Annapolis stingray hearing offers rare glimpse at how police track cellphones

Privacy advocates from the ACLU and other organizations have raised concerns about the Baltimore Police Department’s use of the stingray device and the secrecy that surrounds it. So in a rare turn of events last week, an Annapolis hearing room became a venue for law enforcement to publicly speak about the illicit gathering of cellphone data.
Baltimore County State’s Attorney Scott Shellenberger began his testimony at the March 9 hearing by making it clear that he wasn’t bound by a nondisclosure agreement. “I’m going to answer all your questions,” he told members of the House Judiciary Committee before launching into a PowerPoint presentation.
The clarification on the NDA was necessary because of an existing agreement with the FBI and device makers at the Harris Corporation. Part of the terms of having a stingray was that police could not talk about the device, which acts as a sort of cellphone tower to track nearby cellphones. After a judge threatened to hold a detective in contempt last year, officials from the Baltimore Police Department spoke with the FBI and decided to testify, Lt. Dan Fries said last week.
Before the delegates (and a pack of leather-clad motorcycle enthusiasts waiting for a hearing on the next bill on the docket), Shellenberger and the police officers sought to show that the stingray was not sweeping up mass amounts of personal data, and was being operated within the confines of the law. On the personal data point, Shellenberger described two ways in which the stingray is used. In one, detectives obtain a court order for a specific phone’s unique ID number, which is not a phone number, he said. A second method, called canvassing, allows police to compare the unique ID numbers of two phones. That method is used in the case of a person using a burner phone to avoid being tracked.
Shellenberger said the unique ID is all the police have access to, and not calls, texts, apps or other hardware features.
“All we have the capability of doing is to capture a unique identifier number that is associated with your cellphone,” he said.
A key point of controversy in the debate is the fact that in addition to a suspect’s unique ID, the device also sweeps up the data of other phones in the area. Under questioning from Del. David Moon, Shellenberger acknowledged that the data was collected in a log, but said those logs were purged either after the suspect’s phone was located or at the end of the court order.
Some other interesting facts came out during the hearing:

• Baltimore County’s device is kept under lock and key, and four people have access to it, said Cpl. Bernard Krumbacker.
• Baltimore City found 167 phones that were taken or used in a robbery using stingray, said Fries.
• Maryland State Police used the device about 50 times in 2015, and can share it with other police departments. (That’s contrasted with 4,300+ times Baltimore has used the device since 2007, and Baltimore County’s 600+ uses in five years.)

But it wasn’t merely an informational briefing. The main goal of the hearing was to hear arguments about a bill that would require police to fulfill additional requirements when obtaining a court order to use a stingray.
Supporters of the bipartisan bill, which is sponsored by Del. Charles Sydnor III (D-Baltimore County), include the ACLU and the Maryland Public Defender’s Office. They say the bill was necessary to comply with the Fourth Amendment to the U.S. Constitution.
“I think we can all agree as a general matter that cellphones are one of the most intimate forms of communication in the United States today, and it is not for the state to basically be able to log into our cellphones at any time and track us in real time to know where we are,” said Daniel Kobrin of the Maryland Office of the Public Defender.
The bill would specifically require the court order obtained to disclose that a cell site simulator was being used.
The bill updates a current Maryland law for obtaining a court order to track an electronic device, which was passed in 2014. Before that, police acknowledged getting an order for a pen register, which has a lower requirement for showing probable cause to search for a phone.
Police would also have to tell a judge where they are using the order, and where it would be used. The law enforcement representatives opposed those two requirements.
The bill also adds specific restrictions for getting rid of the data, and requires police departments to report how many times the device was used annually.
Though Sydnor and the law enforcement representatives said they already met, Shellenberger said more time was needed for the two sides to hash out their differences.
“I think we all need to get in a room together and actually write a bill that works for both of us, balancing public safety with your right to privacy,” Shellenberger said.
The committee did not immediately vote on the bill, so it’s unknown whether the debate will continue in the legislature.

The courts are also mulling the issue. Maryland’s Court of Special Appeals recently ruled that evidence obtained by Baltimore police in a case was not admissible because it was not obtained with a warrant.
At the end of the hearing, Sydnor and Shellenberger engaged in their own philosophical debate.
Sydnor asked the law enforcement panel if the use of the stingray amounted to a search. After a pause, Shellenberger took the question.
“That number belongs to a third party … they just assign it to your phone,” he said, referring to the unique ID numbers. “How can you have a reasonable expectation of privacy in something that you’re revealing to a third-party carrier who assigned it from a third party, and you don’t know what that is?”
Police started bringing up other examples of surveillance they could obtain, like security video from Target.
“But these are cellphones that we all have that are essentially tracking devices for the government,” Sydnor, the Baltimore County delegate, said.
They concluded that it had become a personal debate, and the hearing ended.