I have been following the developments about the use of cell site simulators by law enforcement agencies in the United States over the past year. This invasive cell phone tracking technology, often called StingRay, lurks in the shadows in Canada where the RCMP and the Vancouver Police Department have refused to confirm or deny whether they have used it. The most significant developments have been in Maryland as a result of the expansive use of the technology by the Baltimore Police Department that generated the leading appellate court ruling. Here’s the update.

In my last post titled Hailstorm In Maryland Appeals Court dated December 30, 2015, I discussed State v Andrews, Maryland Court of Special Appeals No. 1496 (2015) where the Baltimore police used a Hailstorm – a cell site simulator from the Harris Corporation, the same company that manufactures StingRays – to locate the defendant who was charged with attempted murder. The police not only used the Hailstorm without a warrant, they failed to disclose it to the court in an application for a pen register order or to the State’s attorney. Judge Kendra Ausby, the motions judge in the Circuit Court for Baltimore County, concluded that the police intentionally withheld information from the defendant that constituted a violation of his disclosure rights. The government appealed.

A cell site simulator is an International Mobile Subscriber Identity catcher (IMIC catcher) that tricks cell phones to respond with their ID numbers by mimicking a cell site tower. They were initially developed for the military and intelligence community. They can pinpoint the location of a target phone to within feet and penetrate homes, offices and any other location. The collateral impact is sweeping. They intercept data from all devices within range which means that innocent bystanders are trapped in the dragnet as well as legitimate surveillance targets. Let’s look at the evidence in Andrews in more detail.

The police couldn’t find Andrews. But they knew his cell phone number so they obtained a court order to get real time GPS data from his cell phone provider. The GPS information located the phone to within 200 to 1,600 metres. It gave the police the neighbourhood but not the house.

On the day of the search, the cell phone provider messaged the police that Andrews’ phone was in the area of 5000 Clifton Avenue. The police went to the neighbourhood where there were multiple apartment buildings. They used a Hailstorm that pinpointed a phone inside a house at 5032 Clifton Avenue. The police knocked on the door, a woman answered and allowed them to enter, and Andrews was found sitting on a sofa with his phone in his pocket. He was arrested and the house secured while the police obtained a search warrant. They found a gun hidden in the sofa. The nature of the electronic search was described this way in the testimony of a detective on the motion to suppress:

DETECTIVE HALEY: Like I said, our equipment acts like a cell tower. So, it draws the phone to our equipment.

DEFENCE COUNSEL: …[If] the person’s on the phone, your equipment won’t work, right?

DETECTIVE HALEY: Correct.

DEFENCE COUNSEL: When I am not on my phone, you will drive by my house, and you will get a signal from my phone indicating where I am, right?

DETECTIVE HALEY: Correct.

DEFENCE COUNSEL: So, the phone cannot be in use. You are searching for my phone as you’re driving through my neighbourhood, right?

DETECTIVE HALEY: Yes.

DEFENCE COUNSEL: And in order to get to my phone, you are sending an electronic signal into my house, right?

DETECTIVE HALEY: Yes. [Emphasis added]

On March 30, 2016, the Maryland Court of Special Appeals released its landmark reasons unanimously dismissing the government’s appeal. Judge Andrea M. Leahy, writing for the court at p. 2, held that (1) people have a reasonable expectation of privacy that their cell phones will not be used as real time tracking devices by law enforcement and (2) that use of a cell site simulator requires a search warrant showing probable cause and reasonable limitations on the scope and manner of the search under the Fourth Amendment. In the result, Judge Leahy went on to state, at pp. 2-3:

“Once the constitutionally tainted information, obtained through the use of Hailstorm, was excised from the subsequently issued search warrant for 5032 Clifton Avenue, what remained was insufficient to establish probable cause for a search of that residence. Because the antecedent Fourth Amendment violation by police provided the only information relied upon to establish probable cause in their warrant application, those same officers cannot find shelter in the good faith exception, and the evidence seized in that search withers as fruit of the poisoned tree.”

