INDIANAPOLIS -- The Indianapolis Metropolitan Police Department has a Stingray device capable of tracking cell phones, and has for years, according to documents newly released by the department.
IMPD released a copy of a non-disclosure agreement with the FBI regarding the technology in January following a FOIA request from the non-profit journalism organization MuckRock.
RTV6 was independently able to obtain a copy of the department's purchase order from Harris Corporation, which produces the Stingray device, through a separate records request.
Put together, the documents provide a glimpse into surveillance technology that law enforcement is often unwilling to talk about – if not contractually prohibited from doing so.
Law enforcement's use of electronic surveillance has found itself thrust back into the spotlight recently following the publication of a trove of purported CIA surveillance tools by WikiLeaks. But even before that, privacy advocates were criticizing the use of what they described as indiscriminate surveillance equipment on U.S. citizens.
In January, a Chicago attorney filed a federal lawsuit against the Chicago Police Department alleging CPD's use of a cell-site simulator (the technical name for devices like the Stingray) violated his Fourth Amendment rights. According to the Chicago Tribune, Jerry Boyle, the attorney who filed the lawsuit, frequently attends protests to monitor police activity and believes CPD surveillance of those protests may have swept up data from his phone in the process.
Boyle's lawsuit, and others filed around the country, challenged the Chicago Police Department's use of the devices to conduct warrantless searches. In Indiana, a 2014 law (2014 HEA 1009) authored by Rep. Eric Koch and signed by Gov. Mike Pence requires police officers to obtain a search warrant before using equipment "capable of obtaining geolocation information concerning a cellular device or device connected to a cellular network," except for exigent circumstances. Even then, the law requires police to obtain a search warrant within 72 hours after the use of the equipment.
Former IMPD chief Troy Riggs said electronic surveillance is nothing new for law enforcement -- and that, as long as it adheres to the constitution, it's a good thing.
"Let's be clear: Electronic surveillance has been around since the phone was invented," he said. "But this is new technology. People are afraid of new technology. But they don't need to be, and I'll tell you why. Government utilizes technology in investigations, it always has, it always will. There's new technology being developed every day that's going to be beneficial. And we as citizens need that. We need that technology to track potential criminals. But here's the same thing that governs new technology, that governed old technology, and that's the Constitution of the United States. The Fourth Amendment prohibits that type of search without a warrant or exigent circumstances. Government, whether it be federal government or local government, has to follow the Fourth Amendment. If they don't, there has to be a severe penalty for those that violate that.
How the Stingray Works
IMPD purchased its Stingray equipment in December 2011, shortly before Indianapolis was set to host the 2012 Super Bowl, for a total cost of $341,197.
That figure includes $88,000 for the system and licensing, and $185,000 for unspecified "other equipment."
Purchase orders obtained by RTV6 show IMPD has spent at least another $200,600 on the equipment since January 2012. That money went toward maintenance and one redacted expense for $87,500 in December 2013.
All of that money went to the Harris Corporation, the Florida-based company that manufactures the equipment.
The Harris Corporation – and the FBI, which authorizes local law enforcement agencies to license Stingray equipment – does not make details of how the equipment operates available to the public. But the Department of Justice's latest guidance on "cell-site simulator technology," issued in 2015, does go into some detail about how it functions and what it does, and does not, collect.
The Stingray device works at a basic level by masquerading itself as a cell tower. This "tricks" nearby cell phones into identifying themselves to the Stingray. What the device actually receives is a unique identifying number assigned to a cell phone along with signaling information – what direction the signal is coming from, and how strong the signal is.
According to the DOJ guidance, cell-site simulators like the Stingray don't download location data or the contents of calls, emails or text messages sent or received by the phone. They also won't provide law enforcement with the name, address or telephone number of the person who owns the phone.
The following excerpt from the 2015 version of Department of Justice Policy Guidance: Use of Cell-Site Simulator Technology provides a more in-depth explanation of how the technology works:
How They Function
Cell-site simulators, as governed by this policy, function by transmitting as a cell tower. In response to the signals emitted by the simulator, cellular devices in the proximity of the device identify the simulator as the most attractive cell tower in the area and thus transmit signals to the simulator that identify the device in the same way that they would with a networked tower.
