Existing law makes it a crime to manufacture, assemble, sell, advertise for sale, possess, transport, import, or furnish to another a device that is primarily or exclusively designed or intended for eavesdropping upon the communication of another, or any device that is primarily or exclusively designed or intended for the unauthorized interception of reception of communications between a cellular radio telephone, as defined, and a landline telephone or other cellular radio telephone. Existing law additionally makes it a crime to purchase, sell, offer to purchase or sell, or conspire to purchase or sell, any telephone calling pattern record or list, without the written consent of the subscriber, or to procure, obtain, attempt to obtain, or conspire to obtain, any calling pattern record or list through fraud or deceit. Existing law contains certain exemptions from these crimes for law enforcement agencies.

This bill would require every local agency that operates cellular communications interception technology, as defined, to maintain reasonable operational, administrative, technical, and physical safeguards to protect information gathered through use of the technology from unauthorized access, destruction, use, modification, or disclosure and implement a usage and privacy policy, as specified, to ensure that the collection, use, maintenance, sharing, and dissemination of information gathered through use of the technology complies with applicable law and is consistent with respect for an individuals privacy and civil liberties. The bill would, except as provided, prohibit a local agency from acquiring cellular communications interception technology unless that acquisition is approved by a resolution or ordinance adopted by its legislative body at a regularly scheduled public meeting of the legislative body held pursuant to a specified open meetings law. The bill would require that the resolution or ordinance set forth the policies of the local agency. The bill would require that the local agency make the usage and privacy policy available in writing to the public and if the local agency maintains an Internet Web site, to conspicuously post the usage and privacy policies on that site. The bill would, in addition to any other sanctions, penalties, or remedies provided by law, authorize an individual who has been harmed by a violation of these provisions to bring a civil action in any court of competent jurisdiction against a person who knowingly caused that violation.

Existing law makes it a crime to manufacture, assemble, sell, advertise for sale, possess, transport, import, or furnish to another a device that is primarily or exclusively designed or intended for eavesdropping upon the communication of another, or any device that is primarily or exclusively designed or intended for the unauthorized interception of reception of communications between a cellular radio telephone, as defined, and a landline telephone or other cellular radio telephone. Existing law additionally makes it a crime to purchase, sell, offer to purchase or sell, or conspire to purchase or sell, any telephone calling pattern record or list, without the written consent of the subscriber, or to procure, obtain, attempt to obtain, or conspire to obtain, any calling pattern record or list through fraud or deceit. Existing law contains certain exemptions from these crimes for law enforcement agencies.

This bill would require every local agency that operates cellular communications interception technology, as defined, to maintain reasonable operational, administrative, technical, and physical safeguards to protect information gathered through use of the technology from unauthorized access, destruction, use, modification, or disclosure and implement a usage and privacy policy, as specified, to ensure that the collection, use, maintenance, sharing, and dissemination of information gathered through use of the technology complies with applicable law and is consistent with respect for an individuals privacy and civil liberties. The bill would, except as provided, prohibit a local agency from acquiring cellular communications interception technology unless that acquisition is approved by a resolution or ordinance adopted by its legislative body at a regularly scheduled public meeting of the legislative body held pursuant to a specified open meetings law. The bill would require that the resolution or ordinance set forth the policies of the local agency. The bill would require that the local agency make the usage and privacy policy available in writing to the public and if the local agency maintains an Internet Web site, to conspicuously post the usage and privacy policies on that site. The bill would, in addition to any other sanctions, penalties, or remedies provided by law, authorize an individual who has been harmed by a violation of these provisions to bring a civil action in any court of competent jurisdiction against a person who knowingly caused that violation.

Existing law makes it a crime to manufacture, assemble, sell, advertise for sale, possess, transport, import, or furnish to another a device that is primarily or exclusively designed or intended for eavesdropping upon the communication of another, or any device that is primarily or exclusively designed or intended for the unauthorized interception of reception of communications between a cellular radio telephone, as defined, and a landline telephone or other cellular radio telephone. Existing law additionally makes it a crime to purchase, sell, offer to purchase or sell, or conspire to purchase or sell, any telephone calling pattern record or list, without the written consent of the subscriber, or to procure, obtain, attempt to obtain, or conspire to obtain, any calling pattern record or list through fraud or deceit. Existing law contains certain exemptions from these crimes for law enforcement agencies.

This bill would require every local agency that operates cellular communications interception technology, as defined, to maintain reasonable operational, administrative, technical, and physical safeguards to protect information gathered through use of the technology from unauthorized access, destruction, use, modification, or disclosure and implement a usage and privacy policy, as specified, to ensure that the collection, use, maintenance, sharing, and dissemination of information gathered through use of the technology complies with applicable law and is consistent with respect for an individuals privacy and civil liberties. The bill would would, except as provided, prohibit a local agency from acquiring cellular communications interception technology unless that acquisition is approved by a resolution or ordinance adopted by its legislature legislative body at a regularly scheduled public meeting of the legislative body held pursuant to a specified open meetings law. The bill would require that the resolution or ordinance set forth the policies of the local agency. The bill would require that the local agency make the usage and privacy policy available in writing to the public and if the local agency maintains an Internet Web site, to conspicuously post the usage and privacy policies on that site. The bill would, in addition to any other sanctions, penalties, or remedies provided by law, authorize an individual who has been harmed by a violation of these provisions to bring a civil action in any court of competent jurisdiction against a person who knowingly caused that violation.

Existing law makes it a crime to manufacture, assemble, sell, advertise for sale, possess, transport, import, or furnish to another a device that is primarily or exclusively designed or intended for eavesdropping upon the communication of another, or any device that is primarily or exclusively designed or intended for the unauthorized interception of reception of communications between a cellular radio telephone, as defined, and a landline telephone or other cellular radio telephone. Existing law additionally makes it a crime to purchase, sell, offer to purchase or sell, or conspire to purchase or sell, any telephone calling pattern record or list, without the written consent of the subscriber, or to procure, obtain, attempt to obtain, or conspire to obtain, any calling pattern record or list through fraud or deceit. Existing law contains certain exemptions from these crimes for law enforcement agencies.

This bill would require every local agency that operates cellular communications interception technology, as defined, to maintain reasonable operational, administrative, technical, and physical safeguards to protect information gathered through use of the technology from unauthorized access, destruction, use, modification, or disclosure and implement a usage and privacy policy, as specified, to ensure that the collection, use, maintenance, sharing, and dissemination of information gathered through use of the technology complies with applicable law and is consistent with respect for an individuals privacy and civil liberties. The bill would prohibit a local agency from acquiring or using cellular communications interception technology unless that acquisition or use is approved by a resolution or ordinance adopted by its legislature body at a regularly scheduled public meeting of the legislative body at which members of the public are afforded a reasonable opportunity to comment. held pursuant to a specified open meetings law. The bill would require that the resolution or ordinance set forth the policies of the local agency. The bill would require that the local agency make the usage and privacy policy available in writing to the public and if the local agency maintains an Internet Web site, to conspicuously post the usage and privacy policies on that site. The bill would, in addition to any other sanctions, penalties, or remedies provided by law, authorize an individual who has been harmed by a violation of these provisions to bring a civil action in any court of competent jurisdiction against a person who knowingly caused that violation.

Existing law makes it a crime to manufacture, assemble, sell, advertise for sale, possess, transport, import, or furnish to another a device that is primarily or exclusively designed or intended for eavesdropping upon the communication of another, or any device that is primarily or exclusively designed or intended for the unauthorized interception of reception of communications between a cellular radio telephone, as defined, and a landline telephone or other cellular radio telephone. Existing law additionally makes it a crime to purchase, sell, offer to purchase or sell, or conspire to purchase or sell, any telephone calling pattern record or list, without the written consent of the subscriber, or to procure, obtain, attempt to obtain, or conspire to obtain, any calling pattern record or list through fraud or deceit. Existing law contains certain exemptions from these crimes for law enforcement agencies.

This bill would require every local agency that operates cellular communications interception technology, as defined, to (1) ensure that information and data gathered through use of that technology is protected with reasonable operational, administrative, technical, and physical safeguards to ensure its confidentiality and integrity, (2) implement and maintain reasonable security procedures and practices in order operational, administrative, technical, and physical safeguards to protect information and data gathered through use of the technology from unauthorized access, destruction, use, modification, or disclosure, disclosure and (3) implement and maintain a usage and privacy policy, as specified, to ensure that the collection, use, maintenance, sharing, and dissemination of information and data gathered through use of the technology complies with applicable law and is consistent with respect for an individuals privacy and civil liberties. The bill would prohibit a local agency from acquiring or using cellular communications interception technology unless that acquisition or use is approved by a resolution or ordinance adopted by its legislature body at a regularly scheduled public meeting of the legislative body at which members of the public are afforded a reasonable opportunity to comment. The bill would require that the resolution or ordinance set forth the policies of the local agency as described above in (1), (2), and (3). agency. The bill would require that the local agency make the usage and privacy policy available in writing to the public and if the local agency maintains an Internet Web site, to conspicuously post the usage and privacy policies on that site. The bill would, in addition to any other sanctions, penalties, or remedies provided by law, authorize an individual who has been harmed by a violation of these provisions to bring a civil action in any court of competent jurisdiction against a person who knowingly caused that violation.

Existing law makes it a crime to manufacture, assemble, sell, advertise for sale, possess, transport, import, or furnish to another an a device that is primarily or exclusively designed or intended for eavesdropping upon the communication of another, or any device that is primarily or exclusively designed or intended for the unauthorized interception of reception of communications between a cellular radio telephone, as defined, and a landline telephone or other cellular radio telephone. Existing law additionally makes it a crime to purchase, sell, offer to purchase or sell, or conspire to purchase or sell, any telephone calling pattern record or list, without the written consent of the subscriber, or to procure, obtain, attempt to obtain, or conspire to obtain, any calling pattern record or list through fraud or deceit. Existing law contains certain exemptions from these crimes for law enforcement agencies.

This bill would require every local agency that operates cellular communications interception technology, as defined, to (1) ensure that information and data gathered through use of that technology is protected with reasonable operational, administrative, technical, and physical safeguards to ensure its confidentiality and integrity, (2) implement and maintain reasonable security procedures and practices in order to protect information and data gathered through use of the technology from unauthorized access, destruction, use, modification, or disclosure, and (3) implement and maintain a usage and privacy policy, as specified, to ensure that the collection, use, maintenance, sharing, and dissemination of information and data gathered through use of the technology is consistent with respect for an individuals privacy and civil liberties. The bill would prohibit a local agency from acquiring or using cellular communications interception technology, as defined, unless that acquisition or use is approved by a resolution or ordinance adopted by its legislature body at a regularly scheduled public meeting of the legislative body at which members of the public are afforded a reasonable opportunity to comment. The bill would require that the resolution or ordinance set forth the policies of the local agency as to authorized uses of cellular communications interception technology, and as to the use, protection from unauthorized disclosure, and disposal of data obtained through that technology. If described above in (1), (2), and (3). The bill would require that the local agency make the usage and privacy policy available in writing and if the local agency maintains an Internet Web site, the bill would require the agency to conspicuously post these the usage and privacy policies on that site. The bill would, in addition to any other sanctions, penalties, or remedies provided by law, authorize an individual who has been harmed by a violation of these provisions to bring a civil action in any court of competent jurisdiction against a person who knowingly caused that violation.

