Cell Site Simulators Meet the Fourth Amendment: When can the police track your phone (read: you) without a warrant?

Tweet

Disclaimer: This article was originally written for the Fall 2020 edition of the Office of the Federal Public Defender for the Eastern District of North Carolina’s bi-annual newsletter, The Zealous Advocate. This version is republished here by the same author with the permission of the Office of the Federal Public Defender.

“[M]odern cell phones . . . are now such a pervasive and insistent part of daily life that the proverbial visitor from Mars might conclude they were an important feature of human anatomy.” 

Riley v. California, 134 S. Ct. 2473, 2484 (2014)

In its inexorable march forward in the digital age, Fourth Amendment jurisprudence again encounters issues borne from technological advancements in modern policing in Andrews v. Baltimore City Police Dept. After prevailing on his motion to suppress in Maryland state court, the criminal charges brought against Mr. Kerron Andrews were dropped and the case dismissed. Mr. Andrews then sued the Baltimore Police Department (“BPD”) in federal court under 42 U.S.C. § 1983, claiming a violation of his Fourth Amendment rights to be free from unreasonable searches and seizures. More specifically, he claimed the BPD’s warrantless use of a cell site simulator—a “Hailstorm” device (distinct from the older “Stingray”)—to locate and arrest him was an unreasonable search.

Hailstorms of Surveillance

Cell site simulators are curious devices. Put crudely, they operate by mimicking cell phone towers. The Hailstorm—true to its name—accomplishes this by barraging nearby cell phones with electronic interference that forces the cell phone to connect to the simulator instead of the surrounding cell towers. When connecting to a cell tower (or a simulator), cell phones send “identifying signals” and “other data” that are collected and stored by the cell tower (or simulator). The forced gathering of these identifying signals is the essential function of using a Hailstorm device. When analyzed appropriately, this gathered data provides troves of information about the connecting devices and its digital contents—including data revealing the cell phone user’s specific geographic location in real time. In short, this means when a cell phone connects to a simulator, police can use the captured data to determine exactly where a cell phone user is.

Law enforcement agencies are quite reluctant to disclose information about these cell site simulators, which is not totally abnormal. That said, there is considerable secrecy surrounding their functionality and how pervasively the police use the technology.

Augmenting this secrecy, and germane to this case, is a 2011 non-disclosure agreement (“NDA”) the BPD entered into with the FBI regarding the BPD’s use of the Hailstorm device. The agreement strictly limits the BPD from disclosing any information about the Hailstorm device—at least not without first consulting the FBI and receiving their permission to disclose. As both the Court of Special Appeals of Maryland and the Fourth Circuit note, the NDA specifically prohibits the BPD from divulging “any information concerning [the simulator] other than the evidentiary results obtained through the use of the equipment.” That is, only the evidence gathered by the police and proffered by the State before the court may be divulged. Furthermore, this extensive limitation applies not only during ongoing litigation, but at all times and bars disclosure to virtually anyone including the public, the court, and litigants.

This shielding of further information, in conjunction with there being little information publicly available, makes it quite difficult for courts to gauge the device’s “intrusiveness.” This, of course, greatly hinders courts attempting to conduct a thorough Fourth Amendment analysis in cases involving cell site simulators. Such an analysis requires a court to ascertain the reasonableness of alleged intrusions, which depends upon the balance between the public interest and an individual’s right to personal security fee from arbitrary interference by the government. Without an understanding of the device’s functionality and the range of information potentially compromised by its use, no such balance can be struck. Perhaps more troubling than this NDA is that in circumstances potentially jeopardizing their mysterious policing-accoutrement, the FBI itself has chosen to withdraw critical evidence—even dropping entire prosecutions—over revealing how the technology works and is used.

