DITCH THE CELL: How the Government is using your client s cell phone against her

Transcription

1 DITCH THE CELL: How the Government is using your client s cell phone against her

2 How do cell phones operate?

3 Cellular Network When a cell phone is in idle mode, it regularly communicates with cell towers in its network. Using radio frequency waves, the phone tries to determine which cell tower has the strongest signal. In urban areas, cell towers are often located on top of buildings or water towers. A cell tower emits radio frequency waves in all directions, providing cell phone coverage in a 360 degree radius around the tower. Three antennas typically comprise each tower; each antenna covers a 120 degree area. When a cell phone places a call, it typically connects to the tower in its network with the strongest signal. This is usually the tower nearest to the phone, although a variety of factors including physical obstructions and topography can determine which tower services a particular phone. Once the call reaches the tower, this interaction is recorded by the network provider. The call then proceeds to a mobile switching center, which may choose to reroute the call to a different tower based on network traffic. The call may also be rerouted to a different tower if the caller changes location during the duration of the call. This data is recorded by the network and maintained as call data records / historical cell site data.

4

5

6

7 The Global Positioning System (GPS) is a space based satellite navigation system that provides location and time information in all weather conditions, anywhere on or near the earth where there is an unobstructed line of sight to four or more GPS satellites. Precision: 5 10 Feet

8 GPS: Your phone is a human tracking device Eg: iphone Users Tap Settings from your SpringBoard (main menu) Choose Privacy from the Setting menu Select Location Services from the Privacy menu Tap System Services from the Location Services menu Choose Frequent Locations from the System Services menu Tap any one of the locations under History

9

10

11

12

13

14 Precision: +/ 100 Meters

15

16

17 Obtaining the Records Raw Data may be provide by Government thru Discovery Data may need to be obtained by Defense via Subpoena/Court Order Defense Expert may be warranted to disprove Government s theory or to establish an alibi defense *Never accept paper copies Accept Spreadsheets or Text Files ONLY

18

19

20

21

22

23 Discovery Requests- Beyond Brady Consider using ABA Model Rule 3.8(d) as a vehicle for requesting exculpatory and/or mitigating evidence in your cases. The rule refers to Special Responsibilities of a Prosecutor and states that the prosecutor in a criminal case shall: (d) make timely disclosure to the defense of all evidence or information known to the prosecutor that tends to negate the guilt of the accused or mitigates the offense, and, in connection with sentencing, disclose to the defense and to the tribunal all unprivileged mitigating information known to the prosecutor, except when the prosecutor is relieved of this responsibility by a protective order of the tribunal. There are several distinctions between the Brady Rule and Model Rule 3.8(d) including scope, materiality and timing. Although the Brady Rule is incorporated into our local rules in the District of Vermont to guide discovery procedure, you may argue that federal prosecutors are also required to adhere to the state's rules of ethics and professional conduct. *Vermont adopted the ABA Model Rules of Professional Conduct on 9/1/09 and has not made any amendments to Rule 3.8(d).

24

25

26

27 CellReception.com

28

29 Cellreception.com

30 Theory of Granulization Used by some law enforcement experts to plot phone locations based on historical cell site data Methodology: 1. Identify the physical location of cell sites used by a particular phone during a relevant time period. 2. Identify the specific antenna used at each cell site. 3. Identify the direction of the antenna s coverage 4. Estimate the range of each antenna s coverage based on the proximity of the tower to other towers in the area This is the area in which the cell phone could connect with the tower given the angle of the antenna and the strength of signal. 5. Using training and experience, predict where the coverage area of one tower will overlap with the coverage of another area, thus estimating the general location of the cell phone during a particular time.

31 UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION UNITED STATES OF AMERICA Case No. 10 CR vs. ANTONIO EVANS Judge Joan H. Lefkow OPINION AND ORDER Special Agent Raschke testified that he has used this theory numerous times in the field to locate individuals in other cases with a zero percent rate of error. He also testified that other agents have successfully used this same method without error. No evidence was offered, however, beyond Special Agent Raschke s testimony, to substantiate the FBI s successful use of granulization theory or its rate of error in the field. Despite Special Agent Raschke s assurances, the court remains unconvinced that granulization theory is reliable. Granulization theory has not been subject to scientific testing or formal peer review and has not been generally accepted in the scientific community. These factors weigh against a finding of reliability. Given that multiple factors can affect the signal strength of a tower and that Special Agent Raschke s chosen methodology has received no scrutiny outside the law enforcement community, the court concludes that the government has not demonstrated that testimony related to the granulization theory is reliable. As such, testimony concerning this theory, along with the estimated range of coverage for each of the towers indicated on summary exhibit 6, will be excluded under Rule 702 and Daubert. Footnote: Special Agent Raschke testified that he has driven this area many times and there are no buildings that would obstruct cell phone access to nearby towers. It is unclear when he drove this area and whether he drove it with the specific purpose of determining whether any such obstructions exist.