Existing law makes it a crime to manufacture, assemble, sell, advertise for sale, possess, transport, import, or furnish to another an device that is primarily or exclusively designed or intended for eavesdropping upon the communication of another, or any device that is primarily or exclusively designed or intended for the unauthorized interception of reception of communications between a cellular radio telephone, as defined, and a landline telephone or other cellular radio telephone. Existing law additionally makes it a crime to purchase, sell, offer to purchase or sell, or conspire to purchase or sell, any telephone calling pattern record or list, without the written consent of the subscriber, or to procure, obtain, attempt to obtain, or conspire to obtain, any calling pattern record or list through fraud or deceit. Existing law contains certain exemptions from these crimes for law enforcement agencies.

This bill would prohibit a local agency from acquiring or using cellular communications interception technology, as defined, unless that acquisition or use is approved by a resolution or ordinance adopted by its legislature body at a regularly scheduled public meeting of the legislative body at which members of the public are afforded a reasonable opportunity to comment. The bill would require that the resolution or ordinance set forth the policies of the local agency as to authorized uses of cellular communications interception technology, and as to the use, protection from unauthorized disclosure, and disposal of data obtained through that technology. If the local agency maintains an Internet Web site, the bill would require the agency to conspicuously post these usage and privacy policies on that site.

 UNFINISHED BUSINESS  

Bill No: SB 741

Author: Hill (D), et al.

Amended: 8/31/15

Vote: 21

SENATE GOVERNANCE & FIN. COMMITTEE: 7-0, 4/15/15

AYES: Hertzberg, Nguyen, Bates, Beall, Hernandez, Lara, Pavley

SENATE JUDICIARY COMMITTEE: 7-0, 5/12/15

AYES: Jackson, Moorlach, Anderson, Hertzberg, Leno, Monning, Wieckowski

SENATE FLOOR: 39-0, 5/22/15

AYES: Allen, Anderson, Bates, Beall, Berryhill, Block, Cannella, De León, Fuller, Gaines, Galgiani, Hall, Hancock, Hernandez, Hertzberg, Hill, Hueso, Huff, Jackson, Lara, Leno, Leyva, Liu, McGuire, Mendoza, Mitchell, Monning, Moorlach, Morrell, Nguyen, Nielsen, Pan, Pavley, Roth, Runner, Stone, Vidak, Wieckowski, Wolk

ASSEMBLY FLOOR: 79-0, 9/2/15 - See last page for vote

SUBJECT: Mobile communications: privacy

SOURCE: Author

DIGEST: This bill establishes requirements that local agencies must fulfill before acquiring cellular communications interception technology.

Assembly Amendments (1) modify the requirements that a local agency’s usage and privacy policy must fulfill; (2) specify that an adopted ordinance or resolution must authorize the acquisition, but not the use of, cellular communications interception technology; and (3) allow a county sheriff to acquire cellular communications interception technology after providing public notice, as specified, rather than after the adoption of an authorizing resolution.

ANALYSIS: Existing law, with some exceptions for law enforcement agencies, makes it a crime to manufacture, assemble, sell, advertise for sale, possess, transport, import, or furnish to another a device that is primarily or exclusively designed or intended for eavesdropping upon the communication of another, or any device that is primarily or exclusively designed or intended for the unauthorized interception of reception of communications between a cellular radio telephone, as defined, and a landline telephone or other cellular radio telephone.

This bill:

1. Requires every local agency that operates cellular communications interception technology to do both of the following:

1. Maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, in order to protect information gathered through the use of cellular communications interception technology from unauthorized access, destruction, use, modification, or disclosure.

2. Implement a usage and privacy policy to ensure that the collection, use, maintenance, sharing, and dissemination of information and data gathered through the use of cellular communications interception technology complies with all applicable law and is consistent with respect for an individual’s privacy and civil liberties. This usage and privacy policy must be available in writing, and, if the local agency has an Internet Web site, the usage and privacy policy must be posted conspicuously on that Internet Web site. The usage and privacy policy must include:

1. The authorized purposes for using cellular communications interception technology and for collecting information using that technology.

2. A description of job title or other designation of the employees who are authorized to use, or access information collected through the use of, cellular communications interception technology. The policy must identify the training requirements necessary for those authorized employees.

3. A description of how the agency will monitor its use of cellular communications interception technology to ensure the accuracy of the information collected and compliance with all applicable laws.

4. The existence of a memorandum of understanding or other agreement with another local agency or any other party for the shared use of cellular communications interception technology or the sharing of information collected through its use, including the identity of signatory parties.

5. The purpose of, process for, and restrictions on, the sharing of information gathered through the use of cellular communications interception technology with other local agencies and persons.

6. The length of time information gathered through the use of cellular communications interception technology will be stored or retained, and the process the local agency will utilize to determine if and when to destroy retained information.

2. Prohibits a local agency, with the exception of a county sheriff, from acquiring cellular communications interception technology unless the agency’s legislative body adopts an authorizing resolution or ordinance at a regularly scheduled meeting held pursuant to the Ralph M. Brown Act.

3. Prohibits a county sheriff from acquiring cellular communications interception technology unless the sheriff provides public notice of the acquisition, which must be posted conspicuously on his or her department’s Internet Web site, and his or her department has a usage and privacy policy, as specified in this bill.

4. Specifies that, in addition to any other sanctions, penalties, or remedies provided by law, an individual who has been harmed by a violation of this bill’s provisions may bring a civil action in any court of competent jurisdiction against a person who knowingly caused that violation.

5. Allows a court to award a combination of any one or more of the following:

1. Actual damages, but not less than liquidated damages in the amount of $2,500.

2. Punitive damages upon proof of willful or reckless disregard of the law.

3. Reasonable attorney’s fees and other litigation costs reasonably incurred.

4. Other preliminary and equitable relief as the court determines to be appropriate.

Background

Some California sheriff’s offices and police departments are using surveillance devices that allow investigators to gather cellphone signals to pinpoint a suspect’s location. By simulating a cellular communications tower’s functions, these devices force all cell phones within the vicinity to transmit information to the devices. The information that these devices can collect reportedly includes a cell phone’s number, a phone’s unique “International Mobile Subscriber Identification” (IMSI) number, its electronic serial number, the location of the most recent cell tower the phone connected with, and phone numbers dialed from the cell phone. Some reports indicate that the devices can accurately identify a cell phone’s location, even if the phone is turned off, and could be modified to capture the content of calls or text messages from a phone. These devices are known as “IMSI catchers” and sometimes referred to by brand names like “StingRay” or “HailStorm.”

Exact information about how IMSI catchers work and what they can do is difficult to obtain. Local law enforcement agencies’ acquisition and use of these devices is apparently subject to non-disclosure requirements that, according to various sources, are imposed by the devices’ manufacturer, the Federal Bureau of Investigation, or both, to prevent the release of information that could compromise the devices’ effectiveness. Public information requests for documents relating to the devices are either denied or reveal only heavily-redacted materials. Some news reports indicate that local law enforcement authorities even refuse to reveal information about IMSI catchers to elected officials who are considering whether to approve the acquisition and use of the devices by a sheriff or police department.

IMSI catchers are reportedly used by at least 11 local law enforcement agencies in California including Alameda County, Los Angeles County, the City of Los Angeles, Sacramento County, San Bernardino County, the City of San Diego, the City and County of San Francisco, and the City of San Jose. On February 24, 2015, the Santa Clara County Board of Supervisors authorized the Sheriff’s Office to use funding from the State Homeland Security Grant Program to procure a “mobile phone triangulation system,” presumably an IMSI catcher.

The secrecy surrounding this technology raises substantial unanswered questions about the privacy and civil liberties implications of these devices, particularly because IMSI catchers collect information from the phones of anyone in the devices’ vicinity, not just individuals targeted by law enforcement.

Comments

Because of the non-disclosure agreements that law enforcement officials have used to justify the secrecy surrounding IMSI catchers, the public and their elected representatives know very little about this technology. Some of the unanswered questions about IMSI catchers raise fundamental civil liberty and privacy concerns that deserve to be considered by the public. Important questions that merit public consideration include:

• What data is gathered from the phones of third-parties who are unrelated to the purpose for which an IMSI catcher is deployed? Is that data stored for any period of time? Who can access it? How is it used? Is it secured against unauthorized access?

• Can IMSI catchers be modified to capture voice and text content from cell phones? Can law enforcement agencies determine whether the devices are being used to capture content, regardless of whether such use is authorized by the department?

• What policies govern local law enforcement agencies’ deployment and use of IMSI catchers? To what extent do agencies comply with those policies?

• Must local law enforcements agencies’ use of IMSI catchers always be subject to a warrant issued by a judge? Do warrants specifically allow for the collection of data from every cell phone that transmits to the devices?

To get answers to some of the above questions, this bill requires that a law enforcement agency that acquires or uses an IMSI catcher must disclose information about the policies that govern how the agency will use the device and the data gathered by the device. This bill allows members of the public and their elected representatives to make informed decisions about law enforcement’s deployment of surveillance technology in their communities.

FISCAL EFFECT: Appropriation: No Fiscal Com.: No Local: No

SUPPORT: (Verified 9/2/15)

Bay Area Civil Liberties Coalition

California Civil Liberties Advocacy

Media Alliance

Small Business California

OPPOSITION: (Verified 9/2/15)

None received

ASSEMBLY FLOOR: 79-0, 9/2/15

AYES: Achadjian, Alejo, Travis Allen, Baker, Bigelow, Bloom, Bonilla, Bonta, Brough, Brown, Burke, Calderon, Campos, Chang, Chau, Chávez, Chiu, Chu, Cooley, Cooper, Dababneh, Dahle, Daly, Dodd, Eggman, Frazier, Gallagher, Cristina Garcia, Eduardo Garcia, Gatto, Gipson, Gomez, Gonzalez, Gordon, Gray, Grove, Hadley, Harper, Roger Hernández, Holden, Irwin, Jones, Jones-Sawyer, Kim, Lackey, Levine, Linder, Lopez, Low, Maienschein, Mathis, Mayes, McCarty, Medina, Melendez, Mullin, Nazarian, Obernolte, O'Donnell, Olsen, Patterson, Perea, Quirk, Rendon, Ridley-Thomas, Rodriguez, Salas, Santiago, Steinorth, Mark Stone, Thurmond, Ting, Wagner, Waldron, Weber, Wilk, Williams, Wood, Atkins

NO VOTE RECORDED: Beth Gaines

Prepared by: Brian Weinberger / GOV. & F. / (916) 651-4119

9/2/15 16:00:43

**** END ****

SENATE THIRD READING

STR Bill Id:SB 741

Author:(Hill)

As Amended Ver:August 31, 2015

Majority vote

SENATE VOTE: 39-0

SUMMARY: Requires local agencies to publicly approve or disclose the acquisition of cellular communications interception technology (CCIT), requires local agencies to develop and release a usage and privacy policy for CCIT, and provides for civil remedies in the event of a violation. Specifically, this bill:

1. Requires a local agency that operates CCIT to:

   1. Maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect information gathered through the use of CCIT from unauthorized access, destruction, use, modification, or disclosure; and,

   2. Implement a usage and privacy policy, which shall be available in writing to the public, and posted conspicuously online if the local agency has a Web site.

