Federal judge denies motion to throw out evidence gathered via fake cell tower | Ars Technica

Policy —

Federal judge denies motion to throw out evidence gathered via fake cell tower

Court re-iterates that, by and large, we have no expectation of digital privacy.

Stingrays can be used to generate false cell tower signals as a way to find a phone's location.
Stingrays can be used to generate false cell tower signals as a way to find a phone's location.

In a criminal case on Wednesday, a federal judge denied (PDF) a motion to suppress evidence gathered with the help of a stingray—a device that can create a false cellphone tower signal.

The use of a stingray allows authorities to determine a specific mobile phone’s precise location. The technology isn't new and many believe law enforcement agencies nationwide have used them for many years.

In March 2013, we reported on an amicus brief filed in this case by the American Civil Liberties Union. This revealed that the Feds were not completely upfront about using stingrays (also known as “IMSI catchers”) when they asked federal magistrate judges for permission to conduct electronic surveillance.

As a result, Daniel David Rigmaiden (the defendant in the case who is representing himself and has maintained his innocence), had forcefully argued that using a stingray without a warrant is unconstitutional. As a result, he argues that any evidence gathered from it should be suppressed from the record. But the Court ultimately denied Rigmaiden's motion.

Rigmaiden faces dozens of federal accusations of identify theft, mail fraud, and other charges stemming from an alleged fraudulent tax refund ring. Between 2005 and 2008, federal investigators claimed that Rigmaiden and two co-conspirators—Ransom Marion Carter, III (who remains a fugitive) and another unnamed suspect—filed more than 1,900 fake tax returns online. Their work yielded $4 million sent to more than 170 bank accounts.

Privacy, schmivacy

Among other reasons for denial, Judge David Campbell said that Rigmaiden had no “reasonable expectation of privacy” when using a mobile Internet hotspot ("aircard") from Verizon. And ultimately, that's how law enforcement agents tracked him down and arrested him.

Virtually everything about Defendant’s actions related to the apartment was fraudulent. Defendant rented the apartment using the name of a deceased individual, provided a forged California driver’s license to support the false identity, used the driver’s license number from another person in support of the forged license, and provided a forged tax return to support his purported ability to pay rent. Defendant used the laptop he had procured through fraud in the apartment, and connected to the Internet with the aircard purchased with a false identity while using the account with Verizon that he maintained using a false identity. Even the electricity that lighted the apartment and powered the computer and aircard was purchased in a false name. What is more, while living in the apartment under false pretenses, Defendant had $70,000 in cash, a false passport, and a copy of his laptop computer in a storage unit (also rented under false pretenses) ready for a quick escape.

One who so thoroughly immerses himself in layers of false identities should not later be heard to argue that society must recognize as legitimate his expectation of privacy in the location and implements of his fraud. The Court concludes that Defendant’s presence in apartment 1122 was akin to the “burglar plying his trade in a summer cabin during the off season.”

Campbell, in his 52-page decision, also cited the 1976 case, United States v. Miller. That decision later helped influence the third-party doctrine:

The reasoning of Miller applies to the historical records obtained by the United States. They are not the customer’s private papers. Once a customer makes a call, communicates over the Internet, leases an apartment, or uses the services of an alarm company, he has no control over the business record made by the business of that transaction. Instead, the record created is a business record of the provider. The choice to create and store the record is made by the provider, and the provider controls the format, content, and duration of the records it chooses to create and retain. . . . Moreover, these records pertain to transactions to which the companies were a participant. The assignment of a particular cell tower to process a call is made by the cell phone company to facilitate the functioning of its network; the ISP uses the IP address to route Internet communications it transmits; the rental company maintains a rental file for each occupant; and an alarm service independently maintains records of the equipment it installs and maintains. Thus, under Miller, the business records obtained by the government are not protected by the Fourth Amendment.

The judge concluded:

Contrary to Defendant’s arguments, federal courts consistently rely on Smith and Miller to hold that defendants have no reasonable expectation of privacy in historical cell-site data because the defendants voluntarily convey their location information to the cell phone company when they initiate a call and transmit their signal to a nearby cell tower, and because the companies maintain that information in the ordinary course of business.

ACLU wants stingrays to be more explicitly disclosed

In a blog post published Wednesday, ACLU counsel Linda Lye wrote that law enforcement should be compelled to thoroughly disclose the implications of using a stingray device—as this technology can easily pick up other non-suspect mobile phones.

In today’s decision denying the motion to suppress, the judge held that information about how the stingray operates—such as the fact that it scoops up third party data—was merely a “detail of execution which need not be specified.” We respectfully but strongly disagree.

If the government has probable cause to believe a suspect lives at a particular address and wants a search warrant, it obviously needs to tell the court if the address is a 100-unit apartment building and that the government intends to search all 100 units until it finds the suspect. Omitting such information would never be considered a “detail of execution.” Law enforcement should be held to the same standard when they conduct electronic surveillance.

The judge dismissed the significance of the stingray’s impact on third parties because the government deleted and did not review the third-party data after it located Mr. Rigmaiden. But the Fourth Amendment does not include a “no harm, no foul” rule. The violation arises from the fact that the government searched people who are not suspected of any wrongdoing. This is a violation even if the government doesn’t later use the information against those third parties.

Channel Ars Technica