In 2014, the NYCLU sent a FOIL request about Stingrays to the Erie County Sheriff’s Office (in Buffalo) and the New York State Police. [Update (Feb. 2016): the NYCLU sent the same FOIL request to the NYPD in 2015; (May 2016) in response to a June 2015 FOIL request, the NYCLU received surveillance technology records from the Rochester Police Department; See the document library for the NYPD’s response and the Rochester Police Department's produced records.]
What are Stingrays?
“Stingray” is the commonly used term for a cell site simulator, a briefcase-sized surveillance device that allows the police to spy on cell phones in the area by mimicking a cell phone tower. Stingrays allow the police to pinpoint and track a person’s location, collect the phone numbers that a person has been texting and calling and, in some configurations, intercept the contents of communications.
How much do Stingrays cost?
The New York State Police was quoted $197,100 for its purchase of a Stingray device in 2005, which appears to have been funded by auto theft funds.1 The Erie County Sheriff’s Office has spent more than $350,000 to purchase and maintain its two Stingray systems.2
Update (May 14, 2015): The New York State Police released additional invoices and purchase orders. These records reveal that in the fall of 2012, the State Police submitted two purchase orders for a total of $263,230 to maintain and upgrade the equipment and to provide training. In addition, the State Police received invoices to the total tune of $181,174 in June 2013 for upgrades and training. Assuming all bills were paid, the State Police has spent at least $641,504 on Stingrays.
Update (May 2016): The Rochester Police Department (“RPD”) produced a number of records relating to their purchase of a Stingray device called KingFish with an AmberJack upgrade from Harris Corporation in response to a FOIL request filed by the NYCLU in June of 2015. It appears that the RPD’s KingFish unit is attached to a department vehicle and can be used to identify and track a cell phone on the move.
These tools do not come cheap. Relying on at least $172,588 in state grants, the RPD has spent at least $200,600 since 2011 on their Stingray platform hardware, software, and training . Correspondence between the RPD and Harris Corporation suggests that Stingray technologies might require costly yearly maintenance subscriptions with Harris Corporation to remain operational. Such services can cost thousands of additional taxpayer dollars.
In 2013, Harris Corporation attempted to coax the RPD to spend around $388,000 more to upgrade their KingFish to a Hailstorm Stingray device. Harris Corporation advised the RPD that such an upgrade was necessary in order to keep their technologies operationally current in order to track phones that operate on 4G LTE licensed spectrum.
Why do Stingrays pose a risk to privacy?
Stingrays are extremely invasive: Armed with Stingrays, law enforcement can – without any assistance or consent from cell phone carriers – pinpoint a person’s location in the home, a place of worship or a doctor’s office, or conduct mass surveillance on people gathered in an area, whether for a protest, lecture or a party. Even when used to target a particular suspect, Stingrays sweep up information about innocent individuals who happen to be in the vicinity.
We have a lot of questions about local government use of Stingrays: How often are these devices used? Are there any policies restricting their use? Are local law enforcement agencies applying for warrants to use these devices? Are they describing the technology accurately in the applications? What happens to the data on innocent people that are scooped up by the Stingrays?
What do we know about privacy protections in place when New York law enforcement uses Stingrays?
Unfortunately very little.
The New York State Police stated in response to the NYCLU’s FOIL request that it had no records on the following:
- Policy documents relating to the use of Stingrays
- Guidance on when a warrant or other legal process must be obtained
- Communications or agreements with wireless service providers
- Communications or agreements with the Federal Communications Commission or the New York State Public Service Commission
- Records reflecting the number of investigations in which Stingrays were used
- Applications to court for the use of Stingrays
This leaves us puzzled. Either the $200,000 device is just sitting around somewhere without being used or the agency is using the device without creating and maintaining records.
The NYCLU was forced to sue the Erie County Sheriff’s Office in order to obtain any records responsive to its FOIL request. On March 17, 2015, the court in Buffalo, where we brought the action, concluded that the Sheriff’s Office had “no reasonable basis for denying access” to the records sought by the NYCLU. The court ordered disclosure of all existing records requested by the NYCLU, including purchase orders, a letter from the Stingray’s manufacturer, a confidentiality agreement between the Sheriff’s Office and the FBI, a procedural manual, and summary reports of instances when the device was used.
These records confirm some of the very worst fears about local law enforcement’s use of expensive and intrusive surveillance equipment. The Erie County Sheriff’s Office used very few privacy protections around the use of Stingrays, and it promised breathtaking secrecy in its confidentiality agreement with the FBI – including agreeing not to disclose information about the device to courts without prior written consent of the FBI. Particularly troublingly, the Sheriff’s Office agreed to try to dismiss prosecutions at the request of the FBI if it appeared that information about the device might be revealed.
Specifically, the records reveal that:
- The Sheriff’s Office used Stingrays at least 47 times between May 1, 2010, and October 3, 2014, including to assist other law enforcement departments like the Monroe County Sheriff’s Office. It appears that the office only obtained a court order in only one of those 47 circumstances, in October 2014, and even in that case it was not a warrant but a lower level court order (called a “pen register” order). This contradicts what the sheriff said to a local reporter and undermines what he said to the legislature – that this device is being used subject to “judicial review.”
