Seventh Circuit Opinions (Majority and Dissenting) on Use of Stingray Technology for Cell-Phone Information (11/26/16)

I have written before about federal law enforcement -- specifically IRS -- use of cell site simulators, often called Stingrays (the trademark of one brand of simluator).  IRS Use of Cell-Site Simulators (Also called Stingray) to Retrieve Information About and From Cell Phones (Federal Tax Crimes Blog 12/3/15), here.  The Seventh Circuit has just issued a decision involving the use of cell site simulators.  The technology was not used in a criminal tax investigation, but it could be so used.  Of course, in a federal criminal investigation, as noted in the prior blog entry, the DOJ Guidelines for use will be honored and the IRS has agreed to respect those guidelines.  But, since court opinions about use of the technology are rare (at least to date), I thought readers might want to know about a recent case with thoughtful majority and dissenting opinions on the use of the technology.

In United States v. Patrick, ___ F.3d ___, 2016 U.S. App. LEXIS 21090 (7th Cir. 2016), here, local police located a person for whom an arrest warrant had been issued by using stingray technology.  Police had first obtained a warrant to use the technology.  It did not specifically advise the court issuing the warrant for the electronic location as to precisely how it would locate the target.  Federal charges were then brought based on the fruits of the arrest.  The use of the stingray technology to locate the person was discovered only in post appeal briefing.  So, the issue presented to the Seventh Circuit was whether the use was inappropriate -- either at all or without a warrant or without a warrant issued for its specific use -- and if not in any respect, could this person obtain relief.

Judge Easterbrook wrote the majority opinion, joined by Judge Kanne.  Judge Wood wrote the dissenting opinion.  I have had occasion over the years to focus on the opinions of Judges Easterbrook and Wood.  Both are great judges.  I am less familiar with Judge Kanne, but he did not author the opinions.

I think the briefs might be helpful, but have been unable to log onto Pacer to obtain them.  I did find the link to the Amicus brief, here.:

I recommend that readers interested in this issue read both opinions.  I won't try to summarize them here, but I will excerpt portions discussing the potential uses of the technology.

Judge Easterbrook quotes the DOJ Guidance which I quote and link in my original blog entry.

Judge Easterbrook then says:

If the Department's description is accurate (a question not explored in this litigation) law-enforcement officials get the same sort of information that a phone company could provide using its own facilities, and they get it in real time rather than waiting for the phone company to turn over data. But instead of collecting information on just one person, as the warrant in this proceeding entitled the police to learn Patrick's location, a cell-site simulator collects the relative location of everyone whose phone is induced to connect to the simulator—though it may discard that information before alerting officials to the presence of the sought-after person (just as the phone company, which has location data about all of its customers, would disclose only one person's location). 

One potential question posed by use of a cell-site simulator would be whether it is a "search" at all, or instead is covered by Smith v. Maryland, 442 U.S. 735, 99 S. Ct. 2577, 61 L. Ed. 2d 220 (1979), and United States v. Knotts, 460 U.S. 276, 103 S. Ct. 1081, 75 L. Ed. 2d 55 (1983). The former holds that a pen register is not a search because it reveals the making of a call, and the number called, but not the call's communicative content. The latter holds that the use of a beeper is not a search, because it reveals a suspect's location but nothing else. Recent decisions such as United States v. Graham, 824 F.3d 421 (4th Cir. 2016) (en banc), and United States v. Carpenter, 819 F.3d 880 (6th Cir. 2016), apply these principles to hold that tracking a person via data from phone companies is not a search within the scope of the Fourth Amendment. (Graham involved historical cell-tower location information and Carpenter involved "transactional records" from phone companies, so both cases dealt with the sort of information covered by the location warrant in this proceeding.) Police freely use databases, containing information such as the addresses associated with automobile license plates and persons licensed to drive, to track down suspects; they search trash for credit card receipts showing where he made purchases; they consult a suspect's relatives and friends (and sometimes his enemies) to learn his whereabouts; no one thinks that those methods require a search warrant. 

