Criminal Justice

Criminal suspects challenge legality of warrantless cellphone tracking

Four men charged in federal court with attempted murder in the shooting of an Oakland, California, police officer in 2013 are seeking to have evidence – including the officer’s gun, which was found at one defendant’s apartment – thrown out because they claim it was obtained through the warrantless use of a StingRay, a controversial cellphone surveillance device.

As local police departments expand their surveillance and technology tactics, the unusual defense in a Bay Area criminal court could test whether police have the right to scoop up thousands of cellphone records without seeking court approval. The case is playing out while Oakland, which has faced protests and a backlash over government monitoring, debates new restrictions on the purchase of additional surveillance equipment by police there.

In January 2013, undercover police Officer Eric Karsseboom was staking out an apartment building in East Oakland, trying to locate a car used in a shooting the day before. While on the stakeout, authorities say, Karsseboom was confronted by Deante Kincaid, Damien McDaniel and Joseph Pennymon.

In the ensuing struggle, McDaniel yanked Karsseboom’s own Glock 22 pistol from his waistband while Kincaid and Pennymon pistol-whipped Karsseboom with their own guns. McDaniel then allegedly shot Karsseboom in the arm with the Glock 22 and fled with Karsseboom’s service weapon and his backup gun, a smaller Glock 27.

After Karsseboom radioed for help and was taken to a hospital for treatment, police located the men within hours in a nearby apartment. The officers claimed in a search warrant affidavit that a confidential informant tipped them to search the East Oakland apartment of another man, Purvis Ellis, in which narcotics and Karsseboom’s two stolen firearms were located. A judge approved a warrant for the search of Ellis’ apartment.

Defense attorneys have presented documents suggesting that Oakland police were tracking the defendants’ phones in the hours following Karsseboom’s shooting, including requests to telecom service providers and dispatch logs.

In recent months, there has been a flood of information about law enforcement use of these devices – known as International Mobile Subscriber Identification catchers, or cell-site simulators – which are manufactured by Harris Corp. and sold under various brand names, such as StingRay, KingFish and Triggerfish.

The cell-site simulators act as a police-controlled cellphone tower, forcing all phones in an area to connect to it rather than a telecom-controlled relay. In the process, the towers collect unique identifying information from the target cellphones and allow police to pinpoint their location.

But the device also gathers and retains information about all other cellphones in the area as well. The lack of transparency about the bulk collection of cellphone data of people who happen to be in the same area as the phone of a criminal suspect raises questions about how and why law enforcement agencies are storing and using this metadata.

Documents obtained from a sheriff’s office in New York and court testimony in Maryland reveal that police have used these devices thousands of times, frequently without warrants, and, under the advisement of a nondisclosure agreement with the FBI, have kept their use hidden from prosecutors, judges and defense attorneys.

Linda Lye, a senior staff attorney with the American Civil Liberties Union of Northern California, said the Oakland case is indicative of the need for transparency and judicial review of this technology.

“When law enforcement isn’t candid about their methods, they usurp judicial rule by deciding what court authority to get or not to get for electronic surveillance,” Lye said.

In response to a question from Reveal, Oakland Police Department spokeswoman Johnna Watson confirmed that the agency has no guidelines governing how cell-site simulators are used or how data from target and nontarget phones are stored. Whether warrants and court orders are required “would be all case and circumstance dependent,” she said.

The U.S. Department of Justice this month announced it would review protocols for cell-site simulators and has admitted that FBI agents used such devices for years without warrants.

In response to questions from U.S. Sens. Chuck Grassley and Patrick Leahy in January, the FBI told congressional staffers that there were broad exceptions to warrant requirements for using StingRays and other similar devices, including cases that pose an imminent danger to the public, cases that involve a fugitive, and in public places where “there is no reasonable expectation of privacy.”

In Oakland, documents show that police have used StingRay technology since at least 2006, and officers claim that they are used exclusively to target high-risk suspects in homicides, shootings and assaults. In other cities, such as Chicago and St. Louis, however, StingRays have been used to track and eavesdrop on political activists. While the Oakland Police Department has refused to publicly acknowledge its possession or use of the device, public documents from the department and court testimony from other criminal cases in Oakland reveal that the technology is an integral tool for the department’s Gang Intelligence Task Force.

Some of the city’s most high-profile cases in recent years, such as a bloody 2013 turf war between South Berkeley and North Oakland gangs that led to the killing of 8-year-old Alaysha Carradine, are among the cases where Oakland police have used the device to locate suspects.

The Alameda County district attorney’s office also is seeking to obtain a more advanced cell-site simulator.

In the case stemming from the 2013 shooting of Officer Karsseboom, a motion filed in February by defense attorneys Christopher Cannon and Matthew Laws alleged that Oakland police had tracked down their clients by locating one of their cellphones with a StingRay. Accompanying documents, including redacted transcripts of police communications, show that gang task force officers conducted an electronic sweep of the area and located the accused men and Karsseboom’s stolen guns by locking in on the transmissions from a target cellphone.

