Details of a cell phone spying tool that federal law enforcement have tried to keep secret for years will be made slightly more public after the Department of Justice adopted a new policy Thursday aimed at addressing privacy concerns.
Cell-site simulators, or more commonly known by their industry name of "Stingray," are devices that mimic mobile phone towers and trick phones nearby to connect to the device, effectively delivering the exact location of all cellular phones trapped by it.
But exactly how the devices work, how much information it can extract from cell phones, or how often law enforcement agencies have deployed them has remained a closely guarded secret. Local and federal law enforcement agencies have not only tried to keep details of the device out of public sight, but away from the scrutiny of judges in criminal trials.
On Thursday, the Department of Justice tightened its policy on the use of the cell-site simulators, including requiring a search warrant to be filed, supported by probable cause, in court before the device is used.
The decision comes as the devices, manufactured by Florida-based Harris Corporation, have become more commonly used by state and local law enforcement agencies. The Department of Justice's policy, however, would not apply to local departments.
The decision was applauded, though with caveats, as a step toward transparency by civil rights advocates and legislators that have aired concerns about the technology.
"The Department of Justice's new policies are finally starting to catch up with the rapid advancement of this tracking technology," Sen. Patrick Leahy (D-Vt.) told BuzzFeed News in a statement. "Today's announcement is a welcome step forward, and has the potential to bring transparency and consistency."
But critics, including the American Civil Liberties Union, point out there are still loopholes in the new policy, including an undefined "exceptional circumstances" that allows use of the cell-site simulators without a warrant, and the fact that the policy does not apply to local police departments that have been using them more frequently in recent years.
The new policy also tries to address privacy concerns of mass collection of data, since the devices are believed to collect the information of all cell phones that are within range. Investigators are now required to track how frequently the devices are used, and to delete information of all other cell phones within one day after the suspected device is found.
"This new policy ensures our protocols for this technology are consistent, well-managed and respectful of individuals' privacy and civil liberties," Deputy Attorney General Sally Quillian Yates said in a statement.
It also prevents agencies like the FBI and DEA from collecting the contents of any communication, like texts, images, contacts and emails, with the devices.
Congressman Jason Chaffetz (R-Utah), chairman of the House Oversight Committee, also applauded the announcement as a move toward "increased transparency," but expressed concerns about exceptions to the policy, and the continued use of geolocation technology.
"Establishing a high uniform standard helps protect personal privacy and discourages abuse and mishandling of these powerful devices," Chaffetz said in a statement. "DOJ should continue to produce information — including the Jones memos — to help Congress and the public understand how the federal government tracks people."
The ACLU, which has sued local law enforcement for information about their use of the technology, said in a written statement that although encouraging, the new policy doesn't apply to all federal law enforcement agencies, nor to local departments.
"Disturbingly, the policy does not apply to other federal agencies or the many state and local police departments that have received federal funds to purchase these devices," Nathan Freed Wessler, staff attorney for the ACLU, said in a statement.
Documents obtained by BuzzFeed News show local law enforcement agencies have purchased the devices at a cost of about $400,000 to $500,000 — with some, like the Long Beach Police Department — asking for specific alterations.
Those specifics changes were redacted in documents obtained by BuzzFeed News.
And though departments often cite terrorism prevention and homeland security to spend hundreds of thousands of dollars for the devices, and tens of thousands for software upgrades, they are often used for regular investigations.
The Los Angeles County Sheriff's Department, for example, used the device five times in 2011. The following year, it was used 44 times.
By 2014, the device was deployed 104 times.
From 2011 to June 18, 2015, the department has used cell-site simulators a total of 323 times.
Sgt. James Corrigan told BuzzFeed News the department does not track what types of crimes the device is used for.
In Baltimore, the public defender's office was set to review nearly 2,000 cases after learning police used the controversial device without notifying defense attorneys.
The review came after the Baltimore Sun reported that police used the device thousands of times since purchasing a cell-site simulator from Harris Corporation.
One Baltimore Police detective was threatened with contempt by a judge when he refused to reveal details of the device during a robbery case, citing the non-disclosure agreement with the FBI.
Local departments are required to sign the non-disclosure agreements before beginning the purchase, and some departments have also decided to drop criminal cases instead of talking about the Stingrays.
That includes not telling anyone about the technology in "press releases, in court documents, during judicial hearings," according to the agreement signed by the Anaheim Police Department and obtained by BuzzFeed News.
The FBI also prohibits local departments from mentioning it in court, even if it is being asked to disclose evidence in a criminal proceeding.
"If the Anaheim Police Department learns that a District Attorney, prosecutor, or a court is considering or intends to use or provide any information concerning the Harris Corporation wireless collection equipment/technology (...) Anaheim Police Department will immediately notify the FBI in order to allow sufficient time for the FBI to intervene."
In Tallahassee, a judge ordered police to reveal information about the Stingray used in a robbery involving a BB gun and $130 of pot. Instead of talking about the technology, authorities offered the defendant a plea deal.
That, Wessler said, is an exception that must be closed.
"The Justice Department must close these loopholes, and Congress should act to pass more comprehensive legislation to ensure that Americans' privacy is protected from these devices and other location tracking technologies."