<Omaha, 5.27.15>
Understanding New
Surveillance Tools
Hanni M. Fakhoury
EFF Senior Staff Attorney
<Omaha, 5.27.15>
<Omaha, 5.27.15>
http://www.usatoday.com/story/news/nation/2013/12/08/cellphone-data-spying-nsa-police/3902809/
<Omaha, 5.27.15>
<Omaha, 5.27.15>
https://www.aclu.org/maps/stingray-tracking-devices-whos-got-them
<Omaha, 5.27.15>
<Omaha, 5.27.15>
<Omaha, 5.27.15>
https://www.aclu.org/sites/default/files/assets/aclu_florida_stingra
y_police_emails.pdf
<Omaha, 5.27.15>
https://www.aclu.org/sites/default/files/assets/aclu_florida_stingra
y_police_emails.pdf
“In the past, and at the request of the U.S.
Marshalls, the investigative means utilized to
locate the suspect have not been revealed so
that we may continue to utilize this technology
without knowledge of the criminal element, in
reports or depositions we simply refer to the
assistance as ‘received information from a
confidential source regarding the location of the
suspect.’”
<Omaha, 5.27.15>
https://www.aclu.org/technology-and-liberty/us-v-rigmaiden-doj-emails-stingray-applications
<Omaha, 5.27.15>
US v. Rigmaiden, 844 F. Supp. 2d 982 (D. Ariz. 2012) & 2013 WL 1932800
(D. Ariz. 2013)
<Omaha, 5.27.15>
<Omaha, 5.27.15>
<Omaha, 5.27.15>
<Omaha, 5.27.15>
<Omaha, 5.27.15>
<Omaha, 5.27.15>
<Omaha, 5.27.15>
<Omaha, 5.27.15>
Hemisphere
• Database of CDRs available in near real time
regardless of carrier
– Includes records made 2 hours after a call
– Results returned in hours for exigent
circumstances and 2-5 days for routine requests
– At least 10 years worth of records
• Used to
– Find dropped/new/additional phones
– Determine some location information
– CDRs on international numbers
<Omaha, 5.27.15>
Hemisphere
<Omaha, 5.27.15>
“Protecting” Hemisphere
• Administrative subpoena to get Hemisphere
records
• “Parallel subpoening”
– Hemisphere used as a “pointer” system to be
followed up by a subpoena to carrier
• No reference to Hemisphere in official reports
or court documents
– Just reference to follow up subpoenas
<Omaha, 5.27.15>
US v. Ortiz, 12cr119 (NDCal)
• Defense obtained 17(c)
subpoena ordering
disclosure of:
– Court orders authorizing
HIDTA to release CDRs to
law enforcement
– Correspondence between
law enforcement and
Hemisphere
http://www.sfweekly.com/2014-01-15/news/hemisphere-at-and-t-wiretapping-gangs/
<Omaha, 5.27.15>
DEA Bulk Records Collection
• Collection of phone records made from US to
116 countries from 1992-2013
– numbers, time and date of call and length of call
• Database queried if reasonable articulable
suspicion phone associated with criminal
activity
• DEA’s SOD passed info as tips to field agents
and local law enforcement
– Database not referenced in official reporting
<Omaha, 5.27.15>
Discovery
• Other “Stingray” Terminology
– IMSI catcher, digital analyzer, cell site
simulator, triggerfish, stingray, kingfish,
amberjack, hailstorm, WITT (FBI’s
“wireless intercept tracking team”)
• Descriptions of the Technique
–
–
–
–
Cellular or cell phone tracking
Pinging
“Ride by”
“Known investigative technique”
<Omaha, 5.27.15>
US v. Kincaid, 13cr818 (NDCal)
<Omaha, 5.27.15>
US v. Kincaid, 13cr818 (NDCal)
<Omaha, 5.27.15>
State v. Taylor, 114140031
<Omaha, 5.27.15>
Expectations of Privacy
• Rakas v. Illinois, 439 U.S. 128, 143 n. 12
(1978)
– Must “have a source outside of Fourth
Amendment” by reference to “understandings that
are recognized and permitted by society”
• Riley v. California, 134 S.Ct. 2473 (2014)
– Privacy interests depend on the quality and quality
of information revealed
– Older cases involving physical items or less
intrusive government action don’t control digital
searches or surveillance
<Omaha, 5.27.15>
Expectations of Privacy
• US v. Knotts, 460 U.S. 276 (1983)
– No expectation of privacy in public movements
“voluntarily conveyed” to others
– Reserved right to consider “dragnet-type law
enforcement practices”
• Smith v. Maryland, 442 U.S. 735 (1979)
– Use of pen register to capture outgoing phone
calls made over three days
– No expectation of privacy in dialed phone
numbers
<Omaha, 5.27.15>
Location Privacy
• Subjective expectation of privacy
– Location info revealing when aggregated
– Phone records may be protected under state
constitution
• Expectation is objectively reasonable
– Growing body of case law and statutory protection
reflect changing “understanding”
• Smith Doesn’t Apply
– Nature of intrusion matters
<Omaha, 5.27.15>
Location Privacy
• US v. Cooper, 2015 WL 881578, at *8 (N.D.
Cal. Mar. 2, 2015)
– “Society's expectation of privacy in historical cell
site data is also evidenced by many state statutes
and cases which suggest that this information
exists within the ambit of an individual's personal
and private realm… While state law is, of course,
not dispositive on this question, ‘the recognition of
a privacy right by numerous states may provide
insight into broad societal expectations of
privacy.’”
<Omaha, 5.27.15>
Location Privacy
• Warrant to track car with a GPS device
– U.S. v. Maynard, 644 F.3d 544 (D.C. Cir. 2010); People v.
Weaver, 909 N.E.2d 1195 (N.Y. 2009); State v. Campbell,
759 P.2d 1040 (Or. 1988); State v. Jackson, 76 P.3d 217
(Wash. 2003); Commonwealth v. Rousseau, 990 N.E.2d 543
(Mass. 2013); State v. Brereton, 826 N.W.2d 369 (Wis.
2013); State v. Zahn, 812 N.W.2d 490 (S.D. 2012); U.S. v.
Lopez, 895 F. Supp. 2d 592 (D. Del. 2012)
• Warrant statutorily required to track cell
phone
– Historical & real time: CO, ME, MN, MT, UT
– Real time only: IL, IN, MD, VA, WI
<Omaha, 5.27.15>
Location Privacy
• Warrant required to obtain cell phone location
records
– Tracey v. State, 152 So.3d 504 (Fla. 2014); Commonwealth
v. Augustine, 4 N.E.3d 846 (Mass. 2014); State v. Earls, 70
A.3d (NJ 2013); Commonwealth v. Rushing, 71 A.3d 939,
961-64 (Pa. Sup. Ct. 2013), appeal granted on other
grounds 84 A.3d 699 (2014); United States v. Powell, 943 F.
Supp. 2d 759, 776-77 (E.D. Mich. 2013); United States v.
White, --- F.Supp.3d ---, 2014 WL 6682645 (E.D.Mich. 2014)
(real time)
– But see U.S. v. Davis, --- F.3d ---, 2015 WL 2058977 (11th
Cir. 2015) (en banc); In re US for Historical Cell Site Data,
724 F.3d 600 (5th Cir. 2013); In re US for an Order, 620 F.3d
304 (3d Cir. 2010)
<Omaha, 5.27.15>
Questions?
hanni@eff.org
@hannifakhoury
415 436 9333 x. 117
www.eff.org