California bill requires warrant for stingray use

[Aerosol]

SACRAMENTO, Calif.—A California state bill that would require a warrant to access all kinds of digital data passed its first hurdle after being approved by the Senate Public Safety Committee on Tuesday.

Among other sweeping new requirements to enhance digital privacy, the bill notably imposes a warrant requirement before police can access nearly any type of digital data produced by or contained within a device or service.

In other words, that would include any use of a stingray, also known as a cell-site simulator, which can not only used to determine a phone’s location, but can also intercept calls and text messages. During the act of locating a phone, stingrays also sweep up information about nearby phones—not just the target phone.

According to the bill's summary:

This bill would prohibit a government entity from compelling the production of or access to electronic communication information or electronic device information, as defined, without a search warrant or wiretap order, except for emergency situations, as defined. The bill would define a number of terms for those purposes, including, among others, “electronic communication information,” “service provider,” and “electronic device information.” The bill would require a search warrant for electronic communication information to encompass no more information than is necessary to achieve the objective of the search and would impose other conditions on the use of the search warrant or wiretap order and the information obtained, including retention and disclosure.

If the California Electronic Communications Privacy Act (CalECPA) passes the California State Senate and the State Assembly, and is signed by the governor, it would mark a notable change for law enforcement in America’s most populous state.

However, passage is not a sure thing. Previous versions of the bill were vetoed by the governor twice in 2012 and again in 2013. The bill was introduced in February 2015 by State Senator Mark Leno (D-San Francisco). Texas and other states already have similar laws on the books, while revision to the federal Electronic Communications Privacy Act (ECPA) has stalled for years.

California law enforcement agencies, like others nationwide, have been cagey as to how stingray use is requested and carried out. Last week, the Anaheim Police Department published a version of a letter that had been prewritten by the FBI in a poor attempt to provide further disclosure about how they use the surveillance devices.

Only one opposed

In June 2014, the Supreme Court of the United States ruled unanimously in a case known as Riley v. California that law enforcement officials must obtain a warrant before searching the contents of an arrestee’s phone. Among other changes, the new bill would put the Golden State in compliance with that decision.

The Senate Committee on Public Safety approved Senate Bill 178 (SB 178) by a vote of 6-1, with little discussion from the assembled senators. It faced just a modicum of opposition at this stage.

"California residents use technology every day to connect, communicate, work and learn," Nicole Ozer, an attorney with the American Civil Liberties Union of California, testified from a prepared statement in favor of the bill. "Our state’s leading technology companies rely on consumer confidence in these services to help power the California economy.

"But consumers are increasingly concerned about warrantless government access to their digital information, and for good reason. While technology has advanced exponentially, California privacy law has remained largely unchanged. Law enforcement is increasingly taking advantage of outdated privacy laws to turn mobile phones into tracking devices and to access e-mails, digital documents, and text messages without proper judicial oversight."

In the pre-cellphone era, a "pen register and trap and trace order" allowed law enforcement to obtain someone's calling metadata in near real-time from the telephone company. Now, that same data can also be gathered directly by the cops themselves through the use of a stingray. In some cases, police have gone to judges asking for such a device or have falsely claimed the existence of a confidential informant while in fact deploying this particularly sweeping and invasive surveillance tool.

Most judges are likely to sign off on a pen register application not fully understanding that police are actually asking for permission to use a stingray. Under federal law, pen registers are granted under a very low standard: authorities must simply show that the information obtained from the pen register is "relevant to an ongoing criminal investigation."

That is a far lower standard than being forced to show probable cause for a search warrant or wiretap order. A wiretap requires law enforcement to not only specifically describe the alleged crimes but also to demonstrate that all other means of investigation had been exhausted or would fail if they were attempted.

California doesn’t actually have a specific pen register statute—a pen/trap application template that Ars recently obtained from the Oakland Police Department under a public records request cites the federal statute. However, that practice goes against a 2003 opinion from the California Attorney General. The AG concluded that because California affords its citizens more privacy under the state constitution than does federal law, a state law enforcement officer cannot use a federal statute for a pen/trap order.

Cops don’t like it

After more testimony, the committee members heard from Marty Vranicar of the California District Attorneys Association (CDAA) and Aaron McGuire, a lobbyist for the California Sheriff's Association (CSA).

Vranicar told the committee that the bill would "undermine efforts to find child exploitation," specifically child pornography.

"SB 178 threatens law enforcement’s ability to conduct undercover child porn investigation. the so-called peer-to-peer investigations," he said. "Officers, after creating online profiles—these e-mails provide metadata that is the key to providing information. This would effectively end online undercover investigations in California."

Ars was unable to obtain the letters filed by Vranicar and McGuire to the committee that more fully outlined their opposition.

However, no other members of the public nor other groups spoke up in favor of the law enforcement position.

By contrast, SB 178 has notable support from a number of established organizations and tech companies, including the Council on American Islamic Relations, the California Newspaper Publishers Association, Twitter, Facebook, Microsoft, and Google, among others.

After Vranicar and McGuire spoke, they faced just one question from Sen. Joel Anderson (R-San Diego County), who said that he wanted to see revision suggested by the law enforcement establishment.

"One of the issues that I have is that people's cellphones are being abused," he said, holding up his iPhone. "It's clear that that's happening. I think you need to figure out how to be part of that solution.

"While you want to stop criminal behavior, it can't be at the price of liberty. If you have the right to break into my house, with a warrant and take my computer, that should be the standard for phones as well."

The committee seemed unmoved by law enforcement concerns, and passed the bill handily. It now moves to the Senate Appropriations Committee before eventually going on to the entire state Senate.

Source