Alameda County becomes first in state to regulate cellphone surveillance tool

Alameda County on Tuesday became the first county in California to regulate a controversial cellphone surveillance technology that police around the country, including Oakland, have used for years with little scrutiny.

The Board of Supervisors also voted unanimously to approve county District Attorney Nancy O’Malley’s purchase of the device, called a cell-site simulator, which law enforcement can use to track mobile phones. The board had postponed its decision until it could approve guidelines for using the device that addressed civil liberties concerns.

At the board meeting on October 13, discussions about the surveillance device became heated over those concerns. But this time O’Malley’s office headed off objections by consulting local privacy advocates on what the guidelines should say. The result was a congenial and perfunctory meeting.

At one point during Tuesday’s meeting, Supervisor Nate Miley (District 3) drew some sighs from the handful of assembled privacy advocates when he asked O’Malley if the device could have helped during Friday’s attacks in Paris, France, which killed 129 and wounded more. O’Malley avoided the question’s national security and civil liberties implications. She said the equipment possibly could have helped find a missing person’s cellphone if the manufacturer or family provided authorities with a unique subscriber code from it.

Cell-site simulators have stirred controversy nationwide. It works by imitating a cellphone tower to get mobile phones within range to connect with it. In the process, it harvests unique subscriber codes from every phone caught in its net. This allows police to find the codes of phones they’re looking for, which they can then ping to track their movements.

“It helps to locate dangerous suspects, as well as victims of crime, and victims of natural disaster,” Teresa Drenick, an assistant district attorney for Alameda County, wrote in an email before the meeting. O’Malley’s office didn’t respond to emails seeking comment after the vote.

But privacy advocates and experts say the technology is too powerful and police departments are too secretive about how they’re used. They say it can be intrusive and indiscriminate because it records the locations of every connected phone, including those of people not linked to a police investigation, and some models can record phone calls and other information sent from connected cellphones.

At Tuesday’s meeting, Brian Hofer, a member of the Oakland Privacy Working Group, a surveillance watchdog organization, thanked the district attorney and supervisors for working with him and other advocates to address their privacy concerns. Minutes before the meeting was called to order, he and the DA worked together on a final element of the policy, in which she said she would produce annual reports documenting how, when and for what purpose her office used the device.

“Transparency is best,” Hofer told supervisors. “It’s going to help us build trust.”

According to the policy released last week by the district attorney, her office will manage the new device, known by its brand name, Hailstorm. The police will only be allowed to deploy it with help from her office’s staff, and only after receiving a search warrant. The policy also says the equipment will not be used to capture call, text message or email content.

“It seems like it’s a new day,” said Matt Cagle, a technology and civil liberties policy attorney with the American Civil Liberties Union of Northern California, after the vote. In an interview days prior, he told Oakland North that police have used the technology for years without telling judges.

Cagle met with the DA days before the vote and says he’s pleased she addressed the bulk of the ACLU’s problems with the draft policy. “Other counties are going to look toward Alameda going forward,” he added following the vote.

In initially postponing its vote, the board was complying with new state privacy laws that are set to take effect January 1. One of the laws, SB 741, requires agencies buying cell-site simulators to publish privacy-protecting policies that local lawmakers must then approve.

Another new privacy bill, the California Electronic Communications Privacy Act, or CalECPA, requires police to get a search warrant to collect residents’ electronic data, including by cell-site simulator.

On Tuesday, O’Malley told supervisors her policy was “in 100 percent compliance” with California’s new privacy laws.

State Senator Jerry Hill (D-San Mateo), a co-author of the new laws, said Alameda County showed how his law is already working. “The [board] delay was a direct result of SB 741,” he told Oakland North in an email before the vote. “We need to make sure that the law keeps up with the rapid adoption of these types of technologies.”

Privacy experts say that the precedent set by California and Alameda County could reverberate across the nation.

“States that pass strong laws not only protect their own citizens’ privacy, they send a message to DC about the emerging consensus that change is needed,” wrote Chris Conley, another attorney with the ACLU of Northern California, in an email before the vote.

Two years ago, the Alameda County District Attorney’s office, along with the Oakland and Fremont police departments, applied for federal funds to upgrade OPD’s cell-site simulator. The new Hailstorm equipment can monitor data on a next-generation cellular network technology known as 4G.

Members of the Oakland Privacy Working Group first heard of the move when it appeared on the board of supervisors’ meeting agenda earlier this year. They gathered support and lobbied the supervisors to comply with the new state privacy laws early.

“They’re responsive,” said Hofer, the Oakland-based privacy advocate. “What more do you want from public officials?”

Still, Hofer says he and other activists want to ensure the device is kept under tight rein. “Let’s trust,” he said, “but verify.”