The Justice Department’s decision to require warrants before deployment of secret cellphone tracking systems has earned applause from privacy advocates as a first step in shining a light on the clandestine use of the technology by federal law enforcement.
But experts say the new regulations, issued last week, also leave much to be desired — including the fact that they will apply only to agencies under Justice Department authority and not to local and state law enforcement or to other federal agencies under the Department of Homeland Security.
“There is a lot that is not being covered,” said Nathan Wessler, a staff attorney with the American Civil Liberties Union. “We are certainly happy to see the steps they’ve taken, but there is a lot that they missed and it’s of concern.”
The new regulations involve technology, often known as StingRays, that law enforcement agencies have largely tried to deploy in secret — with police departments willing to go as far as to drop criminal charges rather than disclose their investigative methods.
The devices work by mimicking cellphone towers to trick cellphones to connect to them, enabling investigators to obtain identifying information about the phones and their locations.
Law enforcers often deploy the suitcase-sized StingRays by hauling them around in vehicles as they drive through neighborhoods looking for a suspect’s phone, scooping up data on the cellphones of any passers-by in the process. Before now, investigators have used the devices largely without warrants, in many cases without disclosing their use to judges, prosecutors or defendants.
SEE ALSO: Justice to require search warrants for use of phone-tracking devices
A seven-page memo, issued Thursday by Deputy Attorney General Sally Yates, makes clear that federal law enforcement will be required to obtain a search warrant supported by probable cause before using the devices. There will be exceptions to the new rules — in emergencies such as during the pursuit of a fleeing felon or to protect human life and other circumstances under which the “law does not require a search warrant and circumstances make obtaining a search warrant impracticable.”
Those loopholes are part of what worries privacy advocates.
Mr. Wessler points out that a large part of the work done by U.S. Marshals is to track down suspects. Without a clearer explanation of the new policy, he wonders if that leaves room for warrantless use by the agency as the rule rather than the exception.
Because the regulations are a policy change, not a change in law, privacy advocates also question what recourse is available in instances under which it is discovered that a warrant was not obtained when it should have been.
“As welcome as the announcement is, we need something that’s actually binding,” said Nate Cardozo, a staff attorney with the Electronic Frontier Foundation. “The DOJ’s announcement is just a voluntary policy shift and won’t provide a remedy if the DOJ violates the policy and uses StingRays without a warrant.”
And there is concern over the fact the regulations will not apply to state and local law enforcement, which also have tried to hide their deployment of the technology.
SEE ALSO: David Daleiden says undercover team infiltrated Planned Parenthood by using ‘magic words’
“We at EFF have long called for a warrant requirement before law enforcement uses StingRays, given the incredible intrusiveness of the technology involved and the potential to sweep up data about potentially thousands of innocent cellphone users in the vicinity,” Mr. Cardozo said. “We need to extend this warrant requirement to all state and local law enforcement agencies around the country.”
The DOJ’s memo states that the new policy is meant to apply to all instances in which DOJ uses cell-site simulators “in support of other Federal agencies and/or State and Local law enforcement agencies.”
Mr. Wessler said without further clarification it’s difficult to know whether the warrant policy would apply in arrangements under which the DOJ loans out agency-owned cell-site simulators to local agencies or if the DOJ provides grant money for local agencies to purchase their own.
The new policy requires officials to track use of the technology, information that could provide for the first time a comprehensive data on the prevalence of cell-site simulators’ use. It also lays out for the first time protocol for deleting data collected on innocent people whose cellphone data might be scooped up as authorities pursue suspects. At a minimum the data must now be deleted once a day. Previously there was no policy on the data retention.
Still lacking however, Mr. Wessler notes, is any requirement to disclose to those whose cellphone data was collected — either accidentally or because the person was the target of an investigation.
The new policies caught the attention of the chairman of the Senate Judiciary Committee, who praised the greater oversight and accountability. But Sen. Chuck Grassley, Iowa Republican, said he plans to a further review of the new regulations.
“I’ll be studying the details of the policy to determine if it sufficiently protects the privacy of Americans, and closely examining how it’s adhered to going forward,” said Mr. Grassley, also expressing concern that use of the technology remains unchecked at the state and local level.
Although the ACLU has uncovered use of cell-site simulators by 53 local law enforcement agencies in 21 states and the District, only Washington, Virginia, Minnesota and Utah have adopted any laws limiting their use.
The Justice Department coming around to offer public guidelines on the use of a technology that it once tried to hide, is a remarkable first step, Mr. Wessler said.
“I think this will add to the momentum we are seeing around the country to enact reasonable restrictions on use of this technology,” he said.
• Andrea Noble can be reached at anoble@washingtontimes.com.
Please read our comment policy before commenting.