Mr. Andrews’ Hailstorm

Mr. Andrews’ prosecution provides an example of the furtive nature in which simulators are often utilized. Unable to locate Mr. Andrews and rather than applying for a warrant, the BPD relied only upon a pen register/trap and trace order under the applicable Maryland statute to justify use of a Hailstorm device to locate him. The pen register order was purportedly requested to obtain potentially helpful location from his network provider but did not specifically identify the use of the cell site simulator technology. Indeed, the order only tangentially alluded to the Hailstorm’s presence and only vaguely described its functionality as allowing for the “duplication of facilities, technical devices or equipment . . . [to] initiate a signal to determine the location of the subject’s mobile device . . . .” Furthermore, while the order was “limited” in its application to sixty days, it did not establish any geographic boundaries for use of the device.

With the combination of his cell phone number obtained from a confidential informant and cell site location information (“CSLI”) obtained from his network provider, the BPD was able to track Mr. Andrews to a general area of Baltimore. It was after proceeding to this general area that the police began using the Hailstorm device, which then enabled them to pin-point his exact location as within a specific apartment. After tracking him down to a specific doorstep within an apartment building, they arrested and detained him until a search warrant was secured whereupon the police found him unlawfully in possession of a firearm. Crucially, one must note the Hailstorm device is what ultimately allowed the BPD to pin-point Mr. Andrews’ specific location in the apartment as the CSLI only led the police to that general area of Baltimore.

After learning of the BPD’s use of the Hailstorm device, Mr. Andrews filed a motion to suppress the contraband as the product of an unlawful search or seizure under the Fourth Amendment. After a non-illuminating hearing on the Hailstorm device’s functionality by a BPD field agent (ostensibly to avoid breaching the NDA), the state trial court found that while the vague register order was not wholly invalid, it lacked the probable cause and particularity necessary to justify use of the Hailstorm device. Accordingly, the court granted Mr. Andrews’ motion to suppress, ruling use of the Hailstorm device a warrantless search and that all evidence gathered subsequently to its use must be excluded as unconstitutionally tainted.

In Mr. Andrews’ subsequent § 1983 suit, however, the federal district court reached a different conclusion. In contrast to the rulings of the Maryland state courts, the district court found the pen register order was effectively a valid search warrant and granted summary judgment in favor of BPD. Curiously, the district court did not set about to discern what data the Hailstorm device could collect, how much it might collect, or how it operated—i.e., its “intrusiveness”—which would seem to constitute some genuine dispute of material fact. Mr. Andrews, apparently agreeing with the latter sentiment, appealed the summary judgement ruling to the Fourth Circuit.

The Fourth Circuit also agreed with the notion. Without the necessary information about the Hailstorm device, the court found it was simply unable to adequately review Mr. Andrews’ Fourth Amendment claim. After emphasizing the degree of care that needs to be taken in finding the appropriate “balance” between the use of modern police technology and individual freedoms, the court reiterated the record was insufficient to undertake the delicate balancing inquiry. “[W]e cannot address the issues necessary for resolution of this case. Despite the government’s use of a sophisticated, wide-reaching, and hard-to-detect new surveillance tool . . . we know very little about how many searches it conducted, of whom, and what data it collected and stored.”

Accordingly, the Fourth Circuit remanded the action to the district court with instruction to consider the following factors: (1) the device’s range; (2) the number of phones to which it may connect; (3) “all categories of data” collected by the device; (4) whether such data is stored; (5) what data is available to law enforcement; and (6) any efforts at protecting against data collection from innocent third-parties within the device’s configuration. The appellate court further instructed the lower court to consider whether the BPD has any internal policy or practice of withholding information about the use of a cell site simulator from judicial officials when seeking search warrants or pen register orders.

Judge Wilkinson, writing in concurrence, specifically noted the parallel public interest in solving crime and suggested the district court further consider that governmental interests at stake on remand: “[w]here, as here, both significant governmental interests and significant privacy interests may well be at stake, the district court may find it profitable to inquire whether the important public interest in crime prevention and detection could have been served by means that were less intrusive and damaging to the ‘legitimate expectations of privacy’ that citizens hold.”

