DOJ Posts New Policy on Stingrays

Well, what do you know.

Two weeks ago, we lamented the fact that law enforcement was using these electronic devices—commonly referred to as Stingrays, IMSI-catchers, or cell-site simulators—without search warrants and, often, in secret.

Then last Thursday, the U.S. Justice Department announced that, from now on, each of its agencies must obtain search warrants to use such devices, and the warrants must be supported by probable cause.

Furthermore, when agents do apply for a warrant, they must fairly disclose the nature of the technology as well as what they plan to do with it and how they plan to purge any data they pick up from non-target phones. If they use the device to locate a known phone, for example, they must delete that data once the phone is located and at least once per day. If they use the device to identify an unknown phone, they must delete that data once the phone is identified and at least every thirty days. And they must delete all prior operational data before each subsequent use.

Finally, the policy reaffirms that, even with a search warrant, agents may not use these devices to intercept the content of communications, like texts and emails, or other data like address books or contact lists. (That changes, of course, if they obtain a wiretap order.)

The policy applies to all instances in which the Department’s agencies—including the FBI, DEA, and ATF—use these devices to further their own criminal investigations, those of other federal agencies, or those of state and local agencies. It requires training and supervision before agents can use them, and it requires agencies to keep track of their use.

But the policy doesn’t apply to federal agencies outside the Justice Department or to state and local law enforcement, where a lot of the action is. If you’re wondering about your state, here’s a nifty map that offers the ACLU’s best guess on which local agencies are using them.

Nor does the policy apply to terrorism or national-security investigations.

Finally, the policy doesn’t apply in emergencies or in certain non-emergency circumstances that make it impractical to obtain a warrant, though other requirements still apply even then. See 18 U.S.C. § 3121 et seq. (codifying the federal pen register statutes).

Here’s a copy of the policy itself.