January 30, 2018

To the members of the Judiciary Committee: thank you for inviting me here today to speak
with you about House Bill 314, which would set out a clear path for law enforcement to
follow when using a cell site simulator and ensure that the privacy of the Maryland’s citizens
is protected.

My name is Rachel Levinson-Waldman, and I am senior counsel to the Liberty and National
Security Program at the Brennan Center for Justice, a nonpartisan law and policy institute
that seeks to improve our systems of democracy and justice.1 The Liberty and National
Security Program seeks effective national security policies that respect constitutional values
and the rule of law while protecting the American people. In that context, we frequently
speak, write, and advocate on issues relating to law enforcement, surveillance, privacy, and
the protections of the U.S. Constitution, including through law review articles, policy
reports, and amicus briefs.

I am here to express support for HB 314, and in particular to explain why it is critical that
the legislature impose standards upon the use of cell site simulators. To explain why, I can
turn to no better source than your own Court of Special Appeals, which in 2016 laid out in
detail the consequences of these devices for individual privacy.

Background: Technology and the Andrews decision

First, by way of background: cell site simulators are devices that essentially pretend to be cell
phone towers. Cell phones send out regular signals to find the nearest (or otherwise most
available) cell tower, in case the phone needs to make or receive a call, a text, or another type
of communication. When a cell site simulator is nearby, however, the phones that are close
to the simulator connect with the simulator instead of an actual cell tower. That does two
things: it tells the simulator what cell phones are in its vicinity and their approximate
location, and it can momentarily prevent those phones from making or receiving a call or

                                                                                                               
1 Brennan Center for Justice, accessed January 29, 2018, http://www.brennancenter.org/about.
   2  

carrying out other functions that are enabled by cell phone towers; in other words, the
simulator can essentially briefly disable the phone.2

As you likely know, in 2016, the Maryland Court of Special Appeals ruled in State v. Andrews
that the government must get a warrant to use a cell site simulator.3 In that case, the
Baltimore Police Department wanted to use a cell site simulator – often called a Stingray,
here called a Hailstorm – to find Kerron Andrews, a man wanted for attempted murder, but
did not want to disclose to the court that they were deploying this device. The FBI had
loaned the department the cell site simulator, in exchange for which the department had
promised that they wouldn’t reveal its existence. Instead of describing to the court what the
technology was and how it worked, the police asked the court to approve their use of a “pen
register/trap and trace” device.4

This was an insufficient and misleading representation in two ways: first, a pen register/trap
and trace device is completely different from a Stingray. Its function is to log the incoming
and outgoing calls for a specific phone – that is, the phone numbers that call a particular
phone, and the phone numbers that that phone calls. It doesn’t locate the phone itself. The
only thing it has in common with a Stingray is that they both involve phones.

And second, a pen register/trap and trace order, or PR/TT order, does not require that
police demonstrate probable cause of a crime, which is what would be required for a
warrant. Instead, an officer can get a PR/TT order if he or she shows that the information
the device is going to elicit will be relevant to an ongoing criminal case. That is a much lower
showing, and much easier to meet.

The Hailstorm worked as advertised: after getting a batch of GPS coordinates from
Andrews’s cell phone service provider, which narrowed down his location to a set of
apartments at a particular address, the police congregated there and turned on the device.
The Hailstorm pinpointed the specific apartment Andrews was located in, where the police
found him inside an apartment, sitting on a couch in the living room.5 At trial, Andrews
moved to suppress this information, arguing that the police should have had to get a warrant
to identify his location without his consent.6
                                                                                                               
2 “Department of Justice Policy Guidance: Use of Cell–Site Simulator Technology” 2-5, September 3,
2015, https://www.justice.gov/opa/file/767321/download; Stephanie Pell and Christopher
Soghoian, “A Lot More than a Pen Register, and Less than a Wiretap,” Yale Journal of Law and
Technology 16 (2013): 144-48.
3 State v. Andrews, 134 A.3d 324 (Md. Ct. Spec. App. 2016).
4 Id. at 327-29.
5 Id. at 329. Notably, these devices are not always so precise; one woman sued after she was

handcuffed at gunpoint inside her own home while the police searched for a suspect whom their
Stingray had led them to believe was inside her apartment – it turned out that he was in a nearby unit
instead. See Kate Klonick, “Stingrays: Not Just for Feds!”, Slate, November 10, 2014,
http://www.slate.com/articles/technology/future_tense/2014/11/stingrays_imsi_catchers_how_loc
al_law_enforcement_uses_an_invasive_surveillance.html.
6 Id. at 330.
   3  

The judges agreed, in a blistering opinion that called the police to task for their misleading
representations to the court and forcefully affirmed that people have a legitimate expectation
of privacy in the minutiae of their locations. It is worth reviewing the elements of the court’s
opinion, as they are relevant to the bill in front of you today.

