The U.S. Department of Justice (DOJ), responding to protests from civil libertarians over Stingray surveillance technology that mimics cellphone towers to spy on people, took a first step toward controlling their use by requiring its employees to get warrants for deployment in most cases.

The policy change, outlined in a seven-page document (pdf), will not affect federal agencies outside the DOJ or state and local law enforcement. As near as anyone can tell, the cell-site simulator technology is popular in California.

The Los Angeles Police Department (LAPD) reportedly purchased the equipment in 2005 with a $260,000 grant from the U.S. Department of Homeland Security. The American Civil Liberties Union (ACLU) has filed lawsuits seeking Stingray information in Anaheim and Sacramento, and the First Amendment Coalition filed a lawsuit in San Diego.

The San Bernardino County Sheriff’s Department used Stingrays without a warrant 303 times between January 1, 2014, and May 7 of this year, according to Ars Technica.

Agencies covered by the DOJ memo include the FBI, the Bureau of Alcohol, Tobacco and Firearms (ATF), the U.S. Drug Enforcement Administration (DEA) and the U.S. Marshals Service. Homeland Security is not included.

The federal government has given localities grant money for years to buy the equipment, sold primarily by Harris Corporation under a non-disclosure agreement that has effectively cloaked in secrecy their capability and usage. District attorneys have dropped cases rather than disclose how they used a Stingray to gather information.   

The feds won’t stop doing that. “The protections shouldn't end just because they've given money to locals to use this instead of using it themselves,” ACLU attorney Nathan Freed Wessler told Ars Technica.

The DOJ will now require its officials to delete data inadvertently gathered from non-targeted phones and report how the devices are used to agency headquarters. But the department does not have to provide an annual cell-simulator report to Congress as it does on wiretapping activities and national security letters.

Stingrays pretend to be cell towers and fool wireless phones into establishing a connection. Once connected, they can determine cell locations and download information of people who are not suspects in an investigation, including text messages, emails and documents, raising all sorts of privacy issues.

Law enforcement officials deny that Stingrays gather information beyond basic tracking data. But the new Justice Department memo indicates they have that capability by way of admonishing the authorities not to use it. The devices “may not be used to collect the contents of any communication. . . . This includes any data contained on the phone itself: the simulator does not remotely capture emails, texts contact lists, images or any other data from the phone.”

Although the memo requires warrants in most cases, the directive has what appears to be a rather large loophole. In addition to granting a warrant waiver in emergency situations, the policy allows one for “exceptional circumstances” that “make obtaining a search warrant impracticable.”

That certainly won’t be abused. In fact, the department has always “in the past, obtained appropriate legal authorizations to use cell-site simulators,” the DOJ said. This memo just tidies up a few loose ends.

–Ken Broder

To Learn More:

Finally! DOJ Reverses Course and Requires Warrants for Stingrays! (by Nate Cardoza, Electronic Frontier Foundation)

FBI, DEA and Others Will Now Have to Get a Warrant to Use Stingrays (by Cyrus Farivar, Ars Technica)

The Feds Need a Warrant to Spy with Stingrays from Now On (by Kim Zetter, Wired)

New Cellphone Surveillance Safeguards Imposed on Federal Law Enforcement (by Carrie Johnson, National Public Radio)

LAPD Has Had “Stingray on Steroids” Surveillance Equipment for a Decade (by Ken Broder, AllGov)

Justice Department Announces Enhanced Policy for Use of Cell-Site Simulators (U.S. Department of Justice)