When a cellphone was stolen from a car in Baltimore in 2009, city police broke out their newest toy. Using a device that tricks cellphones into thinking it is a cell tower, they were able to scoop up data from every phone in range, and eventually cornered the suspect.
In Tallahassee, Florida, local police used similar technology to track a woman wanted for forging checks, USA Today reported last year as part of an investigation with the American Civil Liberties Union. In Tacoma, Washington, another cell tower simulator was used to track a man suspected of stealing a laptop.
The cops arrested a suspect in each of those cases, but not before scooping up untold amounts of data from the cellphones of innocent people who just happened to be in the vicinity. As more information emerges about how federal and local law enforcement agencies regularly have used so-called "stingrays" to secretly sift through cellphone signals by intercepting communications between the phone and a service providers' network—usually without a warrant and without targeting a specific suspect—there are more questions being raised about when and how those devices should be deployed.
U.S. Rep Jason Chaffetz (R-Utah), on Wednesday morning announced plans to introduce two bills into Congress to limit federal law enforcement's use of cell tower simulators.
One bill would prohibited federal law enforcement agencies from using stingray technology unless they are investigating a specific person and can show probable cause. It would put an end to sweeping uses of cell tower simulators, as was done in Baltimore during the Freddie Gray protests in 2015, to collect information on all cellphones in a given area.
"To me, tracking everybody, especially suspicion-less Americans, that's a step too far," he said during a discussion of stingray technology at the Cato Institute, a libertarian think tank in Washington, D.C. "Fundamentally, where I come from, I don't trust the federal government. That's my starting premise."
According to a House Oversight Committee report, published in December, the Department of Justice has 310 cell-site simulation devices and spent more than $71 million in fiscal years 2010-14 on cell-site simulation technology, while the Department of Homeland Security has 124 cell-site simulation devices and spent more than $24 million in fiscal years 2010-14 on cell-site simulation technology. The same investigation found that the Department of Homeland Security spent more than $1.8 million on grants that allow local police departments to buy and use Stingrays.
A Baltimore detective revealed last year that the Baltimore Police Department deployed cell tower simulators more than 4,300 times between 2007 and 2015—for investigating everything from kidnappings and murders to minor thefts.
Chaffetz, who chairs the House Oversight Committee, said his second proposal would make it illegal for Stingrays to be used outside of law enforcement. Chaffetz said he views the devices as a violation of a contract signed between individuals and cellphone service providers.
"If someone else is getting in between you and that service provider, well that's not what you're paying for," he said.
Chaffetz introduced similar bills in 2015, but they did not pass.
Neema Singh Guliani, legislative counsel for the ACLU, called Chaffetz bills "a good first step" but said more action was needed from state governments and the courts to place limitations on how Stingrays are deployed and how the data collected by the devices can be used in criminal trials.
Many state lawmakers don't even know that state and local police are using the technology, she said, because the grants from DHS took place outside the normal appropriations and procurement processes. Those grants also came with nondisclosure agreements that in many cases prevent local police from disclosing their possession and use of stingrays to lawmakers, defense attorneys, and even judges.
California, Washington, Virginia, Utah, and Illinois have passed laws requiring law enforcement agencies to obtain a warrant or order based on probable cause before deploying cell-site simulators, with varying exceptions, according to the House Oversight Committee report.
State legislatures should demand information from police departments about how Stingrays are being used, and should pass laws requiring police departments to get permission from their state governments before deploying any new surveillance technology passed down from the feds, Guliani argued.