Considerations in Challenging the Use of the Hailstorm Device

This will be an interesting case to keep an eye on. Not only will it shed light on how these obscure new pieces of technology collect real-time location data, but it could significantly impact an individual’s right to privacy and freedom from intrusive governmental tracking. Two key considerations need noting here as the use of these devices does not appear to be waning.

First, there was no dispute as to whether the use of the Hailstorm device constitutes a “search”; rather, the real issue was whether the pen register order was a sufficient “warrant.” The state courts found it was not (hence its grant of the motion to suppress), but the federal district court found that it was (hence its grant of summary judgment to BPD). The Fourth Circuit seems to hint that it considers the use of the Hailstorm device to be a far more intrusive “search” than the use of a pen register, and thus one requiring a bona fide, non-vague, warrant rather than a mere pen register order.

Regardless, defense counsel would be wise to consider challenging the use of cell site simulator devices because even if an actual warrant and not a pen register order was obtained, the presence of NDA’s (which are not specific to the FBI-BPD arrangement) may render such warrants—and especially pen register orders like here—lacking in particularity or probable cause. Furthermore, not only may such a motion to suppress be granted, but it also might compel the government to dismiss on its own accord rather than risk revealing info on how the device operates.

Second, the Fourth Circuit purports to place considerable emphasis on the Supreme Court’s recent trend in its Fourth Amendment jurisprudence. That is, the Court’s reluctance to allow cell phones as fair game for government tracking and monitoring. Importantly, a most notable aspect of these recent cases is not the mere fact they each involved cell phones, but that when those phones were tapped into and monitored continuously—phones located on peoples persons or in their homes—they provided a treasure trove of intimate data without the target’s knowledge or cognizance. This sort of “drag net” surveillance has made the Court quite wary of allowing the government to utilize such methods.

In contrast, it has indicated willingness to allow such targeting of cell phones if there are some guardrails in place—e.g., constraints on the length of the surveillance, geographical limitations on the reach of the surveillance, and a constrained scope on how many people might be ensnared by the surveillance, intentionally or unintentionally. Ostensibly, these guardrails make such surveillance more “reasonable.” Accordingly, the longer, larger, and more sweeping the surveillance, the better the chance defense counsel has in succeeding on a motion to suppress.

In a day and age where cell phones are themselves tracking devices—and have become essentially a new appendage to our bodies—we all must face the reality that we are cautiously exposed to potential violations of our liberty and privacy and must safeguard them appropriately without compromising the public interest. This case promises to be another chapter in the inexorable chase to strike that balance.

[1] The Supreme Court has long directed lower courts—particularly since the genesis of the digital age and particularly regarding cell phones—in evaluating an order purportedly authorizing a method of technological search, to consider the degree of intrusion on individual privacy. See Berger v. New York, 388 U.S. 41, 59 (1967) (rejecting an order authorizing the use of an eavesdropping device in part because “the conversations of any and all persons coming into the area covered by the device will be seized indiscriminately and without regard to their connection with the crime under investigation”); see also Katz v. United States, 389 U.S. 347, 355-56 (1967) (in evaluating a warrant, courts must ensure “no greater invasion of privacy [i]s permitted than [i]s necessary under the circumstances . . . by authorizing the carefully limited use of electronic surveillance” (internal quotations omitted)); United States v. Bobo, 477 F.2d 974, 979 (4th Cir. 1973) (“[E]lectronic surveillance is permissible when judicially authorized under the most precise and discriminating circumstances which meet the requirements of the Fourth Amendment.”). This determination ensures that execution of such an order “will not take on the character of the wide-ranging exploratory searches the Framers intended to prohibit” by enacting the Fourth Amendment, Maryland v. Garrison, 480 U.S. 79, 84 (1987) and “place[s] obstacles in the way of a too permeating police surveillance,” Carpenter v. United States, 138 S. Ct. 2206, 2214 (2018) (quoting United States v. Di Re, 332 U.S. 581, 595 (1948)).