2. Requires a local agency's usage and privacy policy to include, at a minimum, all of the following:

   1. The authorized purposes for using CCIT and for collecting information using CCIT;

   2. A description of the job title or other designation of the employees who are authorized to use, or access information collected through the use of CCIT, as well as the training requirements for those authorized employees;

   3. A description of how the local agency will monitor its own use of CCIT to ensure the accuracy of the information collected and compliance with all applicable laws, including laws providing for process and time period system audits;

   4. The existence of a memorandum of understanding or other agreement with another local agency or any other party for the shared use of CCIT or the sharing of information collected through its use, including the identity of signatory parties;

   5. The purpose of, process for, and restrictions on, the sharing of information gathered through the use of CCIT with other local agencies and persons; and,

   6. The length of time information gathered through the use of CCIT will be retained, and the process the local agency will utilize to determine if and when to destroy stored or retained information.

3. Prohibits a local agency from acquiring CCIT unless approved by its legislative body by adoption, at a regularly scheduled public meeting, as defined, of a resolution or ordinance authorizing that acquisition and the usage and privacy policy.

4. Prohibits a county sheriff from acquiring CCIT unless the sheriff provides public notice of the acquisition, which must be posted conspicuously on the department's Web site, and his or her department has a usage and privacy policy.

5. Authorizes an individual harmed by the knowing violation of these provisions to bring a civil action in court.

6. Authorizes a court to order any or all of the following remedies:

   1. Actual damages, but not less than liquidated damages in the amount of $2,500;

   2. Punitive damages upon proof of willful or reckless disregard of the law;

   3. Reasonable attorney’s fees and other litigation costs reasonably incurred; and,

   4. Other preliminary and equitable relief as the court determines to be appropriate.

7. Defines the terms "cellular communications interception technology" and "local agency."

FISCAL EFFECT: None. This bill has been keyed non-fiscal by the Legislative Counsel.

COMMENTS: This bill is intended to increase transparency in the use of CCIT by local law enforcement agencies by requiring public approval or disclosure of the acquisition of CCIT, and the creation of a usage and privacy policy to guide implementation. This bill is author-sponsored.

What this bill calls "cellular communications interception technology" or CCIT is more commonly referred to elsewhere as an "international mobile subscriber identity (IMSI) catcher" or a "StingRay," which is a brand-name for a particular line of cell site emulator.

CCIT is a portable cell phone surveillance tool used by government agencies at the federal, state and local levels that generally consists of an antenna, a processor, and laptop computer for analysis and configuration. They work by emulating the operation of a cellular telephone network tower, which prompts nearby cell phones to switch over and communicate with it like it was the carrier's nearest base station.

The CCIT can be used to collect a variety of data about "caught" cell phones, particularly the phone's unique numeric identifier and its physical location. According to the American Civil Liberties Union (ACLU), CCIT is generally used for two purposes: First, if the government knows a suspect's location, it can use CCIT to determine the unique numeric identifier association with the cell phone. Having this number can facilitate the government's efforts to obtain a wiretap or call records on the target of an investigation. Second, if the government has the unique numeric identifier, it can determine the phone's geographic location, often with an accuracy of up to two meters. CCIT can also be used to capture the content of communications (like voice calls and text messages), although the ACLU does not provide evidence that the local law enforcement agencies have done so with any frequency.

According to an ACLU study, at least 34 law enforcement agencies in 15 states have purchased CCIT. The technology is reportedly used by at least 11 local law enforcement agencies in California, including Alameda County, Los Angeles County, the City of Los Angeles, Sacramento County, San Bernardino County, the City of San Diego, the City and County of San Francisco, and the City of San Jose. There is also evidence to suggest that the Santa Clara County Board of Supervisors authorized its Sheriff's Office in February 2015 to purchase CCIT.

There are at least three major policy concerns over the unconstrained use of CCIT: a lack of public transparency, a lack of clarity over the standard of evidence needed to authorize use of CCIT, and the potentially overbroad nature of the search itself facilitated by CCIT.

One problem with understanding the full impact of CCIT is that many local law enforcement agencies with the technology have signed non-disclosure agreements (NDAs) with a CCIT manufacturer, which some agencies have cited as a reason for not providing even basic information about their CCIT use. Another concern exacerbated by the lack of transparency is uncertainty about the standard of evidence for judicial authorization to use CCIT and the danger of less than fully informed judicial oversight. Furthermore, CCIT can affect all mobile users in the vicinity of the device, not just individuals under investigation. This raises important constitutional questions about dragnet-style "general searches" and their prohibition by the Fourth Amendment, as well as practical problems with service disruption for the public.

This bill attempts to begin addressing these concerns by requiring local agencies to maintain reasonable security procedures and practices (to protect personal information), requiring local agencies to publicly approve or disclose the acquisition of CCIT (even retroactively), and requiring those local agencies to adopt a usage and privacy policy to guide their use of CCIT.

Analysis Prepared by: Hank Dempsey / P. & C.P. / (916) 319-2200 FN: 0001594

SENATE THIRD READING

STR Bill Id:SB 741

Author:(Hill)

As Amended Ver:August 17, 2015

Majority vote

SENATE VOTE: 39-0

SUMMARY: Requires local agencies to publicly approve the acquisition of cellular communications interception technology (CCIT), requires local agencies to develop and release a usage and privacy policy for CCIT, and provides for civil remedies in the event of a violation. Specifically, this bill:

1. Requires a local agency that operates CCIT to:

   1. Maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect information gathered through the use of CCIT from unauthorized access, destruction, use, modification, or disclosure; and,

   2. Implement a usage and privacy policy, which shall be available in writing to the public, and posted conspicuously online if the local agency has a Web site.

2. Requires a local agency's usage and privacy policy to include, at a minimum, all of the following:

   1. The authorized purposes for using CCIT and for collecting information using CCIT;

   2. A description of the job title or other designation of the employees who are authorized to use, or access information collected through the use of CCIT, as well as the training requirements for those authorized employees;

   3. A description of how the local agency will monitor its own use of CCIT to ensure the accuracy of the information collected and compliance with all applicable laws, including laws providing for process and time period system audits;

   4. The existence of a memorandum of understanding or other agreement with another local agency or any other party for the shared use of CCIT or the sharing of information collected through its use, including the identity of signatory parties;

   5. The purpose of, process for, and restrictions on, the sharing of information gathered through the use of CCIT with other local agencies and persons; and,

   6. The length of time information gathered through the use of CCIT will be retained, and the process the local agency will utilize to determine if and when to destroy stored or retained information.

3. Prohibits a local agency from acquiring CCIT unless approved by its legislative body by adoption, at a regularly scheduled public meeting, as defined, of a resolution or ordinance authorizing that acquisition or use, and the usage and privacy policy as required.

4. Authorizes an individual harmed by the knowing violation of these provisions to bring a civil action in court.

5. Authorizes a court to order any or all of the following remedies:

   1. Actual damages, but not less than liquidated damages in the amount of $2,500;

   2. Punitive damages upon proof of willful or reckless disregard of the law;

   3. Reasonable attorney's fees and other litigation costs reasonably incurred; and,

   4. Other preliminary and equitable relief as the court determines to be appropriate.

6. Defines the terms "cellular communications interception technology" and "local agency."

FISCAL EFFECT: None. This bill is keyed non-fiscal by the Legislative Counsel.

COMMENTS: This bill is intended to increase transparency in the use of CCIT by local law enforcement agencies by requiring a public hearing of the acquisition of CCIT, and a usage and privacy policy to guide its implementation. This bill is author-sponsored.

What this bill calls "cellular communications interception technology" or CCIT is more commonly referred to elsewhere as an "international mobile subscriber identity (IMSI) catcher" or a "StingRay," which is a brand-name for a particular line of cell site emulator.

CCIT is a portable cell phone surveillance tool used by government agencies at the federal, state and local levels that generally consists of an antenna, a processor, and laptop computer for analysis and configuration. They work by emulating the operation of a cellular telephone network tower, which prompts nearby cell phones to switch over and communicate with it like it was the carrier's nearest base station.

The CCIT can be used to collect a variety of data about "caught" cell phones, particularly the phone's unique numeric identifier and its physical location. According to the American Civil Liberties Union (ACLU), CCIT is generally used for two purposes: First, if the government knows a suspect's location, it can use CCIT to determine the unique numeric identifier association with the cell phone. Having this number can facilitate the government's efforts to obtain a wiretap or call records on the target of an investigation. Second, if the government has the unique numeric identifier, it can determine the phone's geographic location, often with an accuracy of up to two meters. CCIT can also be used to capture the content of communications (like voice calls and text messages) although the ACLU does not provide evidence that the local law enforcement agencies have done so with any frequency.

According to an ACLU study, at least 34 law enforcement agencies in 15 states have purchased CCIT. The technology is reportedly used by at least 11 local law enforcement agencies in California, including Alameda County, Los Angeles County, the City of Los Angeles, Sacramento County, San Bernardino County, the City of San Diego, the City and County of San Francisco, and the City of San Jose. There is also evidence to suggest that the Santa Clara County Board of Supervisors authorized its Sheriff's Office in February 2015 to purchase CCIT.

There are at least three major policy concerns over the unconstrained use of CCIT: a lack of public transparency, a lack of clarity over the standard of evidence needed to authorize use of CCIT, and the potentially overbroad nature of the search itself facilitated by CCIT.

One problem with understanding the full impact of CCIT is that many local law enforcement agencies with the technology have signed non-disclosure agreements (NDAs) with a CCIT manufacturer, which some agencies have cited as a reason for not providing even basic information about their CCIT use. Another concern exacerbated by the lack of transparency is uncertainty about the standard of evidence for judicial authorization to use CCIT and the danger of less than fully informed judicial oversight. Furthermore, CCIT can affect all mobile users in the vicinity of the device, not just individuals under investigation. This raises important constitutional questions about dragnet-style "general searches" and their prohibition by the Fourth Amendment, as well as practical problems with service disruption for the public.

This bill attempts to begin addressing these concerns by requiring local agencies to maintain reasonable security procedures and practices (to protect personal information), requiring local agencies to publicly approve or disclose the acquisition of CCIT (even retroactively), and requiring those local agencies to adopt a usage and privacy policy to guide their use of CCIT.

Analysis Prepared by: Hank Dempsey / P. & C.P. / (916) 319-2200 FN: 0001400

Date of Hearing: July 15, 2015

ASSEMBLY COMMITTEE ON LOCAL GOVERNMENT

Brian Maienschein, Chair

SBPCA Bill Id:SB 741

Author:(Hill) – As Amended Ver:June 24, 2015

SENATE VOTE: 39-0

SUBJECT: Mobile communications: privacy.

SUMMARY: Prohibits a local agency from acquiring or using cellular communications interception technology, unless approved by its legislative body, and requires that local agency to implement a usage and privacy policy for the use of cellular communications interception technology. Specifically, this bill:

1. Prohibits a local agency from acquiring or using cellular communications interception technology, unless approved by its legislative body by adoption, at a regularly scheduled public meeting with an opportunity for public comment, of a resolution or ordinance authorizing that acquisition or use and the usage and privacy policy required by the bill's provisions.

2. Requires every local agency that operates cellular communications interception technology to do both of the following:

   1. Maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect information gathered through the use of cellular communications interception technology from unauthorized access, destruction, use, modification, or disclosure; and,

   2. Implement a usage and privacy policy to ensure that the collection, use, maintenance, sharing, and dissemination of information gathered through the use of cellular communications interception technology complies with all applicable law and is consistent with respect for an individual's privacy and civil liberties.

