Police were waiting for Deon Batty when he stepped off a Baltimore City bus traveling along a commercial strip near the public Douglass Homes on Valentine’s Day three years ago.
An officer dialed the number of a 77-year-old woman who had been robbed of her phone and other items at gunpoint the night before. The phone in the officer’s hand rang.
The mystery deepened in the hours before Batty’s trial in Baltimore City Circuit Court in September 2014. As Meckler shifted through case files, she discovered something she’d never noticed in her 25 years on the job: an after-action police report from the city police’s Advanced Tactical Team. Though she’d seen after action reports, what was unusual about this one was the phrase “target phone.”
Cell site simulators are among the most controversial of intelligence devices to have worked their way into the hands of law enforcement in recent years.
Citing unusual secrecy agreements with the FBI or the need to protect an investigatory tool, most local law enforcement agencies using the equipment in Maryland refuse to answer questions about what happens to this data, or other rules governing its use.
The problem, said lawyers and experts in law enforcement surveillance issues, is that technology has outpaced local laws. As public disclosures about cell site simulators increased in the last year, the Departments of Justice and Homeland Security began requiring their employees for the first time to obtain search warrants before they can use their devices, with some exceptions.
Each agency also enacted rules for deleting data. Those rules include provisions that say data must be deleted as soon as a target is found, and in no less than every 30 days in cases where the equipment is used to identify unknown devices. Each also added auditing requirements.
“The main problem is that the police may be doing something illegal and we have to use mental gymnastics to try and uncover these secret aspects of an investigation that are never written down and turned over to us,” Jason Ricke, a Prince George’s County assistant public defender, said. “The police may be violating our clients’ rights and we will never know it.”
The CNS investigation also found that police agencies in the seven counties closest to the Washington and Baltimore regions have spent at least $2.8 million on the sophisticated equipment.
At least 61 police agencies in 23 states and Washington, D.C., have deployed cell site simulators, according to the American Civil Liberties Union, which has pushed for greater oversight laws and transparency over how police use the technology.
“I would say that this shouldn’t ever be a secret,” David Rocah, senior staff attorney at ACLU of Maryland, said. “We’re not talking about catching spies. We’re talking about routine criminal investigations.”
Among CNS’ findings:
–Howard County has spent at least $452,000 on a cellphone tracking and jamming system that it has used at least 129 times since 2011, leading to at least 27 arrests.
–Heavily redacted records show Montgomery County Police, which obtained its equipment a decade ago, paid $260,944 in 2011 to continue its use. The county has paid an additional $222,961 since then, some of it for “upgrades/enhancements.”
–The Prince George’s County Sheriff’s Office received a $327,000 Justice Department grant in 2009 to buy its cell site simulator system. Within a month of installing it in a vehicle in December 2010, the agency had already used it five times and captured four suspects in cases that included an armed robbery, a carjacking and three attempted murders.
SECRECY SURROUNDS TECHNOLOGY
“That’s when I knew I had something,” Meckler said.
Montgomery County also invoked executive privilege to withhold records, citing “sensitive information pertinent to matters of national security.”
The FBI “believes that this technology is a vital tool in homeland security operations and disclosure of this technology could expose ways to subvert this investigative tool to terrorists and criminals alike,” Baltimore County Police Cpl. Shawn Vinson wrote in a response to a CNS request for information.
That explains why Maryland State Police Sgt. Thomas Bonin told then-state Sen. Christopher Shank during a March 2014 hearing that he could not comment on whether or not the agency owns a StingRay, the name of the most commonly use simulator.
“Is it classified?,” Shank asked during the hearing.
Secrecy even surrounds the non-disclosure agreements. The FBI won’t say how many such agreements it has signed with local jurisdictions.
FBI Spokesman Christopher Allen said the non-disclosures aren’t meant to prevent all discussion about the devices. The FBI doesn’t tell local police how they can use their devices either, he said.
But sometimes prosecutors have decided to offer plea deals in otherwise strong cases rather than disclose the use of cell site simulators.
Assistant Public Defender Ricke said it looked to him like the marshals had picked Stephon Summers “out of thin air.”
“That’s something that law enforcement has to account for, that they’re putting secrecy ahead of public safety,” said the ACLU’s David Rocah. “You cannot say that these things are critical to public safety and then sell out public safety in the same breath.”
A summary of Annapolis Police’s cellphone interceptor program says it “allows the department to locate and apprehend violent offenders, track persons of interest, monitor crowds when intelligence suggests threats; and intercept signals that could activate devices.”
Little is known about the data local police agencies are gathering and how it is handled.
Brian Owsley, a former federal magistrate from Texas who has researched the technology, said Annapolis’ admission “further bolsters that they’re big government coming in, they’re watching everyone.”
Baltimore County and Anne Arundel County both said they don’t store any data. Anne Arundel added that it does not intercept the content of communications.
Baltimore City Police’s acknowledgement, first reported by The Baltimore Sun, that it had used its StingRay in 4,300 cases going back to 2007 helped fuel a national conversation about the need to balance public safety while protecting bystander privacy.
Former Harford County Sheriff Jesse Bane said his office conducted internal audits of the device’s use and retained only data critical to an investigation. He didn’t rule out that other information wasn’t kept.
