EFF, ACLU, and ACLU of Maryland filed an amicus brief today in the Maryland Court of Special Appeals in the first case in the country (that we know of) where a judge has thrown out evidence obtained as a result of using a cell-site simulator without a warrant.
In the case, Baltimore Police used a Hailstorm—a cell-site simulator from the same company that makes Stingrays—to locate Kerron Andrews, the defendant. The police not only failed to get a warrant to use the device, they also failed to disclose it to the judge in their application for a pen register order. And it appears they even failed to tell the State’s attorney prosecuting Mr. Andrews’ case.
Luckily Mr. Andrews’ intrepid defense attorney suspected the police might have used a stingray and sent a discovery request asking specifically if they had. The prosecution stalled for months on answering that request, but, on the eve of trial, one of the investigators responsible for Baltimore PD’s stingrays finally testified in court not only that he'd used the device to find Mr. Andrews, but that he’d specifically not disclosed it in any report filed about Andrews’ arrest. The judge concluded the police had intentionally withheld information from Mr. Andrews—a clear violation of his constitutional rights.
This August, another Baltimore judge granted the defense’s request to suppress all evidence the police were able to get as a direct result of using the stingray. The judge held the use of the device without a warrant violated Andrews’ Fourth Amendment right to be free from unlawful searches and seizures. Unsurprisingly, the government appealed.
Cell-site simulators, also commonly known as IMSI catchers or stingrays, masquerade as legitimate cell phone towers, tricking phones nearby into connecting to the device instead of the tower operated by the phone company. This allows police to log the identifying numbers of mobile phones in the area and to pinpoint their locations. Police often use cell-site simulators when they are trying to find a suspect and know his phone's identifying information.
As we learned from USA Today, the Baltimore PD has been using cell-site simulators extensively (and secretly) for at least the last eight years. A detective testified that Baltimore officers had used cell-site simulators more than 4,300 times since 2007. Like other law enforcement agencies around the country, Baltimore has used its devices for major and minor crimes—everything from trying to locate a man who had kidnapped two small children to trying to find another man who took his wife’s cellphone during an argument (and later returned it). And, like other law enforcement agencies, the Baltimore PD has regularly withheld information about Stingrays from defense attorneys, judges, and the public.
Stingrays are especially pernicious surveillance tools because they collect information on every single phone in a given area—not just the suspect’s phone—this means they allow the police to conduct indiscriminate, dragnet searches. They are also able to locate people inside traditionally-protected private spaces like homes, doctors’ offices, or places of worship—in Mr. Andrews’ case the investigators used the Stingray to pinpoint his location to within a specific apartment. Stingrays can also be configured to capture the content of communications.
This is why it's imperative that police not only obtain a warrant based on probable cause before using a cell-site simulator but also commit to minimization procedures, including immediately deleting information about all phones not covered by the warrant and limiting the time period during which the device is used. These are not novel or onerous requirements—the Wiretap Act requires similar procedures. And in fact, both the Department of Justice and the Department of Homeland Security recently committed to following similar procedures whenever their agents use stingrays.
We hope the Maryland Court of Special Appeals will agree that the warrantless use of a stingray is unconstitutional and uphold the lower court ruling suppressing the evidence.
