Location and Cell Phone Tracking: Technology, Law, and Defense Strategy

Part 1: Location Tracking Technology

• Cell Site Data • “Fine” location data: GPS / Triangulation • GPS Trackers (Homing devices, e.g. Jones) • Stingrays/ISMI catchers

• Other tricks:

– Tower dumps, Email Sweeps, Wiretaps, etc.

Cell Site Location Information (CSI or CSLI) – a Two-Way Radio

“Control” Channel: (Data)

“Content” Channel: (Talk) (Two frequencies)

Subscriber’s Direction - from Tower “Hand-Offs”

CELL SITE DATA IS BECOMING INCREASINGLY PRECISE

Judge Kozinski has 3 femtocells in his house! More accurate than GPS in some circumstances

FCC E-911: “Handset” and “Network” Solutions

Handset Solution Network Solution • Phone itself contains GPS device – it calculates latitude/longitude

• Does not use GPS

• Data resides on phone and provider can ‘ping’

• Measures signal characteristics relative to one or more towers. Data with provider.

Subscriber’s Location – from Tower Triangulation

Global Position System (GPS)

GPS Tracking Device

What can a stingray do?

• Get your ISMI/Phone # - or everyone’s • Find your location • Record your phone calls • Read your texts

All for $60k!

11

Cell Tower Dumps

Get Caller, Recipient, time, and general location for every phone in an area at a specific time

Cross-reference a couple of cell tower dumps, and find

your suspect!

“Scarecrow bandits”

How much is this happenning?

• We don’t know – it’s all under seal!

• 1.3 million requests in 2011 for cell tower data

• Sprint’s law enforcement ‘portal’

Other Tricks:

• Wiretaps • Email grabs • CIPAV devices to monitor internet use • Turn your phone into a mobile listening device • Other “known unknowns”

Only 4 data points required!

US v. Pineda-Moreno (Kozinski dissent), 617 F.3d 1120

• “By tracking and recording the movements of millions of individuals the government can use computers to detect patterns and develop suspicions. It can also learn a great deal about is because where we go says much about who we are. Are winston and Julia’s cell phones together near a hotel a bit too often? Was Syme’s Onstar near an STD clinic? Were Jones Aaronson and Rutheford at that protest outside the White House? The FBI need no longer deploy agents to infiltrate grous it considers subversive, it can figure out where the groups hold meetings and ask the phone company for a list of cell phones near those locations”

Panoptic effect

Part 2(a): The Fourth Amendment

• Katz (’67): 4th Amendment search depends on a “reasonable expectation of privacy.” – “4th Amendment protects people, not places.” – Wiretaps are a search (overruling Olmstead)

• US v. Miller (‘76): No REP in material disclosed to third parties (bank records).

• Maryland v. Smith (‘79): No REP in the numbers you dial.

What is private about being in public?

• Knotts (’83): No privacy interest on a public street, so simple homing device is okay.

• Karo (‘84): Putting a homing device on an object which might enter home is not.

• Kyllo (‘01): Thermal imaging of what is going on inside a house is unconstitutional.

Maynard/Jones

• Maynard (DC Cir): “Mosaic theory” strikes down warrantless tracking.

• Jones: – Scalia (majority) says trespass = search because

mosaic theory unworkable – Alito says continuous tracking is a search – Sotomayor says 3rd party doctrine needs to go

What does it all mean?

• No clear guidance

• Supreme Court uneasy about tracking people.

• Don’t know if your cell site data will locate you in your house – search requiring p/c!*

*(I hope)

Right to Anonymity

Part 2(b): The Statutory Scheme

Or “What Does Congress Think?”

Pen / Trap Orders Court order required to: Install device or process that records - Dialing, routing, addressing or signaling information

from - Transmitted wire or electronic communication by

instrument or facility.

