NYPD used stingrays over 1,000 times without warrants since 2008

The New York Police Department used cell-site simulators, better known as stingrays, over 1,000 times between 2008 and May 2015 without first acquiring a warrant, according to new public records obtained by the New York Civil Liberties Union (NYCLU).

According to the NYCLU, this marks the first time that the nation’s largest police department has admitted to using the notorious surveillance technology. The NYPD does not have a written policy for stingray use. Police records show that while stingrays were mostly used in investigations of serious felonies—homicide, assault, kidnapping, drug trafficking, rape—they were also used for investigating money laundering and ID theft.

Stingrays are in use by both local and federal law enforcement agencies nationwide. The devices determine a target phone’s location by spoofing or simulating a cell tower, and mobile phones in range of the stingray connect to it and exchange data with it as they would with a real cell tower. Once deployed, the devices intercept data from the target phone along with information from other phones within the vicinity—up to and including full calls and text messages. At times, police have falsely claimed that information gathered from a stingray has instead come from a confidential informant.

"If carrying a cell phone means being exposed to military-grade surveillance equipment, then the privacy of nearly all New Yorkers is at risk," Donna Lieberman, executive director of the NYCLU said in a statement. "Considering the NYPD’s troubling history of surveilling innocent people, it must at the very least establish strict privacy policies and obtain warrants prior to using intrusive equipment like stingrays that can track people’s cell phones."

In the name of counterterrorism

The NYPD, like nearly all other law enforcement agencies, typically asks judges to sign off on a "pen register application" when obtaining permission to deploy a stingray, rather than seeking an actual warrant application. Judges are likely to sign off on pen register applications—generally used to authorize law enforcement to record the numbers dialed from a landline—without fully understanding that police are actually asking for permission to use a stingray.

Authorities often opt for pen registers because their standard for issuance is lower than a full warrant. Rather than demonstrating probable cause, they must simply show that information obtained from the pen register is "relevant to an ongoing criminal investigation."

Nearly all police agencies have been reticent to release information about stingrays and exactly how they are used, largely arguing that such disclosure would be detrimental to law enforcement.

As Jonathan David, an NYPD records officer, wrote to the NYCLU earlier this month:

The use of [cell-site simulator] technology by a local law enforcement agency within the context of criminal investigations does not remove information pertaining to use of CSS equipment from the protection of the statute, since the use of a CSS in a criminal investigation that does not involve terrorism does not diminish the ability of an agency to use a CSS as part of its response to a past, present, or future terrorist act. The public disclosure of such information would allow terrorist actors and other potential investigative subjects to develop and implement countermeasures to these counterterrorism tools and to the nonroutine criminal investigative techniques that are involved in the utilization of this technology. This is precisely the type of disclosure that the exempting statutes were enacted to preclude.

There has been increasing public scrutiny on what law enforcement agencies do with stingrays as more information about their use has come to light. Last month, a stingray case finally reached a federal appeals court for the first time.

In 2015, both the Department of Homeland Security and the Department of Justice (which oversees the FBI) said that they would now require a warrant during stingray deployments. However, those policies do not apply to individual state-level law enforcement. Some states, like California, have imposed state-level laws that also have a new warrant requirement as well. A pending bill in Nebraska seeks to ban use of the devices entirely.

The NYPD did not immediately respond to Ars’ request for comment.

UPDATE 10:30pm ET: J. Peter Donald, an NYPD spokesman, wrote Ars:

The NYPD, before using this technology, ensures we have established probable cause, consults with a District Attorney, and applies for a court order, which must be approved by a judge. In rare instances, the NYPD may use this technology in emergency situations while we seek judicial approval. This would be in instances where the life or safety of someone is at risk.

The NYCLU maligned that the privacy of New Yorkers is at risk. It is not. What is at risk is the safety of New Yorkers, without the limited use of this technology to locate dangerous fugitives.

The NYPD does not capture the contents of communications, as the NYCLU stated. Furthermore, the NYPD does not and never has swept up information from cell phones nearby. Perhaps the NYCLU should fact check their press release before issuing it.

However, Donald did not answer Ars' further follow up questions late Thursday evening, as to if in fact, the NYPD has probable cause, why it does not seek a warrant. Nor did he answer how it could back up the claim that the agency does not collect information of innocent bystanders.