1. Understanding & Challenging Location Tracking Hanni M. Fakhoury EFF Senior Staff Attorney

3. http://www.usatoday.com/story/news/nation/2013/12/08/cellphone-data-spying-nsa-police/3902809/

5. https://www.aclu.org/maps/stingray-tracking-devices-whos-got-them

9. https://www.aclu.org/sites/default/files/assets/aclu_florida_stingra y_police_emails.pdf

10. https://www.aclu.org/sites/default/files/assets/aclu_florida_stingra y_police_emails.pdf “In the past, and at the request of the U.S. Marshalls, the investigative means utilized to locate the suspect have not been revealed so that we may continue to utilize this technology without knowledge of the criminal element, in reports or depositions we simply refer to the assistance as ‘received information from a confidential source regarding the location of the suspect.’”

11. https://www.aclu.org/technology-and-liberty/us-v-rigmaiden-doj-emails-stingray-applications

12. US v. Rigmaiden, 844 F. Supp. 2d 982 (D. Ariz. 2012) & 2013 WL 1932800 (D. Ariz. 2013)

19. Hemisphere Database of CDRs available in near real time regardless of carrier –Includes records made 2 hours after a call –Results returned in hours for exigent circumstances and 2-5 days for routine requests –At least 10 years worth of records Used to –Find dropped/new/additional phones –Determine some location information –CDRs on international numbers

20. Hemisphere

21. “Protecting” Hemisphere Administrative subpoena to get Hemisphere records “Parallel subpoening” –Hemisphere used as a “pointer” system to be followed up by a subpoena to carrier No reference to Hemisphere in official reports or court documents –Just reference to follow up subpoenas

22. US v. Ortiz, 12cr119 (NDCal) Defense obtained subpoena ordering disclosure of: –Court orders authorizing HIDTA to release CDRs to law enforcement –Correspondence between law enforcement and Hemisphere http://www.sfweekly.com/2014-01-15/news/hemisphere-at-and-t-wiretapping-gangs/

23. DEA Bulk Records Collection Collection of phone records made from US to 116 countries from 1992-2013 –numbers, time and date of call and length of call Database queried if reasonable articulable suspicion phone associated with criminal activity DEA’s SOD passed info as tips to field agents and local law enforcement –Database not referenced in official reporting

24. Discovery Other “Stingray” Terminology –IMSI catcher, digital analyzer, cell site simulator, triggerfish, stingray, kingfish, amberjack, hailstorm, WITT (FBI’s “wireless intercept tracking team”) Descriptions of the Technique –Cellular or cell phone tracking –Pinging –“Ride by” –“Known investigative technique”

25. US v. Kincaid, 13cr818 (NDCal)

26. US v. Kincaid, 13cr818 (NDCal)

27. State v. Taylor, 114140031

28. Expectations of Privacy Rakas v. Illinois, 439 U.S. 128, 143 n. 12 (1978) –Must “have a source outside of Fourth Amendment” by reference to “understandings that are recognized and permitted by society” Riley v. California, 134 S.Ct. 2473 (2014) –Privacy interests depend on the quality and quality of information revealed –Older cases involving physical items or less intrusive government action don’t control digital searches or surveillance

29. Expectations of Privacy US v. Knotts, 460 U.S. 276 (1983) –No expectation of privacy in public movements “voluntarily conveyed” to others –Reserved right to consider “dragnet-type law enforcement practices” Smith v. Maryland, 442 U.S. 735 (1979) –Use of pen register to capture outgoing phone calls made over three days –No expectation of privacy in dialed phone numbers

30. Location Privacy Subjective expectation of privacy –Location info revealing when aggregated –Phone records may be protected under state constitution Expectation is objectively reasonable –Growing body of case law and statutory protection reflect changing “understanding” Smith Doesn’t Apply –Nature of intrusion matters

31. Location Privacy US v. Cooper, 2015 WL 881578, at *8 (N.D. Cal. Mar. 2, 2015) –“Society's expectation of privacy in historical cell site data is also evidenced by many state statutes and cases which suggest that this information exists within the ambit of an individual's personal and private realm… While state law is, of course, not dispositive on this question, ‘the recognition of a privacy right by numerous states may provide insight into broad societal expectations of privacy.’”

32. Location Privacy Warrant to track car with a GPS device –U.S. v. Maynard, 644 F.3d 544 (D.C. Cir. 2010); People v. Weaver, 909 N.E.2d 1195 (N.Y. 2009); State v. Campbell, 759 P.2d 1040 (Or. 1988); State v. Jackson, 76 P.3d 217 (Wash. 2003); Commonwealth v. Rousseau, 990 N.E.2d 543 (Mass. 2013); State v. Brereton, 826 N.W.2d 369 (Wis. 2013); State v. Zahn, 812 N.W.2d 490 (S.D. 2012); U.S. v. Lopez, 895 F. Supp. 2d 592 (D. Del. 2012) Warrant statutorily required to track cell phone –Historical & real time: CO, ME, MN, MT, UT –Real time only: IL, IN, MD, VA, WI

33. Location Privacy Warrant required to obtain cell phone location records –Tracey v. State, 152 So.3d 504 (Fla. 2014); Commonwealth v. Augustine, 4 N.E.3d 846 (Mass. 2014); State v. Earls, 70 A.3d (NJ 2013); Commonwealth v. Rushing, 71 A.3d 939, 961-64 (Pa. Sup. Ct. 2013), appeal granted on other grounds 84 A.3d 699 (2014); United States v. Powell, 943 F. Supp. 2d 759, 776-77 (E.D. Mich. 2013); United States v. White, --- F.Supp.3d ---, 2014 WL 6682645 (E.D.Mich. 2014) (real time) –But see U.S. v. Davis, --- F.3d ---, 2015 WL 2058977 (11th Cir. 2015) (en banc); In re US for Historical Cell Site Data, 724 F.3d 600 (5th Cir. 2013); In re US for an Order, 620 F.3d 304 (3d Cir. 2010)

34. Questions? hanni@eff.org @hannifakhoury 415 436 9333 x. 117 www.eff.org