3. Requires the usage and privacy policy to be available in writing to the public, and, if the local agency has an Internet Web site, requires the usage and privacy policy to be posted conspicuously on that Internet Web site.

4. Requires the usage and privacy policy to, at a minimum, include all of the following:

   1. The authorized purposes for using cellular communications interception technology and for collecting information using that technology;

   2. A description of the job title or other designation of the employees who are authorized to use, or access information collected through the use of, cellular communications interception technology. The policy shall identify the training requirements necessary for those authorized employees;

   3. A description of how the local agency will monitor its own use of cellular communications interception technology to ensure the accuracy of the information collected and compliance with all applicable laws, including laws providing for process and time period system audits;

   4. The existence of a memorandum of understanding or other agreement with another local agency or any other party for the shared use of cellular communications interception technology or the sharing of information collected through its use, including the identity of signatory parties;

   5. The purpose of, process for, and restrictions on, the sharing of information gathered through the use of cellular communications interception technology with other local agencies and persons; and,

   6. The length of time information gathered through the use of cellular communications interception technology will be retained, and the process the local agency will utilize to determine if and when to destroy retained information.

5. Allows, in addition to any other sanctions, penalties, or remedies provided by law, an individual who has been harmed by a violation of the bill's provisions to bring a civil action in any court of competent jurisdiction against a person who knowingly caused that violation. Allows the court to award a combination of any one or more of the following:

   1. Actual damages, but not less than liquidated damages in the amount of $2,500;

   2. Punitive damages upon proof of willful or reckless disregard of the law;

   3. Reasonable attorney's fees and other litigation costs reasonably incurred; and,

   4. Other preliminary and equitable relief as the court determines to be appropriate.

6. Defines the following terms:

   1. "Cellular communications interception technology" to mean any device that intercepts mobile telephony calling information or content, including an international mobile subscriber identity catcher or other virtual base transceiver station that masquerades as a cellular station and logs mobile telephony calling information.

   2. "Local agency" to mean any city, county, city and county, special district, authority, community redevelopment agency, or other political subdivision of the state, and includes every county sheriff and city police department.

EXISTING LAW:

1. Declares, pursuant to the California Constitution, that people have the right of access to information concerning the conduct of the people's business, and, therefore, the meetings
   of public bodies and the writings of public officials and agencies shall be open to public scrutiny.

2. Requires, pursuant to the Ralph M. Brown Act (Brown Act), that all meetings of the legislative body of a local agency be open and public, and that all persons be permitted to attend any meeting of the legislative body of a local agency, except as otherwise provided.

3. Provides that ordinances may only be passed at a regular meeting or at an adjourned regular meeting, except as specified for urgency ordinances, and prescribes the procedures for publication of ordinances within 15 days after passage by the local agency.

FISCAL EFFECT: None.

COMMENTS:

1. Bill Summary. This bill requires local agencies to approve the acquisition or use of cellular communications interception technology at a public hearing before deploying it, and requires local agencies to develop and release a usage and privacy policy for this technology. The bill is an author-sponsored measure.

2. Author's Statement. According to the author, "Residents should be made aware of what type of surveillance technology law enforcement agencies use within their community. Residents should also be able to participate in a public process to decide whether or not those surveillance technologies should be used in their communities and if adopted, how the technology should be used."

"Current law, however, does not guarantee this for the use of cell phone intercept technology by local law enforcement agencies. Throughout the state, local governments and law enforcement agencies have been adopting the use of cell phone intercept technology without providing an opportunity for community input.

"The technology, which can be used to mimic a cell phone tower and intercept cell phone information, including locational data, is growing more common. According to the most recent data, at least 11 local jurisdictions in California have purchased the technology. None of the local governments have allowed public input or adopted publicly available policies governing the use of the cell phone tracking technology."

3. Background. What this bill calls "cellular communications interception technology" or CCIT is more commonly referred to elsewhere as an "international mobile subscriber identity (IMSI) catcher" or a "StingRay," which is a brand name for a particular line of cell site emulator.
   
   CCIT is a portable cell phone surveillance tool used by government agencies at the federal, state and local levels that generally consists of an antenna, a processor, and laptop computer for analysis and configuration. They work by emulating the operation of a cellular telephone network tower, which prompts nearby cell phones to switch over and communicate with it like it was the carrier's nearest base station.
   
   The CCIT can be used to collect a variety of data about "caught" cell phones, particularly the phone's unique numeric identifier and its physical location. According to the American Civil Liberties Union (ACLU), CCIT is generally used for two purposes: First, if the government knows a suspect's location, it can use CCIT to determine the unique numeric identifier association with the cell phone. Having this number can facilitate the government's efforts to obtain a wiretap or call records on the target of an investigation. Second, if the government has the unique numeric identifier, it can determine the phone's geographic location, often with an accuracy of up to two meters. CCIT can also be used to capture the content of communications (like voice calls and text messages), although the ACLU does not provide evidence that the local law enforcement agencies have done so with any frequency.

According to an ACLU study, at least 34 law enforcement agencies in 15 states have purchased CCIT. The technology is reportedly used by at least 11 local law enforcement agencies in California, including Alameda County, Los Angeles County, the City of Los Angeles, Sacramento County, San Bernardino County, the City of San Diego, the City and County of San Francisco, and the City of San Jose. There is also evidence to suggest that the Santa Clara County Board of Supervisors authorized its Sheriff’s Office in February 2015 to purchase CCIT as well.

4. Policy Considerations. The Committee may wish to consider the following:

   1. Local Agencies that are Already Using this Technology. Since there are a number of local law enforcement agencies already using this technology, the author may wish to consider making it explicit in the bill that these agencies must also adopt a usage and privacy policy and approve the acquisition and usage of this technology at a regularly scheduled meeting, since the provisions of the bill, if chaptered, will not take effect until January 1, 2016.

   2. Resolution vs. Ordinance. The bill allows a local agency to approve the acquisition or use of cellular communications interception technology with either a resolution or an ordinance. Resolutions do not have the force of law within the jurisdiction but are merely expressions of opinion of evidence of a decision made by the body and often related to the administrative business of the municipality. Also, the procedures for adopting resolutions are not as strict as the procedures for adopting ordinances, and in general, the requirement to publish the ordinance within 15 days after passage in a newspaper of general circulation does not apply to resolutions. The Committee may wish to consider whether the usage and privacy policy and acquisition and usage of this technology should be an act adopted via ordinance, instead of by a resolution.

   3. Technical and Clarifying Amendments. The Committee may wish to consider the following technical changes:

      1. RDAs. The bill's definition of "local agency" includes community redevelopment agencies, and should be struck from the definition.

      2. Use of Technology. Language in subdivision (c) of the bill could be interpreted to require approval each time a local agency wishes to use the technology. The Committee may wish to strike out "or use" from that subdivision, which would mean that the legislative body would only need to authorize the acquisition of the technology and adopt the required usage and privacy policy required by the bill.

      3. Brown Act Cross Reference. Instead of requiring a local agency to acquire and use this technology at a regularly scheduled public meeting with an opportunity for public comment, as the bill specifies, the Committee may wish to consider inserting the appropriate cross reference to the Brown Act, as follows:

(d) The legislative body of a local agency shall not approve a resolution or ordinance authorizing the acquisition or use of cellular communications interception technology, unless the resolution or ordinance is adopted at a regularly scheduled public meeting of the legislative body at which members of the public are afforded a reasonable opportunity to comment upon the proposed resolution or ordinance. held pursuant to the Ralph M. Brown Act (commencing with Government Code 54950 et seq).

5. Arguments in Support. Media Alliance writes that this bill protects the rights of residents suspected of no crime, supports the vulnerable, including those too often unfairly targeted by law enforcement, and improves police-community relations with transparency and public process.

6. Arguments in Opposition. The California State Sheriffs' Association writes that this measure will unduly interfere with the ability of independently elected constitutional officers to deploy the latest technology when investigation and prosecuting criminals, and will set a potentially dangerous precedent by alerting criminal enterprises of a specific type of technology that would be deployed by a sheriff's department.

7. Double-Referral. This bill was heard by the Privacy and Consumer Protection Committee on June 23, 2015, where it passed with an 11-0 vote.

REGISTERED SUPPORT / OPPOSITION:

Support

Bay Area Civil Liberties Coalition

California Civil Liberties Advocacy

Media Alliance

Small Business California

Opposition

California Police Chiefs Association

California State Sheriffs' Association

Analysis Prepared by: Debbie Michel / L. GOV. / (916) 319-3958

Date of Hearing: June 23, 2015

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Mike Gatto, Chair

SBPCA Bill Id:SB 741

Author:(Hill) – As Amended Ver:May 19, 2015

SENATE VOTE: 39-0

SUBJECT: Mobile communications: privacy.

SUMMARY: Requires local agencies to approve the acquisition or use of cellular communications interception technology (CCIT) at a public hearing before deploying it, requires local agencies to develop and release a usage and privacy policy for CCIT, and provides for civil remedies in the event of a violation. Specifically, this bill:

1. Requires a local agency that operates CCIT to:

1. Protect the collected information and data with reasonable operational, administrative, technical, and physical safeguards;

2. Implement and maintain reasonable security procedures and practices; and,

3. Implement and maintain a usage and privacy policy, which shall be available in writing, and online if the local agency has a website.
   
   

1. Requires a local agency's usage and privacy policy to include, at a minimum, all of the following:

1. The authorized purposes for using the CCIT and for collecting information or data with the CCIT;
   
   

2. A description of the employees who are authorized to use, or access information or data collected through the use of, CCIT, as well as the training requirements for those authorized employees;

3. A description of how the use of CCIT will be monitored to ensure compliance with all applicable privacy laws, as well as the process for periodic system audits;

4. A description of reasonable measures that will be used to ensure the accuracy of collected information or data, and the process for correcting errors;

5. A description of how the local agency will comply with the security procedures and practices;

6. The length of time information or data will be stored or retained, and the process for determining if and when to destroy stored or retained information or data;

7. The official custodian or owner of the collected information or data, and the employees responsible for implementation of statutory requirements; and,

8. The purpose of, process for, and limitations on, sharing or disseminating information or data with other persons.

3. Prohibits a local agency from acquiring or using CCIT without its legislative body first adopting a resolution or ordinance authorizing that acquisition or use.
   
   

4. Prohibits the legislative body of a local agency from approving a resolution or ordinance authorizing the acquisition or use of CCIT unless it is adopted at a regularly scheduled public meeting where members of the public have a reasonable opportunity to comment, and the resolution or ordinance includes the proposed usage and privacy policy.
   
   

5. Authorizes an individual harmed by the knowing violation of these provisions to bring a civil action in court.
   
   

6. Authorizes a court to order any or all of the following remedies:

1. Actual damages, but not less than liquidated damages in the amount of two thousand five hundred dollars ($2,500);
   
   

2. Punitive damages upon proof of willful or reckless disregard of the law;
   
   

3. Reasonable attorney’s fees and other litigation costs reasonably incurred; and,
   
   

4. Other preliminary and equitable relief as the court determines to be appropriate.
   
   

1. Defines the terms "cellular communications interception technology" and "local agency."

EXISTING LAW:

1. Provides, pursuant to the California Constitution, that all people have an inalienable right to pursue and obtain privacy. (Cal. Const., art. I, Sec. 1.)

