StingRay Cell Phone Tracking and the Fourth Amendment

Cellphones can reveal an extraordinary amount of information about where a person goes, where a person lives, and with whom a person associates.

Federal law enforcement agencies have used devices commonly known as StingRays to locate cellphones with far greater precision than traditional cell-tower records may provide.

A StingRay is a type of cell-site simulator. Instead of obtaining historical location records from a cellphone company, law enforcement deploys its own equipment that acts like a cellphone tower and causes nearby phones to communicate with it.

That technology raises significant Fourth Amendment questions.

In United States v. Lambis, 197 F. Supp. 3d 606 (S.D.N.Y. 2016), a federal court suppressed evidence after DEA agents used a cell-site simulator without a warrant authorizing that technique to pinpoint a cellphone inside a particular apartment.

Two years later, the Supreme Court’s decision in Carpenter v. United States, 585 U.S. 296 (2018) provided additional constitutional protection for cellphone location information, holding that the government’s acquisition of historical cell-site location information in the circumstances before it constituted a Fourth Amendment search requiring a warrant supported by probable cause.

Federal criminal defense attorney Michael J. Petro has more than 35 years of criminal defense experience representing individuals in federal criminal investigations and prosecutions, including cases involving search warrants, electronic surveillance, cellphone evidence, and motions to suppress.

What Is a StingRay?

“StingRay” is a commonly used name for a cell-site simulator.

Other names for this technology have included Hailstorm and TriggerFish.

A cell-site simulator operates by imitating a legitimate wireless carrier’s cell tower. Cellphones in the area may communicate with the simulator because they perceive it as part of the cellular network.

Law enforcement can use information generated through those communications to locate a target cellphone.

In Lambis, the technology allowed DEA agents to move from knowing that a cellphone was somewhere in a general neighborhood to identifying the particular apartment in which the phone was located.

That increased precision was central to the Fourth Amendment issue.

Cell-Site Simulators Are Different From Ordinary Cell-Tower Records

It is important to distinguish a cell-site simulator from cell-site location information, commonly called CSLI.

CSLI generally consists of records created and maintained by a wireless carrier as a cellphone connects with the carrier’s cell towers.

A cell-site simulator is different.

With a simulator, law enforcement deploys its own equipment and causes a cellphone to interact with that equipment.

The distinction can matter legally because the government is not simply requesting an existing business record from a third party. It is actively using surveillance technology to obtain information about the location of the target device.

United States v. Lambis

The DEA was investigating an international drug-trafficking organization when agents sought information concerning a particular cellphone.

Agents initially obtained judicial authorization for pen-register information and CSLI.

Using the CSLI, investigators determined that the target phone was generally located around 177th Street and Broadway in the Washington Heights area of Manhattan.

But the information was not precise enough to identify a particular apartment building or apartment.

The DEA wanted greater precision.

Agents therefore deployed a cell-site simulator.

The DEA Used the StingRay to Find the Apartment

A DEA technician went to the area identified through the CSLI and activated the cell-site simulator.

The device caused the target cellphone to communicate with the simulator.

By examining signal strength, the technician identified the building producing the strongest signal.

He then entered the apartment building and walked through the hallways while continuing to use the simulator.

Eventually, he determined which apartment was producing the strongest signal.

The government had gone from knowing that the phone was located somewhere in a neighborhood to identifying the particular apartment containing the device.

That distinction was constitutionally significant.

The Existing Warrant Did Not Authorize the StingRay Search

The government had previously obtained judicial authorization relating to CSLI.

But that did not automatically authorize the DEA to use a different surveillance technology to obtain substantially more precise information.

The Lambis court concluded that use of the cell-site simulator was not contemplated by the original warrant application.

The court explained that when law enforcement exceeds the scope of a valid warrant, the additional search is not automatically constitutional merely because some judicial authorization already existed.

The government could have sought a warrant specifically authorizing use of the cell-site simulator.

It did not.

