Support Local Journalism. Join Riverfront Times Press Club.

Wednesday, May 20, 2015

St. Louis Police Have Used StingRay Technology for Years -- They Just Won't Talk About It

Posted By on Wed, May 20, 2015 at 8:00 AM

Page 2 of 3

Ferguson. - RAY DOWNS
  • Ray Downs
  • Ferguson.

In the dizziest days following Michael Brown's death in Ferguson, it was common to hear someone in a protest on West Florissant or out in front of the police station complaining that her cell phone was acting up — dropped calls, weird tones and clicks. Thomas Harvey, an attorney and executive director of the ArchCity Defenders, remembers many of his activist clients fretting that they were being electronically monitored.

"The night of the non-indictment, everyone's phone was shutting off or turning on. They couldn't use Google Maps. I had the same thing happen to me," he recalls. "There's no way for me to know what caused that."

(St. Louis County Police spokesman Brian Schellman says his department does not have a StingRay unit, but plenty of other law-enforcement agencies were on the scene in north county, including St. Louis and the FBI.)

While StingRay provides many benefits to law enforcement, how its capabilities will affect the general populace isn't as clear. Many people, like the protesters in Ferguson, worry their phones are being monitored while simply exercising First Amendment rights. They have some reason to be paranoid — federal authorities have admitted that StingRay can cause nearby phones to act glitchy, and in at least one instance, a law-enforcement agency has been open about wanting to monitor protesters: The Miami-Dade Police Department requested an emergency purchase of a StingRay just prior to the Free Trade Area of the Americas conference in 2003.

"Based on the history of these conferences, the department anticipated criminal activities directed at attendees and conference sites facilitated by the use of cellular phones," the request reads. "Wireless phone tracking systems utilized by law enforcement have proven to be an invaluable tool in both the prevention of these offenses and the apprehension of individuals attempting to carry out criminal activities."

There's also documented use of StingRay to track alleged perpetrators' movements, which civil-liberties advocates call a violation of the suspect's Fourth Amendment rights to be free from unreasonable search and seizure — because the signal travels into private spaces, through walls.

Daniel Rigmaiden in Arizona. - COURTESY OF DANIEL RIGMAIDEN
  • Courtesy of Daniel Rigmaiden
  • Daniel Rigmaiden in Arizona.

The first court case where the government acknowledged the existence of StingRay technology came out of a tax-fraud prosecution in Arizona in 2008, in which police used the tracker to locate the wireless broadband modem or "AirCard" of a man named Daniel Rigmaiden. Rigmaiden had been using it to access the Internet and submit fake tax returns, netting about $500,000 over the course of three years.

"I knew the instant I was arrested that they had to track down my AirCard," Rigmaiden says now. "There wasn't any other flaw in my methods."

The "flaw," as he puts it, was assuming that law enforcement would reserve the use of high-tech tracking technology for terrorism or kidnapping cases — not a lowly tax frauder. Turns out police use StingRay for a wide range of cases — which left Rigmaiden and his AirCard a sitting duck for the investigators hot on his trail.

As Rigmaiden mounted a pro se defense, he compelled federal investigators to produce tens of thousands of pages of documents. That paperwork, along with the testimony he obtained, gave the world its first glimpse at how the technology works.

Rigmaiden was unsuccessful in his argument that the StingRay sweep was unconstitutional. However, rather than getting more than twenty years in prison, prosecutors offered him time served in exchange for a guilty plea. The Arizona man got out of prison a year ago and now works to combat StingRay secrecy.

"Every citizen has a duty to make sure the Constitution is upheld," he says. "I have the opportunity to do it in this particular area."

Since Rigmaiden's case, dribs and drabs of information about the technology have come out of other criminal cases, but government secrecy has ruled the day. That may be about to change. Earlier this month the U.S. Department of Justice announced that it would review use of the technology by all arms of federal law enforcement including the FBI, the DEA and the U.S. Marshals.

"I wouldn't call it an investigation. It seems to be a reevaluation of their policy," says Nathan Wessler, staff attorney for the Speech, Privacy, and Technology Project at the American Civil Liberties Union. "It's crucial that local law enforcement follow suit immediately, including in St. Louis."

In St. Louis, former Division 16 Circuit Court Judge Jack Garvey says the first he heard of the "magical" technology that could track phones was during his regular Wednesday meeting with former police chief Dan Isom and Circuit Attorney Jennifer Joyce in 2011. At the time, he says, the cell site simulator belonged to the local branch of the U.S. Secret Service (apparently St. Louis has one of those, too).

"Isom says, 'We can use this device that is sitting in the back of a parking garage at police headquarters,'" recalls Garvey.

In those early days, Garvey agreed to sign off on warrants allowing the police to use the Secret Service's device to look for phones taken from crime victims. They had to provide the serial number for the phone and the cell service provider.

The police and the prosecutors kept this new-fangled tactic tightly under wraps. But Garvey says he spoke openly about the warrants and was astonished no defense attorney ever followed up with questions during the year he was signing them.

"It was a joke," he says. "We were yukking it up back then."

At some point after Garvey moved to the 17th Division and was no longer the primary judge signing the warrants, the way cell site simulator technology was used at the department changed. The same month that Isom announced his retirement, the board of commissioners for the St. Louis Metropolitan Police Department put out an invitation for bids for a "Stingray II System" and the installation of the system in a Chevrolet Tahoe. StingRay units are relatively portable — some are about the size of a suitcase, and can be installed in vehicles and taken on the road.