2. Makes it a crime to manufacture, assemble, sell, advertise for sale, possess, transport, import, or furnish to another a device that is primarily or exclusively designed or intended for eavesdropping upon the communication of another, or any device that is primarily or exclusively designed or intended for the unauthorized interception of reception of communications between a cellular radio telephone, as defined, and a landline telephone or other cellular radio telephone. (Penal Code (PC) Section 635)

3. Makes it a crime to purchase, sell, offer to purchase or sell, or conspire to purchase or sell, any telephone calling pattern record or list, without the written consent of the subscriber, or to procure, obtain, attempt to obtain, or conspire to obtain, any calling pattern record or list through fraud or deceit, subject to certain exemptions for law enforcement agencies. (PC 638)

4. Prohibits a state or local agency from allowing another party to control the disclosure of information that is otherwise subject to disclosure pursuant to the California Public Records Act. (Government Code Section 6253.3)

FISCAL EFFECT: None. This bill has been tagged nonfiscal by the Legislative Counsel.

COMMENTS:

1. Purpose of this bill. This bill is intended to create transparency in the use of CCIT on the part of local law enforcement agencies by requiring a public hearing prior to adoption and a usage and privacy policy to guide its use. SB 741 is author-sponsored.

2. Author's statement. According to the author, "Residents should be made aware of what type of surveillance technology law enforcement agencies use within their community. Residents should also be able to participate in a public process to decide whether or not those surveillance technologies should be used in their communities and if adopted, how the technology should be used."

"Current law, however, does not guarantee this for the use of cell phone intercept technology by local law enforcement agencies. Throughout the state, local governments and law enforcement agencies have been adopting the use of cell phone intercept technology without providing an opportunity for community input.

"The technology, which can be used to mimic a cell phone tower and intercept cell phone information, including locational data, is growing more common. According to the most recent data, at least 11 local jurisdictions in California have purchased the technology. None of the local governments have allowed public input or adopted publicly available policies governing the use of the cell phone tracking technology."

3. Understanding CCIT. What this bill calls "cellular communications interception technology" or CCIT is more commonly referred to elsewhere as an "international mobile subscriber identity (IMSI) catcher" or a "StingRay," which is a brand name for a particular line of cell site emulator.
   
   CCIT is a portable cell phone surveillance tool used by government agencies at the federal, state and local levels that generally consists of an antenna, a processor, and laptop computer for analysis and configuration. They work by emulating the operation of a cellular telephone network tower, which prompts nearby cell phones to switch over and communicate with it like it was the carrier's nearest base station.
   
   The CCIT can be used to collect a variety of data about "caught" cell phones, particularly the phone's unique numeric identifier and its physical location. According to the American Civil Liberties Union (ACLU), CCIT is generally used for two purposes: First, if the government knows a suspect's location, it can use CCIT to determine the unique numeric identifier association with the cell phone. Having this number can facilitate the government's efforts to obtain a wiretap or call records on the target of an investigation. Second, if the government has the unique numeric identifier, it can determine the phone's geographic location, often with an accuracy of up to two meters. CCIT can also be used to capture the content of communications (like voice calls and text messages), although the ACLU does not provide evidence that the local law enforcement agencies have done so with any frequency.

According to an ACLU study, at least 34 law enforcement agencies in 15 states have purchased CCIT. The technology is reportedly used by at least 11 local law enforcement agencies in California, including Alameda County, Los Angeles County, the City of Los Angeles, Sacramento County, San Bernardino County, the City of San Diego, the City and County of San Francisco, and the City of San Jose. There is also evidence to suggest that the Santa Clara County Board of Supervisors authorized its Sheriff’s Office in February 2015 to purchase CCIT as well.

4. Concerns over the use of CCIT. There are at least three major concerns over the use of CCIT: a lack of public transparency, a lack of clarity over the standard of evidence needed to authorize use of CCIT, and the potentially overbroad nature of the search itself facilitated by CCIT.

5. Transparency and non-disclosure agreements. One major problem with understanding the full impact of CCIT is that many local law enforcement agencies with the technology have signed non-disclosure agreements (NDAs) with the CCIT manufacturer, which some agencies have cited as a reason for not providing even basic information about their CCIT use.
   
   A KXTV News10 report from March 2014 found that, after submitting public records requests to every major Northern California law enforcement agency, "some agencies provided documentation, but none would discuss how [CCIT] work[s], or even admit they have [CCIT]." For example, the San Jose Police Department provided heavily redacted purchase orders, but would provide no information on CCIT-enabled arrests. Moreover, the Department justified its withholding of information by saying the "equipment is proprietary and used for surveillance missions…Its capabilities can only be discussed with sworn law enforcement officers, the military or federal government. This equipment's capabilities are not for public knowledge and are protected under non-disclosure agreements…"
   
   As another example, the Sacramento County Sheriff's Department has been listed by other law enforcement agencies as owning CCIT, but the Department itself refused to acknowledge its existence, with its spokesman saying "my understanding is that the acquisition or use of this technology comes with a strict non-disclosure requirement…Therefore it would be inappropriate for us to comment about any agency that may be using the technology."
   
   It bears noting that such agreements may already violate state law, which prohibits state or local agencies from allowing another party to control the disclosure of information that is otherwise subject to disclosure pursuant to the California Public Records Act. To the extent that the refusals to provide information described above are premised on the existence of a non-disclosure agreement, rather than because they are non-disclosable under the Public Records Act, then those justifications may be invalid.

Furthermore, the secrecy engendered by these NDAs appears to run counter to fundamental privacy principles. What are now called the Fair Information Practice Principles (or FIPPs), began as an effort by the federal government in 1973 to articulate a set of privacy principles to guide data management, which ultimately coalesced into the eight principles now recognized as FIPPs. The National Institute of Standards and Technology in its National Strategy for Trusted Identities in Cyberspace says "FIPPs are the widely accepted framework of defining principles to be used in the evaluation and consideration of systems, processes, or programs that affect individual privacy. Universal application of FIPPs provides the basis for confidence and trust..."

The first FIPP principle is Transparency: "Organizations should be transparent and notify individuals regarding collection, use, dissemination, and maintenance of personally identifiable information (PII)." Put another way, organizations should not have information collection programs the very existence of which are secret.

To the extent that this bill requires local agencies to publicly disclose the existence of CCIT systems and programs, it would be entirely consistent with the FIPPs.

6. What standard of evidence applies? Another concern exacerbated by the lack of transparency is the standard of evidence for judicial authorization to use CCIT and the danger of less than fully informed judicial oversight.
   
   A February 2015 article by the ACLU states, "The secrecy is not just from the public, but often from judges who are supposed to ensure that police are not abusing their authority. Partly relying on that secrecy, [Florida] police have been getting authorization to use [CCIT] based on the low standard of 'relevance,' not a warrant based on probable cause as required by the Fourth Amendment. In many of the investigations, police never sought a court order authorizing [CCIT] use. In others, they sought a court order on a low "relevance" standard, but not a warrant based on probable cause. Perhaps most troublingly, the records indicate a pattern of excessive secrecy, including concealment of information that should appear in investigative files and court filings. For example, the [Tallahassee Police Department] provided a sample of judicial applications and orders it says were used to justify [CCIT] use, but not one of them contains a single mention or description of Stingray technology. This suggests that judges weren’t being fully informed about what they were approving."
   
   The same article also points out that none of the departments surveyed had a formal policy on CCIT use, or evidence that they consistently seek a warrant before using the technology, which raises important legal questions: "Indeed, records from Tallahassee and elsewhere indicate that police have not been getting warrants…In a strong ruling last year, the Florida Supreme Court held that the Fourth Amendment requires police to get a warrant before asking a phone company to track a cell phone user’s location in real time. The logic of that opinion should apply equally to cell phone tracking using Stingrays. And because Stingrays sweep up information not just about suspects, but also bystanders, the need for robust judicial oversight is all the greater."
   
   

7. The "dragnet" problem and service disruption. Another privacy concern raised by the use of CCIT is that it can affect all mobile users in the vicinity of the device, not just individuals under investigation. This raises important constitutional questions about dragnet-style "general searches" and their prohibition by the Fourth Amendment, as well as practical problems with service disruption for the public.
   
   According to an October 2012 report by the Electronic Frontier Foundation, the general nature of the search effected by CCIT is highly concerning: "[CCIT] - which could potentially be beamed into all the houses in one neighborhood looking for a particular signal—is the digital version of the pre-Revolutionary war practice of British soldiers going door-to-door, searching Americans’ homes without rationale or suspicion, let alone judicial approval. . . . And when police use [CCIT], it’s not just the suspects’ phone information the device sucks up, but all the innocent people around such suspects as well. Some devices have a range of several kilometers, meaning potentially thousands of people could have their privacy violated despite not being suspected of any crime." And while the constitutional question itself (i.e., whether the technology violates the 4^th Amendment) may be a matter for the courts, the underlying issue is hotly contested and clearly of great concern.
   
   Moreover, CCIT can affect mobile device service for all nearby individuals, even those not related to the investigation. According to a Wired magazine article from March 2015, an ACLU court filing referenced a Federal Bureau of Investigation warrant application that admitted that CCIT "has the potential to intermittently disrupt cellular service…Any potential service disruption will be brief and minimized by reasonably limiting the scope and duration of the use of [CCIT]". And while some CCIT systems are designed to recognize 911 calls and let them pass through to legitimate cell towers, Internet access can be substantially disrupted and non-emergency phone communications can be stopped completely by their operation.
   
   In response, the article quotes the ACLU as saying, "We think the fact that [CCIT can] block or drop calls of cell phone users in the vicinity should be of concern to cell service providers, the FCC and ordinary people…If an emergency or important/urgent call (to a doctor, a loved one, etc.) is blocked or dropped by this technology, that's a serious problem."

8. The practical privacy implications of this bill. In trying to address these issues, this bill largely takes a disclosure-based approach. As a matter of transparency, it requires a local agency's legislative body to approve the use of CCIT, which gives the public a means to become aware of a CCIT program and have meaningful input. The bill also requires disclosure in the form of a usage and privacy policy, which gives the public some high-level insight into the uses of CCIT and how the collected data will be handled. It also provides a substantial legal remedy for individuals who are knowingly harmed by a violation of the statute, and requires the local agency to take reasonable precautions to protect the data
   
   In doing so, public transparency and involvement is improved somewhat without restricting law enforcement's ability to use the technology.

9. Potential Committee amendments. One question raised by the author is the possibility that a memorandum of understanding (MOU) or other agreement between two local law enforcement agencies could enable one department to direct the use of CCIT owned by another for their own investigatory purposes, or benefit from collected data, without "acquiring or using" CCIT.
   
   To further the transparency goals of this bill, the author and Committee may wish to consider amending the bill to require the usage and privacy policy to disclose any agreement with another party related to the operation of CCIT or the sharing of collected data.

10. Arguments in support. According to the Media Alliance, "When technology outstrips a deliberative public process to define appropriate and inappropriate uses of that technology, abuses and overreach can occur, damaging civil and human rights and creating unease and conflict with a municipality. By establishing a usage policy pertaining to when the technology may be employed, how the data is to be used, how the data will be protected from unauthorized disclosure and disposed of once it is no longer needed, SB 741 protects the rights of residents suspected of no crime, supports the vulnerable including those too often unfairly targeted by law enforcement and those exercising investigative or whistle-blowing activities or exercising their First Amendment rights, and protects municipal employees and politicians from perceptions or actual incidents of inappropriate usage that can occur when policies are unclear or absent."
    
