Pierce County judges didn’t know until recently that they’d been authorizing Tacoma police to use a device capable of tracking someone’s cellphone.
Now they do, and they’ve demanded that police change the way they get permission to use their so-called cell site simulator.
From 2009 to earlier this year, the county’s Superior Court judges unwittingly signed more than 170 orders that Tacoma police and other local law enforcement agencies say authorized them to use a device that allows investigators to track a suspect’s cellphone but also sweeps cellphone data from innocent people nearby.
In August, the assistant chief of the Tacoma Police Department told The News Tribune that investigators never deployed the device — a cell site simulator, commonly known as a Stingray — without court authorization.
The newspaper since learned police never mentioned they intended to use the device when detectives swore out affidavits seeking so-called “pen register, trap and trace” orders allowing them to gather information about a suspect’s cellphone use and location.
That’s now changed.
The county’s 22 Superior Court judges, who first learned of the police department’s cell site simulator from The News Tribune’s reporting, now require language in pen register applications that spells out police intend to use the device.
Law enforcement agencies that want to deploy the device also must swear in their affidavits that they will not store data collected from people who are not the target of the investigation, said Judge Bryan Chushcoff, who requested the verbiage during recent meetings with police officials.
“They said they could live with that,” Chushcoff said.
Legal experts differ on whether police should have told judges about the cell site simulator when requesting authorization to use it. They also disagree about whether defendants could challenge evidence gathered using the court orders.
They do agree that case law on the matter is evolving.
“This is an area where the law is not very clear,” said Mary Fan, Henry M. Jackson professor of law at the University of Washington. “The law is changing really fast.”
The News Tribune learned earlier this year that Tacoma police had a cell site simulator and had sought permission to use it at least 170 times. Police have said they did not deploy the device in all those instances.
Cell site simulators act as mobile cellphone towers, tricking phones in a certain geographic area into connecting to it.
Police find them useful because they can pinpoint the location of a certain cellphone if police have the number and a general idea of where to look for it.
Privacy advocates find such devices concerning because they trick all cellphones in the area into connecting to them, including those of innocent third parties.
Since August, the newspaper has published a series of stories about the device, the privacy concerns surrounding its use and which local officials outside the Police Department knew about its existence.
One of those stories, published Aug. 28, quoted Tacoma Assistant Police Chief Kathy McAlpine, who said police use their cell site simulator only with a judge’s permission.
“We obtain a search warrant under the authority of (state law),” she said.
Several Superior Court judges, who are responsible for reviewing police requests for search warrants and pen registers, said that was news to them.
“People had never heard of it,” presiding Judge Ronald Culpepper told The News Tribune at the time.
The court orders police said authorized them to deploy the Stingray and the accompanying documentation had been sealed at the request of police.
On Oct. 2, The News Tribune went to court to request that two of those orders be unsealed. The orders chosen by the newspaper were from 2009, and the underlying criminal cases had been resolved.
The Police Department did not object to the orders being unsealed, and Culpepper ordered that they be made available to the newspaper.
Neither the pen register orders nor the affidavits filed by law enforcement mentioned that police had a Stingray or intended to use it.
Instead, detectives used language commonly associated with requesting an order that would force a cellphone company to turn over records for a particular phone, and, where possible, the real-time location of the phone.
The newspaper this month asked police whether all the Stingray order requests failed to inform judges that investigators intended to use a cell site simulator.
Police spokeswoman Loretta Cool said that was the case
“They all do not have that in there,” Cool said.
Investigators did not believe it was necessary to inform judges that the Police Department had a cell site simulator or intended to use it, she said.
Police are required, when requesting a search warrant, to inform judges of what crime they are investigating and what information they seek, Cool said.
“We don’t put in there the tactics and techniques we’re going to use,” she said. “For instance, if we want to search a house, we don’t tell them we’re going to use the SWAT team or that we’re going to use our dogs.”
That argument does not fly with some civil liberty advocates and legal experts.
In 2012, the American Civil Liberties Union and the Electronic Frontier Foundation filed a pleading in a criminal case in which police used a cell site simulator to track down a California man accused of tax fraud.
“Stingrays are highly intrusive and indiscriminate,” attorney Daniel Pochoda wrote on behalf of the ACLU and Electronic Frontier Foundation. “Their use implicates the privacy interests of the suspect, as well as untold numbers of third parties as to whom there is no probable cause.”
Pochoda said judges should be made aware that police intend to use such devices.
“The government cannot obtain judicial approval for a search using sophisticated, uniquely invasive technology that it never explained to the magistrate,” he wrote.
“To construe this order as a valid ‘warrant’ authorizing the use of a stingray would prevent magistrates from making informed determinations on warrant applications and encourage the government to keep magistrates in the dark.”
