NEWS

Indiana State Police tracking cellphones — but won't say how or why

By Ryan Sabalow
Indianapolis Star

This year, the Indiana State Police paid $373,995 for a device that law enforcement personnel have described as a powerful tool in the fight against crime and terrorism.

It could allow investigators in a surveillance vehicle to park in a crowded area and track the movements of anyone nearby with a cellphone and capture the numbers of people's incoming and outgoing calls and text messages.

All of which concerns civil liberties and open-government groups.

They worry that the technology could be used to violate innocent Hoosiers' constitutionally protected rights to privacy if proper checks and balances aren't in place.

But officials at Indiana's largest police agency aren't saying what they do with the technology; they're mum on whose data they've collected so far; and they're not talking about what steps they take to safeguard the data.

Citing concerns that releasing any information would endanger public safety by hindering the agency's ability to fight crime and combat terrorism, they won't even say whether they ask a judge for a search warrant before they turn the equipment on.

MORE:Examples of data-gathering abuses

On a national level, police officials at other agencies say that such secrecy is essential to thwart terror attacks and fight crime. Some said the devices are used in extraordinary circumstances, and only to hunt for a single phone at a time, not to collect data from thousands of callers.

But a joint investigation of the Indianapolis Star and USA Today found instances in which police in some cities across the U.S. used cellphone snooping techniques in less urgent and more questionable ways.

MORE:Cell data dumps: A legally fuzzy area

In one case, a South Carolina sheriff obtained cellphone data from an unknown number of people — just to investigate a rash of car burglaries that included the theft of guns from the sheriff's SUV.

In another instance, Miami police told the city council they intended to collect cellphone data to track protesters at a world trade event.

Civil liberties groups say that giving police the authority to secretly collect bulk cellphone data has unprecedented potential for abuse. Searching cellphone data, they say, ought to require a warrant as is required to search a home or a car.

INVESTIGATION:How we did it

When presented with The Star's and USA Today's findings, Gerry Lanosga of the Indiana Coalition for Open Government said police should be required to provide at least some information about how the technology is being used. Are, he asked, Indiana police agencies using the devices for routine investigations? Or, of more concern to him, might it be used to monitor political activities, such as a tea party rally or a racially sensitive cultural event, such as Indianapolis' Black Expo? If a suspect walks into a crowded mall, he wonders, are police grabbing — and keeping — data from innocent shoppers?

"I think the public has a right to know some details about that program," said Lanosga, whose group advocates for government transparency.

Stingray devices

While most Americans have paid little thought to the fact that their smartphone is a mobile tracking device that broadcasts their location and data about who they're calling and texting, local police agencies have taken sharp notice.

At least 25 police agencies around the country, including the Indiana State Police, have contracts with Harris Corp., of Melbourne, Fla., for devices called Stingrays, according to public records requests filed this fall with 115 police agencies by the Indianapolis Star, USA Today and other media outlets owned by Gannett.

Often installed in a surveillance vehicle, the suitcase-size Stingrays trick all cellphones in a set distance — sometimes exceeding a mile, depending on the terrain and antennas — into connecting to it as if it were a real cellphone tower. That allows police agencies to capture location data and numbers dialed for calls and text messages from thousands of people at a time.

Local and state police often buy the devices with federal grants aimed at protecting cities from terror attacks, and the devices, originally developed for military and spy agencies, are closely guarded secrets.

The company referred inquires to local police departments, but they're not talking either, in part because Harris requires them to sign nondisclosure agreements.

'Required information'

The Indiana State Police paid Harris $373,995 this spring for a Stingray, but police officials were reluctant to share even that information.

State Police officials initially refused to provide any records related to the agency's contract with Harris or grants they obtained.

After The Star appealed the denial to the Indiana Public Access Counselor, the state's arbiter of public records disputes, the agency provided a one-page purchase order, which provided no clues to how the device works or how and when it may be used.

To receive more information, Public Access Counselor Luke Britt said, The Star would have to sue the State Police to see if a judge agreed with police that releasing the complete contract would constitute a public safety threat and harm the agency's ability to investigate terrorists.

State Police spokesman Dave Bursten declined to be interviewed or answer written questions about how the device is used, nor would he say what steps his agency takes to protect personal information.

"In accordance with the guidance of Indiana's Public Access Counselor," Bursten said in an email, "the state police has provided the required information related to your request and have nothing further to add in response to the inquiry."

The Indianapolis Department of Public Safety also paid Harris $34,800 this spring, but it's not clear what technology the city purchased.

Harris' website says it also sells law enforcement communications systems and remote video surveillance equipment, which the company markets as "a powerful new tool in the public safety arsenal."

The city provided its entire contract with Harris, but the document provided no detail on what the technology was.

Al Larsen, a spokesman for The Department of Public Safety, declined to discuss how his agency uses the Harris technology, saying doing so would "adversely impact our crime-fighting effort."

Indianapolis Division of Homeland Security Chief Gary Coons said that while he didn't know what the Harris technology was and likely couldn't comment on it even if he did, his agency would protect any data from abuse.

For instance, he said, the data and equipment used to collect license plate numbers on local roadways is routinely audited to make sure detectives aren't using the technology for nefarious purposes, such as spying on an ex-girlfriend.

He said detectives know they could face criminal charges for such abuses.

USA Today and The Star also sought records about what are known as "tower dumps," in which police seek court orders requiring cellphone companies to provide investigators with massive amounts of phone data.

State Police officials said they had no such records when The Star asked for any records that might shed light on how many times detectives used such methods.

But officials said they wouldn't have shared the documents if they did keep them, citing a provision in Indiana's records law that gives police agencies discretion to withhold all investigatory files.

Larsen said that any surveillance in Indianapolis is focused on specific targets and is only used if a court order is granted. He said the technology the city uses "does not perform a data-dump function."

"Broad-scale surveillance, including that of a data-related nature, is not currently a tactic we utilize," Larsen said in an email. "And we would only do so in the future if an extreme circumstance drove us to seek an order from the court."

Seeking reassurances of privacy

What most troubles civil liberties groups about Stingrays and tower dumps is that elsewhere in the country, cellphone data often can be obtained with a simple court order — and not a search warrant.

But it's unclear whether the same standard applies in Indiana because local officials wouldn't discuss the matter.

Court orders generally only require detectives to show that the data collected would aid in an investigation, a standard that's much easier to meet than what's required for a search warrant, in which detectives and prosecutors must demonstrate to a judge probable cause, a legal term meaning there is belief a crime occurred.

Kenneth Falk, legal director of the ACLU of Indiana, said the mass collection of cellphone information raises serious and troubling Fourth Amendment questions. The amendment protects citizens' rights to privacy and to be free from government officials searching their homes and other property without probable cause.

He said police should at least be required to have a judge sign a search warrant before getting access to the phone data from potentially hundreds or even thousands of innocent Hoosiers.

Lanosga of the Coalition for Open Government said Indiana police agencies have an obligation to publicly address privacy concerns and explain what checks and balances are in place to protect the data collected.

Both Lanosga and Falk said they didn't want to deny law enforcement the ability of using whatever technology is needed to fight crime and head off terror. But not without limits.

"What sort of reassurances can the agency make to those people their data is being destroyed, not maintained indefinitely, not abused for any purpose?" Lanosga said. "I think there are a lot of serious questions about that that demand the agency publicly address what it's doing with these types of techniques and equipment."

But that's not happening.

"Maybe," Lanosga said, "the legislature can intervene and get some answers."