NYCLU Claims Major Victory in Case Against Police Cellphone Spying
Stingray devices can track mobile phones directly, and their secrets are jealously guarded by law enforcement.
U.S. Patent and Trademark Office
A judge in upstate New York has dealt a significant blow to the secrecy surrounding one of the creepiest tools currently in use by cops across the country.
After drawn-out litigation with the New York Civil Liberties Union, the Erie County Sheriff's Department is being forced to hand over a stack of documents about its use of Stingray devices, tools that mimic cellphone towers and allow cops to track people through their mobile devices.
The NYPD has never acknowledged using Stingray technology, but at least one FOIL request — which is still pending — has been filed seeking documents related to the technology in New York City. Mariko Hirose, the attorney who handled the case for the NYCLU, said the decision in the Erie County case should provide fodder for others seeking related records in the state.
The suitcase-sized devices are also called "cell-site simulators," and they work by mimicking the cellular towers that form the backbone of the country's mobile infrastructure. By impersonating a cell site, Stingrays "trick" cellphones within the immediate area (and operating on the same network) to connect through their antennas. Police are then able to home in on the location of a particular device, and potentially intercept some data as well.
The case in Erie County — which includes the city of Buffalo — began with a May 2014 news report by local TV station WGRZ, which uncovered documents showing that the sheriff there had spent more than $350,000 on technology related to Stingrays.
The NYCLU in June filed a request under New York's Freedom of Information Law asking for documents related to the technology. While some of the requested records, like invoices and purchase receipts, would clearly be considered public in almost any other context, the request was denied in its entirety weeks later.
In a decision released Tuesday, a judge in the New York Supreme Court of Erie County found that the department had unlawfully withheld the records, and ordered them to be reviewed and made public after appropriate redactions. (The court also found that the sheriff had outright ignored an appeal from the group, a clear violation of the law.)
Reporters all over the country have received similar blanket denials about Stingray technology, in some cases because local agencies had signed an extremely unusual non-disclosure agreement with the Federal Bureau of Investigation. The FBI has for years required local cops who want to use the technology to shield it from prying eyes, an agreement that has frequently conflicted with longstanding public-records laws. In an odd coincidence, the New York Times just last week detailed the extraordinary secrecy surrounding Stingray use. While it's not unusual for police to be cagey about their methods, few technologies have been so aggressively shielded from disclosure.
The Stingray — a brand name for a device made by Florida-based Harris Corporation — has been in routine use by local police departments since at least 2012. But questions remain about how often and under what level of court supervision they are deployed. Privacy advocates say police should need a warrant — a legal standard that requires probable cause to believe a crime is being committed — to use the devices. But police departments and the federal government have argued that they need only obtain a "pen register" order, which requires a much lower legal standard.
"Pen register orders...are much less protective of privacy than a warrant based on probable cause," Hirose said.
The use of Stingrays is different from the now-common practice of requesting cellphone data from carriers themselves. While telecoms routinely issue information about a customer's location history under a court order, Stingrays are able to track cellphones directly and therefore have the potential to be used without any court supervision at all. It's this "self-service" capability that worries privacy advocates most; since it's impossible to tell if your phone has been tracked by one of the devices, departments are essentially on the honor system.
The court's decision appears to show that Erie County was indeed using the Stingray without any judicial oversight. The court, which had reviewed the requested records itself, noted that "just one of the reports [on the department's use of Stingray] — the most recent one, in fact, — mentions the obtaining of a court order or other judicial order as a predicate."
Hirose called that revelation "very troubling."
The court's decision will compel the sheriff to release a trove of new documents, and Hirose said she looked forward to seeing what those records might reveal about how often — and for what reasons, if any — the department was bypassing the courts.
The department can appeal the judge's ruling, and Scott Zylka, executive assistant to the Erie County sheriff, told the Voice he couldn't comment on potentially ongoing litigation.
Here's the decision in its entirety: