Delaware police can covertly collect cellphone data

• State Police spent $949,704 between 2008 and 2014 on Stingray surveillance technology.
• The technology allows police to scoop up data from cellphone transmissions.
• The ACLU has raised concerns about how the technology is being used and whether warrants are required.

Delaware State Police can track a cellphone using a portable electronic gadget that once was the domain of secret agents and the military. Advanced models allow law enforcement to view location information, text messages, numbers called, emails and even stored photos.

It's not clear how state police are using the tools because, at the request of the FBI, they're doing everything possible to keep the surveillance secret.

The News Journal has learned through Freedom of Information Act requests that $949,704 has been paid to Melbourne, Florida-based Harris Corp. for hardware and training for technology called cell-site simulators, commonly known as Stingrays, between 2008 and 2014.

The boxy devices, which can be put into a briefcase and carried in a police vehicle, can covertly scoop up all cell phone information within a few miles, including phone data from people who aren’t the target of an investigation.

The controversial technology, originally developed to hunt down terrorists, works by tricking mobile phones to connect to it rather than the nearest tower –– without the knowledge of users. Stingrays allow police to comb through the collected data to extract a phone’s location, as well as eavesdrop on text messages, call histories and other transmitted material.

Law enforcement officials say the method is instrumental in investigating kidnappings, drug dealing and other crimes. But it’s not clear how state police sift through the cache to find pertinent results related to criminals, or how long data of innocent bystanders is kept by police agencies. Delaware authorities also will not discuss how the machines are being used, or for what kind of criminal cases.

The state Attorney General's Office says police must obtain a warrant to deploy the Stingray, but when The News Journal requested those court orders through a FOIA, state police said none existed.

While the very nature of police investigations is secretive, cell-site simulators have an extra layer of mystery as the state police signed an agreement with the FBI promising they would disclose virtually no information about the machines, and are directed to dismiss criminal cases if details about the tools are threatened to be released.

“The court doesn’t really know what they’re doing," said John Daniello, a Sussex County public defender. "They think they’re doing a standard cellphone search and not using this device.”

Daniello suspects police used a Harris-made mobile phone tracker against one of his clients in 2014. When he raised questions about use of the technology, Daniello said, the prosecutor offered his client a far better deal for the drug and gun charges he faced.

“I ultimately came out with a more favorable plea offer and my client took it, and that was the end of it,” Daniello said.

Ryan Tack-Hooper, an attorney for the ACLU of Delaware, said a “shroud of secrecy” exists around Stingrays, which raises a concern that police could be using them for mass public surveillance rather than for targeting individual suspects.

IRS use of 'Stingray' devices to track cellphones sparks Senate inquiry

The ACLU isn’t opposed to using technology to find criminals, he said, but only when a warrant is used to make sure rights aren’t being violated. Other privacy rights advocates have said Stingray technology infringes on the Constitution’s prohibition against unreasonable search and seizures.

“If police go through the proper channels then that’s fine,” he said, “it's no different from a wiretap.”

Stingrays being used in 23 states, ACLU says

The Delaware State Police is one of at least 60 law enforcement agencies nationwide equipped with Stingray, according to the ACLU, which has been studying the proliferation of the technology. Last week, the group released documents it obtained showing that the New York Police Department had used the device over 1,000 times since 2008.

The ACLU found 23 states have at least one machine in the Stingray family of products, which all have maritime-themed names such as King Fish, Triggerfish and Harpoon.

Harris is secretive about the equipment, but a photo submitted to the U.S. Patent and Trademark Office for the Stingray II shows a box with various switches, antenna connectors and computer input nodes. They can cost up to $500,000.

Harris, incorporated in Delaware and with roots in the printing industry, is by far the most recognized maker of cell-site simulators. The company, which has $5 billion in annual revenue, also produces encrypted tablet computers for the military, radio communications systems for transportation agencies, and components for NASA satellites.

Cellphone data spying: It's not just the NSA

Last year, Harris generated $1.8 billion in revenue from communications products sold to various government agencies.

But few outside of law enforcement and Harris Corp. know exactly how many Stingrays are used throughout the country. Jim Burke, a spokesman for the company, declined an interview request by The News Journal.

The head of the Delaware State Police, Col. Nathaniel McQueen Jr., also would not talk about how the technology is used locally. Said department spokesman, Sgt. Richard Bratz: “We do not discuss certain tools or measures that are utilized to thoroughly and comprehensively conduct criminal investigations.”

The News Journal made multiple FOIA submissions to the state police about the use of Stingray, but received only one response that contained requested records.

One was a 10-page document with six Harris Corp. invoices between 2010 and 2014 sent to the Delaware State Police High Tech Crime Unit. The largest purchase, for $310,813, was for a “portable cellular tracking system,” software and equipment.

The invoices also show money being spent for upgrades and training every year. The agency redacted all information about what specific models were purchased.

The second document, a May 2012 letter to then-Delaware State Police Col. Robert Coupe from FBI Assistant Director Amy Hess, outlined the non-disclosure agreement –– noting that officers must keep information about Stingray devices out of the hands of “any non-law enforcement individuals or agencies.”

“All (Stingray) materials shall be marked ‘Law Enforcement Sensitive, For Official Use Only – Not to be Disclosed Outside of the Delaware State Police,” Hess said.

Delaware lawyers raise questions about Stingray

She said the curtain of secrecy extended even to court proceedings. If Stingray information has the potential to be leaked during a trial, Hess said, police should ensure that the case gets dismissed.

If a prosecuting attorney threatens to disclose Stingray details, she said, “the Delaware State Police will immediately notify the FBI in order to allow sufficient time for the FBI to intervene.”

Chris Allen, spokesman for the FBI in Washington, downplayed the notification.

"This is just a way to facilitate a conversation" between the FBI and the prosecutor, said Allen, who would not comment about Stingray surveillance techniques.

Police have frequently said that the secrecy is needed so criminals and terrorists don’t find out about how the machines work.

Coupe, now the commissioner of the Delaware Department of Correction, declined an interview request with The News Journal through DOC spokeswoman Chelsea Hicks. She cited the agreement with the FBI as a reason for his unwillingness to speak on the matter.

"It's almost like a gag clause," Hicks said.

More police departments will likely adopt Stingray-type technologies, and with that trend will come legal challenges, said Gary Miliefsky, CEO of Snoopwall, a company that sells cyber security software for cell phones.

“When you create these kinds of tools, there’s going to be a battle,” he said

'Sworn to secrecy as to its existence' 

Dade Werb, an attorney in the Delaware Public Defender’s Office, said he suspects state police are using Stingrays as a kind of dragnet – a way to collect lots of data that can produce more leads.

They “probably use them early on in their investigations and use that information to obtain other information in the investigation that they then will disclose to us,” he said.

But no one is really sure, he said.

“Police are usually sworn to secrecy as to its existence,” Werb said.

Much of the data that has come to light about Stingrays in Delaware has been a result of efforts by the ACLU and a local civil libertarian.

Jonathan Rudenberg, a Newark software developer, said he sought information about the state police's use of Stingray-type machines last year. There had been evidence of police using the equipment in other states without a warrant, and he wanted to find out if state police did the same here. But his FOIA request was rejected by officials at the agency, citing its non-disclosure agreement with the FBI and Harris Corp.

"They are very invasive devices," Rudenberg said.

With help from the Delaware ACLU, Rudenberg appealed the decision. At the end of December, Attorney General Matt Denn ruled in favor of Rudenberg and last month, the state police provided the purchase order documents and the letter from the FBI. As part of that release, The News Journal received documents to its previously rejected FOIA request.

Political advocates have been monitored by law enforcement agencies in other states in the past, said Tack-Hooper, the ACLU lawyer, and that is why records must be available to the public about how these machines are being used.

Warrants are key for cellphone surveillance, said Widener law professor Leonard Sosnov.  Without one, searching a person’s phone records would strike against constitutional protections. Another possible legal issue, he said, is that the searches scoop up data from innocent people who happen to be near a suspect.

“They have to minimize any possible intrusion on anyone else,” Sosnov said.

Daniello said he first became suspicious about a cell-site simulator being used when he got a copy of a warrant that was used to gather evidence against his client facing a drug dealing charge.

The court order was to allow police to obtain information about who a suspect might have called. The technique is common when investigating drug dealers, he said, but a handwritten note along the top of the warrant said 'Triggerfish'.

That jumped off of the page, Daniello said.

Triggerfish is one kind of cell-site simulator in the Stingray family, made by Harris Corp.

“Somebody gave me that and I don’t think they were supposed to,” he said.

When Daniello saw the note, he demanded more information. What he received instead was a better deal from the prosecutor.

“I was going to make a stink about it and demand all the information,” Daniello said. “They’re going out and pinging everybody."

Daniello said that police are "pulling one over on the courts" by not indicating in the full text of a warrant that cell-site simulators are being used.

The News Journal sent a FOIA request to the Delaware State Police asking for copies of all warrants from adjudicated cases that contained the term “pen register,” the technical term for a call search history. Despite existence of the warrant issued for Daniello’s client, the agency responded that no records existed.

The Wilmington and New Castle County police departments also responded to FOIA requests saying no Stingray-related equipment has been purchased by the agencies.

Delaware Chief Justice Leo Strine, who has wide sway over legal procedures statewide, declined to comment. Spokesman Sean O’Sullivan said it would be inappropriate for Strine to add his perspective to the debate because of the possibility that the issue could be litigated in Delaware.

States limit police cellphone spying, but feds help seal records

Tacoma, Wash., police use cell-phone tracking device

A call for transparency

It is the opinion of Denn that police must obtain a warrant before using a cell-site simulator under Delaware state law, said Attorney General’s Office spokesman Carl Kanefsky. An exception can be made in an emergency situation, he said, but then a retroactive court order must be obtained within two days.

"On balance, (the attorney general) believes that having a tool that legally, and with appropriate court oversight, helps locate criminals is better than not having it," Kanefsky said.

But no records exist of warrants that mention cell-site simulators, according to the FOIA response sent by the Delaware State Police. In her letter to Coupe, Hess said that if police obtain search warrants, they must not disclose that any Harris Corp. made cell-site simulators are being used.

In September, the U.S. Department of Justice said federal law enforcement officers must obtain a warrant before using a Stingray-type mechanism, and they cannot use them to read texts, emails, contact lists or view images. However, the policy applies only to federal agencies, and not to state and local police.

“With the issuance of this policy, the Department of Justice reaffirms its commitment to hold itself to the highest standards,” Deputy Attorney General Sally Quillian Yates said in a statement.

Tack-Hooper, the ACLU lawyer, said more steps and additional transparency are needed in Delaware, especially regarding warrants. Without a record, he said, authorities could monitor anyone they disliked or disagreed with.

On Wednesday, he announced that the ACLU would continue its battle with state police for the release of more records, including the model names redacted from the Harris purchase orders.

“Our position is less that we do not want them to use these devices, it’s to know how they use them,” he said.

Miliefsky expects that this is just the beginning of such technology being used nationally – and the ethical questions that will be raised.

“I don’t want to say exponential,” he said, “but you’re going to see growth in the battle between civil libertarians and police.”

Contact Karl Baker at (302) 324-2329 or kbaker@delawareonline.com. Follow him on twitter @kbaker6.