    Small Business California writes, "[c]urrent law does not provide for the public to know what type of surveillance technology law enforcement agencies use within their community. Residents should be able to participate in a public process to decide whether these surveillance technologies should be used within their communities and how the technologies should be used."

The California Newspaper Publishers Association adds "Currently, 11 jurisdictions in California have purchased [CCIT] monitoring devices…This allows police to conduct warrantless searches of any Californian. Law enforcement agencies have adopted this new technology without any public input, oversight, or in some cases, public knowledge. While California's shield law provides enhanced protections for journalists' data, this protection is jeopardized by the use of cell phone intercept devices. Ultimately, this technology allows for law enforcement to monitor the press without a warrant and without any oversight."

11. Arguments in opposition. According to the California Police Chiefs Association, "While we certainly respect your efforts to strengthen public confidence in law enforcement and shine light on how these devices are used, we are concerned that SB 741 will undermine law enforcement's ability to use discretion to enforce the law and maintain public safety. For example, SB 741 would prohibit a local agency from borrowing [CCIT] from a neighboring agency for a specific investigation if the borrowing agency did not yet have an adopted city resolution or ordinance. Consequently, agencies will be compelled to use alternative, less effective, technologies."

12. Double-referral. This bill is double-referred to the Assembly Local Government Committee, where this bill will be heard if passed by this Committee.

REGISTERED SUPPORT / OPPOSITION:

Support

Bay Area Civil Liberties Coalition

California Newspaper Publishers Association

Media Alliance

Small Business California

Opposition

California Police Chiefs Association

California State Sheriffs’ Association

Analysis Prepared by: Hank Dempsey / P. & C.P. / (916) 319-2200

 THIRD READING  

Bill No: SB 741

Author: Hill (D), et al.

Amended: 5/19/15

Vote: 21

SENATE GOVERNANCE & FIN. COMMITTEE: 7-0, 4/15/15

AYES: Hertzberg, Nguyen, Bates, Beall, Hernandez, Lara, Pavley

SENATE JUDICIARY COMMITTEE: 7-0, 5/12/15

AYES: Jackson, Moorlach, Anderson, Hertzberg, Leno, Monning, Wieckowski

SUBJECT: Mobile communications: privacy

SOURCE: Author

DIGEST: This bill prohibits a local agency from acquiring or using cellular communications interception technology without first adopting a resolution or ordinance and imposes specified requirements on any local agency that uses cellular communication interception technology.

ANALYSIS: Existing law, with some exceptions for law enforcement agencies, makes it a crime to manufacture, assemble, sell, advertise for sale, possess, transport, import, or furnish to another a device that is primarily or exclusively designed or intended for eavesdropping upon the communication of another, or any device that is primarily or exclusively designed or intended for the unauthorized interception of reception of communications between a cellular radio telephone, as defined, and a landline telephone or other cellular radio telephone.

This bill:

1. Requires every local agency that operates cellular communications interception technology to do all of the following:

   1. Ensure that information and data gathered through the use of cellular communications interception technology is protected with reasonable operational, administrative, technical, and physical safeguards to ensure its confidentiality and integrity.

   2. Implement and maintain reasonable security procedures and practices in order to protect information and data gathered through the use of cellular communications interception technology from unauthorized access, destruction, use, modification, or disclosure.

   3. Implement and maintain a usage and privacy policy in order to ensure that the collection, use, maintenance, sharing, and dissemination of information and data gathered through the use of cellular communications interception technology is consistent with respect for an individual’s privacy and civil liberties. This usage and privacy policy must be available in writing, and, if the local agency has an Internet Web site, the usage and privacy policy must be posted conspicuously on that Internet Web site. The usage and privacy policy must include:

      1. The authorized purposes for using cellular communications interception technology and for collecting information or data using that technology.

      2. A description of the employees who are authorized to use, or access information or data collected through the use of, cellular communications interception technology. The policy must identify the training requirements necessary for those authorized employees.

      3. A description of how the use of cellular communications interception technology will be monitored to ensure compliance with all applicable privacy laws and a process for periodic system audits.

      4. A description of reasonable measures that will be used to ensure the accuracy of information or data gathered through the use of cellular communications interception technology and a process to correct errors.

      5. A description of how the local agency will comply with its specified security procedures and practices.

      6. The length of time information or data gathered through the use of cellular communications interception technology will be stored or retained, and the process the local agency will utilize to determine if and when to destroy stored or retained information or data.

      7. The official custodian, or owner, of information or data gathered through the use of cellular communications interception technology and which employees have the responsibility and accountability for implementing this subdivision.

      8. The purpose of, and process for, sharing or disseminating information or data gathered through the use of cellular communications interception technology with other persons. The policy shall also identify how the use or further sharing or dissemination of that information or data will be restricted in order to ensure respect for an individual’s privacy and civil liberties.

2. Prohibits a local agency from acquiring or using cellular communications interception technology unless the agency’s legislative body adopts an authorizing resolution or ordinance.

3. Requires the authorizing resolution or ordinance adopted by a local agency to:

   1. Be adopted at a regularly scheduled public meeting of the legislative body at which members of the public are afforded a reasonable opportunity to comment upon the proposed resolution or ordinance; and

   2. Set forth the local agency’s usage and privacy policy, as specified.

4. Specifies that, in addition to any other sanctions, penalties, or remedies provided by law, an individual who has been harmed by a violation of this bill’s provisions may bring a civil action in any court of competent jurisdiction against a person who knowingly caused that violation.

5. Allows a court to award a combination of any one or more of the following:

   1. Actual damages, but not less than liquidated damages in the amount of $2,500.

   2. Punitive damages upon proof of willful or reckless disregard of the law.

   3. Reasonable attorney’s fees and other litigation costs reasonably incurred.

   4. Other preliminary and equitable relief as the court determines to be appropriate.

Background

Some California sheriff’s offices and police departments are using surveillance devices that allow investigators to gather cellphone signals to pinpoint a suspect’s location. By simulating a cellular communications tower’s functions, these devices force all cell phones within the vicinity to transmit information to the devices. The information that these devices can collect reportedly includes a cell phone’s number, a phone’s unique “International Mobile Subscriber Identification” (IMSI) number, its electronic serial number, the location of the most recent cell tower the phone connected with, and phone numbers dialed from the cell phone. Some reports indicate that the devices can accurately identify a cell phone’s location, even if the phone is turned off, and could be modified to capture the content of calls or text messages from a phone. These devices are known as “IMSI catchers” and sometimes referred to by brand names like “StingRay” or “HailStorm.”

Exact information about how IMSI catchers work and what they can do is difficult to obtain. Local law enforcement agencies’ acquisition and use of these devices is apparently subject to non-disclosure requirements that, according to various sources, are imposed by the devices’ manufacturer, the Federal Bureau of Investigation, or both, to prevent the release of information that could compromise the devices’ effectiveness. Public information requests for documents relating to the devices are either denied or reveal only heavily-redacted materials. Some news reports indicate that local law enforcement authorities even refuse to reveal information about IMSI catchers to elected officials who are considering whether to approve the acquisition and use of the devices by a sheriff or police department.

IMSI catchers are reportedly used by at least 11 local law enforcement agencies in California including Alameda County, Los Angeles County, the City of Los Angeles, Sacramento County, San Bernardino County, the City of San Diego, the City and County of San Francisco, and the City of San Jose. On February 24, 2015, the Santa Clara County Board of Supervisors authorized the Sheriff’s Office to use funding from the State Homeland Security Grant Program to procure a “mobile phone triangulation system,” presumably an IMSI catcher.

The secrecy surrounding this technology raises substantial unanswered questions about the privacy and civil liberties implications of these devices, particularly because IMSI catchers collect information from the phones of anyone in the devices’ vicinity, not just individuals targeted by law enforcement.

Comments

Because of the non-disclosure agreements that law enforcement officials have used to justify the secrecy surrounding IMSI catchers, the public and their elected representatives know very little about this technology. Some of the unanswered questions about IMSI catchers raise fundamental civil liberty and privacy concerns that deserve to be considered by the public. Important questions that merit public consideration include:

• What data is gathered from the phones of third-parties who are unrelated to the purpose for which an IMSI catcher is deployed? Is that data stored for any period of time? Who can access it? How is it used? Is it secured against unauthorized access?

• Can IMSI catchers be modified to capture voice and text content from cell phones? Can law enforcement agencies determine whether the devices are being used to capture content, regardless of whether such use is authorized by the department?

• What policies govern local law enforcement agencies’ deployment and use of IMSI catchers? To what extent do agencies comply with those policies?

• Must local law enforcements agencies’ use of IMSI catchers always be subject to a warrant issued by a judge? Do warrants specifically allow for the collection of data from every cell phone that transmits to the devices?

To get answers to some of the above questions, this bill requires that a law enforcement agency that acquires or uses an IMSI catcher must disclose information about the policies that govern how the agency will use the device and the data gathered by the device. This bill doesn’t prohibit any law enforcement agency from obtaining or using IMSI catchers. This bill simply allows members of the public and their elected representatives to make informed decisions about law enforcement’s deployment of surveillance technology in their communities.

Local control. County sheriffs are elected officials. Because they are directly accountable to the public, they should be allowed to make independent decisions about procuring and deploying law enforcement technology to reflect local needs and priorities. State-imposed restrictions on certain types of technology undermine a sheriff’s ability to use his or her discretion to enforce the law and maintain public safety. By making it more difficult for sheriffs to use IMSI catchers, this bill may compel them to use alternative technologies that may be less effective and result in higher investigative costs. Those decisions may be more appropriately left up to sheriffs and the voters who elect them.

FISCAL EFFECT: Appropriation: No Fiscal Com.: No Local: No

SUPPORT: (Verified 5/19/15)

Bay Area Civil Liberties Coalition

Media Alliance

Small Business California

OPPOSITION: (Verified 5/19/15)

California Police Chiefs Association

California State Sheriffs’ Association

ARGUMENTS IN SUPPORT: >

ARGUMENTS IN OPPOSITION: >

Prepared by: Brian Weinberger / GOV. & F. / (916) 651-4119

5/21/15 11:46:42

**** END ****

SENATE JUDICIARY COMMITTEE

Senator Hannah-Beth Jackson, Chair

2015 - 2016 Regular Session

Bill No: SB 741 (Author:Hill)

Amended: Version: February 27, 2015

Hearing Date: May 12, 2015

Fiscal: No

Urgency: No

Consultant: TH

SUBJECT

Mobile Communications: Privacy

DESCRIPTION

This bill would prohibit a local agency from acquiring or using cellular communications interception technology, as defined, unless its legislative body adopts a resolution or ordinance authorizing the use or acquisition of that technology. This bill would provide that adoption of such a resolution or ordinance may only occur at a regularly scheduled public meeting at which members of the public are afforded an opportunity to comment. This bill would also specify that the resolution or ordinance must set forth the policies of the local agency pertaining to the use of cellular communications interception technology, as specified.

