Baltimore Sun: Baltimore Police used secret technology to track cellphones in thousands of cases

http://www.baltimoresun.com/news/maryland/baltimore-city/bs-md-ci-stingray-case-20150408-story.html

Baltimore Police used secret technology to track cellphones in thousands of cases

By Justin Fenton

April 9, 2015

The Baltimore Police Department has used an invasive and controversial cellphone tracking device thousands of times in recent years while following instructions from the FBI to withhold information about it from prosecutors and judges, a detective revealed in court testimony Wednesday.

The testimony shows for the first time how frequently city police are using a cell site simulator, more commonly known as a "stingray," a technology that authorities have gone to great lengths to avoid disclosing.

The device mimics a cellphone tower to force phones within its range to connect. Police use it to track down stolen phones or find people.

Until recently, the technology was largely unknown to the public. Privacy advocates nationwide have raised questions whether there has been proper oversight of its use.

Baltimore has emerged in recent months as a battleground for the debate. In one case last fall, a city detective said a nondisclosure agreement with federal authorities prevented him from answering questions about the device. The judge threatened to hold him in contempt if he didn't provide information, and prosecutors withdrew the evidence.

The nondisclosure agreement, presented for the first time in court Wednesday, explicitly instructs prosecutors to drop cases if pressed on the technology, and tells them to contact the FBI if legislators or judges are asking questions.

Detective Emmanuel Cabreja, a member of the Police Department's Advanced Technical Team, testified that police own a Hailstorm cell site simulator -- the latest version of the stingray -- and have used the technology 4,300 times since 2007.

Cabreja said he had used it 600 to 800 times in less than two years as a member of the unit.

Nate Wessler, an attorney with the American Civil Liberties Union, said 4,300 uses is "huge number." He noted that most agencies have not released data.

The Florida Department of Law Enforcement says its officers have used the device about 1,800 times. Police in Tallahassee say they have used it more than 250 times; police in Tacoma, Wash., 170 times.

Former U.S. Judge Brian L. Owsley, a law professor at Indiana Tech, said he was "blown away" by the Baltimore figure and the terms of the nondisclosure agreement. "That's a significant amount of control," he said.

Agencies have invoked the nondisclosure agreement to keep information secret. At a hearing last year, a Maryland State Police commander told state lawmakers that "Homeland Security" prevented him from discussing the technology.

Wessler said the secrecy is upending the system of checks and balances built into the criminal justice system.

"In Baltimore, they've been using this since 2007, and it's only been in the last several months that defense attorneys have learned enough to start asking questions," he said. "Our entire judicial system and constitution is set up to avoid a 'just trust us' system where the use of invasive surveillance gear is secret."

Cabreja testified Wednesday during a pretrial hearing in the case of Nicholas West, 21, and Myquan Anderson, 17. West and Anderson were charged in October 2013 with armed carjacking, armed robbery, theft and other violations stemming from an attack on a man in Federal Hill.

Cabreja took what he said was a copy of the nondisclosure agreement to court. It was dated July 2011 and bore the signatures of then-Police Commissioner Frederick H. Bealefeld III and then-State's Attorney Gregg Bernstein.

Defense attorney Joshua Insley asked Cabreja about the agreement.

"Does this document instruct you to withhold evidence from the state's attorney and Circuit Court, even upon court order to produce?" he asked.

"Yes," Cabreja said.

Cabreja did not comply with a defense subpoena to produce the device in court. He said he was barred from doing so by the nondisclosure agreement.

An FBI spokesman declined to comment on the technology or the document.

The signatories to the document agree that disclosing the existence of the stingray would "reveal sensitive technological capabilities possessed by the law enforcement community and may allow individuals who are the subject of investigation ... to avoid detection."

They agree that "disclosure of this information could result in the FBI's inability to protect the public from terrorism and other criminal activity" by rendering the technology useless for investigations.

The signatories agree that if they receive a public records request or an inquiry from judges or legislators, they will notify the FBI immediately to allow "sufficient time for the FBI to intervene."

Cabreja testified Wednesday that his unit received information about a stolen cellphone. He said detectives obtained a court order to get the phone's general location using cellphone towers from a cellphone company.

With that information, detectives ventured out to the Waverly neighborhood with the Hailstorm. The device is portable and can be used from a moving vehicle. Cabreja likened it to a metal detector for cellphone signals.

The device forces cellphones to connect to it. In this case, it was a Verizon phone, so identifying information from every Verizon customer in the area was swept up.

Cabreja said the data was collected but "not seen." Detectives were interested only in the target phone.

Cabreja said the device allows police to make a stronger signal emanate from the phone to help them find it.

"It, on screen, shows me directional arrows and signal strength, showing me the phone's direction," he testified.

The detectives traced the phone to a group home and knocked on the door. They told the woman who answered that they were conducting a general criminal investigation and asked to come inside, Cabreja said, and the woman agreed.

Seven detectives entered the home, he said. They used the Hailstorm to make the phone ring before anyone knew why they were really there.

Amid growing questions about the stingray, details of the technology have been trickling out of some jurisdictions, and it is now relatively easy to find descriptions online of what it does.

Insley, the defense attorney, called it the "worst-kept secret," and questioned why local police continue to be gagged.

Cabreja took notes with him to court that he said came from a discussion last week in which the FBI coached him on what to say in court.

The talking points included: "Data is not retained."

Cabreja did not refuse to answer any of Insley's questions, but he said his answers were constrained by the nondisclosure agreement.

Defense attorneys and privacy advocates express concern about the scope of the stingray's powers, and whether the courts are equipped to provide proper oversight of the police who use it. They argue that the use of the device amounts to a search and requires a warrant.

Baltimore police obtain court orders under the state's "pen register" statute. Insley says that law authorizes police to capture only the numbers that are called or received by a phone, not the more detailed metadata and location information the stingray collects.

He said those orders also require a lower standard of proof than a search warrant, and judges are not aware of what they are authorizing.

"They're basically duping these judges into signing authorizations to use stingrays," Insley said. "If they can increase the signal strength of your phone or make it ring, they can pretty much make it do anything."

But prosecutors say the language in the orders authorizes real-time GPS location, and Cabreja testified that police only use the stingray to find "target" phones and not to spy on the innocent.

In Maryland U.S. District Court last fall, an argument about the stingray device was cut short when the suspects took plea deals. And on Wednesday, following Cabreja's testimony, prosecutors and defense attorneys entered into plea negotiations instead of debating the merits of the stingray further.

In cases where the stingray becomes a sticking point, Wessler said, "defense attorneys are being able to get really good deals for their clients, because the FBI is so insistent on hiding all of these details."

"There are likely going to be a lot of defense attorneys in Baltimore who may have an opportunity to raise these issues," Wessler said. "They are on notice now that their clients may have some arguments to make in these cases."

jfenton@baltsun.com