Applying the Fourth Amendment to cell-site simulators

(Tomohiro Ohsumi/Getty Images)

The widespread use of cellphones gives the government a way to locate criminal suspects using a device known as a cell-site simulator. The Maryland Court of Special Appeals recently handed down the first appellate decision on whether and when use of a cell-site simulator to identify the location of a target's phone is a Fourth Amendment "search." The opinion, in State v. Andrews, rules that government use of a cell-site simulator is always a Fourth Amendment search and that it ordinarily requires a warrant.

I think that result is plausible, but I found the court's path to that result rather frustrating. This post explains why.

I. Introduction to Cell-Site Simulators

First, some background. Cellphones work by communicating with local network base stations known as "cell sites." A cell site will periodically send out a broadcast to nearby phones to know which phones are in the area in case a communication needs to be routed to or from a particular phone. When a local cell site sends out a signal telling phones that the site is nearby, local phones in the area will automatically send back a response giving the cell tower their identifying information.

Cell-site simulators, sometimes known as IMSI catchers or Stingrays, work by simulating local cell sites. The simulators send out broadcasts to phones in the neighborhood just as a real cell site would. Local phones interpret the query as coming from a real site, so they respond with their ID numbers. The person using the simulator who is looking for a particular phone in the area can then move the simulator around and see if the signal back from the target phone becomes stronger or weaker. If the simulator is used in the neighborhood of the target phone and the phone is on, the simulator allows its user to pinpoint the location of that phone to a distance of a matter of feet.

II. Five Possible Fourth Amendment Rules

The question is, does using a cell-site simulator constitute a Fourth Amendment search? And if so, when? I can see five possible ways that existing Fourth Amendment doctrine might plausibly apply to government use of cell-site simulators. Here are the five ways, listed below from the least protective rule to most protective rule, with a short explanation of the legal argument for each rule:

Rule A: Use of a cell-site simulator is never a search. Under Supreme Court cases like Hoffa v. United States, the Fourth Amendment doesn't apply when you voluntarily disclose information to an undercover government agent. Perhaps use of a simulator is not a search because the registration information is voluntarily revealed by the phone to the simulator. The cell-site simulator knows where the phone is located only because the phone is programmed to respond to queries from local towers. The tower asks, "Is anyone here?," and the phone always responds, "Yes, I'm over here." If we can impute the phone's response to the phone's user, then perhaps the user has voluntarily responded to the simulator's signal and there is no Fourth Amendment protection in the response.

Rule B: Use of a cell-site simulator is a search only when it reveals that a phone is inside a home. In the 1980s, the Supreme Court decided two cases on when tracking a suspect using a radio beeper secretly installed in his property amounts to a Fourth Amendment search. In those cases, United States v. Knotts and United States v. Karo, the court held that tracking a suspect's location in public is not a search while it becomes a search when the tracking device enters a home. The basic idea is that people don't have privacy rights in their presence in public but they do have privacy rights in what goes on in their homes. Under the Supreme Court's decisions in Knotts and Karo, use of a secret tracking device is a search only when it reveals that the device is inside a home. If we treat a cell-site simulator like a radio beeper tracking device, then perhaps the same rule applies to cell-site simulators.

Rule C: Use of a cell-site simulator is a search only when used in the aggregate over time. The concurring opinions in United States v. Jones suggested that short-term location surveillance is not a search but that long-term surveillance eventually becomes a search. Long-term surveillance is different, the thinking goes, because it can reveal sensitive information about a suspect's life. Long-term surveillance becomes sufficiently revealing that it violates a person's reasonable expectation of privacy. Perhaps the same approach applies to use of a cell-site simulator. If so, perhaps tracking a phone using a simulator is not a search if done for a short period of time but is a search if the tracking continues for a long period.

Rule D: Use of a cell-site simulator is always a search when it reveals that someone is inside a home, but is a search when it reveals someone's location in public only in the aggregate over time. This approach is a combination of Rules B and C. Perhaps public surveillance is governed by the Jones concurrences and surveillance that reveals a private location is governed by Karo.

Rule E: Use of a cell-site simulator is always a search. Finally, perhaps use of a cell-site simulator is always a search. There are different doctrinal ways to get there, but here's one possibility. United States v. Karo extended Fourth Amendment protection to location tracking in Fourth Amendment protected spaces, and cellphones are usually in protected spaces. Even a cellphone that is just in a suspect's pocket or purse is in a protected space; the government has to conduct a "search" to pat down a suspect or open a pocket or purse to retrieve the phone. So unless the government has specific reason to think the phone is in the open—such as when a person is walking down the street with the phone in his hands—use of a simulator is a search.

