The FBI is taking extraordinary and potentially unconstitutional measures to keep local and state police forces from exposing the use of so-called “Stingray” surveillance technology across the United States, according to documents obtained separately by the Guardian and the American Civil Liberties Union.
Multiple non-disclosure agreements (NDAs) revealed in Florida, New York and Maryland this week show federal authorities effectively binding local law enforcement from disclosing any information – even to judges – about the cellphone dragnet technology, its collection capabilities or its existence.
In an arrangement that shocked privacy advocates and local defense attorneys, the secret pact also mandates that police notify the FBI to push for the dismissal of cases if technical specifications of the devices are in danger of being revealed in court.
The agreement also contains a clause forcing law enforcement to notify the FBI if freedom of information requests are filed by members of the public or the media for such information, “in order to allow sufficient time for the FBI to seek to prevent disclosure through appropriate channels”.
The strikingly similar NDAs, taken together with documents connecting police to the technology’s manufacturer and federal approval guidelines obtained by the Guardian, suggest a state-by-state chain of secrecy surrounding widespread use of the sophisticated cellphone spying devices known best by the brand of one such device: the Stingray.
Made by Florida-based Harris Corporation, the Stingray and similar devices are known as IMSI-catchers or cell-site simulators.
Often not much bigger than a suitcase, the devices are easily portable. They gather information by imitating cellphone towers, scooping up metadata from all devices that connect to the fake tower. Experts told the Guardian that the devices may also be capable of gathering content from phones that connect to them.
The secrecy required by such NDAs is perhaps why information on the use of Stingrays by local police forces remains scarce after years of probing by civil-liberties advocates – and why the true scale of the technology’s use is unknown. But other documents recently obtained by the Guardian and the ACLU hint at how widespread the practice might be.
The ACLU has shown that at least 48 agencies across 20 states likely use the devices. Documents obtained by the Guardian show police from states as such as Texas, Florida, Washington, Minnesota, Virginia, Florida, Maryland, Illinois,Arizona, and California utilize the devices.
The Florida agreement – obtained from the Hillsborough County sheriff’s office by the Guardian after a series of Stingray-related Freedom of Information Act requests sent over the past seven months – reads in part:
“The Florida Department of Law Enforcement will, at the request of the FBI, seek dismissal of the case in lieu of providing, or allowing others to use or provide, any information concerning the Harris Corporation wireless collection equipment/technology, its associated software, operating manuals, and any related documentation.”
Law enforcement agencies that sign NDAs similar to the one in Hillsborough County are barred from providing “any information” about the Stingray-style devices in search warrants, pre-trial hearings, testimony, grand jury proceedings, in appeals or even in defense discovery. Per the agreement, police can only release the “evidentiary results” obtained with the device.
And if the police think a prosecutor is “considering” including such information in a trial, they must notify the FBI, “to allow sufficient time for the FBI to intervene to protect the information/technology and information from disclosure and potential compromise.”
In other words, police can tell the courts about the information they found with the portable spy gadgets – just not how they found it.
“It reminds me of what happens in totalitarian countries: you don’t know what the hell is going on,” said law professor Bruce R Jacob, the former dean of Stetson law school in Florida, when shown a copy of the NDA for Hillsborough County, which includes the Tampa metropolitan area.
“That’s an interference by the FBI and this company, and FDLE in the operation of the local courts,” he said.
In response to a detailed list of questions from the Guardian, the FBI sent a copy of an affidavit from 2014 by supervising special agent Bradley Morrison, chief of the agency’s tracking technology unit.
The FBI affidavit states that the agency believes cell-site simulator devices are exempt from discovery because information “could easily impair use of this investigative method”, and affirms the agency’s policy of secrecy on the matter.
“Disclosure of even minor details about the use of cell site simulators may reveal more information than their apparent insignificance suggests because, much like a jigsaw puzzle, each detail may aid in piecing together other bits of information even when the individual piece is not of obvious importance in itself,” the affidavit states.
The Florida department of law enforcement (FDLE) and its subsidiary in the Hillsborough County sheriff’s office did not respond to requests for details from the Guardian. Harris Corp said Thursday it could not comment.
The FBI’s extreme secrecy: ‘Interfering with the courts’
Two additional versions of similar Stingray NDAs – only with different county names – were obtained this week, one following a lawsuit against the Erie County sheriff’s office by the ACLU of West New York, and the other by a Baltimore defense attorney trying a city carjacking case.
An equipment grant authorization document obtained by the Guardian from the Federal Communications Commission (FCC) states that local police must coordinate with the FBI to use Harris Corporation’s devices. “State and local law enforcement agencies must advance coordinate with the FBI the acquisition and use of the equipment authorized under this authorization,” the document states.