BACKGROUND

Cellular communications interception technology is a type of surveillance tool used by law enforcement to track the location and movements of mobile cellular telephones. About the size of a suitcase, these devices are also known as “International Mobile Subscriber Identity catchers” (IMSI catchers) or more commonly as “StingRays.” They work by simulating a cellphone tower, automatically connecting to all mobile telephones within a given area. “When cellphones within its range connect,” these devices harvest “the IMSI from all of them, which could include data from thousands of unsuspecting people.” (Eric Kurhi, Stingray Surveillance: Cellphone Tracker Has High Potential For Abuse, Say Critics of Santa Clara County Proposal, San Jose Mercury News (Feb. 24, 2015) <http://www.mercurynews.com/crime-courts/ci_27585884/stingray-cell-phone-tracker-santa-clara-county-sheriff> [as of May 4, 2015].) “If the authorities have the IMSI of a subject . . . they can focus on where the phone’s signal is coming from and, after moving the device a few times, triangulate a location to within 10 feet.” (Id.) According to recent media reports, law enforcement agencies in Oakland, Fremont, and San Francisco have acquired IMSI catchers, and nationwide “[a]s many as four dozen federal and local agencies have acknowledged using the devices.” (Richard Winton, Anaheim Police, Sacramento Sheriff Sued Over Surveillance Device, Los Angeles Times (Mar. 10, 2015) <http://www.latimes.com/local/lanow/la-me-l-secret-phone-surveillance-device-20150310-story.html> [as of May 4, 2015].) At least one of these law enforcement agencies has stated its intent to use the device to collect data on protesters.

In response to the issues raised by the use of those devices, this bill would require local agencies to seek approval from their legislative bodies prior to acquiring or using IMSI catchers. This bill would provide that approval may only be granted at a regularly scheduled public meeting of the legislative body, where members of the public are given an opportunity to comment upon the proposed acquisition or use of this technology, as well as the policies of the local agency governing its use.

CHANGES TO EXISTING LAW

Existing law provides that, among other rights, all people have an inalienable right to pursue and obtain privacy. (Cal. Const., art. I, Sec. 1.)

Existing case law permits a person to bring an action in tort for an invasion of privacy and provides that in order to state a claim for violation of the constitutional right to privacy, a plaintiff must establish the following three elements: (1) a legally protected privacy interest; (2) a reasonable expectation of privacy in the circumstances; and (3) conduct by the defendant that constitutes a serious invasion of privacy. (Hill v. National Collegiate Athletic Assn. (1994) 7 Cal.4th 1, 40.)

Existing case law states that legally recognized privacy interests are generally of two classes: interests in precluding the dissemination or misuse of sensitive and confidential information (informational privacy), and interests in making intimate personal decisions or conducting personal activities without observation, intrusion, or interference (autonomy privacy). (Hill v. National Collegiate Athletic Assn. (1994) 7 Cal.4th 1, 35.)

This bill would state that no local agency may acquire or use cellular communications interception technology, as defined, unless approved by its legislative body by adoption of a resolution or ordinance authorizing that acquisition or use.

This bill would provide that the legislative body of a local agency shall not approve a resolution or ordinance authorizing the acquisition or use of cellular communications interception technology, unless the resolution or ordinance is adopted at a regularly scheduled public meeting of the legislative body at which members of the public are afforded a reasonable opportunity to comment upon the proposed resolution or ordinance.

This bill would provide that the resolution or ordinance shall set forth the policies of the local agency as to the circumstances when cellular communications interception technology may be employed, and usage and privacy policies, which shall include, but need not be limited to, how data obtained through use of the technology is to be used, protected from unauthorized disclosure, and disposed of once it is no longer needed.

This bill would state that if the local agency maintains an Internet Web site, the cellular communications interception technology usage and privacy policies shall be posted conspicuously on that site.

COMMENT

1. Stated need for the bill

According to the author:

Residents should be made aware of what type of surveillance technology law enforcement agencies use within their community. Residents should also be able to participate in a public process to decide whether or not those surveillance technologies should be used in their communities and if adopted, how the technology should be used. Current law, however, does not guarantee this for the use of cell phone intercept technology by local law enforcement agencies. Throughout the state, local governments and law enforcement agencies have been adopting the use of cell phone intercept technology without providing an opportunity for community input.

The technology, which can be used to mimic a cell phone tower and intercept cell phone information, including locational data, is growing more common. According to the most recent data, at least 11 local jurisdictions in California have purchased the technology. None of the local governments have allowed public input or adopted publicly available policies governing the use of the cell phone tracking technology.

SB 741 would prevent local governments from authorizing cell phone intercept technology unless use of the technology is approved by a resolution or ordinance at a regularly scheduled public meeting at which community members are afforded an opportunity to comment on the proposed resolution or ordinance. The proposed resolution or ordinance must include a privacy and usage policy pertaining to when the technology may be employed, how the data is to be used, how the data will be protected from unauthorized disclosure and disposed of once it is no longer needed. If the resolution or ordinance is approved, the legislation requires the local agency to post the privacy and usage policy on its website.

2. Fundamental Right to Privacy

The right to privacy is a fundamental right protected by Section 1 of Article I of the California Constitution. This constitutional right to privacy restricts the government and others from infringing upon legally protected privacy interests of California residents. The California Supreme Court has found that “[l]egally recognized privacy interests are generally of two classes: (1) interests in precluding the dissemination or misuse of sensitive and confidential information (informational privacy); and (2) interests in making intimate personal decisions or conducting personal activities without observation, intrusion, or interference (autonomy privacy). (Hill v. National Collegiate Athletic Assn. (1994) 7 Cal.4th 1, 35 [internal quotation marks omitted].) Information and data collected by an IMSI catcher falls into the “informational privacy” class of protected privacy interests.

The Court has held that “[i]nformational privacy is the core value” furthered by the constitutional right of privacy. (Id.) “A particular class of information is private when well-established social norms recognize the need to maximize individual control over its dissemination and use to prevent unjustified embarrassment or indignity. Such norms create a threshold reasonable expectation of privacy in the data at issue.” (Id.) The Court has held that “the usual sources of positive law governing the right to privacy -- common law development, constitutional development, [and] statutory enactment”-- illuminate “[w]hether established social norms safeguard a particular type of information . . . from public or private intervention.” (Id. at 36.)

Recent Fourth Amendment jurisprudence strongly indicates that locational data of the type collected by International Mobile Subscriber Identity catchers (IMSI catchers) falls within a class of information safeguarded by established social norms. In United States v. Jones (2012) 132 S. Ct. 945, the U.S. Supreme Court examined the significant privacy concerns raised by locational tracking technology. The Jones case considered whether the attachment of a Global Positioning System (GPS) tracking device to an individual’s vehicle, and the subsequent use of that device to track the vehicle’s movements on public streets, constituted a search within the meaning of the Fourth Amendment. In her concurring opinion, Justice Sotomayor made the following observations:

Awareness that the Government may be watching chills associational and expressive freedoms. And the Government’s unrestrained power to assemble data that reveal private aspects of identity is susceptible to abuse. The net result is that GPS monitoring--by making available at a relatively low cost such a substantial quantum of intimate information about any person whom the Government, in its unfettered discretion, chooses to track--may alter the relationship between citizen and government in a way that is inimical to democratic society.

I would take these attributes of GPS monitoring into account when considering the existence of a reasonable societal expectation of privacy in the sum of one’s public movements. I would ask whether people reasonably expect that their movements will be recorded and aggregated in a manner that enables the Government to ascertain, more or less at will, their political and religious beliefs, sexual habits, and so on. (United States v. Jones (2012) 132 S. Ct. 945, 955-956 [internal citations and quotation marks omitted].)

Use of an IMSI catcher to track the location of a mobile cellular telephone – and, by extension, its owner – is arguably more invasive than GPS tracking of a vehicle’s movements on public streets. As some commentators have noted, the swathe of data collected by an IMSI catcher is considerably broader than that collected by a GPS tracker. According to the Electronic Frontier Foundation:

A Stingray—which could potentially be beamed into all the houses in one neighborhood looking for a particular signal—is the digital version of the pre-Revolutionary war practice of British soldiers going door-to-door, searching Americans’ homes without rationale or suspicion, let alone judicial approval. . . . And when police use a Stingray, it’s not just the suspects’ phone information the device sucks up, but all the innocent people around such suspect as well. Some devices have a range of several kilometers, meaning potentially thousands of people could have their privacy violated despite not being suspected of any crime. (Stingrays: The Biggest Technological Threat to Cell Phone Privacy You Don't Know About <https://www.eff.org/deeplinks/2012/10/stingrays-biggest-unknown-technological-threat-cell-phone-privacy> [as of May 4, 2015].)

Additionally, unlike other law enforcement surveillance tools such as Automated License Plate Readers and GPS trackers, IMSI catchers are not limited to operating in public places where an individual’s expectation of privacy is arguably diminished. As a federal court in California recently observed, “a cell phone can accompany its owner anywhere. Thus the exposure of the cell site location information can convert what would otherwise be a private event into a public one. . . A cell phone user’s reasonable expectation of privacy in his or her location is especially acute when the call is made from a constitutionally protected area, such as inside a home.” (U.S. v. Elijah Cooper, Order Denying Defendant’s Motion to Suppress (Dkt. 117), 3:13-cr-00693-SI [filed Mar. 2, 2015].)

This bill seeks to bring some transparency to the use of IMSI catchers by requiring local agencies to secure approval of their legislative bodies before using or acquiring these devices. During the approval process, this bill would require a local agency to disclose its usage and privacy policies governing how it will employ these devices. However, without additional guidance, these policies may not be sufficient to ensure that the use of an IMSI catcher does not violate the constitutional right to privacy. In order to provide additional guidance to local agencies about the proper use of these devices and to ensure that local agency use and privacy policies appropriately respect individuals’ privacy and civil liberties, the author offers the following amendments.

Author’s Amendments:

On page 2, between lines 17 and 18, insert:

(c) (1) Implement and maintain a usage and privacy policy in order to ensure that the collection, use, maintenance, sharing, and dissemination of information and data gathered through the use of cellular communications interception technology is consistent with respect for individuals’ privacy and civil liberties. This usage and privacy policy shall be available in writing, and, if the local agency has an Internet Web site, the usage and privacy policy shall be posted conspicuously on that Internet Web site.

(2) The usage and privacy policy shall, at a minimum, include all of the following:

(A) The authorized purposes for using cellular communications interception technology, and for collecting information or data using such technology.

(B) A description of the employees who are authorized to use, or access information or data collected through the use of, cellular communications interception technology. The policy shall identify the training requirements necessary for those authorized employees.

(C) A description of how the use of cellular communications interception technology will be monitored to ensure compliance with all applicable privacy laws and a process for periodic system audits.

(D) A description of reasonable measures that will be used to ensure the accuracy of information or data gathered through the use of cellular communications interception technology and a process to correct errors.

(E) A description of how the local agency will comply with the security procedures and practices implemented and maintained pursuant to subdivision (b).

(F) The length of time information or data gathered through the use of cellular communications interception technology will be stored or retained, and the process the local agency will utilize to determine if and when to destroy stored or retained information or data.

(G) The official custodian, or owner, of information or data gathered through the use of cellular communications interception technology and which employees have the responsibility and accountability for implementing subdivision (b) and this subdivision.

