Habeas Data_Privacy vs. The Rise of Surveillance Tech

by Cyrus Farivar

  This was also the first time that a major American media outlet had reported on the issue, and likely how many lawmakers first heard about the device that had already been in use for years. In the same article, Sherry Sabol, a veteran FBI attorney, sent the Journal a statement about stingrays, noting that the technology is “considered Law Enforcement Sensitive, since its public release could harm law enforcement efforts by compromising future use of the equipment.”

  In short, Rigmaiden unveiled a new chapter in the story of sophisticated surveillance to the public—citizens, journalists, lawyers, judges—that law enforcement had already known for years, mostly without telling anyone.

  * * *

  After Rigmaiden and Soghoian began corresponding, the doctoral student was introduced to Stephanie Pell, a former veteran federal prosecutor, who was then serving as counsel to the House Judiciary Committee. Notably, Pell had been one of four Miami-based lead prosecutors on the José Padilla case, who was implicated in the so-called dirty bomb plot. That case dominated her professional life from 2002 until 2007—the case didn’t end until 2014, when Padilla was sentenced to 21 years on appeal.

  Starting with her work on Capitol Hill, Pell was tasked with working on the reauthorization of the PATRIOT Act, and then worked on Electronic Communications Privacy Act (ECPA) reform, which came before the House Judiciary Committee in the spring of 2011 (see Chapter 6). It was one of those strictly professional opposites attract moments: Soghoian was wary but intrigued by a former high-level prosecutor. Pell, for her part, wanted to know what this technologist hired by the FTC could teach her.

  Months later, sitting on the steps of a frozen yogurt shop in Washington, DC’s Dupont Circle neighborhood, Soghoian told Pell about what he had learned about stingrays from Rigmaiden. Even as someone who had served as an assistant US attorney in a prominent terrorism case, Pell was entirely unfamiliar with stingrays.

  Stingrays aside, the two had a lot to talk about. They quickly put together a research paper (“Can You See Me Now? Toward Reasonable Standards for Law Enforcement Access to Location Data That Congress Could Enact”) that they presented at the 2011 Privacy Law Scholars Conference, an annual three-day gathering of some of the world’s top legal minds in privacy law.

  As the two began collaborating and discussing their mutual interest in government power and surveillance, Pell began to understand that stingrays were an entirely new class of surveillance tools that few in government knew about. Over time, the two of them began to accept what Rigmaiden already knew: that a new class of technology was being used without a clear explanation to judges as to what was going on.

  “If courts don’t know what they are authorizing, then information doesn’t flow through that channel and it puts a whole lot of unsupervised power in law enforcement’s hands,” Pell said.

  By the end of 2011 and into early 2012, Soghoian began filing his own Freedom of Information Act (FOIA) requests to learn more about stingrays. (At one point, Harris Corporation, the makers of the StingRay, offered him a job!) Primarily, he wanted to know how they worked and who had them. Soon, a picture began to emerge. Immigration and Customs Enforcement (ICE) was buying them. Agencies all over the country, ranging from Houston, Texas, to Alexandria, Virginia, were using them. There was even something called an Airborne Kit, allowing stingrays to be mounted on aircraft.

  The tenacious privacy researcher even teamed up with others (including Eric King) to try to submit an amicus brief detailing their research into stingrays and other new information about surveillance in technology in United States v. Rigmaiden—published in the December 2011 Spy Files on WikiLeaks—but the request was denied by the judge. (These friend of the court filings, written by outside parties, which can either be accepted or denied by the judge, are often meant to help provide more context in rapidly evolving areas of the law.)

  As 2012 rolled in, Soghoian and Rigmaiden worked in parallel. Rigmaiden continued to be consumed by his own case and worked it as best as he could from prison, largely by himself. He became frustrated with the bureaucracy, and the slowness of the legal system. In May 2012, he handwrote a highly unorthodox filing: “MOTION Requesting Court to Order Defendant’s Private Investigator to Do His Job or In the Alternative, MOTION to Dismiss the Case With Prejudice.” (The filing didn’t amount to much.)

