By Maya Kushner, Esq. and Marc Emden, Esq.

With the pervasiveness of cell phones, police are using GPS coordinates of cell phones to track the location of crime suspects. However, in their zeal to make arrests, the police have been secretly and illegally using high tech equipment to capture criminals. Most recently, a Maryland high court struck down the seizure of a gun found on a man where police had unlawfully employed a phone tracking device to locate the suspect for whom they had an arrest warrant.

The Andrews Case

In the September 2015 case of State v. Andrews, the police had a valid arrest warrant for defendant Andrews, wanted on charges of attempted murder, but they didn’t know the location of the suspect. Officers applied for and received a court order to use a Pen Register and a Trap & Trace on the defendant’s phone.

A Pen Register is an electronic device or process that records the phone numbers of outgoing calls, while a Trap & Trace records phone numbers of incoming calls. Under Maryland law, police may obtain an order for a pen register/trap & trace provided it is “relevant” to an ongoing criminal investigation: this is a much lesser standard than the “probable cause” standard needed for a warrant. After obtaining a court order for the use of both devices, police sent a request to the defendant’s cell phone carrier (in this case Sprint), requesting: subscriber information, pen register data, and historical and real-time cell site location information (“CSLI”). CSLI shows which towers a cell phone connected to, essentially narrowing down the location of a phone.

Police Lied to the Court

In one small and vague paragraph, buried in the 11-page application for the pen register, the police hinted that they were planning to use other tracking devices, but they never named the technology they planned to use, nor did they explain how it works.

Police cellular signalThus, even though the police were receiving lawful real-time updates on the defendant’s CSLI from Sprint, the police also used a Hailstorm. A Hailstorm is the current generation of what is more commonly known as a Stingray device, manufactured by the Harris Corporation. This device is a cell site simulator, mimicking a wireless carrier tower; it forces all nearby cellular devices to connect to the tracking device as if it were a tower, thereby allowing the user (police) to see the identity of every cell phone in the area. It then obtains and records unique identifying information, such as the phone’s International Mobile Subscriber Identity (“IMSI”) — which is like your phone’s social security number.

The tracking device also calculates and displays the strength of the signal and the direction it is coming from, allowing the user to gauge the distance between the device and the target cell phone. Using a Hailstorm, the police tracked Andrews’ location to a specific apartment, then obtained a search warrant for that apartment, arrested the defendant, and seized a handgun hidden in the couch on which he was sitting.

Police Have Lied to Courts for Years

The court found it troubling that the police didn’t just forget to include information about the Hailstorm in their application for a court order — they deliberately omitted this information. The court also found that the police had been omitting this information for years. In fact, as a condition of purchasing their equipment, the Harris Corporation requires the purchasing organization to sign a non-disclosure agreement (“NDA”), ensuring that the existence and the function of Hailstorm equipment remains a secret.

In the Andrews case, the Baltimore Police Department and the prosecutors (State’s Attorney’s Office) had signed an NDA agreeing that they will not share information on the use or function of the tracking device with anyone, including defendants, criminal defense attorneys, judges, the media, and the general public.

Spying on Innocent Bystanders

The Hailstorm technology is terrifying in the scope of its capability. The Hailstorm pings all cell phones within a certain radius, and obtains their individual IMSIs and location information. And since “nearly three-quarters of smart phone users report being within five feet of their phones most of the time, with 12% admitting that they even use their phones in the shower,” Riley v. California, 134 S. Ct. 2473, 2490 (2014), obtaining precise location of a phone really means knowing the precise location of a person — which is, of course, why police employ phone tracking technology when looking for a suspect.

But when police use a Hailstorm to track a suspect’s location, they are also tracking the location of and learning intimate details about tens to hundreds of innocent bystanders in the area under surveillance. The specific location of a person can reveal if he or she is visiting a doctor’s office, attending a religious service, shopping at a specific store, and who they are with at the time.

Stingray-type technology, problematic?

The use of Stingray-type technology is also problematic because it can interfere with the bystanders’ use of their own cell phones. Since a Stingray or Hailstorm forces all cell phones in the area to connect to the tracking device as if it were a cell tower, this means that the cell phone is sometimes unable to connect to an actual tower. Thus, if you were trying to place a call or send a text message while in an area under surveillance, your communication could fail. Have a phone interview scheduled? Need to have an emergency phone consultation with your therapist? Have time-sensitive information to pass along to your family members? You can’t — your phone isn’t getting service because of the Hailstorm.

And while the Harris Corporation has apparently taken steps to make sure that 911 calls are not interrupted by the tracking device, their assurances ring hollow in the face of proof that they intentionally concealed information about the existence and operation of their devices in the first place.

The Court Rules

In the Andrews case, the Court of Special Appeals ruled that the use of the Hailstorm device is a search within the meaning of the 4th Amendment to the U.S. Constitution, and therefore requires a search warrant prior to its use. While this is a step forward, it is not enough to protect the privacy of innocent bystanders. The court’s ruling simply means that the police must take an extra step prior to using a Hailstorm, but it does not direct the police to minimize the amount of or destroy the personal information collected in the process.

Is you local police department using Hailstorms? Check out a map prepared by the ACLU.