The use of a StingRay to find the location of the target cellphone was confirmed in an April motion by Assistant U.S. Attorney Joseph M. Alioto Jr.: “The United States confirms that a cell-site simulator was used in this case to obtain the general location of an armed suspect at large. … Even if the use of a cell-site simulator now requires a warrant, its use in this case was under exigent circumstances. The Defendant was thought to be armed and involved in the shooting of an Oakland police officer several hours earlier.”

The Northern California U.S. attorney’s office did not respond to requests for comment on this case or the use of evidence obtained by cell-site simulators.

“I think they have to suppress what they obtained and the fruit of what they obtained,” Cannon said in an interview with Reveal.

The motion by the four men accused in Karsseboom’s shooting claims that there was “an attempt to keep the existence of electronic surveillance hidden.” Oakland police requested and received a PEN register – a device that records all telephone numbers, text messages or data communications made from a particular telephone line or smartphone – and cell-site data related to two phone numbers associated with the defendants without providing any warrants, court orders or applications, according to the motion.

Across the country, there is widespread uncertainty about whether law enforcement agencies must obtain court orders to use StingRays and other models of cell-site simulators. It is unclear whether the Oakland Police Department obtains warrants to use these devices.

In response to Public Records Act requests from local activists, the Oakland Police Department has said it does not have written training manuals or policies regarding the use of StingRays.

The Alameda County district attorney’s office declined to answer questions about whether it requires court orders to use such devices. Spokeswoman Teresa Drenick said, “Our policy is at all times to comply with the Constitution in general and the Fourth Amendment in particular with respect to any case we investigate or prosecute.” Drenick did not respond to questions about whether the DA’s office gives guidelines for using StingRays to local law enforcement agencies.

The 9th Circuit Court of Appeals has not ruled on whether StingRay usage by law enforcement agencies requires warrants. Cell-site simulators have the capability to intercept telephone calls and text messages like a traditional wiretap, which requires court authorization under federal and state laws. However, devices like StingRays are so new that courts and state legislatures still are sorting out rules for their use. In May, the state of Washington passed a law requiring law enforcement agencies to obtain warrants in order to use cell-site simulators. Similar laws exist in Minnesota, Utah and Virginia.

The legal wrangling over the Oakland Police Department’s use of a StingRay in tracking down Karsseboom’s alleged assailants comes as the city is proposing an ordinance that would require the City Council to approve the purchase of any surveillance equipment and establish stringent protocols for its use.

According to a 2010 memo by former Oakland police Sgt. Shawn Knight, the department operated its StingRay out of a surveillance van outfitted with GPS mapping software. The StingRays proved very effective in locating high-risk felony suspects, listing 28 redacted cases from September 2006 through March 2010 in which StingRays and PEN registers helped locate people for apprehension, according to the memo.

It’s clear that the federal government wants to keep use of cell-site simulators private. Before allowing a local law enforcement agency to purchase such a device, Harris Corp. and the FBI require that agency to sign a confidentiality agreement. The agreements sent by the FBI to law enforcement agencies in New York and Baltimore, for example, require police to immediately notify the FBI of any records requests pertaining to the technology, to withhold information about its use from court proceedings, and to drop charges in any case that would result in disclosure of the technology’s usage.

In an email to Reveal, FBI spokesman Christopher Allen wrote that the nondisclosure agreements are intended to protect “law enforcement sensitive” surveillance techniques, since publicity about cell-site simulators could “compromi(se) future use of the equipment.” However, Allen said the agreements shouldn’t prohibit law enforcement agencies from disclosing the use of this technology to courts, and a lack of disclosure “could inappropriately and adversely affect a defendant’s right to challenge the use of the equipment.”

Harris Corp. declined repeated requests for comment on this technology.

The Oakland Police Department did not respond to questions about whether it has signed a nondisclosure agreement with the FBI or Harris Corp. In response to a records request by local privacy activist Brian Hofer, the department said it has no policies or guidelines for the use of StingRays or International Mobile Subscriber Identification catchers. The 2010 memo requires a 40-hour training course for any officer to operate the department’s StingRay system, yet no responsive documents for this training were released to Hofer.

Hanni Fakhoury, a senior staff attorney with the Electronic Frontier Foundation and a former federal public defender in San Diego, said that under California law, there are greater protections for phone records than in federal court. He cited two opinions by the state attorney general that require law enforcement agencies to obtain either a grand jury subpoena or a warrant to install a PEN register, rather than relying on a federal order, which is not reviewed by a judge.

“People have an expectation of privacy under the California Constitution for their phone records,” Fakhoury said.

Get the Weekly Reveal newsletter

Don’t miss out on the next big story. Sign up today.