  In February, the Electronic Privacy Information Center (EPIC) filed an FOIA request, which resulted in a lawsuit. Its efforts definitively showed that government law enforcement agencies have not been completely upfront about using stingrays when they asked federal magistrate judges for permission to conduct electronic surveillance. In fact, search warrants have generally not been used at all.

  In the summer of 2012, Soghoian arranged to provide a demonstration to a handful of congressional staffers of how easy it was to build and use a homebrew stingray. They gathered in a small room on Capitol Hill, handed out a few clean phones operating on a temporary cell network created by Kurtis Heimerl using OpenBTS software—the same software used by Paget at DEF CON back in 2010. After the staffers used the phones to make a few calls and send a few texts, Heimerl easily showed them that all of their calls and text messages were being intercepted—content and metadata alike. The goal was to clearly illustrate the power of stingrays and to goad Congress into doing something about it. But no meaningful legislation happened.

  Soghoian, meanwhile, kept at it as his doctoral program wound down. His August 2012 dissertation, titled “The Spies We Trust: Third-Party Service Providers and Law Enforcement Surveillance,” was published nearly four years to the day after Rigmaiden’s arrest.

  Other journalists began taking notice of the Rigmaiden case and asking whether their local law enforcement agencies were acquiring or using stingrays. In September 2012, LA Weekly, a local alternative newspaper, published a story, “LAPD Spy Device Taps Your Cell Phone,” describing the ongoing Arizona case. It also noted that the LAPD, the nation’s third-largest police force, “refuses to say whether its detectives are required…to obtain a search warrant.”

  According to public records, the LAPD had purchased two stingrays “around 2006,” with little notification or public discussion, for the purposes of “regional, terrorist-related investigations.” Four years later, in April 2010, the Los Angeles City Council approved the acquisition of StingRay II gear, funded by the Los Angeles Police Foundation, an outside charity.

  Without knowing what gear the LAPD had acquired years earlier, of course, it was impossible for there to be a meaningful civic discussion as to what, if any, limits there should be on stingrays.

  “We can’t have a public debate on what kinds of location-monitoring technologies are appropriate, and when they’re justified,” Peter Bibring, of the ACLU of Southern California, told LA Weekly.

  The Rigmaiden story in the Journal hadn’t only grabbed the attention of journalists, but also the attention of lawyers. One lawyer, Linda Lye of the ACLU of Northern California, took particular notice. Lye was new to the ACLU, having largely focused on labor and civil rights issues in her previous decade as an attorney.

  Quickly, Lye pushed the federal court in San Francisco to unseal the court orders that had authorized the initial use of the stingray against Rigmaiden, as it was unclear from the Arizona case (where the prosecution against Rigmaiden was unfolding) what the order specifically authorized the government to do.

  “What on Earth was this technology?” she said. “It seemed that there would be all kinds of novel and troubling issues. What sort of court authorization was being obtained? How widespread was it? It was also just a very unlikely story.”

  Initially what drew her in wasn’t the technology itself, but the fact that the government was keeping “novel surveillance orders” a secret.

  In October 2012, Lye and other ACLU and EFF attorneys decided that they would formally jump into the case, not as Rigmaiden’s lawyer, but rather as amici. They wrote to the court, noting that this case would “likely result in the first deci
sion to address the constitutional implications” of stingrays.

  Months later, Lye was allowed to argue her points formally in front of US District Judge David Campbell, a judge who clerked previously for Chief Justice William Rehnquist.

  On March 28, 2013, Lye arrived in the Phoenix federal courthouse and met Rigmaiden for the first time shortly before the hearing on his motion to suppress the stingray evidence and everything that derived from it. This was an important day. After all, without the stingray, the government’s case would be lost.