An important aspect of the history of the use of simulators is the nondisclosure agreement that, in this case, was entered into between the State’s Attorney for Baltimore City and the FBI in August 2011. The nondisclosure agreement provided that (a) use of the technology shall be protected from disclosure in press releases, court documents and judicial hearings and (b) that the police and State’s attorney shall not disclose any information associated with the software or operating manuals beyond the evidentiary results obtained through the use of the equipment. The nondisclosure agreement provoked this rebuke from Judge Leahy, at p. 24:

“A nondisclosure agreement that prevents law enforcement from providing details sufficient to assure the court that a novel method of conducting a search is a reasonable intrusion made in a proper manner and ‘justified by the circumstances,’ obstructs the court’s ability to make the necessary constitutional appraisal. Cf. King, 133 S. Ct. at 1970 (‘Even if a warrant is not required, a search is not beyond Fourth Amendment scrutiny; for it must be reasonable in its scope and manner of execution. Urgent government interests are not a license for indiscriminate police behaviour.’).”

Judge Leahy then went on to reject the government’s arguments based on beeper technology and the third party doctrine:

• Surreptitious conversion of a cell phone into a tracking device and the electronic interception of location data from that cell phone is markedly distinct from the combined use of visual surveillance and a beeper to signal the presence of an automobile to the police receiver to track a vehicle over public roads. The information obtained by the police in this case was not readily available and in the public view. (at p. 40)

• The pin-point location information that led to finding the defendant was obtained directly by law enforcement officers and not through a third party. The defendant’s cell phone did not transmit information to the service provider that was then recorded and shared with the police. The defendant did not assume the risk that the information obtained through the use of the Hailstorm device would be shared by the service provider. The function of the Hailstorm foreclosed that possibility. There was thus no third party element to the use of the Hailstorm and the third party doctrine did not apply. (at p. 48)

There is little information in Canada about law enforcement’s use of cell site simulators. The issue, however, has not escaped the attention of Canadian privacy hawks. The Pivot Legal Society, a British Columbia advocacy group, has filed an appeal with the province’s Privacy Commissioner after the Vancouver Police Department refused to disclose whether it has used the technology. On March 23, 2016, Open Media Engagement Network (OpenMedia) filed an Intervenor Submission by Tamir Israel, a staff lawyer with the Canadian Internet Policy & Public Interest Clinic and Christopher Parsons, a post-doctoral fellow at the Munk School of Global Affairs, University of Toronto.

The Submission of OpenMedia, BC OIPC File No: F15-63155, argues that the use of cell site simulators raises policy concerns that can only be addressed if information about them is made public as a “necessary precursor” to transparency and informed debate, at pp. 24-5:

“…[T]he experience from abroad and particularly from the United States demonstrates that there are good reasons to restrain the use of IMSI Catchers proactively, and Canadian experience to date affirms this. For example, Corrections Services Canada appears to have installed IMSI Catchers in a prison without any safeguards and potentially in violation of criminal laws. Federal agencies appear to be using these devices in violation of federal spectrum regulations. It is likely that if judges knew of the invasive potential of these devices, they would adopt safeguards. Finally, while privacy impact assessments are often required for new privacy-invasive programs, and while IMSI Catcher use likely has implications under federal and provincial data protection laws, it appears that no such privacy impact assessments have been undertaken. Placing information relating to these invasive tools on the public record in Canada is therefore a necessary precursor to ensuring transparency in IMSI Catcher use, where there is tangible concern such use may not be consistent with the law. Moreover, confirmation of IMSI Catcher use is integral to meaningful debate on a matter of public interest in Canada while being equally essential to the proper exercise of Canadian privacy rights.”

I agree. Disclosure of the use of cell site simulators in Canada is a precondition to meaningful debate – in public, in the courts and among law makers – in order to ensure that the use of invasive technology is in compliance with s. 8 of the Charter of Rights that protects all Canadians from unreasonable search and seizure. (See also: Orin Kerr. Applying the Fourth Amendment to cell-site simulators. The Washington Post. April 4, 2016; Shane Dingman. Tracking our phones: How StingRay devices are being used by the police. The Globe and Mail. March 21, 2016; and, Colin Freeze and Matthew Braga. Surveillance device used in prison sets off police probe. The Globe and Mail. March 14, 2016)