Bane reviewed documents detailing the county’s purchase of more than $400,000 in surveillance equipment in 2011, which he approved. The county bought the equipment using a Department of Homeland Security Urban Areas Security Initiative grant, according to the documents. It spent another $52,000 in June 2014 on equipment upgrades.
The grant is meant to enhance regional preparedness and capabilities against terrorism and other threats in high-risk, high-density areas, according to DHS.
“I wanted to stop the flow of drugs into the county as much as I could,” Bane said. “It’s very difficult to do if you don’t have the technology.”
Harford County Sheriff’s officers worked with the state’s attorney’s office to draft court orders when they used their cell site simulator, Bane said.
LEGAL QUESTIONS ARISE FROM USE
Legislation introduced in February would have tightened the rules even further by requiring law enforcement agencies to tell the courts when they planned to use a cell site simulator. The bill also would have placed limits on data collection and required annual reporting by police agencies. It failed to make it out of committee.
But a 74-page state Court of Special Appeals decision issued March 30 is being hailed as the first of its kind in the country by civil liberties experts. The order upheld a ruling by a Baltimore City Circuit Court judge who said police violated Kerron Andrews’ Fourth Amendment rights when they used a StingRay upgrade called Hailstorm to locate him without a warrant in May 2014. Police deployed the Hailstorm to find Andrews, who is accused of attempted murder, after obtaining a pen register/trap and trace order. The orders, which require less than probable cause, have long allowed police to obtain lists of numbers called and received by a user from phone companies.
The three-judge panel also took aim at the non-disclosure agreements between law enforcement and the FBI.
“A nondisclosure agreement that prevents law enforcement from providing details sufficient to assure the court that a novel method of conducting a search is a reasonable intrusion made in a proper manner and justified by the circumstances obstructs the court’s ability to make the necessary constitutional appraisal,” the justices said.
Rocah, of the ACLU, said the court’s decision could mean a reopening of scores of cases across the state, not just in Baltimore.
Text messages between two Montgomery County Police detectives made public defender Ron Gottlieb question if a cell site simulator was used to track Mauricio Morales-Caceres, who was convicted last week in a December 2014 homicide, according to Gottlieb.
“It should be disclosed upfront in discovery under the rules,” Gottlieb said during the hearing. “I had to ask for that.”
HOW CELL SITE SIMULATORS WORK
As the technology improved and spread through federal agencies, local and state agencies learned of them, too. DHS and DOJ officials have said that domestically, their devices only scoop up metadata. They do not gather content, like emails or text messages.
Cell site simulators rely on signal strength and direction finding to locate a target device, Heath Hardman, a former signals analyst for the U.S. Marines Corps, said.
Or, if an operator broadcasts too broad of a signal, it can overload a network with too many devices looking to jump from one cell tower to another.
For these reasons, the Federal Communications Commission must authorize a manufacturer to sell the device. But that authorization only signifies that the equipment meets FCC standards to control radio frequency interference, FCC officials said.
HOW POLICE USE THE DEVICES
One case involved the theft of chicken wings.
Montgomery County Police spokesman Capt. Paul Starks said the agency used its cell site simulator 80 times from April 1, 2015 through March 31. The number indicates uses, not individual cases, he said. About 30 percent, or 24, of those uses were for homicides and another three were kidnappings, Starks said.
“We absolutely use it to go after the worst criminals or the worst criminal offenses,” Starks said. “We use it for violent felonies and do not use it for minor crimes and property crimes.”
Baltimore County Police spokeswoman Elise Armacost said the tool has been effective in local crimes. They successfully located 63 of 72 targets they sought using the device in 2015, according to a log released to CNS. In 2014, county police located 110 of the 119 targets they sought while using the device. The investigative unit that handles the device got 99 requests from county police to use it in 2015. In 2014, the unit got 150 requests, according to county logs.
The “technology is useful at helping us find missing persons and wanted suspects, thus furthering our public safety mission,” Armacost said in an email. “We use this equipment only when there is law enforcement need and probable cause.”
Success rates in other counties were not as high.
Howard police also used the device in suicides, kidnappings and in at least three cases where threats were made to public officials.
But Annapolis Police couldn’t find their target in the case of a Pizza Boli’s employee who reported being robbed of 15 chicken wings and three subs while out on delivery in March. In that case, police got a court order, according to the police log.
Ricke, the Prince George’s County public defender, still questions the use of an invasive surveillance device in tracking his client, Summers.
“He’s not a terrorist, he’s just a kid from the neighborhood,” Ricke said.
“I don’t think its happened at all,” she said
In court, Meckler moved to suppress the phone as evidence. It was a lark, she said.
But during questioning, Baltimore City Circuit Court Judge Barry G. Williams threw the phone evidence out after Sgt. Scott Danielczyk refused to answer how it led police to stop Batty.
“OK, if it goes into Homeland Security issues, the phone doesn’t come in,” Williams said. Batty’s stop by police amounted to a warrantless search, he ruled.
Meckler said she never determined from city police that they used StingRay to track Batty down. But a February 13, 2013 entry in a city log obtained by CNS confirms it.