III. The Facts of State v. Andrews

That brings us to the new case, State v. Andrews. Kerron Andrews was charged with attempted first degree murder for shooting three people. The police wanted to arrest Andrews but they couldn't locate him. The police used several different cell phone tracking technologies to find him. Because the police knew his cell phone number, they obtained a court order to get real-time GPS information about the location of Andrews's phone from his cellphone provider. The GPS information gave the location of the phone within 200 to 1,600 meters. It could tell the police the neighborhood of the phone but it couldn't identify the phone's exact location.

On a particular day, the cell provider messaged the police that Andrews's cellphone was in the area of 5000 Clifton Ave. in Baltimore City. The police went to that area, where there were a few dozen apartments. They then used a simulator known by the brand "Hailstorm" to pinpoint the location of the phone. The simulator indicated that the phone was inside a house in 5032 Clifton Ave. The officers knocked on the door. A woman answered and allowed the officers inside. Inside the house, Andrews was sitting on a couch with his phone in his pants pocket. The officers placed Andrews under arrest. They then secured the home and obtained a warrant to search the home; the search revealed a gun in the couch cushions.

IV. The Legal Decision

The major question in the case was whether the officers had conducted a Fourth Amendment search when they used the Hailstorm cell-site simulator to pinpoint the location of the phone to 5032 Clifton Ave. According to the court, the answer was "yes."

The precise reasoning of the opinion is a little murky. The opinion runs through a lot of Supreme Court cases without clearly rooting its conclusion in a single case or concept. But here is the statement of the holding:

We determine that cell phone users have an objectively reasonable expectation that their cell phones will not be used as real-time tracking devices through the direct and active interference of law enforcement. We hold, therefore, that the use of a cell site simulator, such as Hailstorm, by the government, requires a search warrant based on probable cause and describing with particularity the object and manner of the search, unless an established exception to the warrant requirement applies.

I think the court is adopting Rule E above—that is, use of a cell-site simulator is always a search even if it only reveals that the phone is out in public.

How does the court get there? Here's the main part of the reasoning:

[T]he State argues that because Andrews's cell phone was "constantly emitting 'pings' giving its location to the nearest cell tower, . . . there can be no reasonable expectation of privacy in [that] information" under Knotts.

The State's reliance on Knotts, however, is misplaced. In Karo, the Supreme Court clarified that in Knotts the electronic device "told the authorities nothing about the interior of Knotts' cabin." 468 U.S. at 715. Rather, the information obtained in Knotts was "voluntarily conveyed to anyone who wanted to look[,]" id. (quoting Knotts, 460 U.S. at 281), and the subsequent search warrant was also supported by "intermittent visual surveillance" of the cabin, Knotts, 460 U.S. at 279. As noted in Kyllo, the Supreme Court has long recognized that "[v]isual surveillance [i]s unquestionably lawful because 'the eye cannot by the laws of England be guilty of a trespass.'" 533 U.S. at 31-32 (quoting Boyd v. United States, 116 U.S. 616, 628 (1886)).

Here, there was no visual surveillance. The mere fact that police could have located Andrews within the residence by following him as he travelled over public thoroughfares does not change the fact that the police did not know where he was, so they could not follow him. Unlike Knotts, the information obtained in this case did reveal at least one critical detail about the residence; i.e., that its contents included Andrews's cell phone, and therefore, most likely Andrews himself. Further, "pings" from Andrews's cell phone to the nearest tower were not available "to anyone who wanted to look." We find the surreptitious conversion of a cell phone into a tracking device and the electronic interception of location data from that cell phone markedly distinct from the combined use of visual surveillance and a "beeper to signal the presence of [the defendant's] automobile to the police receiver" to track a vehicle over public roads. See Knotts, 460 U.S. at 282. Put simply, the information obtained by police in this case was not readily available and in the public view as it was in Knotts.

Cell site simulators, such as Hailstorm, can locate and track the movements of a cell phone and its user across both public and private spaces. Unchecked, the use of this technology would allow the government to discover the private and personal habits of any user. As Justice Sotomayor predicted in her concurring opinion in Jones, supra, we are compelled to ask "whether people reasonably expect that their movements will be recorded and aggregated in a manner that enables the Government to ascertain, more or less at will, their political and religious beliefs, sexual habits, and so on." 132 S. Ct. at 956 (Sotomayor, J., concurring). We conclude that they do not.

