Last month, the FBI released nearly 5,000 pages of records regarding cell phone tracking devices. Many have dismissed this staggering cache because of the extensive redactions that the Bureau was kind enough to visit upon them.
Others pointed out that these documents had been released previously. Documents released to MuckRock in response to our FOIA request are identical to those released to Daniel Rigmaiden pursuant to his ongoing litigation against the Justice Department for StingRay documents. Rigmaiden’s lawsuit forced the FBI to remove redactions of references to the Harris Corporation — among other “dirty words”, to use the judge’s term — from nearly 5,000 pages released to the Electronic Privacy Information Center in 2012 and 2013.
But patient sifting — as of today, I’ve trudged through 1,740 out of the 4,960 pages — uncovers some critical bits of StingRay history, including how the PATRIOT Act changed the FBI’s pre-deployment checklist. With key provisions of the PATRIOT Act set to expire next week unless Congress renews them, it’s worth revisiting how the October 2001 legislation reshaped surveillance authorities along a number of fronts, including cell phone tracking.
As Stephanie Pell and ACLU’s Chris Soghoian painstakingly chronicled last year, up until 2001, the Justice Department held that StingRays required no legal authorization to deploy. In 1994, the Office of Enforcement Operations, which reviews DOJ policy on electronic surveillance, determined that investigators did not need to obtain any court order so long as tracking devices only collected “the ‘signaling information’ automatically transmitted between a cell phone and the provider’s tower.” (MuckRock has requested this OEO document.)
But the USA PATRIOT Act of 2001 revised some key definitions. A June 2003 slide deck from the FBI’s Wireless Intercept and Tracking Team (WITT) distills how these changes impacted StingRay deployments.
Before 2001, federal law defined a pen register as any “device which records or decodes electronic or other impulses which identify the numbers called or otherwise transmitted on the telephone line to which such device is attached.” Similarly, the pre-PATRIOT definition for a trap and trace specified that such a device captures incoming calls. Since a given device typically captures both incoming and outgoing signals, the two terms are often combined into “pen/trap.”
Law enforcement may legally use pen/trap devices only under court order — often called a “PR/TT” order — as part of an ongoing criminal investigation. But so long as a given device isn’t attached to a telephone line, the OEO opined, and doesn’t collect numbers for incoming or outgoing calls, it didn’t technically count as a pen/trap as defined.
The PATRIOT Act expanded these definitions in two key ways. First, Congress broadened the both pen register and trap and trace to include processes as well as specific devices, and eliminated language about attachment to a telephone line.
Second, the revised definitions explicitly include “routing, addressing, or signaling information” in addition to dialed numbers. As WITT summarized, the PATRIOT Act thus made the language “technology-neutral,” and so brought cell phone trackers under the pen/trap umbrella.
The new pen/trap definitions do not cover collection of telecommunications content.
Based on these changes to the pen/trap definition, the Justice Department revised its electronic surveillance manual in early 2002 to advise that agents seek court orders before using StingRays.
“A pen/trap authorization is therefore the safest method of allowing law enforcement to collect such transmissions directly using its own devices,” concludes the manual’s revised section on cell phone tracking.
Unlike many portions of the PATRIOT Act — particularly Section 215, which the NSA and the FBI have interpreted to allow bulk collection of telephone records — these definitional changes that Congress made in 2001 did not include sunset provisions.
More than a decade later, the FBI told legislators last year that its new StingRay policy requires agents to secure a warrant to deploy StingRays, rather than simply a pen/trap order, except under particular circumstances. The Justice Department also recently announced that it is reviewing policies across all of its components when it comes to cell phone tracking. MuckRock is seeking documents related to both announcements.
The slides and legal guidance highlighted above are but a few out of the FBI’s pockmarked avalanche of StingRay documents. Yes, they are heavily, frustratingly redacted. But they also hold a critical archive of how cell phone tracking has evolved on both a practical and policy level. There are dots waiting to be connected, and we’re slowly finding them.
