Stung: A Chicago Lawyer report

The cellphone surveillance bringing cases to your courtroom

Photo used with permission of the U.S. Patent and Trademark Office.
Photo used with permission of the U.S. Patent and Trademark Office.
December 2017
By David Thomas
Chicago Lawyer correspondent

The lawsuit charged Chicago police officers spied on a Martin Luther King Day rally in 2015 using cellphone surveillance technology designed for U.S. military covert operations, but there’s no way that could have happened.

The Chicago Police Department’s cellphone surveillance technology designed for U.S. military covert operations was in the shop that day.

“[T]he essential components of its only [cell-site simulator] system were in the custody of its manufacturer, the Harris Corp[.], in Florida, for maintenance and upgrade between late December 2014 and April 2015,” city attorney John Hendricks wrote in an April 24 motion to dismiss.

This admission led to plaintiff Jerry Boyle, a volunteer protest observer for the National Lawyers Guild, dismissing his suit six months later. Boyle’s attorney, Matthew V. Topic of Loevy & Loevy, said they will pursue future litigation as cases arise over stingrays — cellphone-snooping devices sold to local police departments under FBI-enforced secrecy agreements.

“We continue to believe that the CPD [Chicago Police Department] has systematically used stingrays in violation of the Constitution,” Topic said. “We confirmed in the suit that despite the power of stingrays to access our most personal information, the CPD has no written policies or training on the use of stingrays for its officers.”

Formally known as international mobile subscriber identity catchers, stingrays are toaster-sized boxes that send out the same signal as a cellular tower. If the stingray’s signal is more powerful — or less powerful but closer — than the signals from nearby cell antennae, your phone connects to it rather than the tower.

Both Chicago police and the Illinois State Police have or had stingray devices. The existence of a Chicago police stingray was first revealed in 2014 during discovery for a lawsuit filed by a local transparency activist.

Chicago police did not return a request for comment for this story, and a spokesman for the city of Chicago deferred all comments to the city police. Edward N. Siskel, the city’s corporation counsel, briefly addressed the city Law Department’s role in advising the department on its use of the technology.

“This is an evolving technology and an evolving legal backdrop that relates to the use of stingray technology,” Siskel said. “So we work closely with the police department and the Office of Legal Affairs within in the police department to help advise them, provide them and guidance and input on CPD practices.”

Illinois State Police Freedom of Information Officer Erin Davis confirmed to Chicago Lawyer the state police have a stingray, but that the model they own is out-of-date.

“We do not currently use this technology, as this technology is obsolete,” Davis said.

The nondisclosure agreements departments must sign to buy the surveillance equipment requires FBI approval even to admit the device exists — even in discovery prior to trial.

Illinois has emerged one of the states where privacy advocates have made strides in regulating law enforcement’s use of cell-site simulators. But when a stingray is in play, prosecutors’ cases hinge on devices they can’t admit exist and a defense attorney could be fighting charges based on improperly obtained evidence and never know it.

“Not only requiring police departments from the public, but also judges, concealed information, applications in court orders, withhold information in discovery — a gross violation of how our legal process works,” said Nathan Wessler, a staff attorney at the American Civil Liberties Union’s Speech, Privacy, and Technology Project in New York.

Under the hood

Developed for U.S. military use in war zones in Iraq and Central Asia, stingrays are only legal in the U.S. for law enforcement agencies. They are available illegally online — Chicago police arrested a 63-year-old certified public accountant in March 2016 for using a cell-site simulator from China to jam cellphones on his morning commute. He wanted to enjoy the CTA’s Red Line in silence.

The term “stingray” is the genericized version of one of the cell-site simulator products made by the Melbourne, Fla.-based Harris Corp., such as how people say Band-Aid when they mean bandage.

Representatives from Harris and from Boeing — which owns the Germantown, Md.-based Digital Receiver Technology — declined to comment for this story. Harris and DRT are the only legal U.S. manufacturers of the cell-site simulators.

The device itself is a metal box with several jacks and plug-ins, one of which is for a directional antenna used to track and target an individual cellphone. The stingray is often mounted inside a van or other vehicle to follow targets — when a cell-site simulator scans phones from an airplane, it’s often called a “dirtbox,” a nickname based on Digital Receiver Technology’s acronym DRT.

“If you’re trying to use it from an aircraft, you have to generate a far more powerful signal than you would on the ground in order to make it effective,” said William C. Loeffel, a Peoria-based attorney who recently retired as a chief warrant officer in the Army.

Loeffel’s military background including targeting intelligence and electronic warfare, including attack, protection and support, which is, he said, “the world the stingray devices operate in.”

Once a stingray locks onto your phone, it sends the same signal a cell antenna would. Your phone is designed to lock onto the strongest or closest signal — that’s how you get the clearest reception as you move between the antennae mounted to buildings, radio masts and cell towers.

When your phone locks onto a stingray, it gives the operator all your identification numbers, call logs and locations data. If modified correctly, a stingray can track a phone’s location, eavesdrop on calls and inspect messages, jam the phone’s signal, drain the phone’s battery or install malware on the phone — all without the user knowing it what is happening.