We agree with the United States Court of Appeals for the Fourth Circuit in United States v. Graham, in declaring, "[w]e cannot accept the proposition that cell phone users volunteer to convey their location information simply by choosing to activate and use their cell phones and to carry the devices on their person." 796 F.3d 332, 355 (4th Cir.), reh'g en banc granted, 624 F. App'x 75 (4th Cir. 2015). . . . We also accept the circuit court's finding in this case that "no one expects that their phone information is being sent directly to the police department on their apparatus." Recognizing that the Fourth Amendment protects people and not simply areas, Katz, 389 U.S. at 353, we conclude that people have a reasonable expectation of privacy in real-time cell phone location information.

Moreover, because the use of the cell site simulator in this case revealed the location of the phone and Andrews inside a residence, we are presented with the additional concern that an electronic device not in general public use has been used to obtain information about the contents of a home, not otherwise discernable without physical intrusion. See Kyllo, 533 U.S. at 34-35. Under the applicable precedent, this is undoubtedly an intrusion that rises to the level of a Fourth Amendment "search." See id. Indeed, "the Fourth Amendment draws a firm line at the entrance to the house[.]" Id. at 40 (citation and internal quotation marks omitted).

Although we recognize that the use of a cell site simulator to track a phone will not always result in locating the phone within a residence, we agree with the Fourth Circuit's observation that "the government cannot know in advance of obtaining this information how revealing it will be or whether it will detail the cell phone user's movements in private spaces." Graham, 796 F.3d at 350 (citation omitted). The United States District Court for the District of Maryland articulated the same concern when addressing the government's use of a particular cell phone as a tracking device to aid in execution of an arrest warrant. The district court stated:

Location data from a cell phone is distinguishable from traditional physical surveillance because it enables law enforcement to locate a person entirely divorced from all visual observation. Indeed, this is ostensibly the very characteristic that makes obtaining location data a desirable method of locating the subject of an arrest warrant. This also means, however, that there is no way to know before receipt of location data whether the phone is physically located in a constitutionally-protected place. In other words, it is impossible for law enforcement agents to determine prior to obtaining real-time location data whether doing so infringes upon the subject's reasonable expectation of privacy and therefore constitutes a Fourth Amendment search.

In re Application of United States for an Order Authorizing Disclosure of Location Info. of a Specified Wireless Tel., 849 F. Supp. 2d 526, 540 (D. Md. 2011) (emphasis added).

It would be impractical to fashion a rule prohibiting a warrantless search only retrospectively based on the fact that the search resulted in locating the cell phone inside a home or some other constitutionally protected area.

The court then focuses on why the voluntarily disclosure doctrine—Rule A above—doesn't apply:

We agree, once again, with the Graham court and join in the view shared by other courts that, "[t]he fiction that the vast majority of the American population consents to warrantless government access to the records of a significant share of their movements by 'choosing' to carry a cell phone must be rejected." Graham, 796 F.3d at 355-56 (quoting In re United States for an Order Authorizing the Release of Historical Cell-Site Info., 809 F. Supp. 2d 113, 127 (E.D.N.Y. 2011)). Cell phone users do not actively submit their location information to their service provider.

In the present case, there was no affirmative act like "dialing." This is made abundantly clear by Det. Haley's testimony stating that "if they're on the phone, then they're already connected to . . . the [] network[, a]nd we're not going to be able to pull them off of that until . . . they hang up the call." Det. Haley's testimony reveals that, in the event that an individual is actively using the cell phone to knowingly transmit signals to nearby cell towers, the cell site simulator will not be able to access the phone.

The pin-point location information that led to finding Andrews was obtained directly by law enforcement officers and not through a third-party. It is not the case that Andrews's cell phone transmitted information to the service provider that was then recorded and shared with law enforcement. Thus, it cannot be said that Andrews "assumed the risk" that the information obtained through the use of the Hailstorm device would be shared by the service provider as in Smith. The function of the Hailstorm device foreclosed that possibility.When asked "how do you get information about where the phone is on the [Hailstorm] machine," Det. Haley responded: "[W]hen [Hailstorm] captures that identifier that you put into the machine or the equipment, it then tells you . . . where the signal's coming from[.]" Under the facts of this case, the ultimate location data relied on by the police was never transmitted to a third party voluntarily by Andrews. Because there was no third-party element to the use of the Hailstorm by the BPD to locate Andrews, Smith is inapposite. We conclude the Third Party Doctrine does not apply in this case.