  Lye was dressed for court in a dark suit. Rigmaiden, still a prisoner, sat next to her in an orange jumpsuit. Department of Justice (DOJ) attorneys, nearly all men, were seated at the opposing counsel’s table—an army of suits. After Rigmaiden was allowed to present his arguments, it was Lye’s turn.

  “This case raises highly consequential issues in our current technological era about the government’s duty, its obligations to the Court to be explicit, to be candid and forthright when it is using forms of technology with which courts are not familiar,” she said during the hearing.

  Judge Campbell was not easy on the prosecutors. At multiple points, he pushed them, pointing out where they could have been more forthcoming with the magistrate judge who originally signed off on Rigmaiden’s surveillance.

  “I was shaking with the incredible implications of this,” Lye told me in 2017. “I was cautiously optimistic. What the domino effect was going to be? There must be hundreds maybe thousands of investigations across the country where the government didn’t disclose the stingray. It would have called into question unknown numbers of criminal prosecutions.”

  Ultimately, however, in early May 2013, the judge ruled in the government’s favor, finding that Rigmaiden lacked a “reasonable expectation of privacy” while shrouded under multiple false identities—after all, his air card, his apartment, and postboxes that he paid for were all done under assumed names.

  At the end of the year, there was another big media push about stingrays, this time in USA Today. The national newspaper partnered with dozens of reporters around the country, requesting public records from local and state police law enforcement agencies. The months-long investigation resulted in one of the most comprehensive examinations of stingrays to date.

  The newspaper concluded that “at least 25 police departments” have a stingray, and noted that in some states “the devices are available to any local police department via state surveillance units. The federal government funds most of the purchases, via anti-terror grants.”

  Slowly but surely, lawmakers, activists, and journalists were learning more about the details of the device. This newfound attention undoubtedly made life harder for federal authorities as pressure mounted. Rigmaiden wasn’t backing down. By late January 2014, Rigmaiden and federal prosecutors reached a plea deal: he’d plead guilty and prosecutors would recommend that he be given a sentence of time served. The agreement was signed on April 9, 2014.

  Assistant US Attorney Battista, who had been Rigmaiden’s adversary since the beginning, tipped his hat to the fraudster.

  The “defendant challenged virtually every aspect of the United States’ investigation, hoping to dismiss the case or suppress the incriminating evidence,” Battista wrote. “He did so on his own, after requesting the removal of a series of attorneys and electing to represent himself. Although he was ultimately unsuccessful in dismissing the charges or suppressing evidence, he mounted an impressive defense, especially considering that his only formal education is a high school diploma.”

  While the Rigmaiden case wound down, Soghoian (who had joined the ACLU as its chief technologist) and his colleagues were just getting started. The ACLU, along with other privacy groups, including EPIC and the EFF, spearheaded efforts to speak publicly, file record requests, sue, and campaign for meaningful legislative reform.

  Soghoian continued to talk to whoever would listen about stingrays, at one point speaking before Michigan state legislators. On May 16, 2014, the young activist appeared with Brian Owsley, a law professor and former magistrate judge from southern Texas, before an Oversight Committee hearing organized by then representative Tom McMillin.

  The Republican from Rochester Hills had a difficult time getting forthcoming answers from the Oakland County Sheriff’s Department, so he invited Soghoian and Owsley.

  “I’ve been told to ‘just trust us,’ but I think if law enforcement is saying they’re doing nothing wrong, they should welcome oversight,” McMillin said during the hearing.

  Sheriff Michael Bouchard denied that his agency’s stingrays were being used on innocent people. “Unfortunately, because of people like Tom that inflame completely false information, they’re building animosity against law enforcement,” he said, assuring the committee. “Let me be real clear—the technology that we have does not do surveillance, it does not data mine, does not capture anyone’s personal information and it does not listen in on any phone conversation of any kind.”

  Of course, this kind of response is predicated on the common notion often held by federal agencies and local law enforcement that “surveillance” is not how most people understand the term.