And similar NDAs have also been obtained – albeit in heavily redacted form – in Washington state andMinnesota.
“The dynamic we’re seeing is the federal government leaning heavily on local police,” ACLU staff attorney Nathan Freed Wessler said. “Even departments who have said that they would like to be more transparent are being prevented from doing so by this agreement that they’re being forced to sign.”
The provision for pushing cases for dismissal rather than reveal information about Stingray capabilities and scope, he said, represented “the FBI’s consistent policy of making local police maintain extraordinary and extreme secrecy”.
Jacob, the law professor who has reviewed the pacts, said they were “interfering with the operation of the courts” and judges’ ability to evaluate whether a search and seizure involving Stingray technology is even constitutional under the fourth amendment. He said the NDA could also interfere with fair hearings, allowing some defendants to walk free while others are convicted on the basis of the evidence obtained with such devices.
“The defendant who finds out about this is able to get his case dismissed, and the other defendant can’t? That’s unfair.”
From Baltimore to Tampa to Stingray HQ: ‘Your phone calls are at risk’
Despite the sweeping NDAs that law enforcement offices like the Hillsborough County sheriff have signed, local departments have recently struggled to keep a lid on their use of the dragnet.
In Baltimore on Tuesday, police revealed another example of the FBI non-disclosure agreement in court – and also that they had used Stingray technology 4,300 times since 2007, according to defense attorney Joshua Insley. In other cities across the country – from Texas and Minnesota to California and Washington state – the Guardian has obtained invoices, purchase orders and training documents confirming the use of Stingrays.
In June 2014, according to a training request obtained by the Guardian, Hillsborough County detective Mark Gilbertson wrote that the FDLE would pay $5,000 for 11 days of “necessary training” at the Harris Corporation’s base in Melbourne, Florida, on a $780,000 “piece of cellular equipment”.
The exact type of device remains unclear, but the request said the training was “vital to the sheriff’s office” and that “only” one other employee at the office was “actively trained in this equipment”.
In its freedom of information response to the Guardian, the Hillsborough sheriff’s office refused to hand over any training materials, saying they were the property of Harris Corporation and “proprietary”. The NDA bars “direct or indirect statements to the media” about Harris corporation equipment.
John Sawicki, a former police officer who founded Forensic Data Corp, a company that consults attorneys on technological evidence, said “one of the problems we have is we don’t know for sure” what Stingrays specifically can even do, wherever they are used.
“When you get an officer into a deposition and ask what the capability of the device is, they say, ‘Well I can’t get into it because of the NDA.’ We’re left to speculate a bit as to what the device can do,” he said.
“We believe that, at least in some cases, the device has the ability to pull content, so all the sudden your text messages are at risk, your phone calls are at risk, and your data transmission, potentially.”
The NDAs drastically reduce courts’ access to documents on the devices. With provisions that restrict defense attorneys’ discovery, pre-trial motions, testimony and even court orders, defense attorneys say even basic due process has become frustratingly difficult.
For example, the FBI-police pact would make it impossible to determine whether local law enforcement were properly trained to operate the surveillance devices.
In most cases, law enforcement only need to apply for a court order known as a ‘PEN register’ to use a Stingray, based on 1986 legislation designed to track outgoing calls from a land-line phone.
Brian Owsley, a former Texas judge and now law professor at the Indiana Institute of Technology, said the judicial standard for granting PEN register applications was “very low” – it does not require ‘probable cause’ – and woefully inadequate to cover technology with bulk collection capabilities like Stingray. He also said judges themselves may not understand how powerful the devices are.
In any case, Owsley said, police officers from any jurisdiction with access to the devices could also simply choose to use them off the books.
When judges attempt to compel the FDLE to release information about the tracking devices, the state police agency must forward such notices to the assistant director of the FBI’s Operational Technology Division, and to the chief of the Technology Tracking Unit in Quantico, Virginia. Freedom of Information requests are also forwarded to the two department heads.
This kind of sweeping secrecy has led to tense exchanges in courtrooms, and thecrumbling of prosecution’s cases, as they attempt to maintain secrecy. City councils may even be unaware that the police departments they oversee are using the devices if the local force has signed similar agreements with the FBI.
Now, defense attorneys appear to be catching on to the practice. In Tallahassee, Florida, the ACLU has amassed a list of more than 300 cases where they believe Stingrays have been used to locate clients, and at least one Florida case recently came undone when defense attorneys began to dig into the involvement of Stingrays.
There, a robbery defendant took a plea bargain of six months probation after defense attorneys started asking questions about how police found her client.