Oakland’s privacy commission gets closer to policy on Stingray surveillance device

Oakland’s Privacy Advisory Commission inched closer to voting on a policy on Thursday that would bring more transparency to the police department’s use of a controversial surveillance tool that was kept a secret from the public for nearly a decade.

The Oakland Police Department’s future use of a cell-site simulator, known as Stingray, hinges on the policy’s approval. The Stingray, and its upgraded version, the Hailstorm, poses as a cellular tower and tricks cell phones into giving up data like unique ID numbers and location. The police use it to locate a suspect or victim in an investigation, but critics have long voiced concerns about privacy and potential abuse of the powerful tool.

Last October, the California State Senate passed a law requiring every county sheriff and city police department that deploys a Stingray to get a warrant before it is used and approve and publish a usage and privacy policy online. The city of Oakland has been working since then to draft one for the OPD.

If approved, Oakland’s new policy would require OPD officers to get approval from the chief of police or assistant chief of police before they use the Stingray. The policy also defines the scenarios in which the police may deploy the Stingray, such as in mass casualty incidents or when they are trying to locate missing persons or at-risk individuals. Police will also be allowed to use it in investigations involving “danger to the life or physical safety of individuals and to apprehend fugitives,” according to a draft of the policy given to Oakland North. The police will not, however, be allowed to use it to survey civilians at a protest or rally.

The commission had expected to vote on the policy Thursday, but it postponed the decision over concerns about the way communications from a Stingray are intercepted and what information is shared. Several members of the commission wanted to learn more about software made by Nebraska-based surveillance company Pen Link, which is recommended in marketing materials by the device’s manufacturer, Harris Corp. When used in conjunction with the Stingray or Hailstorm, the software allows law enforcement to collect large amounts of metadata, including text and phone call communications.

Brian Hofer, chair of the commission, said that he couldn’t vote on the policy until he could be assured that it included language to prohibit specific uses of this software in the future.

“If they incorporate all of the amendments like they said they would, it will be a really strong policy,” said Hofer. “Not knowing the specifics about the software it uses is still concerning to me.”

The OPD first acquired a Stingray in 2006, but the city council and the public were kept in the dark about how they were using it for years. Since then, the lack of such transparency among police departments across the country has sparked a national debate about the need for more oversight of the device.

In Oakland, concerns over law enforcement’s use of surveillance technology came to a head in 2014 when city officials proposed a city-wide surveillance project called the Domain Awareness Center, giving rise to the Oakland Privacy Working Group, a citizens’ rights group. After the group helped to convince the city to limit the surveillance area to the Port of Oakland, the city council formally adopted the commission, with Hofer as its chair, to draft legislation and advise on citywide privacy concerns.

During its first few months after launching in January, the commission and the OPD butted heads over how to approach the cell-site simulator privacy policy, but they soon began to find common ground. On Thursday, it was apparent the commission and the OPD’s relationship had improved significantly.

“We figured out a practical method involving all the stakeholders, sitting around a table talking to each other instead of just yelling at each other or in the media,” said Hofer.

Tim Birch, OPD’s head of research and planning, and the author of the policy, said he plans to incorporate most of the commission’s feedback into the policy, but may have to hold off on some requests. “Even if we don’t ultimately agree with everything that was provided by the commission or other stakeholders, at least we’ve had what I think is a very open and honest and discussion,” Birch said.

At the meeting, attended by fewer than a dozen citizens, commission members raised concerns about some of the language in the policy covering civil liberties and the extent to which the OPD would use the device in “exigent” circumstances, or in emergency situations without first obtaining a warrant.

OPD Deputy Chief Darren Ellison and Birch listened.

Birch said the department does use Pen Link software but it would not be a problem because the department will not use it for any purposes beyond what is agreed on in the policy.

Birch said he does believe the Stingray is necessary for the OPD, which is understaffed and has limited resources. “If we can capture a suspect sooner and prevent them from bringing further harm to the community, then I think it’s worth it,” he said. “That’s why I think it’s worth all the processes that we’re going through.”

The commission and Hofer’s other major concern about the Stingray was whether or not the OPD will enter into a non-disclosure agreement about the device with its manufacturer and the Federal Bureau of Investigation (FBI). Several police departments across the country have acquired and used a Stingray in the past decade, but non-disclosure agreements between these departments, the FBI and Harris Corp. have prevented the public from learning any details about them.

According to a statement from the FBI given to ArsTechnica in 2015, the agreements were put in place to protect details about how the Stingray works. Over the past year, these agreements have caused prosecutors to drop charges in some criminal investigations in order to avoid discussing details about the Stingray in court. Birch says he is researching whether the OPD must sign such an agreement in order to begin using the Stingray or Hailstorm.

“We’re dealing with some new technology that is really scary that understandably really raises people’s level of concern,” Birch said. “I feel like all [the non-disclosure agreement has] done is speak to the narrative that’s out in the community, which is that we’re doing secret stuff that people don’t know about it.”

The OPD isn’t the only one waiting for the new policy to be approved. The department had entered in to a partnership three years ago with the Alameda County District Attorney’s Office and the Fremont Police Department to upgrade its Stingray device to the Hailstorm as part of a grant package from the Department of Homeland Security. Alameda County already has a policy that is praised by the American Civil Liberties Union as one of the best in the nation. The Fremont Police Department has not given Fremont’s city council a policy to vote on yet, but plans to by the end of the year. Both Oakland and Fremont must approve privacy policies before all three law enforcement units can begin training with the Hailstorm.

Hofer says the commission is taking its time to make sure Oakland gets it right. “Alameda’s is the gold standard in America, but Oakland’s is going to be better, because we have a lot more reporting metrics,” he said, referring to an annual report on the OPD’s use of the device that will be required under the new policy. “We have better warrant applications and it’s got a lot more openness built into it.”

Birch said at the meeting that he has no interest in rushing through the policy, but he wanted to see some progress made on it before the end of the year.

In two weeks, the commission and OPD representatives will reconvene to discuss and likely vote on the updated policy. If passed, it will then go up for a vote by the city’s public safety committee and city council to be enacted.

Correction: This story was updated on October 13, 2016, to correct the spelling of Tim Birch’s name and to clarify that his group does use the Pen Link software.