Bruce Jacob is a law professor at Stetson University in St. Petersburg, Florida.
He told The News Tribune earlier this month he found it troubling that police would not inform judges that they intended to use a cell site simulator in a criminal case.
“I think they’re misleading the judges,” he said. “They should explain the method that’s being used. The court should know what they’re seeking and how they’re seeking it.”
Mary Fan, the UW law professor and a former federal prosecutor, takes a more nuanced view.
Law enforcement agencies must walk a fine line between informing judges about what they’re doing and tipping off a criminal as to the tactics and techniques available to them and “jeopardizing their investigations,” Fan said.
“That’s the challenge,” she said.
While law enforcment requests to use a cell site simulator often are sealed, defense attorneys have access to such documents through the process of discovery when preparing a case for trial.
The law hasn’t been much help, Fan added, with the technologies available to police outpacing the court’s ability to clarify how and when they can be legally used.
“This is new terrain,” she said. “Law enforcement agencies are the first movers here. You often don’t have the definitive last word on new technology.”
Still, Fan said, courts in general, and the U.S. Supreme Court in particular, are becoming “more wary of unregulated and unfettered tracking” by law enforcement.
She cited the 2012 case of United States v. Jones as a recent example.
In that case, the Supreme Court ruled that placing a GPS tracking device on a suspect’s car constituted a search under the Fourth Amendment and that the subject of such a search enjoyed constitutional protections.
Debates such as the one going on in Tacoma can help law enforcement agencies “forge constraints” before the law is clarified by the courts, she added.
Another legal question the courts have yet to answer is whether evidence gathered using such devices can be used against a defendant, especially if the information was obtained either without a court order or one issued by a judge who didn’t know a cell site simulator was being used.
“We’re looking to see if that’s the case for us or not,” said Michael Kawamura, director of Pierce County’s Department of Assigned Counsel. “With what I know now, I think it would have to be on a case-by-case basis.”
Jacob, the Stetson University law professor, said he thinks defendants might have a basis to challenge such evidence, especially if a judge wasn’t informed about the tactics police used to get the information.
“If they obtained evidence that was later used in such cases, then, yes, I think there was a problem,” he said.
It’s impossible to know what exact device Tacoma police are using, its capabilities or, what, if any, evidence local law enforcement gathered using it.
They won’t say, and public documents obtained by The News Tribune about the Stingray have been heavily redacted.
Police said they are required by a nondisclosure agreement with the FBI to remain tightlipped. And, as mentioned before, most of the court documents are sealed.
Spokeswoman Cool denied a request by The News Tribune to see the device and photograph it.
“Then it would be a tool we couldn’t use,” she said.
Ian Smith is a security researcher in the University of Washington Computer Science & Engineering Security and Privacy Lab and has studied cell site simulators and similar devices.
The devices generally can read both the international mobile subscriber identity (the unique number assigned to each cellphone subscriber) and the unique serial number assigned to the actual phone.
“At that point, it would know which devices are in an area and their signal strength, too,” Smith said.
Police who have the cellphone number, and therefore the IMSI number of someone, then could use the cell site simulator almost like a metal detector “to follow the signal strength up the gradient” to locate the exact device they’re looking for, he said.
Tacoma police have said they use their cell site simulator for that capability alone.
But many of the devices have other applications as well, Smith said.
“They have many capabilities,” he said.
Most have the ability to capture and store data of various kinds, including the IMSI and phone identification numbers, Smith said.
Others can break encryption codes a phone sends to a cell tower. That would allow police or others to listen to a person’s calls, read their text messages and, in some cases, analyze Internet data, he said.
Cellphone companies have the ability to access that kind of information now, Smith said. Cell site simulators give that capability to anyone who knows how to use them, including the police, he said.
And the technology is rapidly advancing.
There is information on the Internet about so-called ISMI catchers sewn into a vest-like garment that investigators can wear under a coat. There also are hand-held devices the size of a walkie-talkie.
In some countries, authorities have been known to use Stingrays at protest gatherings to assemble lists of the cell phones, and presumably the subscribers, in attendance, Smith said.
“Even the simplest version of these devices can be abused,” he said.
JUDGES NOT WORRIED
Pierce County judges Culpepper and Chushcoff told The News Tribune earlier this month that they think Tacoma police most likely are using their cell site simulator legally.
Both said the addition of language to law enforcement requests for pen registers gives the local courts more oversight of the program and the ability to say no if they think the device is being misused.
It also helps to protect the privacy rights of innocent third parties whose data might be captured during a police operation, they said.
“We would have preferred to know about it sooner, but, from what we’ve been told by police, we have no reason to believe it’s being misused,” Culpepper said.
Chushcoff said he’s seen at least one pen register request in recent weeks in which the limiting language was included.
“I signed it,” he said. “I felt it was OK.”