The Sacramento County Sheriff’s Department will now require a judge’s approval before it uses its high-tech Stingray surveillance tool, Sheriff Scott Jones said Tuesday, unveiling a new policy governing the controversial technology.
The device’s technology mimics a cellular network’s cell tower, tricking a cellphone and other mobile devices into connecting to it. The cellphones can be identified and text messages and outgoing calls can be intercepted without the users’ knowledge. Law enforcement can then use the information to collect location data from investigative targets.
The department’s use of the cellular site simulator has rankled civil libertarians, privacy advocates and criminal defense attorneys since it began using the technology in 2006. Privacy advocates and others on Tuesday were encouraged by the latest move, but still expressed concerns about the technology’s lawfulness.
Jones said he directed “internal experts” in May to create the order in an “effort to maintain public trust.” The department has used Stingray technology without judicial approval. Under the department’s three-page operations order, deputies will not need judicial authorization to use Stingray for so-called “exigent circumstances,” including searches for missing persons, disaster response and circumstances of imminent great bodily injury or death. The order also requires that all collected data be purged after each use, mimicking a policy the U.S. Justice Department rolled out recently for the use of cell-site simulators.
“One of the components I wanted was judicial review prior to its use,” said Jones, who pointed out that judicial review is not required to use the technology. “I am extremely confident that we can balance the rights and privacy interests of citizens with our need to protect citizens and find bad guys.”
Jones called Stingray another investigative tool in a technology-driven profession, adding that the technology “does not and never has had the ability to collect the content of telephone calls and text messages.” He outlined the order at a news conference at the department’s downtown Sacramento headquarters.
Last week – days after the Justice Department released its policy – the Sacramento County Public Defender’s Office filed motions in Sacramento Superior Court asking a judge to order the Sacramento County District Attorney’s Office to provide the names of defenders’ clients it alleged to be secretly tracked by the Sheriff’s Department’s devices, calling deputies’ use of Stingray tools “secret, intrusive and warrantless.”
The technology prompted a lawsuit against the Sheriff’s Department last year by the American Civil Liberties Union.
In a statement following the sheriff’s news conference, county public defender’s officials called the policy a “positive step,” while reiterating legal efforts to gain more information about the department’s use of the technology, saying they will “continue to press for more facts so that the courts, rather than law enforcement, can determine the lawfulness of these methods.”
“It appears that in the past the sheriff has used this device hundreds of times without approval of the district attorney or the courts,” the statement read. “The public defender believes that citizens in our community have a right to know if, prior to this new policy, their privacy rights were violated.”
Linda Lye, a staff attorney at the ACLU of Northern California who focuses on privacy issues and technology, says the policy is a “step in the right direction” but says the sheriff’s policy appears to stop short of requiring a probable cause warrant to use the Stingray. Lesser statutory orders from a judge rather than warrants may be enough to permit use of the Stingray devices and could sidestep Fourth Amendment protections against illegal search and seizure.
“I’m troubled that (the policy) says ‘judicial authorization’ and not a warrant,” Lye said. “(Investigators) can use the facts of a Stingray search to develop independent probable cause and paper over the fact that they used a Stingray.”
Jones said a softening in recent months of the FBI’s nondisclosure agreement with his and other law enforcement agencies regarding acknowledgment of the Stingray’s use – not the recent legal action by the ACLU and the county’s public defender – helped lead to the new policy.
On Tuesday, Jones defended the department’s new policy, while acknowledging the public’s privacy concerns in a “post-Snowden world,” referring to former government contractor Edward Snowden, whose leaks of National Security Agency documents exposed widespread government surveillance of telephone and Internet communications at home and abroad.
“Perhaps it does not go as far as privacy advocates would want, but it still goes farther than any other agency,” Jones said.
▪ All data collected using the Stingray technology will be purged after each use.
▪ Data gathered by the equipment cannot be used to support probable cause for a search warrant or arrest.
▪ Requests for judicial authorization must note that the equipment “will send signals to all cellular devices within range which will cause the devices to emit unique identifiers,” and note when the intent is to determine those identifiers at multiple locations and times.
Deputies will not need judicial authorization for so-called “exigent circumstances,” including searches for missing persons, disaster response and circumstances of imminent great bodily injury or death.