Newly released documents obtained by the Electronic Privacy Information Center (EPIC) suggest that since 2010 the FBI has warrantlessly tracked cell phones using sophisticated "sniffing" equipment called Stingrays.

The documents, mostly redacted, suggest that the DOJ authorizes its law enforcement agents — some of whom work for a division called Wireless Intercept and Tracking Team (WITT), founded in 2004 — to use cell phone sniffers without warrants, as long as they obtain a secret "pen register" court order.

The FBI has previously withheld details about its use of Stingrays in warrant applications to magistrates. These newly released documents redact multiple pages of information about how agents should present in court information gleaned from Stingrays, strongly implying that the practice continues.

It would make sense for the FBI to withhold that information from the public, because in May 2013 a federal judge found that the FBI did not break the law when it failed to disclose in a warrant application for location tracking the fact that the bureau intended to use a Stingray. The ACLU argued that the FBI should be required to disclose the method of location tracking in warrant applications because judges should have the opportunity to restrict intelligence collection (and privacy harms) through minimization procedures attached to the warrant. Unfortunately, we lost that case; worse still, the judge found that cell phone users don't have a Fourth Amendment right to protect their identities or locations from law enforcement who use Stingrays.

All of that makes it even more likely that the FBI is currently using Stingrays to track cell phone users without warrants. The newly release documents strongly suggest that, in place of warrants, agents use a particular kind of order issued under an outdated legal regime. A US magistrate judge says this legal framework fails to strike the right balance between privacy and security, in favor of government secrecy and at the expense of democracy. It’s likely, US Magistrate Stephen Smith wrote, that “far more law-abiding citizens than criminals have been tracked” under this regime.

Court orders but not warrants: (d) orders and warrantless location tracking

The 2703(d) orders, authorized under the Stored Communications Act, part of the woefully obsolete Electronic Communications Privacy Act (ECPA) of 1986, allow the government to obtain private information about us even if there is no allegation that the items to be searched will produce evidence of a crime. The lesser legal standard applied here is called “relevant and material.” 

Law enforcement can get a (d) order if they show a judge — in secret proceedings that the surveillance target will likely never find out about — that the information officials want is relevant and material to an ongoing investigation. This is a much lower threshold than that required to obtain a probable cause warrant, the gold standard of American justice. To get a warrant, the government has to convince a judge that the items to be searched will produce evidence of a crime.

Getting a warrant is therefore more difficult, and this standard prevents police and agents from conducting broad fishing expeditions during the course of investigations. Warrants further protect our privacy by allowing the issuing judge to impose specific limits — or ‘minimization’ standards — on the government’s search. 

Lesser noticed amidst all the talk about the FISC serving as a rubber stamp for the NSA’s signals intelligence collection is the fact that there’s been another rubber stamp surveillance system operating under our noses for quite some time — and this one is aimed squarely at the American public.

Like with the NSA, the (d) orders regime is rife with secrecy gone wild. 2703(d) orders often come with gag provisions, which bar the recipient (whether a telecom, internet service provider, bank, or internet communications company) from disclosing the existence of the order to the target of the surveillance. Therefore if the FBI uses a (d) order to track your mobile phone, but never ends up pressing charges against you, you’ll probably never know that you were subject to invasive electronic surveillance. 

It’s even possible that you would never know about the electronic surveillance if you were charged with a crime. As we now know, US officials make use of something called "parallel construction" to hide surveillance methods from courts and defendants. 

What do these distinctions between warrants and (d) orders mean in practice? Law enforcement officials can use 2703(d) orders to conduct fishing expeditions, inappropriately pry into our private lives, and obtain our real-time and historic location information even if they have no evidence to show that we are involved in criminal activity. Further, because the orders are issued in ex-parte (or one-sided) legal proceedings in which only the government and the court confer, we might never find out that our privacy was invaded by this prosecutorial tool — even if we are charged with a crime as a result of the ensuing surveillance.

The FBI and Stingrays: secret surveillance with scant oversight

The documents released to EPIC in early October 2013 describe only one type of location tracking: the kind executed with high-tech ‘cell phone sniffers’ called Stingrays, manufactured by the Harris Corporation. The FBI calls this technology ‘triggerfish’. 

The low legal bar to surveillance set out in the 2703(d) framework is particularly dangerous when it comes to Stingrays, because officials do not need to obtain agreement or information from third party providers like cell phone companies. With these tools, the FBI can simply go over the heads of our telecoms and straight into our phones. (To learn about how Stingrays work, click here.)

The records are heavily redacted, and so it’s difficult to get a sense of just how frequently the FBI uses this technology to target cell phone users. But the documents make clear that the Bureau is much more interested in training its agents on how to use the technology than it is in instructing them in how to protect privacy or abide by the law. At one FBI-WITT training event, the documents show, attendees spent two full days learning how to use the Stingray device. Meanwhile, according to the agenda (which is mostly unredacted), they spent ten full minutes talking about the law. That very well may be because the legal regime the FBI has instituted to govern Stingray surveillance is very simple: get a 2703(d) order.

EPIC acquired the documents after filling suit against the FBI for failure to substantively respond to its request for information about how the government agency uses cell phone sniffers, also known as IMSI catchers. One of the things EPIC wanted to find out was what legal justifications and standards the FBI employs when it seeks to use Stingrays to locate, track, or obtain communications from a surveillance target.

The ACLU has long wondered the same thing — and we’ve been stonewalled.

Legal experts and privacy advocates have been scratching our heads on the cell tracking question ever since, in US v. Jones, the Supreme Court ruled that the government must get a probable cause warrant to install a GPS device to track a car. How, we have been wondering, does the Jones ruling affect law enforcement procedure when it comes to tracking our physical locations through our cell phones? Does the FBI think it needs a warrant to track our cell phones? If not, is there a specific timeframe in which warrantless tracking is seen as legitimate? If so, for how long does the DOJ think it can track us before it is required to get a warrant?

The ACLU asked the Department of Justice those very questions in the wake of the Jones ruling. The DOJ refused to answer them. What that effectively means is the federal government’s legal framework for location tracking is secret. That’s still largely true, as evidenced by the FBI’s response to EPIC’s request. The FBI provided no legal memos or detailed insights into the agency’s cell tracking legal regime. Therefore while the documents strongly suggest that the FBI uses 2703(d) orders to warrantlessly identify and track cell phones using Stingray devices, we don't know if there is a temporal threshold that agents could cross, triggering a warrant requirement.

The FBI produced no legal memos in response to EPIC's request and lawsuit. Instead, it sent this slide presentation, the substantive content of which was entirely redacted.

The ACLU is back in court to push for the release of the DOJ's location tracking memos. Until we can see them, we are still largely in the dark about exactly how the FBI uses its authorities — and technologies like Stingrays — to shadow our movements in real time and retroactively. Thanks to the newly released EPIC documents, we have a pretty good idea that if the government is compelled to disclose them, we aren't going to like what we hear.

That shouldn't come as a huge shock, given that the DOJ has previously stated Americans have "no privacy interest" in our location information. If you think that's absurd and dangerous, and you don't want to wait for the courts to settle the issue in the spotty and inconsistent manner that's occurring nationwide today, take action now.