A contrary line of argument analogizes cell-site simulators to GPS locators, which are treated as searches when police enter private property to install them, see United States v. Jones, 565 U.S. 400, 132 S. Ct. 945, 181 L. Ed. 2d 911 (2012), and may be searches when used for extended durations even if installed with a vehicle owner's consent, id. at 954-64 (concurring opinions of Sotomayor and Alito, JJ.). If a cell-site simulator is like a GPS tracker, and if the approach of the concurring opinions in Jones is adopted, then it would be necessary to know how long the police used a simulator while searching for Patrick and just how accurate is the location information it provides. (Is it information that leaves uncertainty about where in several city blocks a suspect may be, such as the beeper in Knotts, or is it closer to the precise location supplied by a GPS tracker?) Cf. Kyllo v. United States, 533 U.S. 27, 121 S. Ct. 2038, 150 L. Ed. 2d 94 (2001) (thermal image of the inside of a house is a search, given a person's strong privacy interest in his dwelling). 

The United States has conceded for the purpose of this litigation that use of a cell-site simulator is a search, so we need not tackle these questions. The parties join issue, however, on the significance of the fact that police did not reveal to the state judge who issued the location-tracking warrant that they planned to use a cell-site simulator—indeed, implied that they planned to track him down using his phone company's data. Patrick says that leaving the judge in the dark (perhaps misleading the judge by omitting a potentially material fact) makes the location-tracking warrant invalid. This poses the question whether a judge is entitled to know how a warrant will be executed. 

The Fourth Amendment requires that warrants be based "upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized." The Supreme Court stated in Dalia v. United States, 441 U.S. 238, 256, 99 S. Ct. 1682, 60 L. Ed. 2d 177 (1979), that neither constitutional text nor precedent suggests that "search warrants also must include a specification of the precise manner in which they are to be executed." The manner of search is subject only to "later judicial review as to its reasonableness." Id. at 258. And the Justices added in Richards v. Wisconsin, 520 U.S. 385, 117 S. Ct. 1416, 137 L. Ed. 2d 615 (1997), that courts cannot limit a warrant so as to foreclose a particular means of execution. In Richards the police sought a warrant that would have authorized a no-knock entry to conduct a search. The judge denied that request but issued a warrant for a regular search. After the police conducted a no-knock entry anyway, the Court held that this was proper because it was reasonable to carry out the search that way under the circumstances. 

This means that the police could have sought a warrant authorizing them to find Patrick's cell phone and kept silent about how they would do it. Or affidavits and the warrant itself might have said that "electronic means that reveal locations of cell phones" will be used. Professor Kerr has concluded from Dalia and Richards, and other considerations, that the Fourth Amendment forbids judges to attempt to regulate, ex ante, how a search must be conducted, and confines the judiciary to ex post assessments of reasonableness. Orin S. Kerr, Ex Ante Regulation of Computer Search and Seizure, 96 Va. L. Rev. 1241, 1260-71 (2010). 

We can imagine an argument that it will often be unreasonable to use a cell-site simulator when phone company data could provide what's needed, because simulators potentially reveal information about many persons other than the suspects. (The contrary argument is that data from simulators is current, while data relayed through phone companies' bureaucracies may arrive after the suspect has gone elsewhere.) But if the problem with simulators is that they are too comprehensive, that would not lead to suppression—though it might create a right to damages by other persons whose interests were unreasonably invaded. Patrick is not entitled to invoke the rights of anyone else; suppression is proper only if the defendant's own rights have been violated. See, e.g., United States v. Payner, 447 U.S. 727, 100 S. Ct. 2439, 65 L. Ed. 2d 468 (1980). 

Patrick contends that, even if ex ante authorization of the method is unnecessary, the police must be candid with the judiciary when they mention potential methods of executing a search warrant. He seeks, at a minimum, a remand to explore those questions, after the fashion of a Franks hearing (see Franks v. Delaware, 438 U.S. 154, 98 S. Ct. 2674, 57 L. Ed. 2d 667 (1978)), at which the court would decide whether the warrant still would have issued if the affidavits had been more forthcoming. 