They might never know it happened, even if the surveillance led to criminal charges. This is due to nondisclosure agreements a police department must sign with both the manufacturer and the FBI prior to buying a stingray.

“The [c]ity of Chicago Police Department shall not, in any civil or criminal proceeding, use or provide any information concerning [stingray manufacturer] the Harris Corp[.] wireless collection equipment/technology … beyond the evidentiary results obtained through the use of the equipment/technology including, but not limited to, during pretrial matters, in search warrants and related affidavits, in discovery, in response to court-ordered disclosure … without the prior written approval of the FBI,” Robert D. Grant, a special agent in charge at the FBI’s Chicago division, wrote in an Oct. 14, 2011, letter to Chicago police Cmdr. Joseph Gorman.

If Chicago police are ordered by a court to reveal the existence of the stingray, it must forward a copy of the order to the FBI “in order to allow sufficient time for the FBI to intervene to protect the equipment/technology and information from disclosure and potential compromise,” Grant continued.

Secrecy about surveillance devices has already gotten one local conviction dropped. The 1st District Appellate Court in a March 1 Rule 23 order reversed the conviction of Shawn Smith. He had been sentenced to 46 years for a series of delivery-driver robberies.

Chicago police officers testified during Smith’s trial they used a device called a “pen register” to track Smith’s phone to the corner of Wabash Avenue and 15th Street.

Pen registers, also called trap-and-trace devices, track numbers coming in and out of a phone. They aren’t able, Smith argued on appeal, to trace a phone’s location. A stingray can.

“If, in fact, the officers used something other than a ‘pen register and track and trace device’ to precisely locate the defendant, they were required to testify to that at the hearing and explain to the trial court how that surveillance technology was used to accomplish their goal,” Justice James Fitzgerald Smith wrote.

In remanding the case to the circuit court, the 1st District panel ordered the court to hold a new hearing to see if the evidence from the “pen register” should be quashed.

“We’re pleased with the result, and we hope the state dismisses the charges because they can’t prove a legal search and seizure,” said Assistant State Appellate Defender Darrell Oman. Oman represented Smith on appeal.

Although the state Supreme Court later vacated the appellate panel’s ruling in a supervisory order, the quash hearing will proceed. Oman said if the state loses at the hearing, it loses its conviction.

The Cook County State’s Attorney’s Office did not return a request for comment.

Secret wars

Chicago police have spent at least $339,800 in acquiring and maintaining its cell-site simulators, according to invoices obtained by Lucy Parsons Labs, a technology-based transparency outfit activist Freddy Martinez directs.

Chicago police has had access to stingrays from Harris since 2005, according to records obtained by Ali Winston, a reporting fellow with The Investigative Fund at The Nation Institute in New York. However, the existence of a Chicago stingray was first revealed in 2014, after Martinez sued the department for denying several Freedom of Information Act requests.

Rumors of prosecutors dropping cases rather than admitting the police own a stingray spurred the FOIAs.

“You hear these stories of prosecutors dropping cases,” Martinez said. “That was another reason that I got really interested. It sounded like they were hiding evidence from defense attorneys, which should have its own constitutional concerns.”

In response to the National Lawyers Guild’s suit filed by Boyle alleging spying during the 2015 Martin Luther King Day rally, Sgt. James J. Fidducia wrote in a declaration attached to the city’s motion to dismiss that, as of that year, the department possessed “outdated” stingray components in storage that “have been out of use for some time. Presently, CPD has no other cell-site simulator systems, usable or otherwise.”

The state police spent $254,260 acquiring its stingray device from Harris in 2008, according to invoices Chicago Lawyer obtained through FOIA.

From 2006 to 2013, Harris billed the state police for several thousand more dollars for other purposes, all of which were redacted. The most recent purchase was in 2012 for $4,000. Davis said the law enforcement agency had “no records … regarding internal policies, memos or other guidance about how the ISP [Illinois State Police] should use these devices,” because it no longer possessed a stingray.

Rather than have defense attorneys have to rely on old statements and declarations to piece together how evidence was obtained, the ACLU’s stance is that stingray use should be available in discovery. Wessler and the ACLU allege departments across the nation have called stingrays “confidential intelligence” or “electronic surveillance measures” in reports rather than break the nondisclosure agreements.

“Use of the devices should be discoverable, but it has often been very difficult for defense attorneys to suss out whether a stingray was used in order to seek or compel disclosure of information,” Wessler said. “Pursuant to the requirements of the NDAs [nondisclosure agreements], police have deliberately avoided mentioning or describing their use of stingrays in investigative reports, notes and other files that would be discoverable.”

The information can be obtained through FOIA, as Cook County Circuit Judge Kathleen G. Kennedy found in 2016 in a separate lawsuit Martinez filed regarding stingrays. In its motions to dismiss, Chicago police alleged revealing the existence of a stingray would violate rules ranging from trade secret rules to Section 3213 of the federal criminal code to the International Traffic in Arms Regulation — cell-site simulators are on the U.S. Munitions List, a list of defense and space-related products and services that the U.S. government tightly regulates.

