Chicago police must finally produce stingray records, judge orders

A local activist has won an important intermediary step in his legal quest to force the Chicago Police Department (CPD) to produce documents that fully explain the department's use of cell-site simulators, also known as IMSI catchers.

In a Monday opinion in Martinez v. Chicago Police Department, Cook County Circuit Judge Kathleen Kennedy denied the city’s motion to dismiss. This decision paves the way later this month for a closed-door hearing (in camera review) where the judge gets to privately review the documents in question.

Back in September 2014, activist Freddy Martinez filed a request under the Illinois Freedom of Information Act. Among other items, Martinez initially asked for:

• All court orders for any instances in which Chicago Police deployed IMSI Catchers
• All formal or informal policies, procedures, orders, directives, or other such records that pertain to when, why, where, how, and by whom IMSI Catchers may be deployed
• All records discussing the constitutionality of deploying IMSI Catchers

That request was originally denied by the CPD. By the end of that month, Martinez sued—his second records-related lawsuit against the CPD of 2014. As of nearly a year ago, the city owed over $120,000 to defend the cases. Martinez and his legal team still don’t know exactly how many documents will now be released.

"Last time we started with eight and got 200 but this one I expect will be much bigger," Martinez told Ars in an encrypted chat.

The Chicago Police Department did not immediately respond to Ars’ request for comment.

“Corrosive secrecy”

In the opinion, Judge Kennedy notably tossed the CPD’s use of an oft-replicated template affidavit written by an FBI special agent who advocated withholding stringray documents. The judge dubbed it "the very type of affidavit that is insufficient to prove an exemption by clear and convincing evidence." Importantly, she also knocked down the police’s attempt to use a decades-old statute—known as a pen register or trap and trace order—that often provides the legal authorization for law enforcement’s use of the invasive surveillance devices.

In fact, within the 19-page opinion Judge Kennedy seemed to specifically single out pen registers and trap and trace orders as two of the ongoing issues with the stingray era. In particular, she highlighted the fact that pen register-use pre-cellphone was not the same thing as when it gets applied to the more modern stingray:

However, Plaintiff did not request only court orders in which police deployed pen registers or trap and trace devices. Plaintiff also requested court orders in which the police deployed IMSI Catchers. The record reflects that a pen register is a device that records the numbers dialed by a particular telephone, and a trap and trace device records the incoming numbers to a telephone. Further, the record reflects that IMSI Catchers, also known as cell site simulators or stingrays, can capture a cell phones unique serial number, its location, and the content of calls, text messages, and webpages visited. Because IMSI catchers’ capabilities are broader, it is improper to equate them to and treat them as pen registers and trap and trace devices. Thus, to the extent that orders address technology other than pen registers and trap and trace devices, they are not exempt under section based on 18 USC 3123(d)(1).

A quick reminder

Cell-site simulators, also known as stingrays, can be used to determine a phone’s location by spoofing a cell tower. In some cases, they can intercept calls and text messages as well. Once deployed, the devices intercept data from a target phone along with information from other phones within the vicinity. In some cases, police have falsely claimed a confidential informant while in fact deploying this particularly sweeping and intrusive surveillance tool.

Often times, authorities have attempted to justify use of a stingray through a pen register rather than a warrant. And more judges are likely to sign off on a pen register application not fully understanding that police are actually asking for permission to use a stingray. That's because under federal law, pen registers are granted under a very low standard: authorities must simply show that the information obtained from the pen register is "relevant to an ongoing criminal investigation."

Luckily in recent months, federal agencies including the FBI, the Department of Homeland Security, the Internal Revenue Service and others have issued revised policies that explicitly require the use of a warrant when stingrays are in use. In 2015, California joined a handful of other states to also specifically require use of a warrant.

With respect to today's decision in Martinez, privacy-minded legal scholars lauded the judge’s reasoning.

"Today’s ruling sends the message that information about police use of invasive surveillance technology can only be kept secret with very good reasons," Nathan Freed Wessler, an attorney with the American Civil Liberties Union, told Ars by e-mail.

"For years, the FBI has been leaning on local police departments to hide basic information about stingray surveillance from judges, defense attorneys, and the public, including by submitting cookie-cutter affidavits in public records cases. As the court recognized, the overbroad and hyperbolic rationales asserted by the government simply do not pass the sniff test. We are glad that this court has joined courts in Buffalo, Baltimore, Tallahassee, and elsewhere in rejecting the government’s reliance on dubious arguments to justify its corrosive secrecy."