The court first detailed the nondisclosure agreement that the State’s Attorney for Baltimore
City and the Federal Bureau of Investigations signed in the summer of 2011, before the
Baltimore Police Department bought its Hailstorm. As a condition for the purchase, the
police department and the State’s Attorney had to agree not to provide any information
about the Hailstorm in court, including in search warrants, without the express approval of
the FBI.7 If a court directed that information about the equipment or technology be
disclosed, or if a Freedom of Information Act request was filed, the State’s Attorney’s Office
had to tell the FBI immediately and allow the FBI to decide whether information could be
disclosed; the FBI could even direct the State’s Attorney’s Office to request that a case be
dismissed in its entirety rather than disclose information about the cell site simulator.8

The court objected to this setup in strong terms, noting that “such an extensive prohibition
on disclosure of information to the court … prevents the court from exercising its
fundamental duties under the Constitution.”9 The court described the false representations
from prosecutors and the police department as “detrimental to its position and inimical to
the constitutional principles we revere.”10

The court turned next to the question of whether the use of a Stingray is a “search” under
the Fourth Amendment; if so, the government would be required to obtain a warrant by
demonstrating to a court that there is probable cause of a crime. The answer to the
constitutional question turned on whether use of the tool invades a reasonable expectation
of privacy – that is, whether it intrudes upon an individual’s subjective expectation of
privacy, and whether society recognizes that expectation as reasonable.11 The Supreme Court
case setting out that test, U.S. v. Katz, stands for the proposition that a reasonable
expectation of privacy may be violated even without a physical intrusion into a particular area;
in other words, “the Fourth Amendment protects people, not places.”12 As the Andrews court
observed, “rapid advancements in technology make ascertaining what constitutes a search
under the Fourth Amendment ever more challenging.”13 Nevertheless, guidance on this
question is emerging from the Fourth Amendment landscape.

                                                                                                               
7 Andrews, 134 A.3d at 338.
8 Id.
9 Id.
10 Id. at 339.
11 Id. at 341 (citing Katz v. United States, 389 U.S. 347, 361 (1967) (Harlan, J., concurring)).
12 Katz v. United States, 389 U.S. 347, 351 (1967).
13 Andrews, 134 A.3d at 341-42.
   4  

First of all, while the approach set out by Katz dictates that physically following someone on
a public road does not require a warrant,14 the Supreme Court has also relied on Katz to hold
that where a particular type of technology reveals information about an individual or object
inside a private home, law enforcement generally has to obtain a warrant to use the tool.15
Because police would have to obtain a warrant to enter a home and observe what’s inside,
the Fourth Amendment doesn’t allow the government to sidestep that constitutional
requirement just because the technology is getting more sophisticated.

Two recent decisions have expanded on this framework, highlighting the intrusiveness of
using modern technology to gather, at low cost and with little effort, large quantities of
detailed information about an individual’s location – even if the data reflects an individual’s
movements in public, and not where he or she is within a private home.16 Thus, in United
States v. Jones, a plurality of justices expressed discomfort with the government’s use of a GPS
tracker to warrantlessly track a suspect’s car for a full month (which a majority of the Court
deemed to be a Fourth Amendment violation on alternate grounds of trespass). Justice
Sotomayor penned a concurrence observing that detailed location monitoring

generates a precise, comprehensive record of a person’s public movements that

reflect a wealth of detail about her familial, political, professional, religious, and
sexual associations. The Government can store such records and efficiently mine
them for information years into the future. And because GPS monitoring is cheap in
comparison to conventional surveillance techniques and, by design, proceeds
surreptitiously, it evades the ordinary checks that constrain abusive law enforcement
practices: “limited police resources and community hostility.”