Kennedy noted that an affidavit from Bradley Morrison, a supervisory special agent with the FBI, regarding the U.S. Munitions List was essentially a form letter — other FBI agents had filed similarly worded affidavits in other FOIA cases.

Power and responsibility

On the federal level, the technology has outpaced the laws. For instance, a stingray’s potential to eavesdrop on phone calls would fall under the federal wiretapping law of 1968, said Adam Schwartz, a senior staff attorney with the Electronic Frontier Foundation in San Francisco.

The Justice Department and the Department of Homeland Security have modern guidelines for their stingrays, and a December 2016 House Oversight and Government Reform Committee report urges local police to follow those rules, especially if they have used federal funds to purchase their cell-site simulators.

But the recommendation is, in effect, toothless. Until Congress passes “a clear, nationwide framework for when and how geolocation information can be accessed and used,” the committee will look to the states to handle Trump-era technology regulated by Lyndon Johnson rules.

As of January, Illinois requires police obtain a warrant before using a stingray. Although this came nine years after the state police first bought a stingray and 12 years after Chicago police first bought one, it still puts Illinois at the forefront. Only five states require warrants before using stingrays.

“Illinois has been very much ahead of the curve,” Schwartz said.

In Illinois, stingrays can only be used to track a device’s location. They cannot be used to monitor phone calls and messages, block calls, drain phone batteries or install malware on the devices. Police must delete the personal data captured from bystanders’ phones within 24 hours if police were trying to track a particular person or 72 hours if they were looking for someone whose identity they don’t know.

But even when a court rules the police must disclose that they used a stingray, they’re not obligated to say how they used it.

In November 2016, the 7th U.S. Circuit Court of Appeals sidestepped the issue. Because a warrant existed for parolee Damian Patrick’s arrest in 2013 and a Chicago police stingray found his car on a public street, he had no expectation of privacy no matter what means were used to find him, a majority of the 7th Circuit panel ruled.

But Chief Judge Diane P. Wood wrote in her dissent that the court should have done more fact-finding before ruling.

“Even if the Stingray revealed no information beyond Patrick’s location, we must know how it works and how the government used it before we can judge whether it functions in a manner sufficiently different from the location-gathering methods specified in the warrant that it amounted to a search outside the warrant’s scope,” Wood wrote.

Privacy advocates did secure a victory at the District of Columbia Court of Appeals. In a divided, 91-page opinion in Prince Jones v. United States, the majority of the D.C. appellate panel held in September that using a stingray to track and locate a person constituted a search under the Fourth Amendment.

Away from the criminal arena, transparency activists are pursuing cases challenging how law enforcement discloses information about their surveillance technology.

Freddy Martinez v. Cook County State’s Attorney’s Office is pending before the 1st District Appellate Court charging the agency wrongly denied a FOIA request about stingrays. Wessler said the Washington state chapter of the ACLU is waging a lawsuit against the Tacoma Police Department over its alleged failure to disclose records about its use of a stingray.

Schwartz said having Congress pass legislation that would regulate the device’s use nationwide or having the U.S. Supreme Court rule on the matter would be better than the patchwork approach of state and municipal regulations.

“We commend Illinois for passing laws like this. It’s no substitute for national protection,” Schwartz added. “You can have a town just across the Mississippi River where they don’t need the warrant to use the cell-site simulator. It’s clearly good in Illinois or not enough in other states.”

Tangled webs

Tricking a mobile device into thinking it’s talking to a cell tower is just one way police can monitor you through your phone. A separate technology Chicago police own allows them to essentially suck out all the data and metadata on the phone.

The Israeli company Cellebrite is a popular provider of these products, Wessler said. Chicago police purchased a Cellebrite Forensic Telephone Kit for $7,074 in November 2009, according to one of Martinez’s FOIA requests.

“It’s more invasive. It just drops everything in the phone,” Martinez said.

In April, Chicago 14th Ward alderman and city council Finance Committee Chairman Edward Burke offered up a resolution calling on the police to testify about their ability to use a device like Cellebrite’s Textalyzer to see if drivers had been using their phones in the moments before an accident. As of press time, that hearing has not been held.

But that’s just cellular surveillance. Police have a wide technology arsenal at their fingertips already: drones, license plate readers, surveillance camera networks, social media monitoring, portable fingerprint readers and facial recognition technology.

“From our perspective, they all knit together to form one big web of surveillance that is of great concern to us,” Schwartz said.

Loeffel, the Army surveillance expert turned downstate attorney, expressed similar sentiments, adding that the technology used in stingrays operates comparably to the technology steering driverless cars.

“We are becoming so trackable because of the devices we carry. Our biggest vulnerability is not the stuff we put out on the internet, but 80 percent of Americans are within five feet of their cellphone,” Loeffel said. “It’s the advance of technology that is stripping any kind of privacy we have. You don’t even have to turn it on anymore.

“Where is privacy going as technology is making these advances?”