32

33 StingRay The Most Common Surveillance Tool the Government won t tell you about StingRay is the name for a line of cell site simulator technology sold by the Harris Corporation. Other Harris cell site simulator models include the TriggerFish, KingFish, and Hailstorm. The more generic term for the technology is IMSI catcher, in reference to the unique identifier or international mobile subscriber identity of a wireless device. The government has been using IMSI catchers for approximately two decades. According to documents obtained by the Electronic Privacy Information Center ( EPIC ) in a Freedom of Information Act ( FOIA ) lawsuit, the Federal Bureau of Investigation ( FBI ) has been using the technology since 1995, agents have undergone extensive training on these devices, and usage is dramatically increasing. A number of federal law enforcement agencies, including the FBI, Drug Enforcement Administration, Bureau of Alcohol, Tobacco, Firearms and Explosives, Secret Service, Marshals Service, and Immigration and Customs Enforcement, are known to own and use cell site simulators.4 Use is not limited to the federal government. At least 34 law enforcement agencies in 15 states have purchased IMSI catchers

34 StingRays: What do they do and how do they work? Wireless carriers provide coverage through a network of base stations, also called cell sites, that connect wireless devices to the regular telephone network. Cell phones periodically identify themselves to the base station that has the strongest radio signal, which is often, but not always, the nearest base station. A cell phone automatically transmits to the base station signaling data, which includes the phone s unique numeric identifier, as well as its cell site code, which identifies its location. An IMSI catcher masquerades as a wireless carrier s base station, thereby prompting cell phones to communicate with it as though it were actually the carrier s base station. The equipment consists of an antenna, an electronic device that processes the signals transmitted on cell phone frequencies, and a laptop computer that analyzes the signals and allows the agent to configure the collection of information. It can be carried by hand or mounted on vehicles or even drones.

35 StingRays are capable of capturing the following types of information: 1. If the government knows a suspect s location, it can use the device to determine the unique numeric identifier (IMSI) associated with her cell phone. To do this, law enforcement agents position a StingRay in the vicinity of the target[ s phone], which will then transmit to the StingRay the signaling information it would normally transmit to the carrier s base station. The information obtained includes the cell phone s unique numeric identifier as well as cell phone number. 2. If the government knows a cell phone s unique numeric identifier (IMSI), it can use a StingRay to determine the phone s location. The numeric identifier is programmed into the StingRay/IMSI catcher, which then sorts through the signaling data (including location) of cell phones in the area until it finds a match. StingRays produce extremely precise location information, in some cases within an accuracy of 2 m[eters]. In one federal case, the government conceded that the IMSI catcher located the defendant s wireless device precisely within a specific apartment in an apartment complex. 3. StingRays are capable of capturing the content of communications, such as voice calls and text messages. While some devices can be configured to intercept content, we are not aware of instances in which law enforcement has deployed an IMSI catcher in this fashion and the primary governmental uses appear to be identifying a phone s unique numeric identifier or location.

36 Salient Aspects of the Technology IMSI catchers scoop up information from third parties, not just the target of an investigation. The type of IMSI catcher currently used by law enforcement mimics a wireless company s network equipment, sending signals to and triggering an automatic response from third parties mobile devices. DOJ concedes as much, as one of its template applications pertaining to IMSI catchers builds in the contingency that any cellular phone that is within close proximity to the government device... may autonomously register with the device. The device broadcasts electronic signals that penetrate the walls of private spaces not visible to the naked eye, including homes and offices. Depending on the device s signal strength, the broadcast radius can reach up to several kilometers, allowing the IMSI catcher to scoop up information from any and all private locations in the area. IMSI catchers force cell phones to transmit signaling information. As one law enforcement officer has described it, the government s device actually captures the phone and direct[s] the signal from the [carrier s] tower to [the government s] equipment.