At this point, StingRay deployment is more like an old-fashioned game of cops-and-robbers than an omniscient Big Brother seeing and knowing all. According to the ACLU the device is often hooked up to a laptop in a police car, and officers drive around as the laptop display shows them whether the signal is getting hotter or colder. Some authorities have even described walking with handheld units through large apartment buildings until they were certain which room had the phone inside.

Although several companies produce this type of product for law enforcement, the leader is Florida-based Harris Corporation, which is also the only company that calls its devices "StingRay."

"Harris is kind of like the Apple corporation of the surveillance world. It's really easy to use their stuff," says Rigmaiden. "The other stuff is more complicated."

Prices for these types of devices range from $16,000 to $400,000 for a suite of technology.

It's not clear whether the St. Louis Police Department successfully purchased the StingRay, or decided to continue using loaners from some other federal jurisdiction. An attorney for the city denied a Sunshine Request for any purchasing paperwork, saying the documents would "reveal trade secrets and commercial or financial information." Isom wouldn't comment on where the purchase stood at the time of his departure, and Police Chief Sam Dotson has not responded to interview requests.

But the department did respond to RFT's request for applications for search warrants or orders authorizing the use of cell site simulators. That request yielded two examples. To Garvey, they're unrecognizable from the orders he signed four years ago.

"It's more of a broad thing. My search warrants that we were doing were, 'This is the phone of this person, this is the serial number of this phone,'" he says. "Something happened. Either the cops got a new machine, or they're running it from a new machine."

The two example applications given to RFT are called "pen register applications," more commonly understood as applications to install a device that reads which numbers are being dialed — and which are incoming — on a landline. But the new application paperwork broadens the language to include "cell site activations," "call detail records in an electronic format" and, most densely, "24-hour a day assistance to include switch based solutions including precision location pursuant to probable cause based information queries and all reasonable assistance to permit the aforementioned Agencies to triangulate target location."

That last, almost inscrutable paragraph is the closest the documents come to referring directly to StingRay usage.

click to enlarge "The secrecy in cities across the country has been so extraordinary," says Nathan Wessler, staff attorney for the ACLU. - COURTESY OF THE ACLU.
  • Courtesy of the ACLU.
  • "The secrecy in cities across the country has been so extraordinary," says Nathan Wessler, staff attorney for the ACLU.

To Wessler of the ACLU, the very vagueness of that language makes it unconstitutional.

"This violates the Fourth Amendment," he concludes after reviewing RFT's documents. "Nothing in the applications suggests that police will be using cell site simulators. Nor do the applications explain to the judge the capabilities of cell site simulators."

It's also simply too easy for police to obtain pen register application approval, Wessler says, as opposed to the higher burden of proving probable cause for a warrant. To obtain a warrant, police have to show there's a preponderance of evidence — as spelled out in the Fourth Amendment — that makes their search necessary.

For a pen register application, all cops have to show is that it could help the investigation. And because of the extremely vague and/or technical language in the applications, judges may have no idea they're authorizing use of a StingRay — the term simply never appears in the document.

Privacy advocates are also concerned about what happens to the data from innocent bystanders in the area who may have their phones swept.

A good analogy, says the ACLU's Nathan Wessler, is a game of Marco Polo: "The device yells 'Marco!' and all the [nearby] phones are forced to yell back 'Polo!' The StingRay can then be used to hone in on the signal from the suspect's phone and locate him/her based on the strength and direction of the signal. But all the while, every other phone is still being forced to yell 'Polo!' over and over, letting the StingRay know that they are in the area too."

It's those other phones that have some activists worried.

"What is done with all that data that's irrelevant? Are they keeping that information, or are they deleting it?" asks Electronic Frontier Forum attorney Fakhoury. "These things identify phones in the area; they don't necessarily listen in on phone conversations or capture data. But that is a technical limitation. What that means is, they are configured not to do that, but we don't know how they're not doing that."

One thing appears to be similar from the days when Garvey was signing off on the StingRay warrants: the ones obtained by RFT show that, locally, the device has only been used to track the phones of victims, rather than perpetrators or activists.

The two heavily redacted pen register applications provided by the police department are both from homicide cases in which the alleged murderer is thought to have stolen the victim's phone.

"Victim ____ registered a hotel room on ______ and prepaid through ______. Witnesses at the scene reported hearing a loud argument near the victim's room earlier in the week," reads one of the applications. "Detective _____ stated an _____ wall charger located in ______ hotel room; however no _______ was located in his room or on his person."

The second application describes a drug deal gone bad, with one fatality. "A suspect pulled a long barreled firearm and began firing shots at the victims. ________ was able to flee the residence through a second floor window and later discovered the other victims had been shot. During this incident victim ______ disclosed his cellular phone had been stolen."

Both applications were approved for 60 days, and the judge — whose name is also redacted — agreed that the orders be sealed.

Garvey says at least one StingRay warrant he signed off on caught a murderer, a guy who was strolling out of a Walmart with the stolen phone in his pocket.

"I'm telling you, it's doing miracle work," he says.

St. Louis Pen Register Applications and Orders

Tags: , ,

Support Local Journalism.
Join the Riverfront Times Press Club

Local journalism is information. Information is power. And we believe everyone deserves access to accurate independent coverage of their community and state. Our readers helped us continue this coverage in 2020, and we are so grateful for the support.

Help us keep this coverage going in 2021. Whether it's a one-time acknowledgement of this article or an ongoing membership pledge, your support goes to local-based reporting from our small but mighty team.

Join the Riverfront Times Club for as little as $5 a month.

Read the Digital Print Issue

September 22, 2021

View more issues


Never miss a beat

Sign Up Now

Subscribe now to get the latest news delivered right to your inbox.

Best Things to Do In St. Louis

© 2021 Riverfront Times

Website powered by Foundation