Stingrays and the Chicago Police Department

“Stingrays” are an invasive technology, capable of gathering vast amounts of data about people’s cell phone locations and communications. In Illinois, the Citizen Privacy Protection Act, 725 ILCS 137/10, limits the use of Stingrays by law enforcement in two ways. First, law enforcement agencies may only use Stingrays to identify, locate, or track the location of a cell phone or other communications device. Second, before using a Stingray, law enforcement agencies must obtain a warrant that the target is engaged in a crime.

Unfortunately, in Chicago, the public cannot assess whether the Chicago Police Department (“CPD”) is following this law. Its lawyers instructed the technicians who manage Stingrays that they should not keep a log of their use, presumably to avoid Freedom of Information Act (“FOIA”) requests. CPD has denied records requests, claiming that its disorganized recordkeeping makes finding relevant information unduly burdensome. Further, like many other agencies, CPD does not keep or share much other information about the technology. It also does not have written internal policies that effectuate the law.

Fortunately, we do have some information about CPD’s use of Stingrays. In addition to our own FOIA efforts, much of the information available is the result of efforts by other advocates, including Freddy Martinez of Lucy Parsons Labs and Matt Topic of Loevy & Loevy. Their work in forcing the City to turn over documents through FOIA and deposing various CPD personnel, respectively, has brought to light important information about what CPD has purchased, how much it has spent, and how little internal accountability there is.

I. WHAT IS A STINGRAY?

A Stingray is the most well-known model of cell-site simulator (“CSS”), but is commonly used to refer to the range of CSS devices as a whole.[1] Other common terms include “IMSI catcher” (short for “international mobile subscriber identity”) and “digital analyzer.” A CSS imitates a cell phone tower, fooling nearby phones into connecting to it and sending their unique identifying numbers.[2] The device can be mounted in a car or plane, and there is even a handheld model.[3] The police can cover large areas or large gatherings of people, then zero in on the location of a particular phone (and its user).

A Stingray, however, doesn’t just capture the ID numbers of the target phone—it captures those of all nearby phones.[4] If the ID number is known, the device can isolate that number once it is within range and will stop connecting with other phones.[5] If the ID number is not known, the device can be deployed at several locations, obtain all ID numbers at those locations, then determine whether there were common ID numbers at each location.[6] It can also be configured to collect the contents of communications, such as texts, emails, contacts, and photos.[7] This location and communications data can be stored, raising concerns about the privacy of all other cell phone users in the vicinity.

Illinois law prohibits the use of Stingrays except for locating, tracking, or identifying a cell phone, and it also prohibits the maintenance of that data.[8] Yet, as noted below, it is not clear whether the CPD has policies in place to follow the requirements of that law.

II. WHAT DOES CPD HAVE?

According to deposition transcripts obtained through FOIA, an unmarked Black SUV sits at Homan Square, the CPD facility in North Lawndale.[9] This vehicle is driven for the sole purpose of deploying the CSS system, which consists of a network of electronic boxes housed in the back of the SUV.[10] Only the handful of officers who are members of the Electronic and Technical Support unit, also known as the “Tech Lab,” are trained to use it.[11]

While we do know the names of some of the models CPD has purchased over the years, we do not know what models CPD currently uses or how they configured, and therefore do not know what their capabilities are. Nearly everything related to CPD’s Stingray has been shrouded in secrecy, even from the time of acquisition.

CPD has purchased CSS equipment from Harris Corporation and Digital Receiver Technology, Inc. using “1505 funds,” which come from civil forfeiture money seized during drug-related investigations.[12] Since at least 2005, the City has paid hundreds of thousands of dollars for equipment, upgrades, and training.[13] And because cellular technology is always changing, periodic updates and enhancements become necessary—and they are not cheap. One such set of upgrades and new equipment totaled $252,275.[14] Despite these large, publicly-funded purchases, CPD has tried to remain secretive about these purchases, including by redacting the item names from invoices, claiming such basic information to be “law enforcement sensitive information that could be damaging to the Department’s police powers” and “proprietary information that would be harmful to a private company.”[15] Additionally, CPD does not even keep records of this expensive equipment in their inventory asset management system.[16]

III. WHEN AND HOW HAS CPD USED STINGRAYS?

CPD intentionally maintains no records documenting how they operate their CSS equipment. When Harris employees came to Chicago to teach CPD’s Tech Lab officers how to operate the equipment,[17] CPD did not retain any written instructions, manuals, notes, or other materials.[18] CPD also had to sign a non-disclosure agreement (“NDA”) with the Federal Bureau of Investigation (“FBI”), which has acted as a sort of gatekeeper between law enforcement and the Harris Corporation.[19] According to this NDA, CPD is required to notify the FBI immediately if it receives any Stingray-related Freedom of Information Act (“FOIA”) requests, so that the FBI has enough time “to seek to prevent disclosure through appropriate channels.”[20] The CPD has often taken several months to respond to our own FOIA requests regarding Stingrays.

