On December 29, 2015, the American Civil Liberties Union filed an amici curiae brief with the ACLU of Maryland and the Electronic Frontier Foundation in the first known case where a motions judge suppressed evidence as a result of the warrantless use of a cell site simulator by the police.

In State v Andrews, Maryland Court of Special Appeals No. 1496 (2015), Baltimore police used a Hailstorm – a cell site simulator from the Harris Corporation, the same company that manufactures Stingrays – to locate the defendant who was charged with attempted murder. The police not only used the Hailstorm without a warrant, they failed to disclose it to the court in an application for a pen register order or to the State’s attorney. Judge Kendra Ausby, the motions judge in the Circuit Court for Baltimore County, concluded that the police intentionally withheld information from the defendant that constituted a violation of his disclosure rights. The government has appealed.

The case raises Fourth Amendment and disclosure issues that are also of interest to Canadian lawyers. The amici curiae brief submits, at p. 8, that use of cell site simulator technology must “at least be constrained by a probable cause warrant that mandates minimization of innocent parties’ data” citing Berger v New York, 388 US 41, 57-9 (1967) where similar protections were required for wiretapping. It further asserts, at p. 12, that the government failed in its duty of candour by not disclosing the intended use of the technology to the court relying on United States v Comprehensive Drug Testing, Inc., 621 F.3d 1162, 1176 (9th Cir. 2010). The same questions would arise in Canadian law under s. 8 of the Charter of Rights, the duty of full and frank disclosure to the issuing judge, and the defendant’s constitutional right to subsequent pretrial disclosure. (See: Hunter v Southam, [1984] 2 SCR 145; R v Araujo, [2000] 2 SCR 992; and, R v Stinchcombe, [1991] 3 SCR 326.)

The amici curiae brief contains a good summary of how the technology works. I thought it would be helpful to the uninitiated if I simply reproduced the following extracts, at pp. 2-5:

• Wireless carriers provide coverage through a network of base stations, also known as “cell sites,” that connect cell phones to the telephone network. Like other cell site simulator models, a Hailstorm masquerades as a wireless carrier’s base station, prompting all wireless devices within range that use the impersonated wireless carrier to communicate with it. Depending on the particular features of the device and how the operator configures them, cell site simulators can be used to identify nearby phones, to precisely locate them, and can even block service to devices in the area. Cell site simulators are commonly used by law enforcement agencies in two ways: to collect the unique electronic serial numbers associated with all phones in a given area, or to locate a particular phone “when the officers know the number associated with it but don’t know precisely where it is.” Some versions of the technology can also obtain metadata about a suspect’s calls and text messages or even the contents of those communications, although there is no evidence that Baltimore Police have employed such capabilities.

• Cell site simulators locate phones by forcing them to repeatedly transmit their unique identifying electronic serial numbers, and then calculating the signal strength and direction of those transmissions until the target phone is pinpointed. This dynamic is essential to understanding the Fourth Amendment status of cell site simulator technology, yet is elided by the government when it argues, incorrectly, that it is an “unproven assumption that it was the cell site simulator which was sending signals to the cell phone, but…in fact, it was the phone which sent signals to the Hailstrom device.” To the contrary, as explained by the U.S. Department of Justice and numerous other sources, “[c]ell-site simulators…function by transmitting as a cell tower. In response to the signals emitted by the simulator, cellular devices in the proximity of the device…transmit signals to the simulator.”…[T]he Hailstorm device used in this case did not passively intercept the signals transmitted between Defendant’s phone and Sprint’s network, but rather forced Defendant’s phone to transmit information to the government that it would not otherwise have transmitted to the government.

Because the Hailstorm draws a cell phone to it, the door opens for the argument that the third-party rule in Smith v Maryland, 442 US 735 (1979) and Upshur v State, 208 Md App 383 (2012) is inapposite. The amici curiae brief argues, at p. 4, that: “Those cases involved law enforcement obtaining information from third-party phone companies that was already in the companies’ possession. Unlike the dialed phone numbers transiting the phone company’s network in Smith and the subscriber information held in the phone company’s files in Upshur, the location information in this case was obtained by a Baltimore Police Department (BPD) officer directly from Defendnat’s phone. When the police seek information by directly interacting with a suspect’s phone, no third party is involved, and the Fourth Amendment warrant requirement applies.”

