Sure, those of us who focus on cool stuff used by cops have been aware of the existence of the StingRay, the cell site simulator, which spoofs a cell tower to capture all cellular service within its sphere. We’re also aware that its manufacturer, the Harris Corp., sells them subject to a non-disclosure agreement.
Based upon this, federal law enforcement agencies have lied to courts and the public about its existence, its function and its actual use in particular investigations. But not because they’re bad people, but because the NDA requires them to, and they really can’t tell or the bad dudes won’t fall into their trap.
But that’s all done now, as StingRay has gone big time, gracing the pages of the New York Times. Well, “done” may not be an accurate description.
The issue led to a public dispute three weeks ago in Silicon Valley, where a sheriff asked county officials to spend $502,000 on the technology. The Santa Clara County sheriff, Laurie Smith, said the technology allowed for locating cellphones — belonging to, say, terrorists or a missing person. But when asked for details, she offered no technical specifications and acknowledged she had not seen a product demonstration.
Sounds like a great business plan. Buy some really expensive piece of equipment that you know nothing about and no one has seen work.
Buying the technology, she said, required the signing of a nondisclosure agreement.
“So, just to be clear,” Joe Simitian, a county supervisor, said, “we are being asked to spend $500,000 of taxpayers’ money and $42,000 a year thereafter for a product for the name brand which we are not sure of, a product we have not seen, a demonstration we don’t have, and we have a nondisclosure requirement as a precondition. You want us to vote and spend money,” he continued, but “you can’t tell us more about it.”
And so the Santa Clara board, in honor of its duty of due diligence to the taxpayers it represents, did what?
Bazinga. Half a mil, sight unseen, because…
(Sheriff Smith argued to the supervisors that she had adequately explained the technology and said she resented that Mr. Simitian’s questioning seemed to “suggest we are not mindful of people’s rights and the Constitution.”)
Of course, Smith hadn’t seen a demo either, but “adequate explanations” don’t require actual knowledge. It’s all in how you tell the story. But certainly now, after committing to the half mil expenditure of other people’s money, they would be entitled to see what they’ve paid for?
A few days later, the county asked Harris for a demonstration open to county supervisors. The company refused, Mr. Simitian said, noting that “only people with badges” would be permitted. Further, he said, the company declined to provide a copy of the nondisclosure agreement — at least until after the demonstration.
Too late. You bought it already, you badge-less believers. And after all, who says Santa Clara County supervisors aren’t terrorists or missing persons? Or anyone else whose calls will be swept up by the StingRay, as it doesn’t distinguish between good guy transmissions and bad guys.
The information is generally out there about what the StingRay purports to do, that it captures “texts, calls, emails and other data” by tricking devices into believing it’s a cell tower. How it works, and what information it collects, isn’t quite as clear.
“It’s scanning the area. What is the government doing with that information?” said Linda Lye, a lawyer for the American Civil Liberties Union of Northern California, which in 2013 sued the Justice Departmentto force it to disclose more about the technology. In November, in a response to the lawsuit, the government said it had asked the courts to allow the technology to capture content, not just identify subscriber location.
Moreover, it’s unclear how wide-spread its use is, and whether law enforcement obtains warrants or conceals its use, lying to courts and defendants about the source of information used via “parallel construction,” making up a false explanation for the source of information to conceal the actual investigative means. With this, the need for, and absence of, a search warrant can also be concealed from a court and the defendant.
But it has to be, because we can’t let the terrorists (or judges) know the cool tricks available to law enforcement. And when caught, law enforcement demurs. After all, there’s the non-disclosure agreement. “Judge, we can’t violate the NDA. It would be wrong!”
“It might be a totally legitimate business interest, or maybe they’re trying to keep people from realizing there are bigger privacy problems,” said Orin S. Kerr, a privacy law expert at George Washington University. “What’s the secret that they’re trying to hide?”
Aside from the ironic use of a lawprof as knowledgeable as Orin for such an obvious quote (no doubt Orin had far more significant things to say, but this is what the reporter chose to include), therein lies the problem. You don’t know what you can’t know.
Yet, the rationale for keeping the StingRay details from everyone without a shield is that Harris Corp. says so.
Jon Michaels, a law professor at the University of California, Los Angeles, who studies government procurement, said Harris’s role with the nondisclosure agreements gave the company tremendous power over privacy policies in the public arena.
“This is like the privatization of a legal regime,” he said. Referring to Harris, he said: “They get to call the shots.”
So what if there’s a Fourth Amendment? So what if they build granite courthouses with wood-paneled courtrooms and big benches for federal judges to hide behind. Harris Corp. says no, you’re unworthy of knowing.
And like the supervisors in Santa Clara, and the judges pretty much everywhere, suck it up, accept your unworthiness with equanimity and pay the half million dollars plus. After all, you don’t want the terrorists to win, right?