In the early morning hours of September 13, 2008, a woman notified the Tallahassee Police Department (TPD) that she had been raped and that her purse, containing her mobile phone, had been stolen. Within 24 hours, the Florida capital’s police had contacted Verizon and obtained real-time ping information, which gave the police a “general area” where they might find the phone and thus, hopefully, the perpetrator of the crime. But that general area still covered plenty of ground—where exactly was the phone?
To answer that question, the cops deployed a secretive device called a stingray, which operates as a fake cell phone tower used to track targeted phones. Though law enforcement typically fights attempts to learn how stingrays work or how often they are used, a court victory by the American Civil Liberties Union (ACLU) has just unsealed Tallahassee police testimony of exactly how the 2008 cell phone hunt happened.
This newly released transcript (PDF) provides what is likely the first-ever verbatim account of how stingrays are used in actual police operations. And it shows that stingrays are so accurate, they can pinpoint the very room in which a phone is located.
"Every door and every window"
After learning the phone's general location, Tallahassee cops deployed a vehicle-mounted stingray and cruised the streets. Verizon had already provided them with the phone's unique IMSI identifier, which told the stingray exactly which handset to track. (“Stingray” is a trademarked product manufactured by Florida-based Harris Corporation, though it has since come to be used as a generic term, like Xerox or Kleenex.)
Such searches are controversial in part because stingrays necessarily capture data about all other compatible phones nearby. Christopher Corbitt noted that the gear evaluates "all the handsets in the area" as it searches for its target. When in use, stingrays force a connected phone to transmit at full power—depleting a handset’s battery faster than normal.
"We emulate a cellphone tower,” Tallahassee investigator Corbitt told a court during his testimony about the incident. “So just as the phone was registered with the real Verizon tower, we emulate a tower; we force that handset to register with us. We identify that we have the correct handset and then we’re able to, by just merely direction-finding on the signal emanating from the handset—we’re able to determine a location.”
The vehicle-based tracking eventually pointed to a particular apartment complex called Berkshire Manor, but police still had no idea which apartment might house the phone (and, hopefully, the woman's attacker). Corbitt deployed a team of officers with a handheld stingray to scour the complex.
“Using portable equipment, we were able to actually basically stand at every door and every window in that complex and determine, with relative certainty you know, the particular area of the apartment that that handset was emanating from,” Corbitt told the court.
Such searches are common; Corbitt said he had personally used the equipment “200 or more times” and that it worked with “100 percent” accuracy.
Eventually, Corbitt and his colleagues detected the phone inside apartment 251, the residence of a woman who was also hosting her boyfriend, the suspect James Thomas. Officers knocked on the door; when it opened, one inserted his foot in the opening to keep it from being closed again. Police then conducted a "protective sweep" of the apartment and waited while a search warrant was obtained.
Police did find the victim’s phone, purse, underwear, and ID card at the apartment, but was their "protective sweep" justified in the name of "exigent circumstances?" For investigators, the move had seemed necessary to prevent the destruction of evidence. At trial, the judge agreed and denied Thomas' motion to suppress the search evidence; Thomas was eventually convicted. Late last year, however, a state appellate court overturned that conviction on the grounds that the search had been improper (though without commenting specifically on the use of a stingray). It ordered a new trial.
“Testimony that a cell phone could be flushed down the toilet does not meet the test [of exigent circumstances],” the District Court of Appeal for Florida, First District, found, in a two to one decision.
“Really aggressive and invasive”
In an interview with Ars, ACLU attorney Nathan Freed Wessler said that having this level of detail about a stingray was highly unusual.
“I think it provides a vivid illustration of how invasive this technology is and how the courts regulate its use. It’s one thing to have a generic description of how it’s used; it’s another thing to read a first-hand account of how people are walking up to people’s doors and windows sending powerful signals to cells inside. This transcript illustrates both the fact that bystanders' phones were being tracked and that the police operating the device knew that’s what the device was doing.”
The Tallahassee Police Department did not immediately respond to our request for comment.
However, TPD Chief Michael DeLeo told the Tallahassee Democrat newspaper in March 2014 that he had ordered a full review of all incidents involving stingrays.
“My first concern as the new chief is what are we doing right now, are we doing it properly, do we need to change how we are doing it,” the paper quoted him as saying.
An initial inquiry of the cases from 2013, he noted, showed that warrants were obtained in 90 percent of the cases; the remainder involved emergency cases.
“What I’m seeing right now is the same process that is applied to any other search by the police department is being followed,” he said.
Still, the main issue that the ACLU has with this technology, as is the case with similar new digital surveillance tools, is that they might function more like "general warrants" than specific searches.
“That is a major concern that we have with this technology,” Wessler added. “We’ve tried to advance two general legal arguments about why the Fourth Amendment has something to say about stingrays: there’s an unsettled question as to whether use of these devices is like a general warrant, in that it could never be used. If there's no way to use a stingray without sweeping up hundreds or thousands of other phones, than maybe it’s not a reasonable search. At the very least, police need to go to a judge to demonstrate probable cause and get a warrant, and the judge needs to provide privacy guidelines.”
Legal experts not involved in the ACLU’s efforts were equally surprised as to the newly revealed information.
“The information that’s most interesting to me is the specific details of how the stingray was used in this case specifically (via two stingray devices, one mounted on a car and one handheld device) and the frequency by which Tallahassee police have used the device,” Hanni Fakhoury, a staff attorney at the Electronic Frontier Foundation, told Ars by e-mail.
“I’ve heard about stingrays attached to drones but seeing them on a typical police car (combined with being used 200 times) suggests the device is far more frequently used and deployed than we’ve known before. The other thing that’s interesting is that the way these devices are configured and physically used shows how invasive they are. They force the phone to use more battery, capture all the information in the area around it and then require police to go from door to door to capture signals. These aren’t simple innocuous devices but really aggressive and invasive ones.”
reader comments
186