New Police Spying Documents Obtained in FOIA Lawsuit
Updated June 9, 2017: See below for new documents.
In late 2015, we learned through our client Jonathan Rudenberg's Freedom of Information Act (FOIA) request that the Delaware State Police had spent hundreds of thousands of dollars to purchase devices that spy on cell phones. Known as a "Stingray," the police gadget pretends to be a cell tower, deceiving cell phones into contacting it and capturing the location of the phones, and potentially other information. The technology takes the data from the phones of everyone who happens to be in the area where the device is used. Stingrays work because of known security flaws in the cellular networks, which have been proven to be exploitable by anyone with hundreds of dollars of off-the-shelf gear, not just the police. Telephone companies and governments should be doing everything they can to patch these security flaws and make sure that everyone is secure.
Jonathan's FOIA request revealed the purchase of the devices as well as the nondisclosure agreement State Police entered with the FBI to keep the technology secret. But much was left out of the records we were provided. The State Police claimed not to have any rules or policies governing the use of Stingrays. We did not learn if they are applying for warrants for Stingray use, or what judges were being told about the technology. We also did not learn what is done with third party data gathered by the devices. Finally, we learned very little about the no-bid purchasing process that allowed the State Police to spend hundreds of thousands of dollars on the devices.
On February 26, 2016, we filed a lawsuit in Superior Court to demand greater transparency regarding the Delaware State Police's use of surveillance technology.
Over a year later, we have finally obtained many of the documents we had been seeking from the beginning of the suit: examples of the warrant applications that are used to seek judicial approval to use these devices, as well as an additional document from the purchase process--a non-disclosure agreement between the State Police and the corporation that manufactures these devices. We resolved the suit with the State Police after receiving these documents.
The warrant applications represent a reasonably transparent approach to seeking court authority to use Stingrays. Police officers applied for judicial warrants, clearly explained the technology to the judges involved, and promised to delete third-party data that was gathered. The procedures and disclosures reflected in these documents should be put into binding law to ensure that these selected examples reflect how the technology is used in all cases.
Troublingly, the additional non-disclosure agreement does not reflect the same commitment to transparency and the rule of law. The agreement between the State Police and Harris Corporation purports to prevent the police from discussing these devices even with “elected officials.” This kind of secrecy is not necessary to ensure that the devices can be used successfully. But it does prevent democratic oversight over police spying technology and the money necessary to procure it.
