Location and Cell Phone Tracking: Technology, Law, and Defense Strategy
Part 1: Location Tracking Technology Cell Site Data Fine location data: GPS / Triangulation GPS Trackers (Homing devices, e.g. Jones) Stingrays/ISMI catchers Other tricks: Tower dumps, Email Sweeps, Wiretaps, etc.
Content Channel: (Talk) (Two frequencies) Cell Site Location Information (CSI or CSLI) a Two-Way Radio Control Channel: (Data)
Subscriber s Direction - from Tower Hand-Offs
CELL SITE DATA IS BECOMING INCREASINGLY PRECISE Judge Kozinski has 3 femtocells in his house! More accurate than GPS in some circumstances
FCC E-911: Handset and Network Solutions Handset Solution Phone itself contains GPS device it calculates latitude/longitude Network Solution Does not use GPS Data resides on phone and provider can ping Measures signal characteristics relative to one or more towers. Data with provider.
Subscriber s Location from Tower Triangulation
Global Position System (GPS)
GPS Tracking Device
What can a stingray do? Get your ISMI/Phone # - or everyone s Find your location Record your phone calls Read your texts All for $60k!
Cell Tower Dumps Get Caller, Recipient, time, and general location for every phone in an area at a specific time Cross-reference a couple of cell tower dumps, and find your suspect! Scarecrow bandits 11
How much is this happenning? We don t know it s all under seal! 1.3 million requests in 2011 for cell tower data Sprint s law enforcement portal
Other Tricks: Wiretaps Email grabs CIPAV devices to monitor internet use Turn your phone into a mobile listening device Other known unknowns
Only 4 data points required!
US v. Pineda-Moreno (Kozinski dissent), 617 F.3d 1120 By tracking and recording the movements of millions of individuals the government can use computers to detect patterns and develop suspicions. It can also learn a great deal about is because where we go says much about who we are. Are winston and Julia s cell phones together near a hotel a bit too often? Was Syme s Onstar near an STD clinic? Were Jones Aaronson and Rutheford at that protest outside the White House? The FBI need no longer deploy agents to infiltrate grous it considers subversive, it can figure out where the groups hold meetings and ask the phone company for a list of cell phones near those locations
Panoptic effect
Part 2(a): The Fourth Amendment Katz ( 67): 4 th Amendment search depends on a reasonable expectation of privacy. 4 th Amendment protects people, not places. Wiretaps are a search (overruling Olmstead) US v. Miller ( 76): No REP in material disclosed to third parties (bank records). Maryland v. Smith ( 79): No REP in the numbers you dial.
What is private about being in public? Knotts ( 83): No privacy interest on a public street, so simple homing device is okay. Karo ( 84): Putting a homing device on an object which might enter home is not. Kyllo ( 01): Thermal imaging of what is going on inside a house is unconstitutional.
Maynard/Jones Maynard (DC Cir): Mosaic theory strikes down warrantless tracking. Jones: Scalia (majority) says trespass = search because mosaic theory unworkable Alito says continuous tracking is a search Sotomayor says 3 rd party doctrine needs to go
What does it all mean? No clear guidance Supreme Court uneasy about tracking people. Don t know if your cell site data will locate you in your house search requiring p/c!* *(I hope)
Right to Anonymity
Part 2(b): The Statutory Scheme Or What Does Congress Think?
Pen / Trap Orders Court order required to: Install device or process that records - Dialing, routing, addressing or signaling information from - Transmitted wire or electronic communication by instrument or facility. Section 3123 court order requires: Certification by government attorney Information to be obtained relevant to an ongoing criminal investigation. 18 USC 3123(a)(1)
CALEA Call-identifying information from pen registers and trap and trace devices: [S]hall not include any information that may disclose the physical location of the subscriber (except to the extent that the location may be determined from the telephone number). 47 U.S.C. 1002(a)(2)
Three Rail Bank Shot Shot Pen Register / Trap & Trace, 18 USC 3121-27 CALEA, 47 USC 1000-02 SCA (Stored Communications Act), 18 USC 2703(d)
D or Hybrid Orders (SCA) A cell service provider may not: [K]nowingly divulg[e] a record or other information pertaining to a subscriber... to any governmental entity Section 2703(d) order permits disclosure if government: Offers specific and articulable facts showing that there are reasonable grounds to believe that the contents of a wire or electronic communication, or the records or other information sought, are relevant and material to an ongoing criminal investigation. 18 USC 2703(d)
Tracking Device Statute 8 USC 3117: As used in this section, the term tracking device means an electronic or mechanical device which permits the tracking of the movement of a person or object. Tracking devices are specifically EXEMPTED from SCA!
Part 2(c): New trends in location tracking law Mag. Judge Stephen Smith (S.D. TX)
Judge Smith Leads the Charge Cell site data turns a cell phone into a tracking device. Cannot get cell-site data with a 2703(d) order: need probable cause and a warrant. Cannot gag cell phone companies about these orders. Unseal those orders.
SHHHHHHHHH!
Government Response: The government maintains that the magistrate judges are wrong to assert that cell-site information is not dialing, routing, addressing, or signaling information under the Pen/Trap Statute. They are wrong to assert that cell-site information is not a record or other information pertaining to a subscriber or customer of an electronic communication service provider under ECPA. They are wrong to assert that the tracking device statute, 18 U.S.C. 3117, requires a warrant based on probable cause to compel disclosure of cell-site information. They are wrong to assert that cell-phone users have a reasonable expectation ofprivacy in cell-site information. - United States Attorney Electronic Surveillance Manual ~2006
Local law enforcement now have, and use, Stingrays!
Secrecy is the first refuge of incompetents. 1 order per district per day (>30,000+ per year) 75,000 criminal cases per year (40% immigration offenses) Nearly 1 order per criminal case! Over 250,000 orders and only 1 appellate decision?!
Capable of repetition, yet avoiding review Cell site data and orders not turned over to defense counsel. Defense attorneys don t litigate fourth amendment of search they don t know took place. No appellate guidance Administrative constitutionalism
Playing soccer, I m the goalie, and there s nobody else on my team
NSA Revelations
Daniel Rigmaiden Pro se vexious litigant First case where government admits using Stingrays Used Stingray to locate his verizon aircard in his apartment Used with a pen register order from Magistrate Seeborg
Blowback in Northern District
Part 3: Practical Tips Request all cell-site data, pen registers or SCA orders, or any other electronic surveilance. Don t take no for an answer: Get them on record, file motions, etc. GPS data can be plugged into google maps to see what it all means
What it looks like Pen Reg: Spreadsheet with call information, time, cell-site information. Cross reference cell site to get location GPS: HTML files with time, lattitude, and longitude. Plug lat/long into google maps
SUPPRESSION! Any location data requires a warrant Cell-site GPS Warrant Wiretap Take down the entire case as fruit of the poisonous tree If didn t in a wiretap case, argue that they fail to show necessity. Cell-site data is subject to Daubert challenge as well as 4 th amendment challenge
Practical Tips Was there a stingray? Find your client without making clear how Discovery your client s new phone number on a burner Your Confidential Reliable Source may very well be a machine File a motion: the judges want to know Get evidentiary hearings and squeeze them!