Debate: The DC Court of Appeals Was Wrong, Stingrays Shouldn’t Require A Warrant

Ed. Note: Following the District of Columbia Court of Appeals decision in Jones v. United States, holding that the use of a “Stingray” cellsite simulator required a warrant under the Fourth Amendment, Andrew King and Chris Seaton were challenged to debate whether the Third-Party Doctrine or the Supreme Court’s Riley v. California decision should control. This is Andrew’s argument.

In the good old days, you traveled on a horse, read by candlelight, and communicated face-to-face. That was how your dad, your grandfather, your great-grandfather, and so on did it. Things changed, sure, but not nearly at the pace they do now, as we rely so much on digital technology. In the dark days before the Starbucks app, no one knew what the new coffee flavor was, or even that they could get a star for buying a coffee.

The young tend to readily adopt the technology, while the old might ignore or resist the technology until it becomes impossible. Beside the horror of not being notified of the moment Pumpkin Spice Lattes become available, this means that the old tend to have a poor idea of even the basics of the technology around them. It’s kinda cute that my mom signs her name to Facebook posts. But when the best way a U.S. Senator can explain the internet is by declaring it isn’t a truck, technological ignorance is a more significant problem.

Likewise, judges trying to apply legal doctrines to cutting edge technology can be a hit or miss activity. Unfortunately for all of us, judicial opinions are more durable than the taste of the gross penny candy your grandma gave you that was all the rage before the Hindenburg became artwork for a Led Zeppelin album.

Recently, the D.C. Court of Appeals reviewed the warrantless use of a stingray by law enforcement. And it turned out about as well as being the house that passes out wax lips to kids on Beggar’s Night. There were three different opinions with a lot of cites, analogies and similes, but very little elucidation. The lead opinion helpfully quotes testimony from the trial court, but it’s pretty clear the judges in the majority didn’t really understand what was being said. In fact, the lead judge concluded that the device’s normal operation was a security flaw. When you’re a judge, misunderstanding technology isn’t endearing or cute.

Your cell phone is basically an expensive paperweight until you turn it on. At that moment a series of pre-programmed activities happen to make your very expensive two-way digital radio seem nothing like the walkie talkies you played with as a kid. But the essential technology is very much like your walkie talkies. The phone using a two-channel radio to send and receive information from a nearby cell tower.

In order for your phone to send and receive calls, one of the first things the phone does is send out a signal to attempt to find a cell tower. It’s like yelling in the dark “Is anyone out there?” In most places a tower will respond and some information is exchanged. If everything works as expected, the tower will register the phone, associate it with the subscriber’s billing information, and give the phone a temporary identification number. After that initial connection, the phone will connect to the tower to make calls or to send texts or data.

If the phone has been idle for a long time, the tower will page the phone and ask if it’s still in range. This is what is sometimes referred to as a ping. For the usual millennial user, the phone is regularly contacting the tower; so, the tower does not normally need to ping the phone. Even if you’re not actively using it, your apps are probably checking in with the tower every few minutes to see if there is any data, like emails, to be received.

As your cell phone moves, the process is repeated with the now-stronger tower, which will take the handoff from the original but now-weaker tower. A more streamlined version of what happened when you powered on your phone registers you at the new tower. All of this typically happens within milliseconds, without you being aware that it happened. And the cell phone companies do this for one reason: to charge you money. The system ensures that you can easily make and receive calls, for which you’ll pay. And the system ensures that all of your activity is recorded so you can properly be billed for what you do.

The upshot of this is the cell company constructively knows approximately where your phone has been and all the reasons and times you connected to the tower. And any time you connect to the tower, the company constructively knows where you’re situated in real time. Generally speaking, the company doesn’t really care where or what an individual subscriber is doing at any one time. No matter what your mom tells you, you’re just too insignificant to matter.

