Stingray: Privacy, Surveillance, the War on Drugs, and Your Phone
Raymond Lambis is a free man—at least for now.
He was looking at 10 years to life on federal drug charges, but the case was built on a controversial technology—"Stingray"—and in a precedent-setting 2016 decision widely celebrated by legal experts and privacy advocates, a federal judge ruled that use of the device without a search warrant violated the Fourth Amendment's proscription against unreasonable search and seizure.
The decision—and the technology—has implications that go far beyond the shadowy world of drug dealers and DEA agents. Stingray is a generic term for a cell-site simulator, a device that can mimic cell towers as a means of tracking down cell phones. Law enforcement can use Stingray to pick up phone calls, voicemail messages, and text messages, and to pinpoint the physical location of a targeted phone to within a few feet.
In the Lambis case, federal prosecutors argued that they didn't need a warrant to use the wide-ranging Stingray, but federal district court Judge William H. Pauley shot them down.
"Absent a search warrant," Judge Pauley held in his 14-page opinion, "the government may not turn a citizen's cell phone into a tracking device."
But that's exactly what DEA agents did to build their case against Lambis. They used Stingray to locate his cell phone inside his family residence, then conducted a warrantless search of his bedroom and uncovered a large amount of cocaine.
Federal prosecutors had a fallback argument—that even if a warrant were necessary to track Lambis' phone, once his father gave agents at his door permission to enter and Lambis then "consented" to a search, the search should be allowed—but Pauley wasn't having that, either.
"The procurement of a 'voluntary' consent to search based upon a prior illegal search taints that consent," he held.
But if federal prosecutors have their way, the DEA and other federal agents will be able to do it again. In September, prosecutors from the US Attorneys Office for the Southern District of New York filed an appeal of Pauley's decision with the US 2nd Circuit Court of Appeals.
"We're obviously disappointed about that," Lambis' attorney Alan Seidler told the Chronicle.
So is the Electronic Frontier Foundation. Rebecca Jeschke, a digital rights analyst for the group, told the Chronicle that if the government wins on appeal, everyone's privacy will be eroded.
"As we use cell phones more and more, a successful appeal will touch nearly every American," she said.
A successful appeal would be salt in the wounds of legal scholars and privacy advocates who hailed Pauley's forceful decision in Lambis as a major victory against warrantless surveillance by the government.
"This is the first federal ruling I know of where a judge squarely ruled that the Fourth Amendment required police to get a warrant to use a Stingray, and further, suppressed evidence derived from warrantless use of the technology," ACLU Attorney Nathan
Wessler told the New York Times at the time. "After decades of secret and warrantless use of Stingray technology by law enforcement to track phones, a federal judge has finally held authorities to account."
According to an ACLU report, at least 60 state and federal law enforcement agencies in 23 states have used Stingray to suck up citizens' cell phone data:
Stingray in the Lambis Case
According to court documents, the trail to Raymond Lambis' front door began with a DEA investigation into an alleged drug pipeline importing large amounts of cocaine from South America beginning in early 2015. DEA agents obtained a wiretap warrant to glean information about the numbers dialed from a specific cell phone.
After agents obtained the warrant, they monitored messages off a Blackberry between two suspected drug traffickers. During one particular conversation agents overheard a voice referring to someone named "Patilla," whose phone had a 646 area code.
Messages between Patilla and the other, unnamed party indicated that Patilla could supply hydrochloric acid, which is used by traffickers in the heroin-refining process. DEA agents then got a warrant to order the phone company to provide "approximate location," or "cell-site location information" (CSLI).
A frequent plaint of defense attorneys and privacy advocates has been that law enforcement, and DEA agents in particular, will mislead judges into thinking the warrant they sign off on is to get specific cell-site information from a carrier when what agents are really doing is using Stingray to locate a person's phone or actual address. As the Chronicle reported in 2013, "The Stingray technology not only raises Fourth Amendment concerns, it also raise questions about whether police withhold information from judges to monitorcitizens without probable cause. That's what happened in Lambis.
In the Lambis case, DEA Special Agent Kathryn Glover obtained a warrant seeking cell-site data and location information for that 646 phone, but did not tell the judge DEA would be using Stingray to conduct a search to pin down Lambis' exact location.
"So they went to the effort to get a warrant, but then didn't tell the judge they intended to use that same warrant to use a Stingray," ACLU technology specialist Christopher Soghoian told Ars Technica. "It is so important for federal courts to recognize that use of a Stingray is a search of a Fourth Amendment-protected place, and not only is a warrant required, but the court authorizing the surveillance must be told they are authorizing the use of a Stingray."
But the phone carrier's CSLI data, which Agent Glover said in her warrant application would be used to track down the 646 phone, only guided DEA agents to the "general area" of Broadway and 177th Street in Manhattan. To pinpoint the 'house or building where the phone most likely resided with its owner the DEA unleashed Stingray to first zero in on the exact building and then on the exact apartment.
A DEA technician using a hand-held Stingray walked through the building until he picked up the strongest signal—coming from inside the Lambis apartment. Then, DEA agents knocked on the door, and Lambis' father allowed the gun-toting agents inside. When agents asked if anyone else lived there, the elderly man knocked on his son's door, and Lambis opened it up only to be confronted by the DEA.
Faced by the agents in his home, he then consented to a search of his bedroom, where agents discovered a kilo of cocaine, empty ziplock bags, a scale, and eight cell phones. He was charged with possession of cocaine with intent to distribute and other drug-related charges. It was Lambis' defense motion to throw out that evidence as a result of an unlawful search that led to Pauley's ruling.
The States Aren't Waiting for the Federal Courts
The courts aren't the only place Stingray is running into headwinds. Thanks to decisions like that in the Lambis case, some states have begun passing privacy legislation aiming at protecting citizens' cell phone data from warrantless searches by Stingray or similar cell-site simulators used by police. Among them are California, Illinois, Minnesota, Rhode Island, Virginia, and Washington.
"Citizens have the right to expect that they will not have their personal information investigated by police without a warrant," said Rep. Edith H Ajello (D-Providence) after passage of a 2016 Rhode Island bill that prohibits obtaining cell phone data by cell-site technology.
"Requiring a warrant won't make it difficult for police to do their job," concurred Sen. Donna Nesselbush (D-North Providence). "It's essentially updating search warrant law for the information age."
"As advances in technology enable police to more efficiently investigate and solve crimes, it's important that we help them to know they are following state laws and the Constitution," said Illinois Sen. Daniel Bliss (D-Evanston) upon passage of similar legislation there in 2016. That law, the Citizen Privacy Protection Act, went into effect January 1.
While the states aren't waiting for the federal courts to provide protections, the Lambis decision and related controversies over Stingray technology have created such a firestorm that the Justice Department and the Department of Homeland Security are now requiring agents to obtain a warrant before using Stingray in investigations. But that could change if the appeals court rules in the government's favor. Stay tuned.
