After facing tough questions not just from civil liberties advocates and criminal defense attorneys, but also from members of congress and the national press, the Department of Justice has today issued a policy requiring, absent special circumstances, federal law enforcement officials to obtain probable cause backed warrants before deploying controversial cell phone surveillance devices commonly called “stingrays.” The new policy also requires DOJ entities like the FBI, US Marshals, and Drug Enforcement Administration to keep records of each time they use a cell-site simulator, including when the technology is deployed in the service of a state or local police operation, and in emergencies when warrants aren’t required.  

Up until now, the DOJ’s official policy was that law enforcement officials did not need to get warrants to use cell site simulators to track or collect call or other metadata records from cell phones. Now, except in emergencies and some other vaguely defined situations (read: anything to do with the concept of “National Security” or “organized crime”), DOJ is clearly instructing its prosecutors to obtain search warrants before using the controversial spying devices, including those the US Marshals have been flying over our homes in planes, sucking up potentially vast quantities of information about hundreds of thousands of people. The rules also apply to joint task force operations or other circumstances in which federal agencies assist state or local law enforcement with stingray surveillance deployments.

Importantly, the rules also specify that FBI and other federal law enforcement officers must inform prosecutors that they intend to use cell site simulators when they ask for legal authority to locate a person or obtain their cell records. Prosecutors, in turn, must also notify judges that the law enforcement officials intend to use a stingray to obtain the desired information.

These parts of the new policy requiring basic transparency with courts are critical, because as we’ve seen nationwide, police do not always notify even their law enforcement partners—prosecutors—that they intend to use stingrays or like devices. And prosecutors don’t always notify judges. In some cases, federal law enforcement has even instructed local police to lie to judges about stingrays. When judges don’t know police intend to use a stingray to track someone, they probably assume the cops are going to conduct the surveillance the way they have for a long time, by demanding user information on a specific target from the target’s cell phone company.

If a judge doesn’t know the cops want to use a stingray to conduct surveillance on someone, that judge cannot impose minimization requirements as a condition of approving the surveillance request. If police don’t tell prosecutors they want to use a stingray, and prosecutors don’t tell judges, there’s absolutely no oversight or accountability mechanism in place to ensure law enforcement doesn’t use the devices to collect, retain, and deploy information gleaned from an operation to spy on target X against hundreds or even thousands of people who happen to be nearby.

That’s because of how stingrays work. In order for law enforcement officials to find target X, they need to bounce the device off the signals of everyone near the target, thereby collecting information from many people suspected of no crime. If judges don’t know cops intend to use stingrays, they can’t require as a condition of the surveillance approval that the police go back and delete information incidentally collected about people who weren’t targeted. And before this rule change, there was nothing to stop police from using that information against people in some future, even unrelated criminal investigation.

Critically, the new DOJ policy mostly plugs that hole by forbidding law enforcement from using information incidentally collected against persons not specifically named in the search warrant, unless a judge approves it.

An application for the use of a cell-site simulator should inform the court about how law enforcement intends to address deletion of data not associated with the target phone. The application should also indicate that law enforcement will make no affirmative investigative use of any non-target data absent further order of the court, except to identify and distinguish the target device from other devices.

The policy also stipulates that law enforcement must delete all collected data from a stingray when the stingray has located the device it is seeking. When the device is used to “identify an unknown cellular device,” they must delete all the other data captured as soon as they identify the target device.

The DOJ’s new cell-site simulator policy is a step in the right direction, and marks a sea change in the federal government’s public attitude about the technology. But it cannot and should not take the place of law reform that requires police at every level to obtain warrants to conduct invasive electronic surveillance. DOJ policy, as the policy itself states, is not law.

Now it’s time for advocates across the nation to use this policy change at the DOJ to support our calls for comprehensive digital privacy reform at the state and federal level. The Department of Justice has made it clear that it’s not afraid to apply a warrant standard to stingray spying. But it should not just be a policy. “Get a warrant” should be the law of the land.