By Thomas Vogel

State lawmakers are working to prevent local law enforcement agencies conducting investigations from violating the privacy of Chicagoans. Any resident using a phone to place a call, send a text message or browse the web may be at risk.

“Stingrays,” refer to a broad category of so-called cell site simulator devices, which, when activated, collect electronic communication from phones by imitating an actual cellular tower. Government agencies throughout the United States, including the Chicago Police Department, use the devices.

“We have to put in basic guardrails,” State Senator Daniel Biss (9th) said. “If you let the horse out of the barn, it gets difficult to control very quickly.”

Crime-fighting agencies defend the controversial devices arguing the technology helps conduct surveillance, develop investigations and track suspects.

Privacy advocates like the American Civil Liberties Union of Illinois, however, contend the devices are too intrusive and jeopardize the sensitive information of thousands of people.

Representative Ann Williams (11th) sponsored the bill , which helps prevent abuse by law enforcement and institutes statewide regulations. Biss is spearheading a similar effort in the Senate.
If adopted, the Citizen Privacy Protection Act would require law enforcement agencies to get a warrant and explain to a judge specific details on how the device will be used and what information will be collected. The bill also requires a timeline for destroying any collateral information swept up during investigations.

“It’s kind of a blunt instrument,” said Bamshad Mobasher, a professor at DePaul University’s Center for Web Intelligence. “Even if you are after a particular, let’s say perpetrator or a particular person of interest you are actually capturing a lot more information and data, some from people who have nothing to do with that particular subject.”

How StingRays Work
• Small, shoebox-size device can placed almost anywhere like police cars or office buildings
• Device broadcasts strong cell signal
• Any nearby phones respond and connect to device
• Device installs malware and begins to track communication like texts, phone calls and browser history

Williams highlighted the bill’s bipartisan appeal and reiterated the importance of adopting regulations to keep pace with evolving technologies. Only four other states and a few federal agencies currently regulate Stingray-like devices, which are often small, metal boxes and can cost tens of thousands of dollars.

“It’s a very powerful technology. This is very urgent,” said Williams. “Whether you consider yourself liberal or conservative, you are interested in privacy.”

Although the debate over Stingray-like devices is similar to other surveillance technologies, like drones, Mobasher disputed a direct correlation. Drones, he said, have legitimate uses like filmmaking and product delivery.

“I’m not quite sure what would be a civilian use of this that would be appropriate at the moment,” Mobasher said. “You are talking about capturing, you know, information that is potentially private for lots and lots of people in a particular geographic location. Really, no one, at least constitutionally has the right to do that.”

Mobasher acknowledged the usefulness of the tool for law enforcement but mentioned that some oversight, which the bill provides, is necessary.

Daniel Rigmaiden, a privacy activist, who was indicted in 2008 of wire fraud and identity left, does not share Mobasher’s assessment. Although he described the bill as “solid on many fronts” in an email, Rigmaiden forecasted pushback from law enforcement.

“The way the bill is worded, law enforcement may just delete everything, claim to be following the bill, but with an ulterior motive of simply deleting the data to further hides details of the technology,” Rigmaiden said. “Deleting the non-target, third-party data is good, but deleting the data collected on the suspect is bad.”

Frank Giancamilli, a CPD spokesman, said the department could not comment and refrained from giving information regarding the number of devices currently in use, citing current law enforcement operations.

However, Cook County Judge Kathleen Kennedy recently ordered the CPD to release documents related to the department’s use of surveillance devices. Kennedy’s decision is the latest development in a suit brought by a local activist, Freddy Martinez, after a rejected Freedom of Information Act request. The CPD has 28 days to comply.

Martinez said the bill’s regulations are a positive step toward transparency but stressed the importance of holding agencies accountable for past uses of Stingray-like devices, too.

“I want to learn more about these devices before we begin to regulate them,” Martinez said. “They shouldn’t even have this stuff but they do.”