The Fourth Amendment Protects the Home

The fact that the StingRay identified a cellphone inside a particular home was especially important.

The home receives the highest level of Fourth Amendment protection.

The government ordinarily cannot use technology to obtain information about the interior of a home that it could not otherwise obtain without a physical intrusion and then avoid constitutional scrutiny merely because officers remained outside while obtaining the information.

The Lambis court compared the StingRay surveillance to the Supreme Court’s decision in Kyllo v. United States, 533 U.S. 27 (2001).

Kyllo v. United States

In Kyllo, federal agents suspected that marijuana was being grown inside a home.

From outside the residence, investigators used a thermal-imaging device to measure heat emanating from the house.

The Supreme Court held that the government’s use of technology not in general public use to explore details of the home that previously would have been unknowable without physical intrusion constituted a Fourth Amendment search.

That principle was important in Lambis.

The StingRay allowed DEA agents to determine something they previously did not know:

The target cellphone was inside a specific apartment.

The court concluded that the government needed appropriate Fourth Amendment authorization before using the technology to obtain that information.

The Evidence Was Suppressed

After identifying the apartment, DEA agents went to the residence.

The investigation ultimately resulted in the discovery of narcotics and other evidence.

Lambis moved to suppress.

The federal district court concluded that use of the cell-site simulator constituted a warrantless Fourth Amendment search and suppressed the evidence derived from that search.

The case became an important early decision concerning StingRay surveillance.

Carpenter v. United States Changed Cellphone Location Law

Two years after Lambis, the Supreme Court decided Carpenter v. United States.

Carpenter did not involve a StingRay.

Instead, the government obtained historical CSLI from Carpenter’s wireless carriers. Prosecutors acquired 12,898 location points covering 127 days without obtaining a traditional probable-cause search warrant.

The Supreme Court held that the government’s acquisition of those historical cell-site records constituted a Fourth Amendment search.

The Court further held that the government’s order under the Stored Communications Act—which required less than probable cause—was insufficient.

The government generally needed a warrant supported by probable cause.

Why Carpenter Matters to Cellphone Tracking

Carpenter recognized that cellphone location information is fundamentally different from many traditional business records.

A cellphone accompanies its owner almost everywhere.

As the Supreme Court recognized, cellphone location information can reveal a detailed record of a person’s physical movements.

That can potentially reveal visits to:

• Homes
• Medical offices
• Attorneys
• Religious institutions
• Political organizations
• Businesses
• Hotels
• Other sensitive locations

The Supreme Court therefore refused to apply the traditional third-party doctrine mechanically to the historical CSLI at issue in Carpenter.

Carpenter Does Not Directly Decide Every StingRay Case

It is important not to overstate Carpenter.

The Supreme Court expressly described its decision as narrow.

The Court did not decide the constitutionality of every form of real-time cellphone tracking, tower dump, or other surveillance technology.

A StingRay case therefore requires analysis of the particular technology used, what information was obtained, where the device was located, what judicial authorization existed, and the controlling precedent in the jurisdiction.

But Carpenter reinforces an important constitutional principle:

Highly revealing cellphone location information can receive Fourth Amendment protection even when technology rather than traditional physical surveillance produces the information.

DOJ Policy Generally Requires a Search Warrant

The Department of Justice adopted a policy requiring its federal law enforcement components generally to obtain a search warrant supported by probable cause before using a cell-site simulator in a criminal investigation.

The policy contains limited exceptions, including certain exigent or exceptional circumstances.

DOJ also states that cell-site simulators used under the policy may not be used to collect the contents of communications, such as emails, text messages, contact lists, or photographs stored on a phone.

This policy is important, but a DOJ policy and the Fourth Amendment are not identical.

A violation of an internal agency policy does not necessarily produce the same legal consequences as a constitutional violation.

Defense counsel should analyze both.

Does Police Use of a StingRay Always Require a Warrant?

