Share This article

The DOJ has issued new guidelines governing stingray use that bring such deployments into marginally better alignment with fundamental civil rights — but there are some significant limitations to the new policies as well. First, the good news: The new recommendations specifically state that these devices are to be used in a matter that is “consistent with the requirements and protections of the Constitution, including the Fourth Amendment…[and] including the Pen Register Statute.”

The seven-page document then details the basics of how stingray devices operate and notes that such devices must be configured to act as simple pen registers, meaning they collect only metadata about contacted numbers and durations of a call, not text messages, IMs, emails, or the actual contents of a phone conversation. The exact capabilities of stingrays is shrouded in enormous amounts of secrecy thanks to the mandatory NDAs that cloak their operation. The report states that warrants are now required for the use of a stingray, which law enforcement must properly represent to a judge that stingray access is being sought, and that explains how the data will be handled and deleted following the conclusion of the investigation.

These basic concerns have been largely left to patchwork policies that, intentionally or not, largely boiled down to “Whatever the individual agent thinks is appropriate.” Just as with license plate scanners, there’s been no insight into how long data was being kept, how that data was used, or what information was being gathered. (For example, license plate readers obviously read license plates, but may or may not cross-reference that information with other facts about the driver and share it with third-party companies or other law enforcement offices.)

As Techdirt points out, there are many qualifications to this step. It only applies to federal cases, it’s a policy and guidelines paper as opposed to a binding legal document, and it doesn’t apply to state or local officials who remain free to operate in any mode they choose. This was hammered home earlier this week, when the Indiana state police refused to turn over information related to stingray use and the Harris corporation’s restrictive NDAs.

According to the Indiana State Police, the information was refused because disclosing information about the FBI’s use of stingrays or the NDAs in question could “threaten public safety by exposing or disclosing detailed information related [to] the functioning and capabilities of equipment and programs the Department possesses to prevent, mitigate, or respond to an act of terrorism… or agricultural terrorism.”

I haven’t lived in Indiana for a few years, but I grew up there and spent the first 32 years of my life in various parts of the state or immediately across the Ohio river, in Louisville, KY. I would like to take a moment to reassure everyone that Indiana does not suffer from an abundance of would-be ISIS recruits or fiendishly crafty militants out to steal our precious bodily fluids corn and soybeans.

The discrepancy between these policies points to the need for coherent reform, uniform best practices, and consistently applied rules of conduct for the use of stingray devices across local, state, and federal jurisdictions. No one is denying these devices can provide police with vital information under the right circumstances. In certain cases, a stingray could conceivably save lives or prevent disaster. The current status quo, however, gives far too much power to officials who have shown far too much willingness to misrepresent the technology to achieve their own ends.