For the first time, federal judge tosses evidence obtained via stingray

ArsTechnica – by Cyrus Farivar

On Thursday, a US federal judge in New York delivered a crucial rebuke to the government’s warrantless use of stingrays.

In a 14-page opinion, the judge ruled that the government could not use its stingray to locate a drug suspect, asleep in his apartment. As a result of the ruling, the judge suppressed the evidence found in the man’s bedroom—a kilogram of cocaine—likely effectively ending the case.  

In March 2016, a state appeals court in Maryland reached a similar finding, but this is believed to be the first federal ruling of its kind.

“This is the first federal ruling I know of in which a judge squarely ruled that the Fourth Amendment requires police to get a warrant to use a stingray, and suppressed evidence derived from warrantless use of the technology,” Nathan Wessler, an attorney with the American Civil Liberties Union, told Ars.

As Ars has long reported, cell-site simulators—known colloquially as stingrays—can be used to determine a mobile phone’s location by spoofing a cell tower. In some cases, stingrays can intercept calls and text messages. Once deployed, the devices intercept data from a target phone along with information from other phones within the vicinity. At times, police have falsely claimed the use of a confidential informant when they have actually deployed these particularly sweeping and intrusive surveillance tools.

In recent years, stingray use has come under increasing scrutiny. Several states, including California,Washington, Virginia, Minnesota, and Utah, now mandate that a warrant be issued for use of the devices. Last year, the Department of Homeland Security and the Department of Justice also imposed new policies that require a warrant for stingray use in most cases.

Here, the stingray was used by the Drug Enforcement Agency, which is bound by rules under the DOJ—however, the device was deployed just days before the DOJ announced its new rules.

“Absent a search warrant, the Government may not turn a citizen’s cell phone into a tracking device,” US District Judge William Pauley wrote.

The case, known as United States v. Raymond Lambis, involves a man who was the target of a drug investigation.

According to court documents, since January 2015 federal authorities had been investigating an operation to move “large quantities” of narcotics from South America. As part of that investigation, investigators obtained a wiretap order to monitor Blackberry PIN messages between two suspected drug traffickers.

During one of those exchanges, they came across a message referencing someone named “Patilla,” which listed a 646 area code phone number. Those messages suggested that Patilla would be able to furnish hydrochloric acid, which can be used to purify heroin.

So, DEA Special Agent Kathryn Glover sought and obtained a warrant seeking location information and cell site data for the 646 phone—not for the search of the suspect’s apartment.

In fact, in the warrant application, Agent Glover wrote: “the Prospective Location Information will be obtained by requiring the Service Provider to provide the information.”

“So they went to the effort to get a warrant, but then didn’t tell the judge they intended to use that warrant to use a stingray,” Christopher Soghoian, an ACLU technologist, told Ars.

He underscored that while the DOJ and other law enforcement agencies have policies that require the use of a warrant, that’s not the same thing as having a properly-crafted law that defines stingray use.

“Which means there is no suppression remedy just for violating the policy,” Soghoian added. “Which is why it is so important for federal courts, like this one, to recognize that use of a stingray is a search of a Fourth Amendment-protected place, and that not only is a warrant required, but that the court authorizing the surveillance must be told that they are authorizing the use of a stingray.”

Going door to door

Indeed, the government didn’t limit itself to data obtained from the cell carrier. In fact, as Judge Pauley wrote, on August 27, 2015, the DEA got the cell-site location information (CSLI) to locate the 646 phone. However, that only got agents to the “general vicinity” of the intersection of Broadway and 177th streets, in Manhattan.

The DEA then turned to its handheld stingray—a technician used it to locate first the building, and then the individual apartment where the signal was strongest. Within a couple of hours, the DEA knocked on the door, where the suspect’s father answered, allowed the agents in, and permitted a search.

Then, the father knocked on his son’s bedroom door, and again, agents asked to search his bedroom. The son, Raymond Lambis, consented. (In a court filing, Lambis later said that he consented only because he claimed that agents threatened to search his family’s apartment if he did not.)

Agents found over a kilogram of cocaine, empty ziploc bags, a scale, and eight cell phones. Lambis was arrested that evening and formally charged three days later.

The case proceeded normally until February 25 2016, when Lambis and his attorney filed a motion to suppress, and the judge held a hearing on the issue in April.

In the Tuesday opinion and order, the judge also tackled the thorny question of the third-party doctrine head on. That legal theory, which stems from a 1979 Supreme Court case, postulates that people don’t have a privacy interest in data that they hand over to third parties, like a phone company.

The legal precedent has been used to justify stingray use in previous cases.

“However, the location information detected by a cell-site simulator is different in kind from pen register information: it is neither initiated by the user nor sent to a third-party,” the judge wrote.

“For both pen register information and CSLI, the Government ultimately obtains the information from the service provider who is keeping a record of the information. With the cell-site simulator, the Government cuts out the middleman and obtains the information directly. Without a third-party, the third-party doctrine is inapplicable.”

Brian Owsley, a former federal magistrate judge, who is now a law professor at the University of North Texas, told Ars that “the doctrine is being challenged in a significant manner regarding privacy rights related to cell phones.”

“The fact that information is transmitted to the cell phone company does not, according to this court, trigger the third party doctrine,” he e-mailed. “This is very important given how ubiquitous cell phones are in our society and the fact that just about everyone uses them these days.”

In an e-mail, DOJ spokesman Peter Carr didn’t say whether the government would be appealing to the 2nd Circuit.

“We are declining to comment at the moment,” he wrote. “Will let you know of that changes.”

http://arstechnica.com/tech-policy/2016/07/for-the-first-time-federal-judge-tosses-evidence-obtained-via-stingray/