Cell-site simulator policy approved by Oakland Privacy Commission
on October 24, 2016
The Oakland Privacy Commission approved the city’s first cell-site simulator policy on Thursday night during a special meeting at City Hall, clearing the way for the City Council and the Public Safety Committee to give it a final stamp of approval.
Oakland is one of the first cities in the country to create such a comprehensive policy for the cell-site simulator, also known as a Stingray or Hailstorm. Used by law enforcement during investigations, these devices pose as a cell tower and trick phones into giving up information, like a cell phone user’s location. They can also intercept communications.
“I think this is a model policy and the amount of public discussion we’ve had here is remarkable,” said policy activist Mike Katz-Lacabe during the public comment period at the meeting.
Thursday’s vote comes after months of debate over how and when the Oakland Police Department should be allowed to use the Stingray and its upgraded version, the Hailstorm.
The city’s new policy addresses those concerns by requiring the OPD to compile annual reports on each use of the Stingray and obtain warrants for every deployment. It also scales back use-case scenarios and massively restricts what information can be collected and stored.
Earlier this month, the commission held a public meeting with Darren Allison, OPD deputy chief, and Tim Birch, OPD’s head of research and planning, to review a draft of the policy. The commission and Birch had expected to approve the policy at that time, but the decision was delayed by new concerns about the way Stingray could intercept communications and store information.
The updated policy draft now incorporates the commission’s concerns by limiting the software functions that can be used so as to prevent the device from collecting data from cell phones belonging to bystanders.
Brian Hofer, chairman of the commission, said he was very pleased by how Birch had addressed the commission’s questions.
“They were very responsive,” Hofer said after Thursday’s meeting. “I was very satisfied that they built in a lot of the transparency metrics, and they tightened up weaknesses we saw in the language.”
One of the commission’s previous concerns about the policy had been a non-disclosure agreement that existed between the OPD, the Stingray’s manufacturer Harris Corp., and the FBI. Hofer says the agreement is now a federal question.
“It’s out of Oakland’s control,” he said.
The civilian-led commission that oversaw the policy was launched last January to address the public’s privacy concerns. It was formed after city council heeded concerns from the Oakland Privacy Working Group, a citizens’ rights group, over the city’s use of surveillance technology.
Hofer said the new policy is just the beginning, and the commission intended to continue to monitor the device’s use closely. He added that they would amend the policy if it became necessary.
“We may make the policy look completely different next year based on the data that we gather, but until we have that data telling us something different, I think our policy is really good,” he said.
Oakland North welcomes comments from our readers, but we ask users to keep all discussion civil and on-topic. Comments post automatically without review from our staff, but we reserve the right to delete material that is libelous, a personal attack, or spam. We request that commenters consistently use the same login name. Comments from the same user posted under multiple aliases may be deleted. Oakland North assumes no liability for comments posted to the site and no endorsement is implied; commenters are solely responsible for their own content.
Oakland North is an online news service produced by students at the UC Berkeley Graduate School of Journalism and covering Oakland, California. Our goals are to improve local coverage, innovate with digital media, and listen to you–about the issues that concern you and the reporting you’d like to see in your community. Please send news tips to: firstname.lastname@example.org.