Awareness that the Government may be watching chills associational and expressive
freedoms. And the Government’s unrestrained power to assemble data that reveal
private aspects of identity is susceptible to abuse.17

Two years later, the Supreme Court emphasized in Riley v. California – a case involving the
warrantless search of a cell phone – that at this point in the development of modern
technology, “[t]he term ‘cell phone’ is itself misleading shorthand; many of these devices are
in fact minicomputers that also happen to have the capacity to be used as a telephone.”18

Relying on these decisions, the Court of Special Appeals determined in Andrews that a cell
site simulator falls in the category of technologies that can surreptitiously obtain information
from inside a private home about an individual cell phone user and reveal a range of intimate
details:

                                                                                                               
14 United States v. Knotts, 460 U.S. 276, 280-82 (1983).
15 United States v. Karo, 468 U.S. 705, 730-35 (1984); Kyllo v. United States, 533 U.S. 27, 34-9 (2001).
16 United States v. Jones, 565 U.S. 400 (2012); see also Riley v. California, 134 S. Ct. 2473 (2014).
17 Jones, 565 U.S. at 415-16 (Sotomayor, J., concurring).
18 Riley, 134 S. Ct. at 2489.
   5  

The mere fact that police could have located Andrews within the residence by
following him as he travelled over public thoroughfares does not change the fact that
the police did not know where he was, so they could not follow him. … [T]he
information obtained in this case did reveal at least one critical detail about the
residence; i.e., that its contents included Andrews’s cell phone, and therefore, most
likely Andrews himself. … Put simply, the information obtained by police in this
case was not readily available and in the public view….19

The judges continued:

Cell site simulators, such as Hailstorm, can locate and track the movements of a cell
phone and its user across both public and private spaces. Unchecked, the use of this
technology would allow the government to discover the private and personal habits
of any user. As Justice Sotomayor predicted in her concurring opinion in Jones, we
are compelled to ask ‘whether people reasonably expect that their movements will be
recorded and aggregated in a manner that enables the Government to ascertain,
more or less at will, their political and religious beliefs, sexual habits, and so on.” We
conclude that they do not.20

For these reasons, and because individuals would have no reason to think that their cell
phone was sending information directly to the police department via a cell site simulator, the
court concluded that “people have a reasonable expectation of privacy in real-time cell
phone location information.”21 The panel also emphasized that a cell site simulator can
reveal an individual’s location inside a private residence – and even though a Stingray might
not do that in every circumstance, there is no way to know in advance “of obtaining this
information how revealing it will be or whether it will detail the cell phone user’s movements
in private spaces.”22 Thus, “the use of a cell site simulator, such as Hailstorm, by the
government, requires a search warrant based on probable cause and describing with
particularly the object and manner of the search, unless an established exception to the
warrant requirement applies.”23

One such exception would be the third party doctrine – a legal doctrine holding that where
an individual “voluntarily” conveys information to a third party, she surrenders any
reasonable expectation of privacy in the data, and the government can obtain it without a

                                                                                                               
19 Andrews, 134 A.3d at 348; see also Rachel Levinson-Waldman, “Hiding in Plain Sight: A Fourth
Amendment Framework for Analyzing Government Surveillance in Public,” Emory Law Review, 66
(2017): 527.
20 Andrews, 134 A.3d at 348 (quoting Jones, 565 U.S. at 416 (Sotomayor, J., concurring)).
21 Id. at 349.
22 Id. (quoting United States v. Graham, 796 F.3d 332, 350 (4th Cir. 2015), rev’d en banc, 824 F.3d 421

(4th Cir. 2016)). While the Graham decision on which the court relied was subsequently overturned
by the Fourth Circuit sitting en banc, the reasoning remains valid in light of Supreme Court
precedent.
23 Id. at 350.
   6  

warrant.24 While in increasing disfavor, this holding has not been overruled by the Supreme
Court.25 Nevertheless, the Andrews court held that the third party doctrine was not applicable
here; among other things, the Hailstorm works only when the phone is not already in use,
meaning that the device pulls location data from the ether at the precise moments when a
user would have no reason to believe information is being transmitted and could not be said
to be sharing it “voluntarily.”26

Why this bill is necessary

The Andrews decision describes, in a nutshell, why the elements of the bill before you today
are so important.

First, in light of the failure of the governmental parties in Andrews to be candid about the
capabilities of the Hailstorm, H.B. 314 mandates critical transparency. The draft legislation
specifically requires that any law enforcement agency seeking authorization to use a Stingray
must describe to the court “the nature and capabilities of the cell site simulator device that
will be used and the manner and method of its deployment,” along with “the procedures
that will be followed to protect the privacy” of people who are not targets but whose
information may be swept up anyway.

