DOJ cracks down on use of cell-duping Stingrays

The Justice Department on Thursday issued new guidance for how federal law enforcement can use controversial technology that dupes cellphones to collect evidence – placing substantially more requirements on what has been a shadowy policing technique.

At issue are cell-site simulators, also referred to as “Stingrays,” one type of such device. The secret devices are used by law enforcement to mimic a cellphone tower, tricking phones to connect through the Stingray, instead. That allows law enforcement to capture data from the phones, including location information and call traffic. The Justice Department says the technology is programmed to collect no more than that.

The technology has become highly controversial. A report from The Wall Street Journal last year revealed that the feds flew airplanes over the U.S. carrying Stingrays to scoop up call information. And a judge in March detailed a deal between the FBI and local sheriff’s office to drop cases rather than reveal any information about the use of Stingrays to gather evidence.

The Justice Department had to date largely declined to comment on use of the devices, citing national security and not wanting to telegraph U.S. capabilities to enemies.

But U.S. law enforcement point to the capture of notorious drug cartel kingpin Joaquin “El Chapo” Guzman in Mexico in 2013 as an example of the benefits of cell-site simulators. A version of the Stingray device operated by the U.S. Marshals Service was used to track a cell phone belonging to Guzman’s courier. Guzman later escaped from a Mexican prison in July.

Thursday, the Justice Department came out with a detailed set of restrictions on the use of the devices, requiring federal officers to get warrants before using them and setting boundaries on what data can be collected and for how long.

But there are loopholes, as well, including exceptions for “exigent circumstances” and “exceptional circumstances.”

Deputy Attorney General Sally Quillian Yates heralded the new policies as striking the right balance between law enforcement needs and civil liberties.

“Cell-site simulators are a really critical tool for us that we use in a variety of contexts,” Yates said in a briefing Thursday. “It’s an important tool in finding fugitives and finding kidnapping victims and drug cases. But we also recognize that the public has a real privacy interest and concern here so we have tried to craft a policy that is mindful of all of those interests and have attempted to strike the right balance.”

Going forward, the new guidance requires law enforcement to get a warrant before using cell-site simulators, in addition to the traditional use of the “Pen Register Statute.” That is a 1980’s law that allows law enforcement to place a trace on phone lines to collect numbers.

The Justice Department will also require that information collected by Stingrays is limited to signal direction of the cellphone, as opposed to GPS data, and to the numbers being dialed. The Stingrays cannot collect the content of conversations, text messages or emails or application data.

Information collected by Stingrays should be deleted after 30 days if officers don’t know their specific target’s number, and after no more than one day if they do.

The guidance also requires training for personnel using the technology, requires agencies to pick a point of contact for implementing the guidance, and requires that use of Stingrays is OK’d by an approved supervisor – and in emergency circumstances by a second-level supervisor.

The policy also notes that using Stingrays on aircraft must be approved at the executive level.

The “exigent circumstances” and “exceptional circumstances” when a warrant isn’t needed include “immediate danger of death or serious bodily injury to any person; conspiratorial activities characteristic of organized crime; an immediate threat to a national security interest; or an ongoing attack on a protected computer … that constitutes a crime punishable by a term of imprisonment greater than one year,” the guidance says, as well as times when “circumstances make obtaining a search warrant impracticable.”

At the briefing with reporters, Yates said it would be “pretty rare” for those circumstances to be used, though she wouldn’t quantify how rare when asked how many previous cases would have fallen in that category.

She also said the policies weren’t prompted by a specific incident, but rather were motivated by a desire to have a “consistent practice” throughout the Justice Department.

The American Civil Liberties Union, which has campaigned against the use of Stingrays without proper restrictions and oversight, said the standards were a positive step forward, although there are still concerns.

“For far too long, their use of this powerful surveillance gear has been shrouded in corrosive levels of secrecy, so we’re glad to see more information now and to see some common-sense policies to protect privacy,” staff attorney Nathan Freed Wessler told CNN. “This should have been policy many years ago; it shouldn’t have relied on the ACLU and the press and defense attorneys prying information about the use of Stingrays out of the curled fingers of the government, but as it goes this is certainly a positive step.”

Wessler said the ACLU is pleased to see the warrant requirement and restrictions on data collection. But he also said the group would like the policy to explicitly extend to local law enforcement that uses technology or grant money from the Justice Department for Stingrays.

He added that privacy community still has concerns about what the exceptional circumstances described by the policy might be, and called for the Justice Department to be more explicit.

“It is completely opaque to us what that means, and we’re concerned that it may constitute a large loophole in the end,” Wessler said. “We’re not willing to take them at face value that those would be limited, they owe the public an explanation on what would be exceptional circumstances.”

Yates said Thursday that the Justice Department is aware of the privacy community’s qualms with Stingrays, and working to address them.

“We understand people have a concern about their private information,” Yates said.

“Would it be better for law enforcement if we didn’t give up any of this information? Yes, it probably would,” she said. “But there’s also an interest in transparency and in public confidence as well and we’re trying to find a balance between the two of those.”

Vermont Sen. Patrick Leahy, the top Democrat on the Senate Judiciary Committee, heralded the move – though he echoed the ACLU’s concerns. He and Chairman Chuck Grassley of Iowa have repeatedly questioned the administration on its use of Stingrays through their committee.

“The Department of Justice’s new policies are finally starting to catch up with the rapid advancement of this tracking technology,” Leahy said in a statement. “Today’s announcement is a welcome step forward, and has the potential to bring transparency and consistency to the department’s use of these tracking devices. However, I have serious questions about the exceptions to the warrant requirement that are set forth in this new policy, and I will press the department to justify them.”

The policy released Thursday does not specifically deal with investigations on foreigners under the Foreign Intelligence Surveillance Act, which authorizes much of the National Security Agency’s surveillance program.

The seven-page policy technically only applies to federal law enforcement, although it also extends to the many cases in which local agencies coordinate with the federal law enforcement agencies and share resources, like on task forces. It does not apply to the Department of Homeland Security, which houses law enforcement agencies like the Secret Service and Immigration Customs Enforcement, but Yates said they are working on a similar policy.

According to the ACLU, 53 agencies in 21 states and Washington, D.C., have Stingray technology.

CNN’s Evan Perez contributed to this report.