At least seven law enforcement agencies in California are using controversial technology that allows them to secretly collect data from cellphones and track people, News10 has learned.
Hundreds of pages of documents, from grant applications to purchase orders, show that the technology has been here for years and it's been used in dozens of arrests. In Oakland, a device called a StingRay allows police to track people and collect real-time data from every cell phone within a certain radius. The city's Targeted Enforcement Task Force II used a Stingray to make 19 arrests in 2009, according to an Oakland Police Criminal Investigation Division report.
StingRays are being paid for mostly by Homeland Security grant money distributed by the California Emergency Management Agency, under programs such as the Urban Areas Security Initiative (UASI) or the State Homeland Security Program (SHSP). Grant applications from several agencies show local law enforcement are justifying the purchase of StingRay technology as an anti-terrorism tool, but it's being used to apprehend and prosecute suspects in routine crimes, from robberies to homicides.
None of the 19 arrests made using the StingRay in Oakland in 2009 were related to terrorism.
Linda Lye, Staff Attorney at the ACLU of Northern California, has been challenging the federal government to unseal StingRay related records for several years. She's troubled by the new revelations showing the technology is in the hands of local law enforcement across the state.
"It's very surprising to learn that many local law enforcement agencies are using these devices," Lye said. "The public and criminal defendants don't have any idea what guidelines govern their use."
Harris Corporation, the Florida company that makes StingRays, includes non-disclosure agreements in their contracts. They say the technology can only be discussed with sworn law enforcement agents. Even their marketing materials are heavily guarded.
News10 contacted several law enforcement agencies about StingRays. None would discuss the devices.
How a StingRay Works
A StingRay is a brand of IMSI (International Mobile Subscriber Identity) catcher, a device that masquerades as a cellphone tower. It's about the size of a briefcase and is generally mounted in a police surveillance vehicle.
"StingRays are powerful surveillance tools capable of many different kinds of privacy invasions," Lye said. "StingRays operate by mimicking a cell tower and tricking all wireless devices on a particular network into communicating with the StingRay."
Cellphones are constantly seeking the nearest tower, so every phone within a certain radius is tricked into connecting with the device, giving police real-time information from every phone within a certain radius of the device.
Police can use this data to pinpoint the location of a specific person by determining the direction and distance of the phone from the StingRay and other nearby cell towers. They can also determine the unique ID and telephone number of every connected phone, as well as the phone numbers dialed by a connected phone, including outgoing calls and texts.
"StingRays can determine a device's location with remarkable precision, even pinpointing someone to a particular unit within an apartment building," Lye said. "In other words, the government can use a StingRay to determine who is inside a private home and when."
Although StingRays can capture the content of phone calls and text messages, law enforcement sources and documents from the Harris Corporation say devices configured for law enforcement don't have that capability.
"Certain devices are capable of capturing voice communications and indeed in Eastern Europe are widely used for industrial espionage," Lye said. "Some of the products sold in the US to law enforcement are purposefully configured not to capture voice communications, but they still detect information such as the serial number and location of devices that communicate with the StingRay."
Peter Scheer, the Executive Director of the First Amendment Coalition, says there is potential for abuse. Because there is so little transparency, police can say one thing and do another.
"You could use it for just sheer intelligence gathering without any real expectation that you're going to bring a case, and then who would ever know?" Scheer said.
Groups such as the ACLU and the Electronic Frontier Foundation have been critical of StingRays since learning the FBI was using them in 2011.
They have a number of concerns about possible Fourth Amendment violations, free speech issues and the oversight mechanisms that are in place to prevent abuse.
StingRays don't have the ability to lock onto the phone of a specific target or suspect. Instead, they cast a wide net and suck up data from every phone within a certain radius.
Lye says that amounts to the type of "general search" the 4th Amendment is supposed to protect against.
"This intrusive surveillance technique means that StingRay searches cannot be focused only on individuals who are suspected of wrongdoing, and that such searches necessarily scoop up information about innocent third parties," Lye said. "This is the electronic equivalent of a general search."
In some cases, those innocent third parties are inside their home, where there is an expectation of privacy. Even armed with a search warrant, Lye says police could be violating the Fourth Amendment rights of innocent third parties by using a StingRay.
"StingRays invade reasonable expectations of privacy because they are capable of locating people when they are inside their homes," she said. "In addition, given the intrusive nature of StingRay searches, it is critical that a neutral judicial officer supervise the search to limit its effect of third parties."
But it's not clear that police are getting search warrants to use StingRays or similar devices. News10 asked that question to agencies known to use the device, but all agencies declined to comment.
Although Lye says police should be getting a warrant to use a StingRay, she's concerned that's not happening.
"If law enforcement were getting warrants, or were making clear in any warrants that they were using StingRays, we would expect to have seen some legal challenges in the California state courts by now," Lye said. "But we haven't."
Hanni Fakhoury, an attorney for the Electronic Frontier Foundation, agreed with Lye. He said police need to come clean about how they're using the technology.
"They should be more forthright about whether they have a device, how they're using the device, the types of cases they're using them on and the legal procedures they're following to get authorization to use the device," Fakhoury said.
On top of the Fourth Amendment and oversight concerns, Fakhoury said StingRays can have a chilling effect on free speech.
When Miami-Dade police submitted a grant application to buy a StingRay, they told the city council they needed one to monitor protestors at an upcoming World Trade Conference. Parking a StingRay outside the protest would give law enforcement the names and telephone numbers of everyone nearby. Scheer says this is a problem, unless they're only monitoring specific people suspected of criminal activity.
"To simply take inventory through the indentifying of phone numbers of all the people who might be there, including the hundreds of people who are just journalists watching or ordinary civilians just going about their business…and then end up with their personal information and telephone numbers in some FBI file somewhere – that's troubling," Scheer said.