- The confidentiality agreement with the FBI requires the Sheriff’s Office to maintain almost total secrecy over Stingray records, including in court filings and when responding to court orders, unless the Sheriff’s Office receives the written consent of the FBI. This agreement is shocking in its explicit instruction to avoid transparency, going so far as to instruct the Sheriff’s Office to seek FBI approval before being forthcoming to courts.
- The confidentiality agreement with the FBI further instructs the Sheriff’s Office, upon request of the FBI, to seek dismissal of a criminal prosecution in lieu of making any possibly compromising public or even case-related revelations of any information concerning a Stingray or its use. To the extent that this power lies with the district attorney, the agreement requires the district attorney to sign on. We question the wisdom of spending more than $350,000 on various Stingray equipment if criminal cases in which Stingrays are used might have to be dismissed.
Update (May 14, 2015): According to an additional set of records released, the New York State Police has spent over $640,000 on purchasing and maintaining Stingrays. In 2012-13, the State Police purchased upgrades to the equipment called Hailstorm and Harpoon. According to news reports, Harpoon is an “amplifier” that can augment the surveillance capacity of Stingrays. Hailstorm is another upgrade that can be used to enhance Stingrays’ capabilities, although few details about it are in the public domain. Despite actively purchasing upgrades and providing officers with training, the State Police continues to claim that it has no policy documents on the use of Stingrays or any records on the number of times that Stingrays have been used.
Update (May 2016): The RPD uses its Stingray surveillance technologies surreptitiously. Like other New York law enforcement agencies, the RPD signed a nondisclosure agreement with the FBI. The RPD’s surveillance policies instruct officers using their vehicle mounted KingFish system to avoid exiting the vehicle or expose their identity as law enforcement officers “under any circumstances other than an imminent threat of injury to officers or civilians.”
The RPD’s records indicate that they used the KingFish 13 times between January 2012 and May 2015. The RPD sought and received legal authorization approximately 69% of the time they used their KingFish platform:
- The RPD acquired a state issued search warrant 6 times.
- The RPD acquired a lower level federal court order 3 times under 18 USC § 2703.
- The RPD used the KingFish without legal authorization 4 times: 3 uses were based on consent from someone cooperating with the police; 1 use was based on exigency, defined in RPD policy documents as “involving an imminent threat to the life or safety of any person or a significant unanticipated enforcement or investigative opportunity that must be acted on quickly.”
It appears based on grant documents that the KingFish technology was meant to augment intelligence gathering on alleged gang members in Rochester by a consortium of Monroe County law enforcement agencies. According to their DCJS Byrne JAG grant application, the RPD acquired the KingFish platform to “remotely identify cell phone numbers used by gang members, and, after obtaining proper court orders, track the cell phone...This would significantly enhance RPD[’]s ability to investigate and prosecute gang conspiracies.” While some judicial authorization is better than none, these records raise some concerns about oversight: why doesn’t the RPD seek a search warrant in each and every instance of their Stingray use?
What does RPD do with the information they acquire (intentionally or otherwise)? Although an RPD policy document suggests that the RPD keeps the records they intentionally acquired through Stingray use for a minimum of ten years, they at least destroy or seal the material they acquire inadvertently.
What legal process should law enforcement follow when using Stingrays? (Updated September 15, 2015)
According to our analysis of New York statutory and constitutional law, existing law requires law enforcement to obtain a warrant before using Stingrays. In fact, in most circumstances New York law is clear that law enforcement should be obtaining an eavesdropping warrant – a special type of warrant that comes with heightened privacy protections to ensure that law enforcement is not engaging in unnecessary and unjustified surveillance.
Given the invasive nature of Stingrays, law enforcement should comply with the heightened requirements of an eavesdropping warrant every time it chooses to use the technology. That’s why the NYCLU enthusiastically supported a bill (A.8055) introduced by Assemblymember Sean Ryan in 2015 that would leave no doubt that law enforcement should be obtaining an eavesdropping warrant for all uses of Stingrays. We will continue to urge the State Legislature to make clear that Stingray use must be governed by the stringent eavesdropping warrant procedures of New York law.
New York State Police
2014-06-17 FOIL Request
2014-10-02 FOIL Response with Purchase Order
2015-01-09 FOIL Appeal Response with Terms and Conditions
Letter from FBI to Harris Corporation re New York State Police Stingray Purchase
Erie County Sheriff’s Office
2014-06-16 FOIL Request
2014-07-06 FOIL Response
New York Police Department (NYPD)
2015-04-13 FOIL Request
2015-10-30 FOIL Response
2016-02-04 FOIL Appeal Response
2016 Rochester Police Department (RPD)
Documents regarding KingFish/Stingray acquisition through New York State’s DCJS’s Byrne JAG grants and through Operation IMPACT VII funding:
Harris Corporation contracts, invoices, and marketing materials:
1 New York State Police FOIL Response: 2005-03-11 State of New York Purchase Order.
2 Erie County Sheriff’s Office: Purchase Records.