On the other hand, this same information has a tremendous law enforcement use. They often care where a specific person was and at what time. While the cell phone companies collect this data to bill you for a service, the same data can be used to incriminate you. If you’re passingly aware of hot legal issues, this implicates the third-party doctrine. In essence, it means that if you voluntarily reveal information to a third person, the government cannot stand in any worse position than the person to whom you revealed the incriminating information. Thus, the doctrine usually obviates the warrant requirement.

Currently, the Supreme Court is reviewing this doctrine and the Stored Communications Act in the context of historic data. The issue before the D.C. Court of Appeals was about the use of a Stingray to discover the current location of a suspect. The Stingray device simulates a strong cell tower, inviting phones to connect to it instead of a weaker cell tower. The cell phone doesn’t care about this new cell tower when it’s sitting idle. But whenever the cell phone needs to connect to a tower, it notices this stronger signal. This leads the phone to act as it does whenever it encounters a stronger signal, which is that it communicates with the Stingray and attempts to use it as its new tower.

Previously, the Seventh Circuit reviewed the use of a Stingray and concluded that it was not a search for Fourth Amendment purposes. The D.C. Court of Appeals only managed to cite this opinion once, in the dissent. The concurring judge did acknowledge that the Third-Party Doctrine could be dispositive, but, like the lead judge, wrongly concluded that the Stingray took functional control of the phone. We can safely guess that the judge probably ate candy cigarettes as a kid.

Contrary to the judges’ misunderstanding, a Stingray doesn’t hijack the phone. It functions much more like a honeypot. The cell phone must attempt to contact a cell tower in order to work. It’s an inherent and necessary feature of the phone. Your phone broadcasts information out each and every time you use the phone, even if it’s a background app. It’s a signal that is available to anyone that chooses to listen. Thus, it’s not a search; it’s capturing a broadcast radio signal the device voluntarily sends out to get service. Don’t like that? Don’t use a cell phone.

The lead opinion also appeared concerned that the Stingray allowed law enforcement to track the phone in real time. The judge seemed to conflate the capabilities of the Stringray with the GPS monitoring that was at issue in another Jones case. The Stingray has a limited range, as it must stay within in the range of the cell phone’s broadcast antenna. This makes this technologically similar to the search approved by the Supreme Court in Knotts. This is quite in contrast to the satellite-based GPS technology at issue in Jones.

A user of the cell phone can’t, on the one hand, broadcast this information that any antenna tuned to the right frequency can pick up, then on the other claim that the government can’t use its antenna to tune into that frequency. If the judges understood the technology better, it is quite likely that they would have joined the Seventh Circuit and found that using the Stringray is not a search.

Rebuttal: The long-suffering Tennessee Vols fan, Chris Seaton, makes the common mistake of wanting to prohibit Stringrays because cell phone technology is new and different, thus somehow exempting it from legal doctrines that came before.

First, it is wrong to take the approach cell phone + Riley = warrant. Riley focused on both the quantity and quality of data cell phones contained. With just 32 GBs, a phone can hold thousands of photos, a lot of video clips, and up to 32,000 document files. The “meta data” being broadcast from the phone to any listening cell tower or Stringray is much, much less. It’s far more akin to a magstripe on a credit card than the Scrooge McDuck-like vault of personal information carried in your pocket.

Second, the fact that a Stingray can use the signal from the transmitting phone for location is arguably sensitive information. But the Supreme Court has already held that using a radio transmitter to find a person’s location is not a search. The mere fact that the radio transmitter is attached to a cell phone shouldn’t change the analysis. Moreover, if the Stingray does indeed impede the use of the cell phone, that’s something likely to tip off the subject, making the likely duration of the surveillance relatively brief, which should also satisfy the concerns in Jones.

Third, you don’t have a reasonable expectation to privacy in what you expose to the public. Even if the cell phone user is unaware of it, even an idle cell phone will occasionally broadcast a signal containing some identifying information and which will reveal your general location. The government is merely listening to this broadcast and using a piece of technology to find you. That’s something even a gender studies major should be able to figure out.

P.S. The Vols won a National Championship in 1998 only because the media chose the inferior Florida State Seminoles to play them.