The NDA also instructs CPD not to “use or provide any information” concerning their Stingray “beyond the evidentiary results obtained” while using it.[21] In other words, CPD may not reveal the steps that led to obtaining their evidence. The FBI can even go so far as to make CPD seek the dismissal of a criminal case rather than allow any information to come to light that might “compromise” the Stingray technology.[22] This isn’t a unique requirement imposed on CPD. Rather, the NDA contains boilerplate language that the FBI has used with dozens of other law enforcement agencies across the country.[23] In fact, CSS manufacturers must notify the FBI before selling their devices to law enforcement agencies.[24] One cost estimate from Harris to CPD included the caveat that “purchasing this equipment and software is contingent on authorization and approval of the Government Sponsor NDA.”[25]

Furthermore, CPD Tech Lab personnel have testified that no log or electronic records are kept when CPD officers deploy the Stingray, and no written regulations limit its use.[26] The unwritten process for using a Stingray begins when an officer comes to the Tech Lab with a court order and the Tech Lab sends the order to a service provider like Verizon or AT&T.[27] The service provider then gives the general whereabouts of the cell phone, and the officers drive the Stingray to that area to find a more precise location.[28] There is no log to track this activity, and in fact, when one sergeant inquired about keeping such records, an attorney retained by the City of Chicago advised him not to.[29] Instead, the Tech Lab simply files the hard copies of the CSS court orders in a cabinet mixed in with pen register court orders.[30] When the ACLU sought records of all warrants or court orders related to CSS, the City refused, arguing that the records consist of more than 6,000 pages of unsegregated records, making them too burdensome to identify.[31] Officers claim that a Stingray is almost never used without a court order,[32] and that the Tech Lab sergeant reviews the order to ensure the language complies with the Citizen Privacy Protection Act, but without adequate recordkeeping, it is impossible to tell.[33]

Keeping these secrets has come at a cost to Chicago taxpayers. From 2014 to 2016, the City defended two lawsuits filed by a concerned member of the public, Freddy Martinez, who was denied FOIA records regarding cell site simulators in the possession of CPD. The city ultimately settled the lawsuits and ended up releasing hundreds of pages of documents that it had claimed were exempt from FOIA, but over the course of those two years paid out hundreds of thousands of dollars in attorneys’ fees.[34] Those documents included dozens of purchase requests for various CSS equipment and upgrades over the past decade totaling several hundred thousands of dollars.

IV. WHAT ARE THE LEGAL REQUIREMENTS IN ILLINOIS?

With pressure from the ACLU of Illinois and many other organizations, Governor Bruce Rauner signed the Citizen Privacy Protection Act, which took effect at the beginning of 2017. The law permits law enforcement agencies to use CSS devices only to locate, track the location of, or identify a communications device—in other words, they cannot configure them to capture the content of any communications.[35]

The law also requires that a court order be obtained based on probable cause that the target is committing, has committed, or will commit a crime.[36] This requirement does not apply in cases of missing persons or emergencies, but in such emergency cases, police are still required to seek out a court order within 72 hours of tracking.[37] In the application for the court order, police must describe the capabilities of the CSS they are using, including whether it will capture data from non-target phones and what procedures will be followed to protect the privacy of non-targets.[38]

When a CSS is used to find a known device, the Act requires police to delete non-target’ data within 24 hours.[39] If it’s used to find an unknown device, they must delete non-target data within 72 hours of identifying the unknown communications device, absent a court order preserving the data.[40]

The use of Stingrays also raise constitutional concerns. The collection and use of similar data has been found to violate the Fourth Amendment. Carpenter v. United States, 138 S. Ct. 2206 (2018) (holding that Fourth Amendment requirements are triggered when the government accesses historical cell phone records that provide a chronicle of the user’s past locations and movements).

Is CPD abiding by state law rules? It is impossible to say without any record-keeping or audits. CPD has not responded to our most recent FOIA request for information about any new policies, procedures, or records on its use of this technology, so we can only assume that it has not developed any.

V. RECOMMENDATIONS

Stingrays routinely capture information about innocent bystanders, and the average person has no way of knowing that it has even happened. CPD needs better oversight for this intrusive technology, and they need to be more open with their records.

At a minimum, CPD must:

1. Maintain a log detailing each instance a CSS is used, including the date, time, location, purpose, intended target, court order or explanation as to why no court order was obtained, and date that all non-target data was deleted.
2. Develop policies, guidelines, and training to ensure the use of CSS devices complies with the Fourth Amendment and state law, and protects the privacy rights of innocent people.
3. Disclose the specific CSS equipment it has and how it is configured, as well as the amount of money spent on acquiring, updating, maintaining, and training officers on the equipment, including the kinds of funding used for these purposes.
4. Disclose how effective this technology has been in apprehending and convicting the correct criminal suspects and the nature of their alleged crimes.

We call on Chicago’s Office of the Inspector General to conduct an investigation into CPD’s policies, practices, and records relating to its use of CSS devices.