A bill introduced in the House this week would place new limits on cellphone tracking technology in use by federal, state, and local government agencies across the United States.
The Cell Location Privacy Act, introduced on Wednesday by Rep. Jason Chaffetz, Republican of Utah, aims to place new legal restrictions on the use of technology known as cell-site simulators. The bill, H.R. 1061, would prohibit the use of cell-site simulators without a warrant, except when authorized by the Foreign Intelligence Service Act (FISA), or in emergency situations.
In addition, the bill prohibits the use in court of evidence collected through the extralegal operation of a cell-site simulator.
“The abuse of cell site simulators can lead to blatant violations of privacy by anyone who can purchase such a device,” Chaffetz said in a statement. “If probable cause exists, get a warrant. But if they just want to surf through our private information, that’s a bridge too far. The purchase of these devices by agencies like the IRS raises red flags about the potential for abuse.”
Often called “Stingrays” after a popular model, a cell-site simulator is a suitcase-sized device used by police to track and collect data from consumer cellphones. The device works by masquerading as a base transceiver station (“cell tower”) and emits a signal stronger than those generated by authentic towers in the area. This forces cellphones to connect to the simulator instead of a legitimate tower, taking advantage of a power-saving feature inherent to most devices.
When this occurs, a variety of identifying data may be retrieved from the phone, including its unique IMEI number, which can be used to identify the device’s owner.
Read more:
Advanced models—deployed during the war in Afghanistan, but reportedly not sold to local police agencies—are capable of collecting not only metadata but the content of conversations and messages, using what’s called a “man-in-the-middle” attack.
Generally speaking, when cellphones connect to a simulator instead of an actual cell tower, they are prevented from sending or receiving calls and text messages. Research conducted by Canadian police also show that the devices can and do disrupt calls to emergency services, despite software changes intended to prevent it. The Royal Mounted Canadian Police (RCMP) currently limit the use of the device to three-minute intervals, which they consider a “calculated risk to public safety,” according to the Globe and Mail. There are no such regulations in the U.S., however.
Chaffetz’s bill appears aimed to codify in law more broadly the policies which were implemented by the U.S. Justice Department (DOJ) in September 2015. The DOJ policy—not to be confused with a law—advises federal law enforcement agencies to acquire a probable cause warrant before deploying a Stingray. This policy does not extend, however, to the hundreds or thousands of local and state law enforcement agencies that have acquired cell-site simulators, often by way of a federal grant.
The Cell Location Privacy Act offers three exemptions to its chief provision, which bans the use of the technology: The operator must have a warrant; they must be conducting electronic surveillance authorized by the Foreign Intelligence Surveillance Court (FISC); or they must be reacting to a legitimate emergency. (Due to the level of secrecy surrounding the surveillance court and the investigations it authorizes, it is impossible to state how often a cell-site simulator might be used under this provision.)
The emergency provision requires an agency using a cell-site simulator to determine “reasonably” that there is an “immediate danger of death or serious physical injury to a person.” The simulator may also be deployed in an emergency prompted by a national security threat, or by “conspiratorial activities characteristic of organized crime.” Nonetheless, the agency must apply for a warrant “not later than 48 hours” after the cell-site simulator is activated, and if the warrant is denied, the agency must discontinue use of the device.
The bill additionally prohibits the introduction of evidence in court originally acquired by a cell-site simulator without a warrant, even in emergency situations.
Chaffetz also cosponsored the Geolocation Privacy and Surveillance Act (GPS Act), a bicameral bill, alongside Sen. Ron Wyden (D-Ore.) and Rep. John Conyers (D-Mich.). The bill aims to curtail the collection of Americans’ geolocation information without a warrant, and specifically references the use of cell-site simulators as well.
In regards to geolocation data, Chaffetz and Wyden have been working together to push for increased privacy protections since 2011.