But for the reasons given earlier we conclude that the answers do not control this appeal. A person wanted on probable cause (and an arrest warrant) who is taken into custody in a public place, where he had no legitimate expectation of privacy, cannot complain about how the police learned his location. Recall that the cell-site simulator (unlike the GPS device in Jones) was not used to generate the probable cause for arrest; probable cause to arrest Patrick predated the effort to locate him. From his perspective, it is all the same whether a paid informant, a jilted lover, police with binoculars, a bartender, a member of a rival gang, a spy trailing his car after it left his driveway, the phone company's cell towers, or a device pretending to be a cell tower, provided location information. A fugitive cannot be picky about how he is run to ground. So it would be inappropriate to use the exclusionary rule, even if the police should have told the judge that they planned to use a cell-site simulator to execute the location warrant. 

The Department of Justice announced last September that in the future it would ordinarily seek a warrant, plus an order under the pen-register statute, 18 U.S.C. § 3123, before using a cell-site simulator, but it has not conceded that this is constitutionally required. Questions about whether use of a simulator is a search, if so whether a warrant authorizing this method is essential, and whether in a particular situation a simulator is a reasonable means of executing a warrant, have yet to be addressed by any United States court of appeals. We think it best to withhold full analysis until these issues control the outcome of a concrete case. 

Affirmed

Judge Wood then in dissent says (emphasis supplied by JAT):

My colleagues see no serious Fourth Amendment issues in Patrick's case, because they believe that a defendant has no interest in the manner in which a warrant is executed. They also question whether the use of a cell-site simulator is a "search" at all, noting that Smith v. Maryland, 442 U.S. 735, 99 S. Ct. 2577, 61 L. Ed. 2d 220 (1979), holds that the use of a pen register is not a "search," and that United States v. Knotts, 460 U.S. 276, 103 S. Ct. 1081, 75 L. Ed. 2d 55 (1983), says the same thing about the use of a beeper. Finally, they note that Patrick was arrested in a "public place," by which they mean sitting in the passenger seat of a parked car. All of this matters greatly to Patrick, because if his initial arrest was invalid, then the gun that the police spotted in plain view in the car should have been suppressed as "fruit of the poisonous tree," see Wong Sun v. United States, 371 U.S. 471, 488, 83 S. Ct. 407, 9 L. Ed. 2d 441 (1963), and Patrick's conviction under 18 U.S.C. §§ 922(g)(1) and 924(a)(2) for being a felon in possession of a firearm would need to be revisited. If the arrest complied with the Fourth Amendment, the gun was lawfully found and seized and his conviction must be affirmed. Because I believe that the panel opinion underestimates the relevant technology's capabilities and extends Utah v. Strieff, 136 S. Ct. 2056, 195 L. Ed. 2d 400 (2016), too far, I dissent. 

This is the first court of appeals case to discuss the use of a cell-site simulator, trade name "Stingray." We know very little about the device, thanks mostly to the government's refusal to divulge any information about it. Until recently, the government has gone so far as to dismiss cases and withdraw evidence rather than reveal that the technology was used. See Memorandum Agreement between Amy S. Hess, Assistant Director, Operational Technology Division, FBI, and David Salazar, Chief of Police, MPD (Aug. 13, 2013) (agreeing to dismiss cases rather than disclose use of Stingray). Indeed, in this case, the government appears to have purposefully concealed the Stingray's use from the issuing magistrate, the district court, defense counsel, and even this court. It ultimately admitted its use of the device only in response to an amicus curiae brief filed during this appeal. 

* * * * 

The majority offers a long quote from the Department of Justice Policy Guidance manual on the use of cell-site simulator technology, ante at 3-4, but that information is contestable. We are given no reason to think that a municipal police department such as MPD was bound in any way to the guidance offered by the DOJ, or that the MPD chose to follow the DOJ Guidance as a matter of internal policy. There is another side to the story, but because of the government's furtiveness, Patrick never had the chance to present it. 

