In Court: Uncovering Stingrays, A Troubling New Location Tracking Device

The ACLU and Electronic Frontier Foundation have filed an amicus brief in what will be the first case in the country to address the constitutional implications of a so-called “stingray,” a little known device that can be used to track a suspect’s location and engage in other types of surveillance. We argue that if the government wants to use invasive surveillance technology like this, it must explain the technology to the courts so they can perform their judicial oversight function as required by the Constitution.

The case is highly significant for two reasons. First, it shows that the government is using new types of technology—not just GPS and cell site location records—to track location. Second, it shows that the government is going to great lengths to keep its surveillance practices secret. The government is hiding information about new surveillance technology not only from the public, but even from the courts. By keeping courts in the dark about new technologies, the government is essentially seeking to write its own search warrants. That’s not how the Constitution works.

We filed an amicus brief in the case of Daniel Rigmaiden, who is being criminally prosecuted in federal court in Arizona for allegedly filing fraudulent tax returns. Last fall, the Wall Street Journal reported on the government’s use of the stingray device in Rigmaiden’s case. Stingray is the name of a particular product sold by the Harris Corporation. The more generic term for the device is “IMSI catcher,” in reference to the unique identifier, or International Mobile Subscriber Identity, of wireless devices.

Several aspects about stingrays are important to understand from a privacy perspective.

First, they collect information about the devices and whereabouts of third parties, not just the targets of an investigation. As noted above, IMSI catchers mimic a wireless carrier’s network equipment; in doing so, they send and receive signals to and from all mobile devices in the vicinity on the same network.
Second, the devices can pinpoint a target with extraordinary precision. Some have an accuracy of two meters. This means that individuals can be tracked even when they are inside their homes.
Third, although the government says the device used in Rigmaiden’s case was not capable of capturing the content of communications, many IMSI catchers offered for sale by surveillance vendors offer this feature. IMSI catchers can thus be used for eavesdropping, not just location tracking.

The government in Rigmaiden’s case acknowledges that using the stingray was a “search” within the meaning of the Fourth Amendment. So far so good. But then it claims that it got a “warrant” to authorize the search. The problem, however, is that the papers the government submitted to get the so-called “warrant” never told the judge that the government wanted to use a stingray (or IMSI catcher, or cell site emulator), what the device is, or how it works. In other words, the government hid from the judge the facts that stingrays collect information about third parties, that they can pinpoint targets even within their homes, and that some models capture content, not just location. It was essential for the judge to have all of this information in order to make a meaningful, informed decision about whether the search the government sought to undertake was constitutional, and if so, whether the court should have imposed limitations on the scope of the search.

Because stingrays are indiscriminate, highly intrusive devices that obtain information from all nearby third parties on the same cellular network, and not just the target of an investigation, there is a serious question whether they can ever be used consistent with the Fourth Amendment. But at a minimum, the Fourth Amendment means that the government can’t hide new surveillance technologies from the courts. Some judges are pushing back against this practice and denying broad surveillance requests when the government fails to explain the technology. Judges are not rubber stamps—they are constitutional safeguards of our privacy.