California cops, want to use a stingray? Get a warrant, governor says

On Thursday, California Governor Jerry Brown signed a bill into law that requires police get a warrant to use a stingray during investigations. The devices, which are also known as cell-site simulators, are usually used to locate a phone but can also in some cases intercept calls and text messages.

The law, known as the California Electronic Communications Privacy Act, imposes other sweeping new requirements to enhance digital privacy, and imposes a warrant requirement before police can access nearly any type of digital data produced by or contained within a device or service.

"Governor Brown just signed a law that says ‘no’ to warrantless government snooping in our digital information. This is a landmark win for digital privacy and all Californians," Nicole Ozer, a lawyer with the American Civil Liberties Union of California ACLU, said in a statement. "We hope this is a model for the rest of the nation in protecting our digital privacy rights."

The ACLU of California was one of the organizations, in addition to tech companies including Google, Airbnb, Apple, Facebook, that co-sponsored the bill.

Notably, the law specifically says that the government is forbidden from "accessing electronic device information by means of physical interaction or electronic communication with the device," barring a short list of exceptions.

California is by no means the first state to impose such a requirement, but as the most populous state it the union, it will surely have an outsized effect. Others states that already have similar laws include Washington, Virginia, Minnesota, and Utah.

Ars contacted several law enforcement agencies across the Golden State to see how this would change their policies, but has not immediately heard back.

Brian Owsley, a law professor at the University of North Texas, and a former federal judge, lauded the new law's wide berth.

"This legislation provides citizens and non-citizens alike when in California greater protections than they enjoy at the federal or in most other states," he told Ars by e-mail.

"My initial read of the statute is such that it has a broad scope of coverage, which is beneficial in that it does not apply to specific technologies. In the future, as technological developments happen, the statute will have some flexibility in changing with the times. This obviates the need to come back next year and amend the statute, which may or may not be as politically feasible regarding a specific new technology."

No more pen registers

Prior to Thursday, California law enforcement would typically use a stingray using the legal authority of a "pen register and trap and trace order," a pre-cellphone-era order that let cops obtain someone's calling metadata in near real-time from the telephone company.

Now, that same data can also be gathered directly by the cops themselves over the air through the use of a stingray. In some cases, police have gone to judges asking for such a device or have falsely claimed the existence of a confidential informant while in fact deploying this particularly sweeping and intrusive surveillance tool.

Most judges are likely to sign off on a pen register application not fully understanding that police are actually asking for permission to use a stingray. Under federal law, pen registers are granted under a very low standard: authorities must simply show that the information obtained from the pen register is "relevant to an ongoing criminal investigation."

That is a far lower standard than being forced to show probable cause for a search warrant or wiretap order. A wiretap requires law enforcement to not only specifically describe the alleged crimes but also to demonstrate that all other means of investigation had been exhausted or would fail if they were attempted.

California doesn’t actually have a specific pen register statute—a pen/trap application template that Ars obtained from the Oakland Police Department under a public records request cites the federal statute. However, that practice goes against a 2003 opinion from the California Attorney General. The AG concluded that because California affords its citizens more privacy under the state constitution than does federal law, a state law enforcement officer cannot use a federal statute for a pen/trap order.

The law’s authors were understandably thrilled.

"For too long, California’s digital privacy laws have been stuck in the Dark Ages, leaving our personal emails, text messages, photos and smartphones increasingly vulnerable to warrantless searches," Senator Mark Leno (D-San Francisco), a state legislator, said in a statement.

"Senator Leno and I helped bridge the gap between progressives and conservatives to make the privacy of Californians a top priority this year," Sen. Joel Anderson (R-San Diego County) added in the same statement. "This bipartisan bill protects Californians’ basic civil liberties as the Fourth Amendment and the California Constitution intended."