37 What kind of court authorization, if any, does the government currently obtain to use the device? No Authorization In some instances, law enforcement entities, at least at the state and local level, are not obtaining any court authorization to use the device. Pen/Trap Statute DOJ recommends that the government obtain an order under the Pen Register/Trap and Trace Statute when using an IMSI catcher to identify a target phone s unique numeric identifier or location. Under the Pen/Trap Statute, the government may obtain an order authorizing installation of a pen register or trap and trace device upon an application certifying that the information likely to be obtained is relevant to an ongoing criminal investigation. 18 U.S.C. 3122(b)(2). A pen register is typically understood to be a device that records the numbers dialed by a particular telephone; a trap and trace device records the incoming numbers to a telephone. The Pen/Trap Statute was amended in 2001 to expand the definition of pen/trap devices to include not only devices that capture incoming and outgoing numbers, but also those that capture signaling information. Hybrid Order Under the hybrid theory, the government justifies acquisition of location information from wireless carriers by combining the Pen/Trap Statute with the Stored Communications Act ( SCA ), 18 U.S.C. 2703(d), which authorizes the government to obtain records from a provider pertaining to certain kinds of records or information pertaining to customers or subscribers. Warrant In at least some instances, the federal government has sought warrants to use a StingRay to obtain location information. Warrants, of course, require, among other things, the government to establish probable cause and to state with particularity the place to be searched, and the persons or things to be seized.

38 How can you tell if the Government used a StingRay in your case? There are very few cases addressing IMSI catchers, leaving the area ripe for litigation. The challenge lies in determining whether an IMSI catcher was even used. Even in those instances where the government obtains some kind of court authorization to use the device, the application and order will very likely not refer to IMSI catcher technology. Terminology While technologists use the term IMSI catcher, DOJ does not and instead uses widely varying, inconsistent terms, including, but not limited to, digital analyzer, cell site simulator, cell site emulator, cell site monitor, triggerfish, StingRay, kingfish, amberjack, hailstorm, and WITT, in reference to the FBI s Wireless Intercept Tracking Team. If the government obtained a wiretap order in your case, but it is unclear how it obtained your client s cell phone number, or the only explanation is a highly cryptic reference to an unspecified confidential source or source of information with no details as to the source, consider pursuing the issue of an IMSI catcher in discovery. (An alternative possibility is that the government obtained the number through another surveillance program known as the Hemisphere project.

39 Responses Identify whether a StingRay may have been used in your case. Make a discovery request for IMSI Catcher information see handout File motions to suppress: IMSI Catchers trigger 4 th Amendment Scrutiny Use in Connection with Residences Invades Reasonable Expectation of Privacy Use in Public Intrusion on possessory interests, even in a public place Electronic equivalent of a general search Investigatory dragnet that the 4 th Amendment was designed to prevent. Statutory Orders do not suffice must obtain warrant, meet probably cause threshold. If warrant obtained, defendant is entitled to a Franks hearing material omissions in affidavit.

40

41

42

43

44

45

46

47

48 The first rule of Fight Club is: You do not talk about Fight Club. The first rule of Hemisphere is: You do not talk about Hemisphere.

49 Your Client Has Been Arrested and her Cell Phone has been seized! Now What?

50 Recent Supreme Court Decision Cell Phone Privacy Riley v. California and United States v. Wurie, 134 S.Ct (June 25, 2014) In a consolidated opinion denominated Riley v. California, the unanimous Supreme Court held that officers must generally secure a warrant before searching digital information on a cell phone seized from an individual who has been arrested. Chief Justice Roberts wrote an opinion, beginning with the reminder that, In the absence of a warrant, a search is reasonable only if it falls within a specific exception to the warrant requirement. Search incident to lawful arrest, the Court held, is not such an exception. Modern cell phones are not just another technological convenience. With all they contain and all they may reveal, they hold for many Americans the privacies of life, Boyd [v. United States, 116 U.S. 616, 630 (1886)]. The fact that technology now allows an individual to carry such information in his hand does not make the information any less worthy of the protection for which the Founders fought. Our answer to the question of what police must do before searching a cell phone seized incident to an arrest is accordingly simple get a warrant.