Published by The Lawfare Institute
in Cooperation With
In late November, a California state court issued a final decision interpreting a 2015 California state law regulating government agency use of cell site simulators, devices that can be used to locate and track cell phones. The devices are commonly known as “stingrays.” The challenge—the first brought under this law—argued that the City of Vallejo was not in compliance with the law’s requirement that a local public body approve, at a public meeting, both police acquisition of the technology and a policy determining how and when these devices can be used. The court upheld this view of the law, providing an important victory for transparency.
Stingray devices present serious privacy risks because they allow law enforcement to track the physical location of anyone with a cell phone in real time. Originally billed as anti-terrorism tools, police often use them in routine investigations of nonviolent crimes. Furthermore, stingray devices can access data about all phones in an area, ranging from a few hundred yards to about 2 miles, even if the police are interested in only one device. Because of these “dragnet” capabilities, I and others have argued that localities should have the opportunity to decide if and how stingray and similar devices should be used in their communities. The California state law mandates this local decision-making process, providing an opportunity for needed transparency and democratic oversight.
The ruling and resulting changes to Vallejo’s policy provide a guide for other cities in California. Indeed, by being forced through a public discussion period, the policy benefited from significant changes, including explicit safeguards for First Amendment-protected activity. But, at a higher level, this litigation demonstrates the importance of having a governance process for surveillance, not just one governance mechanism. State laws, state courts and civil society all were crucial to the effective regulation of surveillance technologies used by local police forces.
Local acquisition of these technologies frequently bypasses established local oversight mechanisms—through nondisclosure agreements with sellers or via federal grant programs that don’t require local political approval. Local use of these technologies suffers from a more general Fourth Amendment problem, too: Under Fourth Amendment law, to challenge use or misuse of new technologies, you have to wait until you can prove that they were used in a criminal prosecution. Even then, judicial scrutiny of these devices is usually slow and limited in scope to the confines of the Fourth Amendment’s “reasonableness” doctrine.
The state law’s required procedural measures help mitigate some of these problems by allowing legal challenges to “move up” in time: First, public discussion occurs much earlier, and any legal challenges can also occur well before use in a criminal prosecution. The state law also allows legal challenges about surveillance to take place in procedural and statutory terms, rather than constitutional terms. Lower courts sometimes welcome the opportunity to rule on these grounds rather than engaging with riskier questions of constitutional interpretation.
But these required procedural measures go only so far. To bring Vallejo into full compliance with the law required corrective litigation from a civil society group. Civil society was able to do so only because the original state law granted private citizens legal standing to challenge local processes. The Vallejo story shows just how important such standing provisions are to ensuring surveillance statutes have their intended effect.
The litigation also meant the resulting policy decisions in Vallejo were subject to particular public scrutiny. Civil society groups achieved substantial revisions to the policy that go beyond the minimum required by the statute, including prohibitions on the use of these devices to monitor First Amendment-protected activity and requiring logs of the device’s use. Vallejo’s policies will serve as good substantive precedent for other cities looking to acquire this technology; in this way, statutorily required procedures proved to be a gateway to improved substance.
And, indeed, many more California cities may soon be going through this statutory process. Harris Corporation, a primary manufacturer of these devices, announced that it will stop supplying local agencies. Although most of California’s major cities acquired their original cell site simulators before the 2015 law went into effect, meaning they had to comply with only a portion of the law, cities will be required to adhere to the full range of procedural requirements as they acquire new models. The City of Anaheim, for instance, went through this process—compliantly—over the summer. More litigation may be on the horizon, too: The plaintiffs in City of Vallejo believe “other cities in California may have also put cell site simulators to work without a public policy process and will be contacting those cities to insist upon compliance with state law.”