Cell-site simulator policy approved by Oakland Privacy Commission

The Oakland Privacy Commission approved the city’s first cell-site simulator policy on Thursday night during a special meeting at City Hall, clearing the way for the City Council and the Public Safety Committee to give it a final stamp of approval.

Oakland is one of the first cities in the country to create such a comprehensive policy for the cell-site simulator, also known as a Stingray or Hailstorm. Used by law enforcement during investigations, these devices pose as a cell tower and trick phones into giving up information, like a cell phone user’s location. They can also intercept communications.

“I think this is a model policy and the amount of public discussion we’ve had here is remarkable,” said policy activist Mike Katz-Lacabe during the public comment period at the meeting.

Thursday’s vote comes after months of debate over how and when the Oakland Police Department should be allowed to use the Stingray and its upgraded version, the Hailstorm.

Law enforcement around the country have been using the surveillance technology without public knowledge for years, but local governments and the public have been increasingly concerned about potential violations of privacy and civil liberties. Oakland began its work on a policy after the California State Senate passed a law last October requiring police departments to publish a privacy policy before using the powerful devices. The Oakland Police Department (OPD) had been using a Stingray since 2006, but it halted its use when the law passed.

The city’s new policy addresses those concerns by requiring the OPD to compile annual reports on each use of the Stingray and obtain warrants for every deployment. It also scales back use-case scenarios and massively restricts what information can be collected and stored.

Earlier this month, the commission held a public meeting with Darren Allison, OPD deputy chief, and Tim Birch, OPD’s head of research and planning, to review a draft of the policy. The commission and Birch had expected to approve the policy at that time, but the decision was delayed by new concerns about the way Stingray could intercept communications and store information.

The updated policy draft now incorporates the commission’s concerns by limiting the software functions that can be used so as to prevent the device from collecting data from cell phones belonging to bystanders.

Brian Hofer, chairman of the commission, said he was very pleased by how Birch had addressed the commission’s questions.

“They were very responsive,” Hofer said after Thursday’s meeting. “I was very satisfied that they built in a lot of the transparency metrics, and they tightened up weaknesses we saw in the language.”

One of the commission’s previous concerns about the policy had been a non-disclosure agreement that existed between the OPD, the Stingray’s manufacturer Harris Corp., and the FBI. Hofer says the agreement is now a federal question.

“It’s out of Oakland’s control,” he said.

The civilian-led commission that oversaw the policy was launched last January to address the public’s privacy concerns. It was formed after city council heeded concerns from the Oakland Privacy Working Group, a citizens’ rights group, over the city’s use of surveillance technology.

Hofer said the new policy is just the beginning, and the commission intended to continue to monitor the device’s use closely. He added that they would amend the policy if it became necessary.

“We may make the policy look completely different next year based on the data that we gather, but until we have that data telling us something different, I think our policy is really good,” he said.