The Courts and Cell Site Simulators
by Adam DeVries, Adjunct Instructor of Criminal Justice, Radford University, Email:adevries@radford.edu
Stingray and Hailstorm, also known as “IMSI[1] catchers,” are devices which mimic a cell tower. The device sends out signals prompting nearby cell phones to connect with it and display their location and phone number. The user needs to know the cell phone number of the subject in order to identify the nearby phone. Unlike triangulating through fixed cell towers, stingray can give a much more accurate location for the subject. It can even identify in which room of a building the subject is located. The stingray has a directional antenna that also measures cell phone signal strength to determine the location of the subject phone.
The FBI and other federal agencies have stingray devices. At times local law-enforcement has used the device in conjunction with the FBI. There is much debate as to whether a search warrant should be required before employing the stingray. Readers of this publication know that, “a person has no legitimate expectation of privacy in information he voluntarily turns over to third parties.”[2] Furthermore, a person “takes the risk, in revealing his affairs to another, that the information will be conveyed by that person to the Government.”[3]
Some courts have taken up this question and their opinions are discussed below. (For further discussion on Virginia’s statute see Eric Snow’s article in Virginia Police Legal Bulletin).[4]
Maryland's intermediate Court of Appeals considered the issue in State v. Andrews.[5] The Court of Special Appeals of Maryland held that the use of a cell site simulator to track a cell phone constituted a Fourth Amendment search. Police were searching for the defendant who was wanted for attempted murder in connection with the shooting of three individuals who were attempting to purchase drugs. Police identified Andrews, and obtained his cellphone number through a confidential informant. They secured a pen register/trap and trace order and obtained information and general location from the cell phone provider. Police then used an IMSI catcher trade-named Hailstorm to locate the specific apartment Andrews was in and arrested him. They then obtained a search warrant for the location and recovered the gun used in the shooting.
The Court cited Kyllo v. United States[6] for the principle that using technology to obtain information otherwise not discernible is an unlawful search, and cited United States v. Jones[7] for the principle that use of electronic signals to surveil is subject to the Katz test of reasonable expectations of privacy. In Kyllo, police had used a thermal imaging device to measure the amount of heat emanating from Kyllo’s townhouse. In Jones, police had installed a GPS tracking device to Jones’ car and monitored its movements for 28 days.
The Court held that a person has a reasonable expectation of privacy in the cellphone location. The State’s case was prejudiced somewhat by the Court’s disfavor of a nondisclosure agreement between local police and the FBI, who owned the Hailstorm.[8]
The nondisclosure agreement’s purpose was to maintain the secrecy of the technology to protect it for future use. As a condition of Hailstorm’s use, the police and prosecutor pledged to not disclose to defense counsel the process by which Hailstorm functioned. If the Court ordered disclosure, the prosecution was to seek dismissal of its case.[9]
The District of Columbia’s Appellate Court has also reviewed the issue in Jones v. United States.[10] Two women reported being sexually assaulted by a man they met through a website and later contacted by telephone. After assaulting the victims, the suspect stole their cell phones. Police reviewed the victims’ cell phone records, looking for a common number, to identify the suspect cell phone number. The suspect used a prepaid phone, so no identifying subscriber information was available. From AT&T police were able to obtain a general location of the phones. After narrowing that down, police used the stingray to locate the individual suspect.
Police testified they could not recall if they were tracking the suspect’s phone number or the victim’s. The trial court denied the motion to suppress, relying on the inevitable discovery doctrine. It noted that even if it was the suspect’s phone that was tracked, police could have always used the device for the same purpose to locate the victim’s phone.
At some point this issue may be settled by the U.S. Supreme Court. However, several states and the federal government have adopted policies regarding warrants for IMSI tracking devices.
Of further interest is a case currently pending in the United States Supreme Court asking the question of whether a warrant is required to collect historical cell phone location data from a cell phone provider. That case is Timothy Carpenter v. United States.[11]
In closing, it may be worth considering Judge Alito’s observation in a concurring opinion in United States v. Jones.[12] “[P]hone-location-tracking services are offered as ‘social’ tools, allowing consumers to find (or to avoid) others who enroll in these services. The availability and use of these and other new devices will continue to shape the average person's expectations about the privacy of his or her daily movements.”[13]
[1] International Mobile Subscriber Identity.
[2] Smith v. Maryland, 442 U.S. 735, 743–44 (1979).
[3] Miller v. United States, 425 U.S. 435, 443 (1976).
[4] ,(http://www.radford.edu/content/va-chiefs/home/january-2015/court-orders.html).
[5] 227 Md. App. 350, (Mar. 30, 2017).
[6] 533 U.S. 27 (2001).
[7] 565 U.S. 400 (2012).
[8]”We perceive the State's actions in this case to protect the Hailstorm technology, driven by a nondisclosure agreement to which it bound itself, as detrimental to its position and inimical to the constitutional principles we revere.” State v. Andrews, 227 Md. App. 350, 377.
[9] State v. Andrews, 227 Md. App. 350, 374-377.
[10] 168 A.3d 703, (2017).
[11] (Docket No. 16-402).
[12] Supra, note 7.
[13]United States v. Jones, 565 U.S. 400, 429 (2012).