For at least six years, Howard police have used invasive cellphone surveillance devices that masquerade as fake cellphone towers. The devices, originally designed for the battlefield and federal intelligence and security agencies to hunt terrorists and kidnappers, have been used by local law enforcement with mixed success.
Cell site simulators, known by the product name Stingray, have attracted national public scrutiny and the attention of state lawmakers in response to mounting concerns about possible violations of Fourth Amendment privacy protections and indiscriminate, dragnet surveillance on innocent bystanders.
Absent consistent policies that regulate the use of the devices, privacy advocates and some state lawmakers are pushing for more oversight laws and transparency over how police use the technology, which allows police to determine the precise location of a cellphone and its owner.
The devices mimic cellphone towers and trick phones in an area to transmit their location and identifying information, gathering data indiscriminately on the phones of bystanders near the vicinity of a suspected target.
In Howard County, use of the device led to arrests in 21 percent of all cases each time the device was deployed between September 2011 and November 2016, gathering evidence that helped lead to 32 total arrests, three of them on drug-related cases, according to a surveillance log released to the Baltimore Sun Media Group. Police have also used them to investigate homicides, suicidal individuals and to develop wiretap investigations.
Howard police have spent at least $400,000 on cell site simulators since 2010, funded primarily through grants.
According to internal manuals released by The Intercept, an online news organization, one of the devices used by the police department was not recommended for release to non-U.S. forces. The county purchased a $39,236 hand-held device manufactured by Syndetix, a New Mexico-based company with clients like the National Security Agency.
To justify the purchase and use of $1,736 from the county's asset forfeiture funds, the head of the police department's vice and narcotics division pledged the device would have "an immediate effect on the outcome of cases throughout all branches of the department."
Capt. Dan Coon, head of the police department's criminal investigations bureau, said the devices are "absolutely effective" investigative tools regulated by internal controls. A spokeswoman for the police department said the devices are used primarily as a "location device" to find pre-identified targets, not for widespread searches.
Closing an investigation with arrests is sometimes not the goal when the device is deployed, Coon said.
"Sometimes, we're not necessarily looking to make an arrest when we locate the device at that time. Sometimes we're looking to further an investigation for a particular location," Coon said.
According to the log, Howard police did not request court orders to use the surveillance technology 56 percent of the time they used the devices. In those cases, law enforcement determined the cases were "exigent" — a classification that, by law, allows police to circumvent constitutional warrant requirements in emergencies.
Although several cases involved suspected suicidal individuals, missing phones and at least three threats to public officials, some cases appear to not truly fit the standard of exigency.
For example, in February 2012, police tracked the phone of an individual who failed to appear in court for a sex offense-related charge.
The phone they tracked to Dundalk, a small Baltimore County community, belonged to the mother of the suspect.
"In many of these cases, there is ample reason to believe there was no exigency at all. Failure to appear in court is clearly not exigent," said David Rocah, a senior staff attorney for the ACLU of Maryland.
Without responding to specific cases, Coon said there are multiple reasons that determine why a device may have been used. In several cases, the devices were deployed on missions to develop targets — with no specified target being sought, according to the log. One instance led police to an eight-story residential high-rise building in Washington to track a suspect related to a robbery in November 2014.
In October 2013, law enforcement sought information for a wiretap case related to a drug-related investigation — with the loose assurance they had a "possible number" for the main target.
In another case in November 2015 at a redacted location, law enforcement tracked a person suspected in a series of carjackings and robberies at a motel "through a concrete wall," according to the log.
Law enforcement officers usually did not obtain court orders when investigating drug-related offenses. Coon said the tool is especially useful in those cases because potential dealers often go by street names and police can attempt to find a suspect at his or her residence or area of business.
The use of devices in circumstances deemed exigent by law enforcement led to roughly the same number of arrests as when the devices were deployed using court orders.
Internal controls and oversight are built-in to ensure the devices are used with accountability and controls, according to the police department.
In March last year, the police department mandated all officers include a supplemented report in police reports detailing when, why and how the device was used, Coon said.
"There's always going to be oversight any time we deploy the device," he said.
In order to add that layer of oversight, staff at the Howard County State's Attorney office often conduct a preliminary review of requests for court orders and search warrants, said Kim Oldham, Deputy State's Attorney for Howard County.
The devices have some advocates concerned about possible violations of the Fourth Amendment, especially since state laws governing how police can use the devices without violating private rights came into effect less than three years ago.
It wasn't until 2014 when state lawmakers passed a bill that requires law enforcement to seek court orders based on probable cause to conduct real-time tracking, requiring a higher burden of proof than other orders that rely purely on the justification information may be relevant to an ongoing investigation.
