Stingrays: Now Extinct in California?

Information sharing over the internet is becoming more and more prevalent across society with the drastic increase of goods and services exchanged over the internet in recent years. Even so, Americans still strongly value privacy and feel that having control over private information and how it is disclosed to third parties is of paramount importance. Citizens of California should feel a little more at ease after the California State Legislature passed two bills earlier this month providing greater privacy protections to the state’s citizens. The first bill, SB 178, would prohibit government entities from accessing electronically stored cell phone information through “physical interaction or electronic communication with the electronic device without a search warrant, a wiretap order, an order for electronic reader records, or pursuant to a subpoena issued pursuant to existing state law, provided that the information is not sought for the purpose of investigating or prosecuting a criminal offense.” A second bill, SB 741, prevents local agencies from acquiring or using  StingRays, a cell site simulator, device without gaining prior approval from the local government through an act or resolution. Both bills passed overwhelmingly with bipartisan support before being signed into law by Governor Jerry Brown.
Both SB 178 and SB 741 were enacted, in part, to combat the problem of unregulated StingRay use. StingRays are “cell phone surveillance devices that mimic cell phone towers and send out signals to trick cell phones in the area into transmitting their locations and identifying information.”While exact numbers are unknown, StringRays are used by law enforcement agencies in jurisdiction all across the country, on both the state and federal levels. The StingRay allows government authorities to pinpoint a person’s location, accurately conveying an individuals location to within several yards of actual physical location. StingRays even have the capability to “capture texts, calls, emails and other data.” Contributing to the privacy concerns of StingRay use is the high level of secrecy surrounding the device.  In order to buy the StingRay technology, a law enforcement agency must first sign a non-disclosure agreement “preventing them from saying almost anything about the technology.”  The government contends that disclosure of even minor details about the StingRay could impact law enforcements ability to use the device in an effective way. This lack of disclosure and public discussion has many wondering if such secrecy is being used to further legitimate business interests or if it’s simply being used to mask greater threats to individual privacy.
Nevertheless, the most alarming aspect of StingRay use is the fact that the device is known to inadvertently collect the personal data of innocent bystanders and not just information pertaining to the targeted individual. In some instances, the StingRay collects cell phone data within the targeted area from all cell phones using the same service provider as the targeted cell phone. Even though law enforcement officials maintain that this extraneous data is deleted, this cannot be confirmed given the lack information, oversight, and accountability surrounding the use of StingRay devices.
The United States Department of Justice has recognized the privacy threat that StingRays pose and has accordingly implemented guidelines to improve “transparency and accountability” on the federal level. On the state level, California is one of the first states in the nation to address these privacy concerns. Like the DOJ, the two California bills aim to insert more oversight and accountability into the process. It is unclear how this legislation will mesh with StingRay’s policy of requiring users to submit to a non-disclosure agreement. It is clear however, that public concern with StingRay use highlights a larger debate that is occurring within society. Law enforcement needs to be equipped with the best technology available to detect and thwart criminal activity. Law Enforcement officials do not need to be overburdened with too much government regulation. Over-regulation would only impede legitimate investigation and detection. On the other hand, this legitimate governmental interest needs to be delicately balanced against the individual’s Fourth Amendment rights and the individual’s right to control unwarranted access to private information. Only in extreme and exceptional circumstances should law enforcement’s interest in detecting crime outweigh an individual’s privacy interests.

Routine law enforcement operations do not and should not constitute sufficient grounds to allow officials to use StingRays to collect a large amount of personal cell phone data, especially when it is done under the cloak of secrecy.

 
While it remains unclear how SB 178 and SB 141 will operate in practice, they are aimed at fixing a flawed law enforcement practice. More states should follow in the footsteps of California and ensure that privacy rights are protected against the dangerous, unregulated use of StingRay devices.