The safest general answer is that federal law enforcement policy ordinarily requires a probable-cause warrant, and cases such as Lambis demonstrate the serious Fourth Amendment concerns created by warrantless use.

But constitutional analysis remains fact-specific.

Questions may include:

• Was there a warrant?
• What exactly did the warrant authorize?
• Did the warrant specifically disclose use of a cell-site simulator?
• What information did the simulator obtain?
• Was the phone located inside a home?
• How long was the surveillance conducted?
• Was the device used only to locate a known target phone?
• Did the technology interact with other phones?
• Did exigent circumstances exist?
• What did officers tell the issuing judge?
• Did law enforcement exceed the scope of the warrant?
• What circuit precedent controls?

The answers can determine whether suppression is available.

The Warrant’s Language Matters

The existence of a warrant does not end the Fourth Amendment analysis.

The defense should examine the actual warrant and supporting affidavit.

A warrant authorizing one form of cellphone information does not necessarily authorize every other form of electronic surveillance.

That was an important part of Lambis.

The DEA possessed authorization for CSLI, but the court concluded that the authorization did not contemplate the substantially more precise use of a cell-site simulator.

Defense counsel should compare exactly what the government asked permission to do with exactly what investigators actually did.

Particularity Can Be Important

The Fourth Amendment requires warrants to particularly describe the place to be searched and the persons or things to be seized.

Electronic-surveillance technology can create difficult particularity questions.

A StingRay may interact not only with the target cellphone but also with other devices in the surrounding area.

That raises questions concerning:

• Identification of the target device
• Geographic limitations
• Duration of surveillance
• Data collected from nontarget phones
• Data retention
• Minimization procedures
• Location precision
• Whether the surveillance entered constitutionally protected spaces

The particularity analysis should be based on the warrant actually issued and the technology actually deployed.

What Should Defense Counsel Look for in Discovery?

When cellphone-location evidence appears in a federal criminal case, counsel should determine how the government obtained it.

Terms appearing in reports or discovery may include:

• Cell-site simulator
• StingRay
• Hailstorm
• TriggerFish
• IMSI catcher
• CSLI
• Historical CSLI
• Real-time location information
• Precision location
• Pen register
• Trap and trace
• GPS information

The terminology matters because different technologies obtain different information and may have been authorized through different legal procedures.

Ask for the Underlying Warrant

A defense attorney should obtain and examine the warrant, application, affidavit, orders, returns, and related surveillance documents whenever possible.

Important questions include:

Did the affidavit tell the judge that a cell-site simulator would be used?

Did it explain how the technology operates?

What information did the government request authority to collect?

What minimization procedures were proposed?

Did the agents comply with the limitations imposed by the court?

Was information collected beyond the scope of the authorization?

The answers may provide the basis for a motion to suppress or other litigation.

Cellphone Evidence May Lead to Other Evidence

The constitutional importance of cellphone tracking may extend beyond the location information itself.

Suppose an allegedly unlawful StingRay search identifies a residence.

Agents then use that location to:

• Approach the residence
• Conduct surveillance
• Obtain consent
• Obtain another search warrant
• Seize drugs
• Recover firearms
• Locate a suspect
• Obtain statements

The defense may need to determine whether that later evidence was derived from the original allegedly unlawful search.

That is essentially what occurred in Lambis.

The StingRay was important because it led agents to the specific apartment where the subsequent investigation occurred.

The Exclusionary Rule and Fruit of the Poisonous Tree

When the government obtains evidence through an unconstitutional search, the defense may seek suppression under the exclusionary rule.

The issue may extend to evidence obtained as a consequence of the unlawful search—the concept commonly described as fruit of the poisonous tree.

But suppression is not automatic whenever a constitutional violation occurs.

The government may argue doctrines such as:

• Independent source
• Inevitable discovery
• Attenuation
• Good-faith reliance
• Consent
• Exigent circumstances

A suppression motion should therefore address not only the initial constitutional violation but also the government’s likely arguments for admitting the evidence anyway.