With certain software (known as "Fishhawk" and "Porpoise"), the Stingray is much more than a high-tech pen register. It can capture the "emails, texts, contact lists, images," and other data disclaimed by the last paragraph of the majority's excerpt of the Policy Guidance. It can eavesdrop on telephone conversations and intercept text messages. See Stephanie K. Pell & Christopher Soghoian, Your Secret Stingray's No Secret Anymore: The Vanishing Government Monopoly over Cell Phone Surveillance and Its Impact on National Security and Consumer Privacy, 28 HARV. J.L. & TECH. 1, 11-12 (2014) ("Depending on the particular features of the surveillance device and how they are configured by the operator, IMSI catchers can be used to identify nearby phones, locate them with extraordinary precision, intercept outgoing calls and text messages, as well as block service, either to all devices in the area or to particular devices." (footnotes omitted)). Because many thirdparty apps automatically send and receive data through the subscriber's network, it is reasonable to assume that a Stingray can collect other information from a cell phone, as well. 

We know nothing about the way in which the Stingray used in Patrick's case was configured, nor do we know the extent of its surveillance capabilities. The majority properly notes that DOJ's description may or may not be accurate, either in general or for particular cases. It is worth underscoring how inaccurate that description may be and how important it is, both for Patrick and as a matter of Fourth Amendment jurisprudence and public policy, that these questions be explored. 

In this case, the location warrant authorized only methods of fixing Patrick's location that involved gathering information that would reveal his phone's connection with cellphone towers. The Supreme Court has recognized that a search of cell-phone data requires a warrant. See Riley v. California, 134 S. Ct. 2473, 2494-95, 189 L. Ed. 2d 430 (2014) (associating a warrantless search of a cell phone [*18]  with the "reviled 'general warrants' and 'writs of assistance'" against which the Fourth Amendment was aimed). The authorization of the collection of location data cannot be expanded to permit a search of the contents of Patrick's cell phone. If the Stingray gathered information from the phone that went beyond his location, such a "search" of his phone would have been unauthorized, and suppression of the additional information (which might have pinpointed Patrick's location) would likely be required. See United States v. Foster, 100 F.3d 846, 850-51 (10th Cir. 1996) (applying blanket suppression where agents performed general search of residence and seized "anything of value" even though warrant authorized only search for four firearms and marijuana). 

Title III may also be pertinent here, depending on what the facts reveal about the device that was used. It seems clear that if the MPD intercepted any cell-phone conversations, text messages, or data, Title III covered those interceptions. Under section 2511(a), any person who "intentionally intercepts ... any wire, oral, or electronic communication" without following the proper procedures is liable under the statute. "Title III now applies to the interception of conversations over both cellular and cordless phones." Bartnicki v. Vopper, 532 U.S. 514, 524, 121 S. Ct. 1753, 149 L. Ed. 2d 787 (2001). The Act defines "electronic communication" as "any transfer of signs, signals, writing, images, sounds, data, or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, photoelectronic or photooptical system that affects interstate or foreign commerce." 18 U.S.C. § 2510(12). Text messages and cell-phone data transmissions easily fit that definition. None of the relevant exceptions to that definition applies, see id., and there is no reason to think that the interception of text messages or data transmissions would otherwise be excluded from it. See Brown v. Waddell, 50 F.3d 285, 289 (4th Cir. 1995) ("The principal purpose of the [Electronic Communications Privacy Act] amendments to Title III was to extend to 'electronic communications' the same protections against unauthorized interceptions that Title III had been providing for 'oral' and 'wire' communications via common carrier transmissions."); see also Joffe v. Google, Inc., 746 F.3d 920, 930 (9th Cir. 2013) (electronic information transmitted over Wi-Fi network does not fit 18 U.S.C. § 2511(2)(g) exceptions). 

The MPD concededly never followed the procedures required for an order for electronic surveillance. See 18 U.S.C. § 2518. Any interception of the substance of Patrick's communications would thus almost certainly be illegal. The remedy for a Title III violation is normally the suppression of the illegally intercepted communications and any evidence derived from them. 18 U.S.C. § 2515. If such evidence is relevant to Patrick's conviction, Title III might require suppression and, in the absence of the suppressed evidence, a reversal of the conviction. 