(H) The purpose of, and process for, sharing or disseminating information or data gathered through the use of cellular communications interception technology with other persons. The policy shall also identify how the use or further sharing or dissemination of such information or data will be restricted in order to ensure respect for individuals’ privacy and civil liberties.

On page 2, strike lines 29 through 30, strike page 3 in its entirety, and insert: “of the local agency as required by subdivision (c).”

3. Data Security

As discussed in Comment 2, the type of information collected through the use of an IMSI catcher is highly sensitive. Locational data taken from a mobile cellular telephone, especially over time, can be used to determine the owner’s political and religious beliefs, known associates, frequented places, and even their medical conditions. Before a local agency can obtain authorization to use an IMSI catcher, this bill would require the legislative body approving the use or acquisition of such a device to formulate a use and privacy policy describing how data collected by the device would be protected from unauthorized disclosure. However, the bill does not impose any direct requirements to ensure that collected data is protected from misuse or data breach with appropriate safeguards. To ensure that data collected using an IMSI catcher remains confidential and is protected from unauthorized access or use, the author offers the following amendments that would require local agencies to implement and maintain specific security procedures to safeguard this data.

Author’s Amendment:

On page 3, between lines 17 and 18, insert:

(b) Every local agency that operates cellular communications interception technology shall do all of the following:

(1) Ensure that information and data gathered through the use of cellular communications interception technology is protected with reasonable operational, administrative, technical, and physical safeguards to ensure its confidentiality and integrity.

(2) Implement and maintain reasonable security procedures and practices in order to protect information and data gathered through the use of cellular communications interception technology from unauthorized access, destruction, use, modification, or disclosure.

4. Pending Litigation

In the past, this Committee has raised concerns about bills that interfere with pending litigation. Any such interference could result in a direct financial windfall to a private party, prevent a court from deciding an action based upon the laws in place at the time the cause of action accrued, or create a situation where the legislative branch is used to circumvent the discretion and independence of the judicial branch.

The author has informed the Committee that the Electronic Frontier Foundation (EFF) is engaged in litigation with the United States over an alleged failure to release documents related to IMSI catchers pursuant to a federal Freedom of Information Act (FOIA) request. This bill is unlikely to impact that litigation since it does not impact FOIA, or the withholding or production of documents related to IMSI catchers. To the extent the usage and privacy policies that must be implemented under this bill would require the disclosure of information also subject to EFF’s FOIA litigation, the disclosures required by this bill would be prospective only. Under California law, “a statute may be applied retroactively only if it contains express language of retroactivity or if other sources provide a clear and unavoidable implication that the Legislature intended retroactive application.” (Myers v. Philip Morris Companies, Inc. (2002) 28 Cal.4th 828, 844.) This bill neither contains express retroactivity language, nor provisions evincing a clear Legislative intent that it should be given retroactive effect. Consequently, were it to be enacted, this bill would likely have no legal impact on the claims or defenses at issue in EFF’s FOIA suit.

5. Opposition Concerns

The Citizens for Criminal Justice Reform (CCJR) states that they are opposed to this bill because it “grants too much power to local municipalities and does not go far enough to protect the private data of unsuspecting citizens.” They state that “[l]aw enforcement use of cell phone intercept technology absent a warrant or probable cause . . . is ipso facto unconstitutional,” and that “leaving the implementation of such technology to be determined by local municipalities will result in inconsistency throughout the state and adversely impact the lawful privacy expectations of transient citizens.”

To ensure that aggrieved parties are able to redress harms caused by a local agency’s unlawful use or implementation of IMSI catcher technology, the author offers the following amendments to provide a right of action to challenge a local agency’s non-compliance with the provisions of this bill.

Author’s Amendment:

On page 3, after line 6, insert:

(d) In addition to any other sanctions, penalties, or remedies provided by law, an individual who has been harmed by a violation of this title may bring a civil action in any court of competent jurisdiction against a person who knowingly caused that violation. The court may award a combination of any one or more of the following:

(1) Actual damages, but not less than liquidated damages in the amount of two thousand five hundred dollars ($2,500).

(2) Punitive damages upon proof of willful or reckless disregard of the law.

(3) Reasonable attorney’s fees and other litigation costs reasonably incurred.

(4) Other preliminary and equitable relief as the court determines to be appropriate.

The California Police Chiefs Association, in opposition, writes that this bill “would prohibit a local agency from borrowing a StingRay from a neighborhood agency for a specific investigation if the borrowing agency did not yet have an adopted city resolution or ordinance,” compelling them “to use alternative, less effective, technologies.” Similarly, the California State Sheriffs’ Association, also in opposition, states that “this measure unduly interferes with the ability of independently elected constitutional officers to deploy the latest technology when investigating and prosecuting criminals,” and that this bill may “[alert] criminal enterprises of a specific type of technology that would be deployed by a sheriff’s department.”

Support: Bay Area Civil Liberties Coalition; Media Alliance; Small Business California

Opposition: Citizens for Criminal Justice Reform; California Police Chiefs Association; California State Sheriffs’ Association

HISTORY

Source: Author

Related Pending Legislation: None Known

Prior Legislation: None Known

Prior Vote: Senate Governance and Finance Committee (Ayes 7, Noes 0)

**************

SENATE COMMITTEE ON GOVERNANCE AND FINANCE

Senator Robert M. Hertzberg, Chair

2015 - 2016 Regular

CELLULAR COMMUNICATION INTERCEPTION TECHNOLOGY

Prohibits a local agency from acquiring or using cellular communications interception technology without first adopting a resolution or ordinance that meets specified criteria.

Background and Existing Law

Some California sheriff’s offices and police departments are using surveillance devices that allow investigators to gather cellphone signals to pinpoint a suspect’s location. By simulating a cellular communications tower’s functions, these devices force all cell phones within the vicinity to transmit information to the devices. The information that these devices can collect reportedly includes a cell phone’s number, a phone’s unique “International Mobile Subscriber Identification” (IMSI) number, its electronic serial number, the location of the most recent cell tower the phone connected with, and phone numbers dialed from the cell phone. Some reports indicate that the devices can accurately identify a cell phone’s location, even if the phone is turned off, and could be modified to capture the content of calls or text messages from a phone. These devices are known as “IMSI catchers” and sometimes referred to by brand names like “StingRay” or “HailStorm.”

Exact information about how IMSI catchers work and what they can do is difficult to obtain. Local law enforcement agencies’ acquisition and use of these devices is apparently subject to non-disclosure requirements that, according to various sources, are imposed by the devices’ manufacturer, the Federal Bureau of Investigation, or both, to prevent the release of information that could compromise the devices’ effectiveness. Public information requests for documents relating to the devices are either denied or reveal only heavily-redacted materials. Some news reports indicate that local law enforcement authorities even refuse to reveal information about IMSI catchers to elected officials who are considering whether to approve the acquisition and use of the devices by a sheriff or police department.

IMSI catchers are reportedly used by at least 11 local law enforcement agencies in California including Alameda County, Los Angeles County, the City of Los Angeles, Sacramento County, San Bernardino County, the City of San Diego, the City and County of San Francisco, and the City of San Jose. On February 24, 2015, the Santa Clara County Board of Supervisors authorized the Sheriff’s Office to use funding from the State Homeland Security Grant Program to procure a “mobile phone triangulation system,” presumably an IMSI catcher.

The secrecy surrounding this technology raises substantial unanswered questions about the privacy and civil liberties implications of these devices, particularly because IMSI catchers collect information from the phones of anyone in the devices’ vicinity, not just individuals targeted by law enforcement.

Some local officials want the public to have more information about the use of cellular communication surveillance devices in their communities.

Proposed Law

Senate Bill 741 prohibits a local agency from acquiring or using cellular communications interception technology unless the agency’s legislative body adopts an authorizing resolution or ordinance. The authorizing resolution or ordinance must:

• Be adopted at a regularly scheduled public meeting of the legislative body at which members of the public are afforded a reasonable opportunity to comment upon the proposed resolution or ordinance;

• Set forth the local agency’s policies as to the circumstances when cellular communications interception technology may be employed; and,

• Set forth usage and privacy policies, which must include how data obtained through use of the technology is to be used, protected from unauthorized disclosure, and disposed of once it is no longer needed.

SB 741 defines “cellular communications interception technology” as any device that intercepts mobile telephony calling information or content, including an international mobile subscriber identity catcher or other virtual base transceiver station that masquerades as a cellular station and logs mobile telephony calling information.

SB 741 defines “local agency” as any city, county, city and county, special district, authority, community redevelopment agency, or other political subdivision of the state, including every county sheriff and city police department.

The bill requires that the cellular communications interception technology usage and privacy policies must be posted conspicuously on an agency’s Internet Web site, if the Agency maintains an Internet Web site.

State Revenue Impact

No estimate.

Comments

1. Purpose of the bill. Because of the non-disclosure agreements that law enforcement officials have used to justify the secrecy surrounding IMSI catchers, the public and their elected representatives know very little about this technology. Some of the unanswered questions about IMSI catchers raise fundamental civil liberty and privacy concerns that deserve to be considered by the public. Important questions that merit public consideration include:

• What data is gathered from the phones of third-parties who are unrelated to the purpose for which an IMSI catcher is deployed? Is that data stored for any period of time? Who can access it? How is it used? Is it secured against unauthorized access?

• Can IMSI catchers be modified to capture voice and text content from cell phones? Can law enforcement agencies determine whether the devices are being used to capture content, regardless of whether such use is authorized by the department?

• What policies govern local law enforcement agencies’ deployment and use of IMSI catchers? To what extent do agencies comply with those policies?

• Must local law enforcements agencies’ use of IMSI catchers always be subject to a warrant issued by a judge? Do warrants specifically allow for the collection of data from every cell phone that transmits to the devices?

To get answers to some of the above questions, SB 741 would require that a law enforcement agency that acquires or uses an IMSI catcher must disclose a modest amount of information about the policies that govern how the agency will use the device and the data gathered by the device. SB 741 doesn’t prohibit any law enforcement agency from obtaining or using IMSI catchers. The bill simply allows members of the public and their elected representatives to make informed decisions about law enforcement’s deployment of surveillance technology in their communities.

2. Local control. County sheriffs are elected officials. Because they are directly accountable to the public, they should be allowed to make independent decisions about procuring and deploying law enforcement technology to reflect local needs and priorities. State-imposed restrictions on certain types of technology undermine a sheriff’s ability to use his or her discretion to enforce the law and maintain public safety. By making it more difficult for sheriffs to use IMSI catchers, SB 741 may compel them to use alternative technologies that may be less effective and result in higher investigative costs. Those decisions may be more appropriately left up to sheriffs and the voters who elect them.

3. Not far enough. Some civil liberties advocates suggest that SB 741 may not go far enough. They suggest that SB 741’s public disclosure requirements, which allow the public to consider and comment upon local IMSI policies, are an insufficient response to this problematic surveillance technology. Instead, they want legislators to consider statewide standards that will address some of the broader privacy and unreasonable search issues raised by IMSI catchers.

4. Double-referred. The Senate Rules Committee has ordered a double-referral of SB 741 --- first to the Senate Governance & Finance Committee which has policy jurisdiction over state laws relating to local governments, and then to the Senate Judiciary Committee.

Support and Opposition

(4/9/15)

Support: Bay Area Civil Liberties Coalition; California Newspaper Publishers Association; Small Business California.

Opposition: Citizens for Criminal Justice Reform - California.

-- END --