by Cyrus Farivar - May 24, 2015 1:00pm EDT

The sheriff in San Bernardino County—east of Los Angeles County—has deployed a stingray hundreds of times without a warrant, and under questionable judicial authority.

In response to a public records request, the San Bernardino Sheriff’s Department (SBSD) sent Ars, among other outlets, a rare example of a template for a "pen register and trap and trace order" application. (In the letter, county lawyers claimed this was a warrant application template, when it clearly is not.) The SBSD is the law enforcement agency for the entire county, the 12th-most populous county in the United States, and the fifth-most populous in California.

Stingrays, or cell-site simulators, can be used to determine location by spoofing a cell tower, but they can also be used to intercept calls and text messages. Once deployed, the devices intercept data from a target phone as well as information from other phones within the vicinity. For years, federal and local law enforcement have tried to keep their existence a secret while simultaneously upgrading their capabilities. Over the last year, as the devices have become scrutinized, new information about the secretive devices has been revealed.

This template application, surprisingly, cites no legal authority on which to base its activities. The SBSD did not respond to Ars’ request for comment.

"This is astonishing because it suggests the absence of legal authorization (because if there were clear legal authorization you can bet the government would be citing it)," Fred Cate, a law professor at Indiana University, told Ars by e-mail.

"Alternatively, it might suggest that the government just doesn’t care about legal authorization. Either interpretation is profoundly troubling," he said.

The documents sent to Ars by the SBSD's county attorneys also show that since acquiring a stingray in late 2012, the agency has used it 303 times between January 1, 2014 and May 7, 2015.

Further, the SBSD, like other departments nationwide, maintains a questionable non-disclosure agreement (NDA) with the FBI that indicates that the agency will work with local prosecuting authority to dismiss cases rather than reveal information in court about stingrays. (This has happened in at least some known jurisdictions elsewhere in the country.)

Just last week, the FBI released a statement regarding the use of stingrays, which claims the opposite of what its NDA with local law enforcement actually says. The SBSD also declined to produce policies, guidelines, training materials, nor the specific cases where stingrays were used.

The FBI and the Harris Corporation, the manufacturer of the device, have repeatedly declined to respond to Ars' specific questions.

That old standby, a “pen/trap order”

Detectives typically go to a local judge before they want to deploy the device and file an application for a "pen register and trap and trace order." Those orders are often sealed, even well after the case has concluded, so there is usually little public scrutiny.

But, as is the case in most jurisdictions nationwide, this application to the court is not very explicit about what exactly what law enforcement wants to do, nor how exactly it will be carried out. This is precisely the reason why Washington state just signed into law a new warrant requirement for stingray use, which also imposes stringent disclosure and data minimization standards. A similar bill in California is pending in the state legislature.

The template states:

DetectiveName, a Detective for the San Bernardino County Sheriff's Department. hereby applies to the Court for an Order (1) authorizing the use of a PEN register on the telephone lines currently designated by the numbers; Telephone Number (The “Telephone Line”); (2) authorizing the use of a trap-and-trace device on the Telephone Line: and (3) requiring the disclosure of subscriber name and address, whether listed or unlisted. for numbers called by the Telephone Line or numbers calling the Telephone Line. or found during investigation of this case upon oral or written demand of agents of the San Bernardino County Sheriff‘s Department. In support of this application, he states the following:

1) I am a detective for the San Bernardino County Sheriff's Departmant and am requesting an Order authorizing the installation and use of a PEN register and a trap-and-trace device. and the disclosure of subscriber information.

2) I certify that the San Bernardino County Sheriffs Department is conducting a criminal investigation of Crime in connection with possible violations of Crime Definition. It is believed that the below named persons and other unknowns are using the Telephone Lines in furtherance of the subject offenses and that the information likely to be obtained from the PEN register and the trap-and-trace devices is relevant to the ongoing criminal investigation being conducted by the above named agency.

AFFIDAVIT "Insert Probable Cause"

In the pre-cellphone era, a "pen register and trap and trace order" allowed law enforcement to obtain someone's calling metadata in near real-time from the telephone company. Now, that same data can also be gathered directly by the cops themselves through the use of a stingray.

Nathan Wessler, an attorney with the American Civil Liberties Union, told Ars that this type of language is very unusual.

"The template is likely to mislead judges who receive applications based on it because it gives no indication that the Sheriff’s Department intends to use a stingray," he wrote by e-mail.

"We have seen similarly misleading applications submitted to judges by police departments across the country," he continued. "Judges have no hope of ensuring that use of stingrays complies with the Fourth Amendment if they are kept in the dark about law enforcement’s intent to use a stingray. When police hide the ball from judges, our justice system cannot ensure justice."

Other lawyers concurred.

"On the fact the pen/trap order makes no reference to a stingray or IMSI catcher at all is really troubling because this order reads like any standard pen/trap application which would be given to a cell phone provider," Hanni Fakhoury, an attorney with the Electronic Frontier Foundation, and a former federal public defender, told Ars by e-mail.

"But of course the scope of information obtained via an IMSI catcher is potentially much greater," Fakhoury said. "So it suggest that unless the officers are telling the judges in the affidavit or when they’re in chambers swearing out the affidavit that they’re planning on using a stingray, there’s nothing to indicate what exactly law enforcement is planning to do. And of course, we find that highly problematic."

Most judges are likely to sign off on a pen register application not fully understanding that police are actually asking for permission to use a stingray. In some cases, cops have even falsely claimed the existence of a confidential informant while in fact deploying this particularly sweeping and invasive surveillance tool.

Ars has also contacted Superior Court Judge R. Glenn Yabuno, the supervising criminal judge in the county, but he has yet to respond.

Forget federal law

Under federal law, pen registers are granted under a very low standard: authorities must simply show that the information obtained from the pen register is "relevant to an ongoing criminal investigation."

That is a far lower standard than being forced to show probable cause for a search warrant or wiretap order. A wiretap requires law enforcement to not only specifically describe the alleged crimes but also to demonstrate that all other means of investigation had been exhausted or would fail if they were attempted.

"I am used to seeing citations of various statutory provisions that the government would rely upon for its application," Brian Owsley, a law professor at Indiana Tech, and a former United States magistrate judge in Texas who has worked on numerous stingray cases, told Ars.

"These statutes are cited in the proposed order. It is problematic that if this is indeed an application for a stingray that the application heading indicates that is for a pen register and trap and trace device. I think that it should actually state ‘Application for a Cell Site Simulator’ or something along that lines."

California doesn’t actually have a specific pen register statute—a statewide pen/trap application template that Ars previously obtained from the Oakland Police Department under a public records request cites the federal statute. However, that practice goes against a 2003 opinion from the California Attorney General. The AG concluded that because California affords its citizens more privacy under the state constitution than does federal law, a state law enforcement officer cannot use a federal statute for a pen/trap order.

In the sample order that the SBSD provided, only federal law is cited, specifically 18 U.S. Code § 2703(d), among others.

Curiously, in the SBSD template application, it includes a section for the detective to "insert probable cause," which is not required under the federal pen register statute.

"The fact that order requires probable cause but isn’t labelled a warrant is also interesting," Fakhoury said. "[It's] definitely good that the Sheriff and the court are using the probable cause standard but a warrant is about more than just probable cause; a warrant also requires particularity and continuing oversight by the judge who has to review the inventory and receipt to make sure only authorized things were taken."

"So it’s like this order does some of the stuff a warrant would do, but not all," he said.

http://arstechnica.com/tech-policy/2015/05/county-sheriff-has-used-stingray-over-300-times-with-no-warrant/