The law required police to obtain a court order even under "exigent" circumstances after 48 hours.
A landmark ruling by Maryland appellate court last year required police to establish probable cause and obtain a warrant before using a cell site simulator, and rejected a lower court's argument anyone turning on a phone "voluntarily" shared their whereabouts.
When needed, Coon said the police department has always sought court-orders based on probable cause, which he said is necessary to grab location information necessary to use the equipment.
At least 72 agencies in 23 states own cell site simulators, according to the ACLU. Some have gone to great lengths to withhold information from the public and courts, according to multiple news reports. Unlike other jurisdictions, Howard County has no non-disclosure agreements regarding the devices, according to the police department.
Still, much remains unknown.
The extent of the surveillance dragnet and whether or not the devices are capable of intercepting cellphone communications is not entirely clear.
The police department declined to disclose training materials, policies and other documentation that detail use of devices, regulations, internal controls, the retention of data, the deletion of data and other specifications.
In purchase orders requested by the Baltimore Sun Media Group, the police department redacted all information about the device's technical capabilities — noting that public disclosure could "facilitate in the planning of a terrorist attack."
The police department does not use the devices for crowd monitoring, does not retain third-party data, "generally" stores data germane to specific investigations and does not retain location data "in no event" for longer than 30 days, a spokeswoman for the police department wrote in a statement.
Still, absent written documentation, privacy advocates argue the police should disclose policies to ensure accountability, oversight and transparency.
Absent comprehensive federal guidelines, states and local law enforcement agencies have adopted a hodgepodge of polices. No national laws govern the use of devices by local and federal law enforcement.
"It's all well and good to say that we would never misuse this information. But there's no way for the public to have oversight unless there are actual policies — and we can read what those policies are," said Stephanie Lacumbra, a criminal defense attorney with Electronic Frontier Foundation, a digital rights nonprofit organization.
In December, the U.S. House Committee on Oversight and Government reform called for individual states to enact legislation that explicitly governs how law enforcement use cell-site simulator technology and more oversight on the local level.
Despite protections in state law and the landmark court decision, Rocah said the legislature has abdicated on its responsibility to make sure comprehensive and consistent policies are in place for how the police use these devices.
"People need to understand these are not targeted surveillance devices and given the way in which law enforcement has played fast and loose with this technology in the past, grand assurances that everything si fine really doesn't cut it," Rocah said.
A state bill in the Senate to add additional requirements for applications, court orders and information obtained from cell site simulators was withdrawn by the sponsor this year after an unfavorable committee report.
In Howard County, Oldham said it is rare to see court cases that involve its use.
"We haven't had very many cases where it's been involved in the actual prosecution," Oldham said.
The police department discloses the use of the devices as an investigative technique during the discovery process in the event there is a motion to suppress evidence, she said.
Funding for cell site simulators has passed through federal grants for jurisdictions throughout the state, including Anne Arundel county, through federal grants. In Baltimore City, police have used the devices at least 4,700 times since 2007 — a number that far exceeds the 150 times Howard police have used the technology.
Although Howard police justified the initial purchase of some surveillance devices in an application for a federal grant as being necessary to "promote free-flowing information exchange among all regional homeland security agencies" and to "identify the risk and prevent terrorism," the devices instead are almost always in routine criminal investigations, according to grant applications from 2009 through 2016.
The language in the county's grant application does not limit how local law enforcement can use the equipment, Coon said.
"Some of our investigations do involve local investigations and threats to public officials or just threats of mass destruction," he said. "In some cases, [the investigation] may not be necessarily 'terrorism-specific,'" he said.
Howard County Times: Top stories Newsletter
Daily highlights from Howard County's number one source for local news.
Not one case explicitly referenced terrorism in the log.
Coon stressed it was inaccurate to assert police ride around in patrol cars and collect cellphone information "out of the airwaves."
He compares the police department's use of cell site simulators, which grab each phone's unique identifier, to a license plate on a car. Without a court order, local police can do little with information grabbed from the devices, just as police can only glean information if they run a license plate through their system.
"All of this is done under the strict scrutiny and supervision of the court system …" he said. "It's similar to when an office sees someone's registration plate on a car. We don't know who that plate belongs to until we're able to run it," he said.
"A license plate is something you can see in public, but it does not follow you into your private spaces. It's restricted. They can't follow you into your home. Just because you happen to be near or around someone suspected of a crime doesn't mean you lose your own privacy interests," she said. "There's a whole host of truly intimate details that can be revealed just from tracking someone's day-to-day location. Your handset shouldn't be used as a GPS tracker."