The Supreme Court has emphasized that the warrant requirement “serves to insure that the
deliberate, impartial judgment of a judicial officer will be interposed between the citizen and
the police.”27 In Katz, the Court struck down the warrantless wiretap of a public phone
booth on the grounds that the surveilling officers had not been required “to present their
estimate of probable cause for detached scrutiny by a neutral magistrate.”28 For a judge to
exercise “impartial judgment” and “detached scrutiny,” she must be provided with all the
relevant facts about the police tactics before her. This bill ensures that will occur.

Second, the ability of a cell site simulator to elicit information about the inside of a private
residence – an area that has historically been entitled to the highest levels of constitutional
protection – makes the warrant requirement in H.B. 314 a necessary feature. Anticipating the
Court of Special Appeals’ decision in Andrews, the Florida Supreme Court observed in 2014:

[B]ecause cell phones are indispensable to so many people and are normally carried
on one’s person, cell phone tracking can easily invade the right to privacy in one’s

                                                                                                               
24 Id. at 350-52 (citing United States v. Miller, 425 U.S. 435 (1976); Smith v. Maryland, 442 U.S. 735
(1979)).
25 See, e.g., Jones, 565 U.S. at 417-18 (Sotomayor, J., concurring) (noting that “it may be necessary to

reconsider the premise that an individual has no reasonable expectation of privacy in information
voluntarily disclosed to third parties”).
26 Andrews, 134 A.3d at 352 (noting that “In the present case, there was no affirmative act like

‘dialing’…”).
27 Wong Sun v. United States, 371 U.S. 471, 481-82 (1963).
28 Katz, 389 U.S. at 356.
   7  

home or other private areas, a matter that the government cannot always anticipate
and one which, when it occurs, is clearly a Fourth Amendment violation.29

The capability to intrude into a home to acquire otherwise private information – whether the
intrusion is physical or electronic – is arguably a dispositive factor in the Fourth Amendment
analysis; in light of both the likelihood that a cell site simulator will obtain information from
within a home that would otherwise be accessible only with a warrant, and the impossibility
of guarding against this eventuality, the proposed legislation rightly draws a bright line in
requiring a warrant before the device can be deployed.30 A warrant requirement also protects
against the risk that a police officer could collect data en masse or target political opponents
or personal enemies.31

In doing so, the proposed bill provides useful guidance to law enforcement about how to
meet the Fourth Amendment’s particularity requirement, setting out the information that
must be reflected in an order issued under its provisions, including details about the owner
of the phone, the “geographic area that will be covered by” the device, the grounds for
obtaining the information, and more.

Critically, the bill also recognizes that even with a warrant requirement in place, cell site
simulators will inevitably collect information about people in the vicinity of the individual
being targeted, who themselves are not suspected of any criminal wrongdoing. It puts into
place limitations on how long non-germane information can be kept, limiting the privacy
intrusion on uninvolved third parties.

A reasonable observer might ask why, if there is already a court decision in place, the
legislature should debate and approve a bill that puts into place many of the same
protections. There are three important reasons why this bill is a vital step in protecting
Marylanders, notwithstanding the Andrews opinion:

• First, it will enshrine these protections into law. Because the Andrews decision came
from the Court of Special Appeals, it is vulnerable to being narrowed or overturned
by the higher Court of Appeals. If the legislature takes decisive action now, the
residents of Maryland can be assured going forward that their privacy is safeguarded,
without having to wonder whether a subsequent case could radically change the
landscape.
• In addition, the proposed legislation sets out a far more detailed and practical
regimen than any court is in a position to do. This is valuable not only to the
                                                                                                               
