Privacy advocates sued a Florida police department Tuesday over a controversial surveillance technology that, they say, improperly lets authorities track the movements of thousands of cellphone users without a warrant.
The suit, filed by the American Civil Liberties Union and obtained by The Washington Post, revives a perennial debate about the judicial standards law enforcement officials must meet to gather geolocation information — and once they receive a court's permission, how much of that data they can collect and store. It also implicates decades-old privacy legislation that was written in the age of the telephone but has been liberally interpreted to allow much greater surveillance in the Internet era, according to the law's critics.
The ACLU alleges in the suit that law enforcement officials in Sarasota, Fla., acting on behalf of the U.S. Marshals Service, obtained judicial approval to use a type of surveillance tool known as a "stingray." Used in an investigation, stingray equipment can help police identify which cellphones may be operating in an area by establishing a fake cell tower; nearby devices then automatically try to connect with the stingray device, which logs the connections for forensic analysis unbeknownst to the cellphone users.
Although the paperwork surrounding the court order is considered public records, authorities then allegedly took steps to conceal their request for approval as well as the judicial order authorizing the surveillance. According to the suit, an unnamed federal agency transferred the paperwork to another facility after the Sarasota police department, responding to a formal request, agreed to share the documents with the ACLU.
"Here we have the U.S. Marshals swooping in and physically grabbing what turns out to be the only copy in existence of these orders and applications and spiriting them away," said ACLU staff attorney Nathan Wessler, "thus taking them outside the reach of anyone trying to use the state public records law."
The U.S. Marshals' office declined to comment. The Sarasota Police Department said it had "a different opinion" than the ACLU and that it was working with its lawyers on the matter.
Civil liberties groups have been active in seeking out court orders for stingrays — particularly those that do not force authorities to justify their request with a high burden of proof. The result, they say, is that governments can collect location data on "hundreds of thousands of innocent people" simply by arguing before a judge that the use of a stingray would be relevant to an ongoing criminal investigation.
"All kinds of things can be 'relevant,' " said Brian Owsley, a former U.S. magistrate judge for the Southern District of Texas. "It's a pretty low standard."
Law enforcement defenders argue that the operative words are "ongoing investigation," and that layers of oversight in a well-functioning police department would not allow officers to launch frivolous investigations involving a stingray. Geolocation data from stingrays has been used to exonerate suspects who were proven not to be at the scene of a crime, and has even saved lives, according to Ronald Hosko, a former head of the FBI's Washington field office.
"There's not this massive pool of data that the FBI is storing and storing and storing. We don't have that," Hosko said of his time in the agency. "We needed a predicated case to go start to collect. We didn't do that randomly; we needed a reason."
Hosko added that to date, law enforcement officials have not "made the case effectively enough" as to the public benefits of location data used for crime-fighting purposes. Instead, Americans are more concerned about the potential for abuse.
That fear is justified, Owsley said. If police are investigating a series of bank robberies and collect the phone numbers of all the individuals near the banks, they may find a criminal pattern — but the stingray will also incidentally reveal the location of bystanders.
The underlying law allowing police to use stingrays with little more than a relevance test dates back to 1986. Known as the Electronic Communications Privacy Act, the law is being considered for a revamp in Congress. But it's unclear whether the proposed changes would affect Title III of the statute, which governs another type of surveillance tool called pen registers and trap-and-trace devices. These tools, which collect the routing information of outbound and incoming calls, respectively, do not require a warrant. Law enforcement officials have argued in the past that stingrays are effectively the same thing, in that they collect information about a communications device but not the content of those communications.
As a result, according to the ACLU, authorities have been able to gather location information on too many individuals too easily.