Yesterday, New Mexico Governor Michelle Lujan Grisham signed a bill into law that limits the warrantless use of stingray devices to track people’s location and sweep up electronic communications, and more broadly protects the privacy of electronic data. The new law will also hinder the federal surveillance state.
Sen. Peter Wirth (D) filed Senate Bill 199 (SB199) on Jan. 8. Titled the “Electronic Communications Privacy Act,” the new law will help block the use of cell site simulators, known as “stingrays.” These devices essentially spoof cell phone towers, tricking any device within range into connecting to the stingray instead of the tower, allowing law enforcement to sweep up communications content, as well as locate and track the person in possession of a specific phone or other electronic device.
The bill requires police to obtain a warrant or wiretap order before deploying a stingray device, unless they have the explicit permission of the owner or authorized possessor of the device, or if the device is lost or stolen. SB199 includes an exception to the warrant requirement for emergency situations. Even then, police must apply for a warrant within 3 days and destroy any information obtained if the court denies the application.
On Jan. 24, the Senate passed SB199 by a 41-0 vote. On Jan. 30, the House concurred with a vote of 68-0. With the governor’s signature, the law will go into effect 90 days after adjournment of the legislature.
SB199 also bars law enforcement agencies from compelling a service provider or any person other than the owner of the device without a warrant or wiretap order. This includes actual communication content such as phone conversations, text messages and email, location information and other metadata such as IP addresses pertaining to a person or device participating in the communication.
A service provider may still share information voluntarily under the law. Law enforcement will have to destroy such information within 90 days unless it gets the consent of the owner or a court order.
Provisions in SB199 will severely limit sharing of any legally obtained data.
The legislation provides a legal remedy for anybody whose data is obtained in violation of the law.
A person in a trial, hearing or proceeding may move to suppress any electronic information obtained or retained in violation of the United States constitution, the constitution of New Mexico or the Electronic Communications Privacy Act. The motion shall be made, determined and subject to review in accordance with the procedures provided in law.
A similar bill unanimously passed in both houses of the New Mexico legislature in 2017, but Gov. Susana Martinez vetoed the bill, saying she didn’t want to “burden law enforcement officials.” Martinez was term-limited out of office and Democrat Gov. Michelle Lujan Grisham replaced her in 2019.
IMPACT ON FEDERAL SURVEILLANCE PROGRAMS
The federal government funds the vast majority of state and local stingray programs, attaching one important condition. The feds require agencies acquiring the technology to sign non-disclosure agreements. This throws a giant shroud over the program, even preventing judges, prosecutors and defense attorneys from getting information about the use of stingrays in court. The feds actually instruct prosecutors to withdraw evidence if judges or legislators press for information. As the Baltimore Sun reported in April 2015, a Baltimore detective refused to answer questions on the stand during a trial, citing a federal non-disclosure agreement.
Defense attorney Joshua Insley asked Cabreja about the agreement.
“Does this document instruct you to withhold evidence from the state’s attorney and Circuit Court, even upon court order to produce?” he asked.
“Yes,” Cabreja said.
As privacysos.org put it, “The FBI would rather police officers and prosecutors let ‘criminals’ go than face a possible scenario where a defendant brings a Fourth Amendment challenge to warrantless stingray spying.”
The experience of a Pinellas County, Florida, man further highlights the shroud of secrecy around the use of stingray devices, along with the potential for abuse of power inherent in America’s law enforcement community.
The feds sell the technology in the name of “anti-terrorism” efforts. With non-disclosure agreements in place, most police departments refuse to release any information on the use of stingrays. But information obtained from the Tacoma Police Department revealed that it uses the technology primarily for routine criminal investigations.
Some privacy advocates argue that stingray use can never happen within the parameters of the Fourth Amendment because the technology necessarily connects to every electronic device within range, not just the one held by the target. And the information collected by these devices undoubtedly ends up in federal databases.
The feds can share and tap into vast amounts of information gathered at the state and local level through fusion centers and a system known as the “information sharing environment” or ISE. In other words, stingrays create the potential for the federal government to track the movement of millions of Americans with no warrant, no probable cause, and without the people even knowing it.
Fusion centers were sold as a tool to combat terrorism, but that is not how they are being used. The ACLU pointed to a bipartisan congressional report to demonstrate the true nature of government fusion centers: “They haven’t contributed anything meaningful to counterterrorism efforts. Instead, they have largely served as police surveillance and information sharing nodes for law enforcement efforts targeting the frequent subjects of police attention: Black and brown people, immigrants, dissidents, and the poor.”
Fusion centers operate within the broader ISE. According to its website, the ISE “provides analysts, operators, and investigators with information needed to enhance national security. These analysts, operators, and investigators…have mission needs to collaborate and share information with each other and with private sector partners and our foreign allies.” In other words, ISE serves as a conduit for the sharing of information gathered without a warrant. Known ISE partners include the Office of Director of National Intelligence which oversees 17 federal agencies and organizations, including the NSA. ISE utilizes these partnerships to collect and share data on the millions of unwitting people they track.
The federal government encourages and funds stingrays at the state and local level across the U.S., thereby undoubtedly gaining access to a massive data pool on Americans without having to expend the resources to collect the information itself. By placing restrictions on stingray use, state and local governments limit the data available that the feds can access.
In a nutshell, without state and local cooperation, the feds have a much more difficult time gathering information. Passage of SB199 strikes a major blow to the surveillance state and is a win for privacy.
By allowing defendants to suppress information obtained in violation of the law, SB199 will hinder one practical effect of NSA spying in New Mexico.
Reuters revealed the extent of such NSA data sharing with state and local law enforcement in an August 2013 article. According to documents obtained by the news agency, the NSA passes information to police through a formerly secret DEA unit known Special Operations Divisions and the cases “rarely involve national security issues.” Almost all of the information involves regular criminal investigations, not terror-related investigations.
In other words, not only does the NSA collect and store this data, using it to build profiles, the agency encourages state and local law enforcement to violate the Fourth Amendment by making use of this information in their day-to-day investigations.
This is “the most threatening situation to our constitutional republic since the Civil War,” Binney said.