V. A Few Thoughts on the Opinion

As a matter of policy, a rule that a warrant is usually required for the government to use a cell-site simulator seems sound. But that conclusion isn't intellectually interesting, so I want to instead focus on whether the Andrews opinion is strong or weak under existing Fourth Amendment doctrine. My bottom line: I find the result in Andrews plausible, although a significant amount of its reasoning strikes me as weak.

Here's a run-through of which arguments strike me as stronger and weaker.

First, it seems plausible to me that the voluntary disclosure doctrine doesn't apply and that the court was right to rule out Rule A. Cellphones are programmed to respond automatically to cell-tower queries. The query-and-response is completely invisible to the user. Users don't and even can't know when a particular cell tower is sending a query or when the phone is responding.

That is different from cell-site location information disclosed when a user makes a call, which is the issue in the still-pending Graham cell-site case. A person who makes a call and has some idea of how cell phones work knows that he is necessarily disclosing a very general indicator of his location to the cell network. That has to happen for the call to be completed. Use of a cell-site simulator strikes me as somewhat different because the query and response is entirely invisible to the user. Given that, it seems plausible to me that the user can't be deemed to be voluntarily disclosing information even when the user happens to know that phones generally are disclosing information to nearby towers.

Contrary to what Andrews says, however, this has nothing to do with whether there is a third-party element to the disclosure. The Supreme Court's cases on third-party disclosure (such as Smith) applied the Supreme Court's cases on disclosures directly to undercover government agents (such as Hoffa). In the Andrews case, the disclosure was to an undercover agent of sorts—a government simulator posting as a real cell tower—so it shouldn't matter whether there was a "third party element" to the case. The invisibility of the disclosure strikes me as a plausible basis for making the facts more like Karo than Hoffa, but it doesn't matter whether there was a third party involved.

So much for the option of Rule A. How about the other possible rules? I think the court doesn't have a very good answer for why the case isn't governed by the Knotts/Karo line of cases (Rule B) instead of the court's rule that use of a simulator is always a search (Rule E). Yes, it makes sense that locating Andrews in a private home where he was a guest was a search. He had a reasonable expectation of privacy in the home, so learning about what was inside the home was a search under Karo. (Although, to be fair, around pages 50-51 the court seems undecided on whether Andrews was actually an overnight guest with sufficient privacy rights in the home.)

Assuming that is right, though, why should that mean that it is always a search to use a simulator, at least absent an exception to the warrant requirement? Imagine the cell-site simulator reveals that Andrews is walking down a public street nearby talking openly on his phone. Or imagine he was found inside a vacant home that he had illegally entered. Why would the Fourth Amendment be implicated in those cases?

The court offers two reasons, neither of which strikes me as particularly persuasive. The first reason is that Knotts was only about visual surveillance. Use of a beeper to monitor location is only a non-search, the Andrews court suggests, if the officers also are conducting visual surveillance and the tracking device is only modestly assisting them. This doesn't work, I think, as I don't see that limit in Knotts or in Karo's description of Knotts. As I read Karo and Knotts, those cases rest on whether the government could have legally conducted visual surveillance to learn what the government learned using the tracking device, not whether they actually did conduct that visual surveillance.

Second, the Andrews court suggests that an inside/outside distinction should be rejected as "impractical." It's hard for the government to know if a phone is inside his home or outside his home before locating it, so courts should just rule that the warrant requirement always applies. I think this is a weak argument. Yes, it may be difficult for the government to know ex ante if a phone is inside a Fourth-Amendment-protected space. But this problem was already raised and rejected as irrelevant to the constitutional rule in Karo. From Karo:

If agents are required to obtain warrants prior to monitoring a beeper when it has been withdrawn from public view, the Government argues, for all practical purposes they will be forced to obtain warrants in every case in which they seek to use a beeper, because they have no way of knowing in advance whether the beeper will be transmitting its signals from inside private premises. The argument that a warrant requirement would oblige the Government to obtain warrants in a large number of cases is hardly a compelling argument against the requirement.

Under Karo, then, the government can use tracking devices in public but it has the burden of knowing when the device is inside a private home. The government's difficulty applying that standard was not a reason for the Supreme Court to reject that standard then. It's not obvious why a lower court should rule differently now.

Finally, I was a little puzzled by the reliance on Justice Sotomayor's concurring opinion in Jones. Sotomayor's opinion discusses how surveillance over time can allow the government to aggregate and analyze so much information that it lets the government learn of a person's "political and religious beliefs, sexual habits, and so on." In contrast, this case involves a single use of a tool at one discrete time to reveal a suspect's location in one place. I don't see how the concerns raised by Sotomayor's concurring opinion are in play here.