Consent After Electronic Tracking Can Raise Additional Questions

Investigators sometimes use electronic location information to identify a residence and then seek consent to enter or search.

The existence of consent does not necessarily eliminate every question about the earlier surveillance.

If allegedly unconstitutional tracking led police directly to the location where consent was obtained, the defense may examine whether the later consent sufficiently broke the causal connection with the earlier illegality.

That analysis is highly fact-dependent.

The timing, circumstances, intervening events, and nature of the original constitutional violation may all matter.

Cell-Site Simulator Evidence May Not Be Obvious

One practical problem is that the use of a StingRay may not always be immediately obvious from a police report.

The report may simply state that officers “located” a cellphone or “determined” that a suspect was at a particular location.

That makes the investigative chronology important.

If ordinary CSLI could locate a phone only within a relatively broad geographic area but officers suddenly identified a particular building or apartment, defense counsel should determine what investigative technique supplied the additional precision.

The answer may be significant to a Fourth Amendment challenge.

The Difference Between Location Evidence and Phone Contents

A cell-site simulator used for location purposes should also be distinguished from a search of the cellphone’s contents.

Searching stored data on a cellphone generally raises the separate principles addressed in Riley v. California, 573 U.S. 373 (2014).

A phone can contain:

• Text messages
• Emails
• Photographs
• Videos
• Internet history
• Applications
• Contacts
• Documents
• Location history
• Financial information

Different Fourth Amendment issues may therefore arise depending on whether law enforcement tracked the device, searched it, or did both.

Location Technology Continues to Change

The constitutional analysis of cellphone surveillance continues to develop because the technology itself changes.

Modern phones and wireless networks can potentially generate increasingly precise information.

Investigators may also obtain location evidence from sources beyond traditional CSLI, including applications, cloud services, advertising data, GPS data, and other digital records.

A defense attorney should therefore identify the specific technological source of the location evidence rather than treating all cellphone tracking as the same thing.

Challenging Cellphone Location Evidence

A potential motion to suppress cellphone location evidence should begin with the complete investigative timeline.

Counsel should determine:

1. What information did investigators initially possess?
2. What legal process did they obtain?
3. What surveillance technology did they use?
4. What information did that technology reveal?
5. Did the surveillance reveal information about a home or other protected location?
6. Did investigators exceed the scope of judicial authorization?
7. What evidence was subsequently obtained because of the tracking?
8. Does an exception to the warrant requirement apply?
9. Does the government claim good-faith reliance?
10. What controlling Supreme Court and circuit precedent applies?

The constitutional challenge should be built around the government’s actual investigative conduct.

Carpenter Reinforces the Privacy Interest in Cellphone Location Data

Carpenter adds another important principle.

The Supreme Court rejected the government’s argument that cellphone location records automatically lose Fourth Amendment protection simply because a wireless carrier possesses them.

The Court recognized the unique privacy implications posed by detailed cellphone location information and generally required a probable-cause warrant for the historical CSLI at issue in that case.

Together, Lambis, Kyllo, and Carpenter demonstrate why modern electronic surveillance must be evaluated under enduring Fourth Amendment principles even when the investigative technology is new.

Experienced Federal Search and Seizure Attorney

Michael J. Petro has more than 35 years of criminal defense experience representing individuals facing serious federal criminal investigations and prosecutions.

Cellphone location evidence can become critically important in federal cases involving drugs, firearms, fraud, conspiracy, and other offenses.

When the government uses cellphone tracking to identify a suspect’s movements or locate a residence, the defense should determine exactly what technology was used, what judicial authorization existed, whether investigators stayed within the scope of that authorization, and whether the evidence resulted from an unconstitutional search.

If federal agents used cellphone location information, a StingRay, a cell-site simulator, or other electronic surveillance technology in an investigation against you, contact federal criminal defense attorney Michael J. Petro to discuss whether the government’s search complied with the Fourth Amendment.