I have written previously on this blog about the significance of the third-party rule in Fourth Amendment doctrine – a rule that is marginalized in Canada under Charter s. 8 jurisprudence. In R v Dyment, [1988] 2 SCR 417 Justice Gerald La Forest said at pp. 429-30 that, even though information (data) is communicated, and can no longer be thought of as secret, “…situations abound where the reasonable expectations of the individual that the information shall remain confidential to the persons to whom, and restricted to the purposes for which it is divulged, must be protected.” The question whether the Hailstorm draws cell phones to it is thus less significant in the Canadian context. (See also: R v Spencer, [2014] 2 SCR 212, at para. 40.)

Back, then, to the Fourth Amendment: Does use of a cell site simulator constitute a search? The amici curiae brief persuasively answers – Yes. Here are the key extracts from the argument, at pp. 5-9:

• First, the devices transmit invisible, probing electronic signals that penetrate walls of Fourth Amendment-protected locations, including homes, offices, and other private spaces occupied by the target and innocent third parties in the area…By pinpointing suspects and third parties while they are inside constitutionally protected spaces, cell site simulators invade reasonable expectations of privacy.

• Second, the devices can pinpoint an individual with extraordinary precision, in some cases “with an accuracy of 2 m[eters].” Just as in this case, in cases across the country law enforcement agents have used cell site simulators to pinpoint suspects’ locations not only in free-standing houses, but even in specific apartments or areas within large apartment complexes…In one Baltimore case, police reportedly used a cell site simulator to determine even that the person carrying the target phone was riding on a particular bus.

• Third, cell site simulators search the contents of people’s phones by forcing those phones to transmit their electronic serial number and other identifying information held in electronic storage on the device, as well as the identity of the (legitimate) cell tower to which the phone was most recently connected and other stored data…As the Supreme Court held last year, searching the contents of a cell phone requires a warrant. Riley, 134 S. Ct. 2473.

• Fourth, cell site simulators impact third parties on a significant scale. In particular, they interact with and capture information from innocent bystanders’ phones by impersonating one or more wireless companies’ cell sites and thereby triggering an automatic response from all mobile devices on the same network in the vicinity…[U]se of this technology must at least be constrained by a probable cause warrant that mandates minimization of innocent parties’ data.

• Finally, cell site simulators can, as a side-effect of their normal use, disrupt the ability of phones in the area to make calls. The Harris Corporation…has apparently taken steps to ensure that 911 calls are not disrupted. However, emergency calls to doctors, psychologists, and family members may be blocked while the Hailstorm is in use nearby. This is invasive in general, raises possible conflicts with federal law…and can have enormous consequences for anyone in an emergency situation trying to make an urgent call for assistance. To avoid effecting an unreasonably invasive or destructive search…use of cell site simulators must be strictly and explicitly authorized by a court.

The indiscriminate dragnet capability and the capacity to capture the content of communications were highlighted as “especially pernicious” by Jennifer Lynch, Staff Attorney for the Electronic Frontier Foundation, in a post titled EFF Joins ACLU in Amicus Brief Supporting Warrant Requirement for Cell-Site Simulators dated December 29, 2015. Ms. Lynch went on to conclude: “This is why it is imperative that police not only obtain a warrant based on probable cause before using a cell-site simulator but also commit to minimization procedures, including immediately deleting information about all phones not covered by the warrant and limiting the time period during which the device is used. These are not novel or onerous requirements – the Wiretap Act requires similar procedures. And in fact, both the Department of Justice and the Department of Homeland Security recently committed to following similar procedures whenever their agents use stingrays.” Time limitations and minimization requirements are also common features of wiretap authorizations in Canada under Part VI of the Criminal Code.

And, in a post titled Maryland Court Considering Key Question on Legality of Stingray Use dated December 29, 2015, ACLU Staff Attorney, Nathan Freed Wessler, commented on the importance of Judge Ausby’s suppression ruling as the latest example of the judiciary pushing back against law enforcement’s disregard for constitutional limits on their surveillance activities and their duty of candour to the courts. “Although federal judges in Illinois and Texas have recently issued opinions discussing the dangers of Stingrays,” Mr. Wessler said, “we know of no judge who has actually thrown out evidence obtained through secret, warrantless Stingray use. Until now, that is.”