Section 3123 court order requires: Certification by government attorney Information to be obtained “relevant to an ongoing criminal investigation.” 18 USC § 3123(a)(1)

CALEA Call-identifying information from pen registers and trap and trace devices:

[S]hall not include any information that may disclose the physical location of the subscriber (except to the extent that the location may be determined from the telephone number).

47 U.S.C. § 1002(a)(2)

“Three Rail Bank Shot”Shot” •Pen Register / Trap & Trace, 18 USC § 3121-27 • CALEA, 47 USC § 1000-02 • SCA (Stored Communications Act), 18 USC § 2703(d)

“D” or “Hybrid” Orders (SCA) A cell service provider may not:

[K]nowingly divulg[e] a record or other information pertaining to a subscriber . . . to any governmental entity…

Section 2703(d) order permits disclosure if government: Offers specific and articulable facts showing that there are reasonable grounds to believe that the contents of a wire or electronic communication, or the records or other information sought, are relevant and material to an ongoing criminal investigation. 18 USC § 2703(d)

“Tracking Device” Statute

• 8 USC 3117: “As used in this section, the term “tracking device” means an electronic or mechanical device which permits the tracking of the movement of a person or object.”

• Tracking devices are specifically EXEMPTED from SCA!

Part 2(c): New trends in location tracking law

Mag. Judge Stephen Smith (S.D. TX)

Judge Smith Leads the Charge

• Cell site data turns a cell phone into a tracking device.

• Cannot get cell-site data with a 2703(d) order: need probable cause and a warrant.

• Cannot gag cell phone companies about these orders.

• Unseal those orders.

SHHHHHHHHH!

Government Response: • “The government maintains that the magistrate judges are

wrong to assert that cell-site information is not “dialing, routing, addressing, or signaling information” under the Pen/Trap Statute. They are wrong to assert that cell-site information is not “a record or other information pertaining to a subscriber or customer” of an electronic communication service provider under ECPA. They are wrong to assert that the tracking device statute, 18 U.S.C. § 3117, requires a warrant based on probable cause to compel disclosure of cell-site information. They are wrong to assert that cell-phone users have a reasonable expectation ofprivacy in cell-site information.”

• - United States Attorney Electronic Surveillance Manual ~2006

Local law enforcement now have, and use, Stingrays!

“Secrecy is the first refuge of incompetents.”

• 1 order per district per day (>30,000+ per

year) • 75,000 criminal cases per year (40%

immigration offenses) • Nearly 1 order per criminal case! • Over 250,000 orders and only 1 appellate

decision?!

“Capable of repetition, yet avoiding review”

• Cell site data and orders not turned over to defense counsel.

• Defense attorneys don’t litigate fourth amendment of search they don’t know took place.

• No appellate guidance • “Administrative constitutionalism”

• “Playing soccer, I’m the goalie, and there’s nobody else on my team”

NSA Revelations

Daniel Rigmaiden

• Pro se vexious litigant • First case where government admits using

Stingrays • Used Stingray to locate his verizon aircard in

his apartment • Used with a pen register order from

Magistrate Seeborg

Blowback in Northern District

Part 3: Practical Tips

• Request all cell-site data, pen registers or SCA orders, or any other electronic surveilance.

• Don’t take no for an answer: Get them on record, file motions, etc.

• GPS data can be plugged into google maps to see what it all means

What it looks like

• Pen Reg: Spreadsheet with call information, time, cell-site information. – Cross reference cell site to get location

• GPS: HTML files with time, lattitude, and

longitude. – Plug lat/long into google maps

SUPPRESSION! • Any location data requires a warrant

• Cell-site GPS Warrant Wiretap

• Take down the entire case as fruit of the poisonous tree

• If didn’t in a wiretap case, argue that they fail to

show necessity.

• Cell-site data is subject to Daubert challenge as well as 4th amendment challenge

Practical Tips… Was there a stingray?

• Find your client without making clear how • Discovery your client’s new phone number on

a ‘burner’ • Your ‘Confidential Reliable Source’ may very

well be a machine – File a motion: the judges want to know – Get evidentiary hearings and squeeze them!