Even if the Stingray did not gather any information from Patrick's cell phone other than its location, its use still might be problematic. The court order authorized "cellular telephone global positioning system (GPS) location information ... if available," and the "identification of the physical location of the target cellular telephone." But that is not all it said: it specified in some detail the manner in which that information was to be collected—from the service provider. "Such service provider," it stated, "shall initiate a signal to determine the location of the subject's mobile device on the service provider's network or with such other reference points as may be reasonably available[.]" It "[a]pprove[d] the release of information," not the use of a device that would allow the MPD to track Patrick's phone on its own. While it also "authorize[d] the identification of the physical location of the target cellular phone," the context implied that the identification would be derived from information released by a service provider. I take these limitations, built into the warrant, seriously; they circumscribe the authority granted by the warrant just as surely as a physical limitation to the house but not the garage, or vice versa, would do. 

At oral argument, the government argued that the warrant authorized it to obtain Patrick's location with no restrictions on how it went about accomplishing that task. It relies on Dalia v. United States, 441 U.S. 238, 257, 99 S. Ct. 1682, 60 L. Ed. 2d 177 (1979), which held that a warrant was not defective for lack of particularity where it authorized police officers to install an electronic listening device in the defendant's office but did not specify that the officers would covertly enter the premises to do so. Dalia noted that "the specificity required by the Fourth Amendment does not generally extend to the means by which warrants are executed." Id. But that statement must be understood in context. Here, the device itself is what is at issue. Because of its capabilities, the way it was used could affect the scope and location of the search itself. 

We are in all likelihood not looking at two interchangeable tools for gathering exactly the same information. If the facts ultimately show that the MPD had gathered the identical information in the same manner that Sprint would have used, I would concede that there is no problem. In such a case, the only difference between using the Stingray and obtaining the information from Sprint would be who gathered the information. And the majority may even be correct that the government's regrettable lack of candor about the manner of the search is not enough by itself to render the search unconstitutional. Under these circumstances, there would be no additional privacy intrusion from the use of the Stingray, and the misrepresentation would not affect whether there was probable cause for the search. See United States v. Mittelman, 999 F.2d 440, 444 (9th Cir. 1993) (holding that because "only false statements that are material in causing the warrant to issue will invalidate it," "misstatements regarding the manner of a search do not bear on the issue of whether the search itself was justified" under the Fourth Amendment (quoting United States v. Ippolito, 774 F.2d 1482, 1485 (9th Cir. 1985))); see also Franks v. Delaware, 438 U.S. 154, 156, 98 S. Ct. 2674, 57 L. Ed. 2d 667 (1978) (warrant based in part on false statements is void if "with the affidavit's false material set to one side, the affidavit's remaining content is insufficient to establish probable cause"). This means that the critical questions in a case such as this one, where a much more sophisticated device is used, are how the Stingray was used, how it works, and whether, conceptually, it "searched" Patrick's phone in the same manner that Sprint would or much more intrusively. 

According to extra-record information provided by amici, the Stingray is different in kind, not just in degree. On this record, we do not have sufficient information to say whether that is right or wrong. We do not know whether the warrant's authorization of Sprint to "initiate a signal to determine the location of the subject's mobile device on the service provider's network or with such other reference points as may be reasonable available" also describes the working of the Stingray that was used. If so, perhaps all is well. If the Stingray works in a different manner—for instance, by forcing the cell phone to transmit location data housed inside the cell phone rather than using a signal to locate the cell phone on the Sprint network—it might not. See C. Justin Brown & Kasha M. Leese, Stingray Devices Usher in A New Fourth Amendment Battleground, 39 CHAMPION 12, 14 (2015) (arguing that cell-site simulators engage in "electronic...intrusion" possibly constituting trespass because they force cell phones to transmit information that they would not otherwise). The relevant point is that a location warrant does not (without saying more) authorize a search of the contents of the cell phone itself. If that is the right way to describe what the Stingray did, its use would constitute an impermissible search, and the gun would be fruit of the poisonous tree. At this point, we do not have the facts to say.