24 thoughts on “Debate: The DC Court of Appeals Was Wrong, Stingrays Shouldn’t Require A Warrant

  1. Dan

    So your argument relies primarily on insulting the judges, and secondarily on misstating how a Stingray operates (whatever else it may be, a Stingray is not simply a passive listener). Perhaps not the most effective.

  2. Richard Kopf

    Andrew, CLS leaves half-eaten corndogs from Vols games in his trash can when he schleps the can to the street. I think pings are like corn dogs.

    All the best.

    RGK

    1. CLS

      Judge:

      If you’re still smarting over the Bowl game, please allow me to humbly submit the Vols had difficulty beating UMass on Saturday. Forgive my coarse language, but it’s fucking UMass! My four year old’s pee-wee team could beat UMass on any given day.

      Best,
      –CLS

      1. Richard Kopf

        CLS,

        I will one-up you! Nebraska lost to fucking Northern Illinois! Having paid for the best team that money can buy, we want a refund. The center is not holding.

        All the best.

        RGK

  3. Jim Tyre

    Andrew,

    Approximately two years ago, DOJ adopted a formal policy requiring a warrant based on probable cause as a condition to using a cell site simulator. (Exigent circumstances and one other exception apply.) It’s only a policy, not a court decision or a statute. And it only applies to federal law enforcement agencies, so it wouldn’t have applied here (or in the Seventh Circuit case). Still, DOJ isn’t famous for requiring more than what it thinks the law requires. Your take may not be as cut and dried as you present it.

    Doing this at the end to make it easy for Scott to delete should he so choose. Link to the policy: https://www.justice.gov/opa/file/767321/download

    1. SHG

      Still, DOJ isn’t famous for requiring more than what it thinks the law requires. Your take may not be as cut and dried as you present it.

      Aside from its irrelevance here (but relevance is for kids), the DoJ adopted a number of palliative policies to undermine momentum for law or decisions that could impose greater constraints during the Holder days. Breaking Apple cellphones, anyone? And when one is debating, it’s not a matter of “cut and dried,” but an argument in support of a position. Remember the old Lincoln/Douglas debate? You were there, right?

  4. Paul L.

    “The government is merely listening to this broadcast and using a piece of technology to find you.”
    Stingrays are not just listening. Stingrays pretend to be a cell tower and broadcast back to the cell phone.

      1. Patrick Maupin

        True, but the description of the order of events in the post (and in the comment above) was incorrect. The reason that the Stringray must transmit is that cell phone communications are encrypted, so the Stingray cannot determine location by passively listening to a conversation between the cell phone and a third party tower; it must entice the target cell phone into communicating with it.

        So, the only reason the cell phone transmits any information to the Stingray is because the Stingray transmits first — it continuously sends signals designed to fool the cell phone into thinking that the Stingray is a legitimate cell site belonging to a network that the cell phone owner would want to communicate with.

        Every cell tower is the master of radio discipline on its frequencies within its geographical area. When your phone shows “searching for network” it is not madly sending radio waves to see if there is a listener; it maintains radio silence until it detects a tower it thinks is suitable, and even then only responds within the correct timeslot when that tower asks “are there any new phones around here that would like to attach to the network?”

        A honeypot sits passively waiting until a bad actor communicates with it, and then it responds. To the extent the analogy is apt, it is the cellphone that is the honeypot, and the Stingray that is the bad actor.

        This distinction about who transmits first may still be legally irrelevant — smarter minds than mine can decide that — but it always smells like a strawman is being set up when the fundamental ordering of the information exchange is described so inaccurately.

        Another potential issue with active transmitters as opposed to passive receivers is that FCC laws and regulations might be implicated.

        1. SHG

          It’s one thing to point to a distinction you believe to be significant. It’s another to note what’s said without noting more. One has a point. The other is noise. If there is a point to be made, make it.

          1. Patrick Maupin

            The Stingray lies about what it is and solicits new cell collections.

