Back in September, HPD officer James Taylor lamented how the Edward Snowden leaks had spooked the public into thinking that even local law enforcement agencies were part of a broad, indiscriminate surveillance dragnet that gathers data on unsuspecting Americans.
"We are not the NSA nor the federal government," the HPD officer told members of a Senate State Affairs Committee. A PowerPoint slide he'd prepared for the occasion flashed up on the screen: "STATE AND LOCAL LAW ENFORCEMENT DO NOT 'SNOOP!'"
Maybe, maybe not. The problem, privacy advocates say, is we don't know. What we do know -- actually, what we've known for quite some time -- is that HPD has the technology to sweep up cell phone data in real time, deploying a device that essentially mimics a cell phone tower and tricks your phone into communicating with it. And, according to local prosecutors -- who, it should be noted, admit they don't know how local cops are using the technology, either -- HPD doesn't need a warrant to use it.
In September, HPD officer Taylor and Bill Exley, an assistant prosecutor with the Harris County DA's office who works with local cops to help solve (in his words) "blood and guts cases," warned state lawmakers that, under their interpretation of state law, local cops do need a warrant to gather sensitive cell phone data from a phone company (not messages or call contents, but data showing where you've been and logs of your incoming and outgoing calls). This is despite virtually everyone else saying a state appeals court ruling from last summer called Ford v. State cemented the fact that cops don't need a warrant to get your metadata from a phone company.
It's unclear why the Harris County District Attorney's Office would take this rather unique stance -- the state prosecutors association, for instance, has said that, in light of the Ford case, metadata held by a phone company is most certainly not protected by the Fourth Amendment. Exley basically told lawmakers that the current law is complex and that no matter how they read it, cops always come away needing a warrant to get metadata from a phone company. Perhaps. The more skeptical among us might think Exley and Taylor were trying to scare legislators away from passing stricter privacy rules this session that would explicitly add a warrant-for-metadata protection to state law. (Taylor, for instance, told the committee that securing warrants for phone data "results in us not being able to investigate cases, which results in people dying.")
But if HPD wants to gather that data directly from the source, i.e., directly from your phone, no warrant is necessary, Exley says.
See, back in 2007, HPD first asked for and received FCC approval to buy a so-called "Stingray" cell-site simulator (basically a roving fake cell phone tower) from Harris Corp., up until recently the only manufacturer of such technology. Ever since, HPD has spent hundreds of thousands of dollars in grant funding or asset-forfeiture funds to buy "covert surveillance equipment" from Harris Corp., council minutes show.
We have a general idea of what these devices are capable of doing, thanks to anecdotes that have trickled out in court and to digging by privacy advocates like the ACLU. But we have no clue how HPD, one of only two law enforcement agencies in Texas that have these devices (the other is Fort Worth PD), is actually using the technology.
As MuckRock first uncovered last year, police departments buying Stingray devices from Harris Corp. must first sign a nondisclosure agreement with the FBI. And as the Houston Chronicle reiterated last week, that nondisclosure agreement means even local prosecutors don't know the specifics of how HPD is using its fake-cell-phone-tower devices.
That doesn't seem to bother Exley much. In emails last week, he told us that police using "historical data" gleaned from cell phone companies is a completely different issue than police tracking someone with "live data" sucked up by a Stingray. Exley says that, according to his understanding (again, this is all relatively speculative since HPD won't talk at all about how they use the devices), HPD only deploys Stingrays in a pretty narrow set of circumstances -- for instance, when police are trying to track down a fugitive with an arrest warrant.
In the case of an on-the-run fugitive, Exley stressed that there is already some legal process involved: an arrest warrant. "I understand Stingrays have applications when police are trying to locate a fugitive, i.e. a person who has an open warrant. ... if it is being used to catch fugitives, then there IS a warrant signed by a judge for the fugitive, so to say there is no legal process involved is not actually correct," he told us.
Still, privacy advocates at the ACLU say that misses the point. Sure, Stingrays can be used like high-tech metal detectors, placed in a van or truck and driven around a neighborhood where cops think a suspect might be hiding (you basically wait for the suspect's cell phone to ping back to the fake cell phone tower signal and keep driving in concentric circles until you get closer).
But, because the device mimics a cell phone tower, it also gathers data from other phones in its vicinity, says Nathan Wessler, a staff attorney with the ACLU's Speech, Privacy and Technology Project. "These are not just passive collectors," he says. "They're going out there and pretending to be an AT&T or Sprint tower, sending out a signal that forces all of the phones in the area to send out their electronic serial number, and then sweeping in that whole list."
Plus, these things literally interfere with routine cell phone service, Wessler says, so anybody near one might have to deal with dropped or blocked calls.
If you like this story, consider signing up for our email newsletters.
SHOW ME HOW
You have successfully signed up for your selected newsletter(s) - please keep an eye on your mailbox, we're movin' in!
"Once you understand how these devices work, you see why getting a warrant to use them is important," Wessler says. Someone outside of HPD needs a full and complete explanation of what the devices do and how HPD uses them, he insists. Like a judge.
"[A judge] could tell police to immediately delete all innocent bystanders' data, for instance," Wessler says. "A judge could tell them to purge everything except for one phone's data, or that the police can use it but for only a particular duration of time, in particular area, in a particular neighborhood where you have reason to believe a suspect is."
A bill filed by state senators Craig Estes and Rodney Ellis last week would put Stingrays under at least some judicial oversight and explicitly call for warrants any time police want to collect metadata from a third-party cell phone provider. If last September was any indication, you can expect police and prosecutors to come out against it.
For example, here's what Exley thinks about the debate: "Is the ACLU suggesting police need a warrant to arrest, and then another warrant to use technology to find someone? Should the police get some kind of warrant to get in their patrol cars to drive across town to find the guy that already has an open arrest warrant? To use their handcuffs?"