House, Senate Bill Would Limit Cell-Site Simulator Use, Geolocation Data Access
House Oversight Committee Chairman Jason Chaffetz, R-Utah, Rep. John Conyers, D-Mich., and Sen. Ron Wyden, D-Ore., Wednesday introduced legislation that establishes rules governing when law enforcement agencies can access people's geolocation data without their knowledge, including information obtained by companies and through the use of cell-site simulators. During a Cato Institute event earlier in the day, Chaffetz noted he was planning to introduce the legislation. The event focused on the growing government use of the devices that mimic cellphone towers to locate people under investigation, which one civil liberties expert called a "disturbing trend.”
Sign up for a free preview to unlock the rest of this article
Timely, relevant coverage of court proceedings and agency rulings involving tariffs, classification, valuation, origin and antidumping and countervailing duties. Each day, Trade Law Daily subscribers receive a daily headline email, in-depth PDF edition and access to all relevant documents via our trade law source document library and website.
The Geolocation Privacy and Surveillance Act would "create clear rules for when agencies can access and track an individual’s geolocation information," the lawmakers said in a joint news release. The bill is similar to previous legislation Chaffetz sponsored (see 1511030015 and 1305100032). "If I can watch you where you are, where you go, what you do, who you visit, that's the content of your life," he said. "What if somebody's maybe getting cancer treatments or wants to go to a particular bar or wants to just pick up their kids at a school every day, is that anybody else's business? No, it's not," said Chaffetz at Cato. It's not law enforcement's business, either, unless it has probable cause, he said.
In December, Chaffetz's committee issued a bipartisan report on cell-site simulators after a year-long investigation (see 1612190019) that found the federal government -- including DOJ, the Department of Homeland Security and the IRS -- spent $100 million to buy hundreds of devices. He said the agencies went to great lengths to keep their usage of the devices secret. He criticized FBI policy of requiring state and local law enforcement agencies that buy the devices to sign nondisclosure agreements. Rep. Elijah Cummings, D-Md., was also slated to talk at the event but couldn't make it.
Cell-site simulators, more popularly known by the brand name StingRays, emulate cellphone towers by exploiting known security flaws in carrier networks, sweeping up cellphone information about an individual targeted for investigation, but also about everyone within the vicinity of the device. Security researcher Jonathan Rudenberg said the devices will "literally" search every phone.
Last year, Justice and DHS adopted policies that would require law enforcement to get warrants in order to use the devices, but Chaffetz said that needs to be codified. A DOJ spokesman emailed that the department introduced its "enhanced policy" on cell-site simulator use in September 2015, but declined to comment further.
Chaffetz and experts bemoaned the secrecy behind the government and law enforcement's use of the devices and their refusal even to divulge even their existence, let alone their capabilities, to defense attorneys, judges and lawmakers. Cato Policy Analyst Adam Bates, who recently wrote a piece about the police use of StingRays, said that a few years ago, police in Tallahassee wouldn't reveal how they tracked down a pair of individuals who robbed a drug dealer and the dealer's cellphone, which was located through a cell-site simulator. He said that led the prosecutor to withdraw evidence and agree to a plea deal giving the robbers probation instead of jail time.
Laura Moy, new deputy director of Georgetown University Law School's Center on Privacy & Technology, said that last year she filed an informal complaint with the FCC on behalf of Center for Media Justice, Color of Change and the New America Foundation's Open Technology Institute. They said police departments use cell-site simulators "without the appropriate license to use the licensed spectrum over which the device transmits" (see 1609020025). Moy said the spectrum is licensed to carriers and she doesn't know of any police departments that have licenses to transmit in that spectrum and therefore those departments are in violation of the Communications Act.
“The use of these devices is so shrouded in secrecy it's really difficult to know to what extent the interference is occurring and what that interference looks like," said Moy. But police records and court testimony revealed that the devices can cause calls to drop and drain cellphone batteries, she said. The complaint also said police disproportionately use the devices in communities of color, she said. Moy said the complaint is "in limbo" given the FCC transition, but she had meetings with staff last year on the complaint: "We’re hopeful though the new FCC will take a hard look at this issue.”
“This is part of a disturbing trend in law enforcement when it comes to surveillance," said American Civil Liberties Union Legislative Counsel Neema Singh Guliani, whose organization tried to canvass cell-site simulator policies of police agencies. She said DOJ deliberately attempted to hide the use of these technologies from communities, courts and members of Congress. DOJ is trying to mask how cell-site data is collected and undermine the ability to challenge the use of the devices, she said, and there may be hundreds of cases where information was collected without defendants' knowledge, preventing those defendants from raising constitutional challenges in court. Guliani said society needs to decide what protections should apply to the devices before they’re deployed.