            Is an FBI agent allowed to don a brown uniform with a logo, walk into a business and ask if there are any boxes to be sent via UPS, and then collect the proffered boxes? If so, fine, the distinction is irrelevant and that comment and this one are both noise. But if not, maybe the distinction is relevant, because that analogy is much closer to what’s happening here than the stupid honeypot one.

            1. Aaron Grossman

              Any security researcher (nee hacker) will immediately discount calling this a honeypot – it’s a textbook man in the middle attack. Your Ferrari would need zipcar stickers and a lookalike website to even come close. Patrick’s shipper analogy is dead on, including the metadata collection and secondary targets collected – particularly if your sheet then delivers said packages to the nearest UPS depot.

            2. Patrick Maupin

              That’s even more ridiculous. The Ferrari attracts actors with bad intent. The Stingray is pretending to be a cell tower belonging to AT&T, T-Mobile, Sprint, etc. — an electronic agent of a legitimate entity, offering its services to all phones — the electronic agents of people who have legitimate business relationships with that legitimate entity, and whose phones have conducted literally millions of legal, indistinguishable handshakes with actual cell towers.

              When the man in the brown uniform enters the office, he is unthinkingly handed the stack of boxes.

            3. Andrew King

              You’re mixing metaphors here, which is leading to confusion. The contents of the communication are usually encrypted by the phone at transmission to the tower. If I want to listen to the content of the call, I have to break the encryption. If I want to know the unencrypted “handshake metadata” the phone transmits to the tower, I only have to listen to the right frequency. That’s nothing like stealing a package by deception.

              And even if assume that the Stringray is the device that initiates the “handshake” between itself and the phone, the unavoidable fact is that phone responds within its normal operation. The broadcast always exposes certain unencrypted information to the public.

            4. Patrick Maupin

              “I only have to listen to the right frequency.”

              I may be mixing metaphors, but this is active misdirection.

              Listening is a passive activity, which does not require the man-in-the-middle attack that a Stingray is capable of.

              Nobody is complaining that the cops are out there using radio scanners; everybody is complaining that the cops are out there deceiving cellphones into connecting to fake cell towers.

            5. Patrick Maupin

              ” the unavoidable fact is that phone responds within its normal operation. ”

              This is no different than the unavoidable fact that the receptionist’s normal operation is to hand over all the boxes to the man in the brown uniform.

  5. KP

    So, should someone want to do something they don’t want the authorities to know about they just swap phones with someone else, or maybe pop in a SIM card that came in from China or the USSR with a spoofed account.

    By the time the aurthorities finally solve a new problem the solution is out of date.

    Oh no! That lovely maths verification has turned into the stupid pictorial thing!

  6. Phillippe du Poisson

    I’m late to this but a couple of points. “you don’t have a reasonable expectation to privacy in what you expose to the public”: This is not public. The phone connection is to the tower. The public has no access to that data.

    “The mere fact that the radio transmitter is attached to a cell phone shouldn’t change the analysis.” If I am to use a phone I must employ a specialized radio transmitter. This isn’t like I’m a ham radio operator, there are hundreds of these transmitters on every street. The way the police can identify the location of a particular transmitter is with the metadata recorded by the phone company – again not public information.

      1. Phillippe du Poisson

        Yes, I was pretty stupid. At least I can cross off getting scolded by SHG from my bucket list.

        Looking at your third party article, you don’t mention the word public once in that context. Would not ‘expose info to others’ (or in fact to a third party) rather than using ‘to the public’ cause less confusion? It is unfortunate that the clear meaning of a common word is being so twisted – this isn’t the first time I’ve seen it used this way which was why I responded.

        1. SHG

          It’s just how it’s referred to, and while it may seem confusing, it’s common in the context of the Third-Party Doctrine. The problem isn’t that you were stupid (ignorant, perhaps, but not stupid), but that your comment was.

          And I don’t scold. That would be wrong. I do, occasionally, inform in a slightly harsh manner.

Comments are closed.