.” State law needs to keep pace, she said, so “as more law enforcement become interested in the technology, they have some very clear guidelines from the Legislature about the use of them.”
The bill also emphasizes that a warrant signed by a judge is required to deploy the technology — something Tacoma police have done since it started using its Stingray in 2009. What police here have not done until recently is tell judges exactly which technology was being used.
Tacoma police spokeswoman Loretta Cool said Thursday the department doesn’t expect any problems if the bill is signed into law.
“We have always applied for court orders and now, we specify in the applications the use of specific equipment,” Cool wrote in an email.
Last year, 22 Pierce County Superior Court judges told police they must swear in affidavits that they will not store data collected from people who are not the target of that police investigation.
The bill in the Senate also would require police to permanently delete all data from those who are not the target of the police investigation, and to delete the data of the target of investigation after 30 days if police no longer believe the data can be used to prove criminal activity. The bill would not apply to federal agencies who deploy the technology.
Police could continue to deploy the technology in emergencies provided they get a judge’s permission within 48 hours.
The Senate committee hasn’t scheduled a vote on the bill.