  As Jennifer Granick, now an ACLU lawyer, noted in her 2017 book, American Spies, in many government circles, the word “surveillance” is defined in a very particular way: it specifically means electronic surveillance (ELSUR) as governed by the Foreign Intelligence Surveillance Act. So what might a government agency call the use of stingrays? Perhaps “data collection,” or maybe even just good police work. After all, in their view, the unreasonable search threshold has not been crossed.

  In an interview years later, McMillin, who now serves on the state board of education, told me that as a libertarian, he felt that the “Fourth Amendment is on the line and I’m not a fan of Big Brother,” adding that “once they’re using it, it’s hard to pull it back.”

  He said he was pleasantly surprised that this was an area where libertarians and supporters of the ACLU could “work together.”

  Upon his release from prison, as part of his plea deal, Rigmaiden was assigned to do community service. At first, he volunteered at a food bank, but his talents were better put to use at the ACLU as a researcher. He helped Lye put together a comprehensive guide about stingrays for criminal defense attorneys. After all, defense attorneys would likely be the ones encountering stingrays in their cases.

  The guide was blunt, noting that few attorneys were even aware of what a stingray was or how it was used. “This is entirely understandable because the federal government has a policy of not disclosing information about this device,” Lye wrote.

  The government appears to be withholding information from criminal defendants. It even appears to be providing misleading information and making material omissions to judicial officers when it seeks purported court authorization to use this device—inaccurately referring to it as a “confidential source” or calling it a different kind of device (like a pen register), and failing to alert courts to constitutionally material facts about the technology, such as the full breadth of information it obtains from a suspect and its impact on third parties. As a result, courts are probably not aware that they are authorizing use of this device and have not had an opportunity to rule on its legality, except in very rare instances.

  Another ACLU attorney based in New York, Nathan Freed Wessler, began giving regular talks to criminal defense attorneys, alerting them to the paper. (Recall that in November 2017, Wessler argued Carpenter at the Supreme Court.) Meanwhile, also in California, an EFF attorney who specialized in criminal law (and is named in the ACLU guide), Hanni Fakhoury, went on to become a federal public defender based in Oakland. The seeds had been planted nationwide, and would soon bear fruit.

  Meanwhile, an enterprising reporter based in Tacoma, Washington, did what other good journalists were doing: looking at how stingrays were being used in their own backyards. However, Kate Martin took it one step further: she was able to speak to the
ranking judge in the county (frequently, sitting judges are reluctant to speak to the press on the record).

  Judge Ronald Culpepper, then the presiding judge of the Pierce County Superior Court, was taken aback when presented with information about how stingrays were being used in his corner of Washington State.

  “If they use it wisely and within limits, that’s one thing,” he told the Tacoma News Tribune on August 26, 2014. “I would certainly personally have some concerns about just sweeping up information from non-involved and innocent parties—and to do it with a whole neighborhood? That’s concerning.”

  The local police chief, Don Ramsdell, through a spokeswoman, declined to speak with the paper, citing a non-disclosure agreement (NDA) with the FBI. Through public records, Martin learned that Tacoma acquired stingrays at least as early as 2008, seemingly without anyone outside of the police department knowing about it.

  “I’ve got to find out what I voted on before I comment,” Councilman David Boe said at the time. “This is new information.”

  Other lawmakers, including the mayor, seemed to be unbothered, indicating essentially that they had full confidence in the police’s ability to apprehend bad guys and wanted them to have the appropriate tools to do it.

  In its 2013 grant application to acquire an upgraded version of the stingray, the Tacoma Police Department cited its need to combat the threat of improvised explosive devices (IED). However, Tacoma has never been subjected to a major IED attack.

  “Chances are the city of Tacoma is not using it to find IEDs,” Soghoian told the paper. “They’re using it to get drug dealers.”

  Martin’s reporting quickly had a major impact on Pierce County. By November 2014, local county judges banded together to require new language in law enforcement applications to use stingrays: law enforcement had to explicitly articulate what device they were using, and it had to also affirmatively swear that the agency would immediately delete non-target data captured incidentally.