29 Tracey v. State, 152 So. 3d 504, 524 (Fla. 2014), reh’g denied (2014).
30 Levinson-Waldman, supra n. 19, 572-74.
31 Klonick, supra n. 5 (“It’s easy to imagine the parade of horribles that could result from this type of

continued used of Stingrays without warrants by local police: targeting and tracking of certain
protesters, or a more general dragnet collection of phone numbers in high crime areas, or even use
by one local police officer who has a grudge. Both of these issues are problems that judge-issued
warrants—which require a level of specificity and basis for the particular search that a reasonable
human being must accept—were designed to solve.”).
   8  

residents of the state who may be targeted by a Stingray (or have their data
incidentally collected as a result of being near a target), but to law enforcement as
well. When the police have a process in place for using cutting-edge technology and
handling the data they gather as a result, they can be far more confident that the
evidence they collect will be available for use at trial.32 These requirements also
ensure that the police will become thoroughly familiar with the tool’s specifications
and capabilities, a valuable precondition to deploying this sophisticated technology.
• Finally, these standards protect everyone – not just individuals suspected of criminal
wrongdoing, but every person in this room. As the Andrews court implicitly
recognized in suppressing the evidence about Mr. Andrews, even an individual
suspected of murder deserves robust constitutional protections – because if those
protections are diluted with respect to him, they will be diluted with respect to us all.
And critically, this legislation does not prevent the police from using a Stingray; it
only puts in place standards for doing so.

National support for warrant requirement for location information

In addition, Maryland will be in good company when it passes this bill; eleven states so far
have passed legislation requiring a warrant for cell phone location information, including
Rhode Island, Massachusetts, and Illinois.33 And of course, this legislature has already
spoken on location privacy, requiring a showing of probable cause and a warrant to obtain
real-time location information generated by an electronic device, with limited exceptions.34
The bill before you today would make clear that those protections apply when it comes to
Stingrays as well, and put in place clear, understandable guidelines about the use, retention,
and deletion of the data that they gather.

Possible counterarguments

Opponents of the bill may point out that Stingrays do not in fact capture an individual’s
phone number per se – instead, they capture something called an International Mobile
Subscriber Identity, or IMSI. The argument goes that because the device does not produce
the phone number, it does not identify the individual in possession of the phone.

This is misleading in two ways: first, if the police already know the IMSI number of the
person they are trying to locate, they know everything they need to know the moment the
tool connects with the targeted phone and identifies its location. And second, while the
                                                                                                               
32 Compare Andrews, 134 A.3d at 363 (affirming the court’s exclusion of evidence obtained as a result
of the use of a Hailstorm device).
33 “Cell Phone Location Tracking Laws by State,” ACLU, accessed January 29, 2018,

https://www.aclu.org/issues/privacy-technology/location-tracking/cell-phone-location-tracking-
laws-state. Eight states require a warrant for all cell phone location information: California, Utah,
Montana, Minnesota, Rhode Island, Vermont, New Hampshire, and Maine. Two states – Illinois and
Indiana – require a warrant for real-time location information, and Massachusetts requires a warrant
for historical location information.
34 Md. Code Ann., Crim. Proc., §1-203.1 (West 2014).
   9  

police cannot type an IMSI number into a phone and call someone, it is a unique piece of
data that is tied to a single phone and therefore (usually) a single individual. Saying that an
IMSI is not identifying because it’s not a phone number is like saying that a phone number is
not identifying because it’s not a name. They all lead to the same place.

Opponents may also point out that a Stingray does not capture the content of a conversation
– that is, it is not a wiretap in disguise. That argument is a red herring three times over as
well. First, as Justice Sotomayor observed in her concurrence in U.S. v. Jones, one does not
need to listen to the content of a phone call to learn intimate details about an individual’s
life; that can be accomplished equally through location monitoring that “generates a precise,
comprehensive record of a person’s public movements.”35 Second, the fact that the Stingray
can confirm that an individual is inside a private residence is constitutionally dispositive on
its own; under well-settled Supreme Court precedent, the police may not obtain that
information without a warrant. And finally, while the cell site simulators currently in use by
law enforcement agencies in Maryland may not be listening in on phone conversations as a
matter of practice, policy, or technical capacity, it is not the case that the devices are
incapable of doing so. A 2015 Wired article revealed that the devices can “intercept[] the
content of voice and text communications” and can even potentially transform cell phones
into a listening bug.36

Conclusion

In sum, I urge this Committee to vote in favor of H.B. 314. It would enshrine critical privacy
protections for Marylanders while setting out a clear set of guidelines for law enforcement to
follow in obtaining a warrant to use this powerful technology.

                                                                                                               
35Jones, 565 U.S. at 415-16 (Sotomayor, J., concurring).
36Kim Zetter, “Turns Out Police Stingray Spy Tools Can Indeed Record Calls,” Wired, Oct. 28, 2015,
https://www.wired.com/2015/10/stingray-government-spy-tools-can-record-calls-new-documents-
confirm/.