A cell-site simulator receives and uses an industry standard unique identifying number assigned by a device manufacturer or cellular network provider. When used to locate a known cellular device, a cell-site simulator initially receives the unique identifying number from multiple devices in the vicinity of the simulator. Once the cell-site simulator identifies the specific cellular device for which it is looking, it will obtain the signaling information relating only to that particular phone. When used to identify an unknown device, the cell-site simulator obtains signaling information from non-target devices in the target's vicinity for the limited purpose of distinguishing the target device.
What They Do and Do Not Obtain
By transmitting as a cell tower, cell-site simulators acquire the identifying information from cellular devices. This identifying information is limited, however. Cell-site simulators provide only the relative signal strength and general direction of a subject cellular telephone; they do not function as a GPS locator, as they do not obtain or download any location information from the device or its applications. Moreover, cell-site simulators used by the Department must be configured as pen registers, and may not be used to collect the contents of any communication, in accordance with 18 U.S.C. § 3127(3). This includes any data contained on the phone itself: the simulator does not remotely capture emails, texts, contact lists, images or any other data from the phone. In addition, Department cell-site simulators do not provide subscriber account information (for example, an account holder's name, address, or telephone number).
The DOJ guidance also advises law enforcement agencies that they must obtain a search warrant when using the device, except in exigent and exceptional circumstances. Police are not supposed to use any information they obtain from non-target phones in further investigations, unless authorized to do so by the court.
Law enforcement should also have a plan in place when applying for a warrant regarding how it will address the "deletion of data not associated with the target phone." When the equipment is used to track a known phone, the DOJ guidance requires all data to be deleted within 24 hours. When used to track an unknown phone, all data should be deleted within 30 days, at the most.
What's in the Stingray Agreement
The FBI approved IMPD's purchase of the Stingray device, and the restricted "Landshark" software, in January 2012.
As part of that approval, IMPD signed a non-disclosure agreement with the FBI. The agreement, in addition to a general prohibition on disclosing information about the Stingray device, contained a number of other aspects:
-
IMPD agreed to coordinate with the FBI any time it planned to use the Stingray so as not to interfere with ongoing FBI investigations.
-
IMPD agreed not to provide any information about the Stingray device or its software or documentation in a court setting beyond evidence obtained with the device.
-
IMPD agreed not to publicize its acquisition of the Stingray device in any news or press release or direct or indirect statements to the media.
Law enforcement always tries to extend the window as long as possible before criminals catch onto new technology, Riggs said. But, he said, even once they're aware it exists, it remains effective.
"Whether they're aware or not, most of the violent acts that we see are crimes of passion in the moment. So they're not thinking rationally as it is," he said. "It does make it more difficult when you're talking about organized individuals that may want to bring harm to the homeland of the United States. They may think about these things more and may take measures to throw law enforcement off the tracks, especially on the federal side. But for most of local law enforcement, these are individuals that have committed a crime without thinking a great deal about it."
IMPD declined to comment for this story, saying the released documents speak for themselves. The department referred all further questions to its legal advisor.
The Marion County Prosecutor's Office also declined to comment about whether evidence produced by the device had been used in prosecutions, and referred all questions to IMPD.
For Riggs, now viewing law enforcement from the outside for the first time in more than two decades, efforts to keep new surveillance technology secret are in line with what the public expects from police departments.
"Citizens want the police department, whether it's local or federal, to be very secretive about how they do investigations. There's a reason police departments are secretive. It's because they want to bring the person responsible for a crime in front of a court," Riggs said. "Now, during that court proceeding, everything's open … it's difficult. We live in an open society. There are consequences for that in law enforcement, meaning that you have to be more open than other nations are about that. But that's what gives us a free society. And people are asking good questions. We shouldn't be afraid to answer questions regarding new technology. We don't need to give all the details, but we need to reassure in governments across the nation when there is new technology that the fundamental rules in the Constitution are being kept, and that people's privacy is not being violated. And when it is violated, there needs to be harsh penalties for that."
