States Eye Surveillance Limits Amid Congressional Stalemate

State legislators can act on surveillance laws while their federal counterparts remain locked in stalemate, privacy supporters said. “The only reason that this is happening in the states is that Congress is thoroughly asleep at the switch,” said Electronic Frontier Foundation Director-Grassroots Advocacy Shahid Buttar. The federal government “hasn’t been able to pass many things” for several years, said Khadine Bennett, associate legislative director for the American Civil Liberties Union of Illinois. There are supporters at the federal level, but “it’s more where politics are than this particular issue,” she said. Having the conversation at a state level has an advantage of bringing the discussion closer to the people affected, she said.

The Illinois law is the strongest so far and could succeed in other states, said Bennett, who helped draft the Illinois bill and move it through the legislature and to the governor with only a few “minor tweaks.” Law enforcement and members of both parties, including the governor, supported the bill, she said. Convincing lawmakers was typically a matter of explaining the issue, she said: “When you tell a lawmaker that law enforcement has the power to intercept your text messages or drain your battery, and you have no idea it’s happening,” and it also consumes information of nearby nontargets, “warning bells go off pretty quickly.”

Gov. Bruce Rauner (R) signed the Citizen Privacy Protection Act July 20. By requiring a warrant for cellsite simulators, Illinois joined a handful of other states, including Utah, Virginia, Washington, California and Minnesota, said Buttar. But the Illinois law goes beyond the other state laws, adding an exclusionary remedy for violations -- if police use a simulator without warrant, courts will suppress the information and not consider it at trial, he said. The law says the surveillance technology may be used in only two ways -- to locate or track a known device and to identify an unknown device, banning other uses, including intercepting content or metadata of calls or short messages, infecting phones with malware or blocking a device from communicating with others, he said. It requires police to delete data incidentally obtained from nontargets -- within 24 hours after location tracking or within 72 hours for identifying a device, he said.

“It’s an extremely strong law,” said Gabe Rottman, a deputy director at the Center for Democracy & Technology. “It reflects the growing legal consensus that location information is as sensitive, and in cases much more sensitive, than the content of your letters or emails,” he said. “It’s also, hopefully, another nail in the coffin of the ‘third-party doctrine,’ the notion that you have no expectation of privacy in information that you voluntarily disclose to another. Our mobile providers have information about our religious beliefs, romantic entanglements, political activities and countless other details of our private lives.”

It’s imperfect, said Buttar. “One thing that the Illinois bill still leaves to be desired is addressing the ways other similar surveillance technologies can be, have been and -- quite frankly -- will likely be abused by police.” By legislating specifically on cellsite simulators, “it’s fixing last year’s problem,” he said. StingRays came out in 2007, he noted. “What is the technology being deployed in 2016 that the public knows nothing about and … might not find out about until the mid-2020s?” For example, a recent Bloomberg report said the Baltimore Police Department, facing criticism for use of cellsite simulators, tested persistent aerial surveillance without notifying the public, he said. The Illinois bill wouldn't cover that, he said.

In that sense, the June mandate in Santa Clara County may be stronger than the Illinois measure, said Buttar. The law, which took effect in July, requires any police purchase of any surveillance technology -- including tech that hasn’t yet been developed -- to be approved by the county board, after public notice and comment, he said. It subjects the approved surveillance technologies to annual audits to show how they’re being used, he said. While covering a wider array of surveillance technologies, the Santa Clara ordinance is weaker than the Illinois law in that it lacks explicit limits or punishments on offensive uses of purchased technologies, Buttar said. “The ideal bill from our perspective would be one that requires a warrant and an exclusionary remedy and transparency for any device platform.”

The California legislature may consider a state bill​ based on the county ordinance when its new session starts next year, said Santa Clara County Supervisor Joe Simitian, the measure’s author and a former state lawmaker who was on privacy committees. Simitian is in talks with state Sen. Jerry Hill (D) to introduce the state version, the supervisor told us Friday. “Having a uniform standard at the state level certainly makes sense,” he said. “The concern that I would have is whether or not the standard would be equally robust.” He wouldn’t support a measure that dilutes requirements and preempts stronger local rules, he said.

With the ordinance, Simitian wanted to put in place a policy for surveillance technology purchases “rather than dealing with these on a one-off or ad hoc basis.” Finalizing the bill took a year and a half due to concerns, including from the sheriff, district attorney and some county staff, about the amount of paperwork and because it didn’t specify which technologies would be included. Keeping the bill technology neutral was key to making the measure future-proof, he said. “It’s a pretty straightforward notion.” Authorities using taxpayers’ money to buy surveillance technology to be used on those taxpayers should ask about privacy and due process implications, he said. "We can both protect the public safety and respect the public's privacy and due process."

With most legislatures adjourned for the year, more state action likely will wait until next year, said ACLU Staff Attorney Nathan Wessler. New York's legislature is still in session and has one bill pending, he said, but there hasn’t appeared to be any movement since January. States that have laws addressing cellsite simulators include California, Vermont, Virginia and Washington, he said. “A number of additional states have enacted laws requiring a warrant for all real-time cellphone location tracking, whether conducted via the service provider or using a cellsite simulator.” They include Maine, Utah, Maryland, Montana, New Hampshire, Indiana, Minnesota and California.

Virginia has no immediate plans to revive a surveillance bill vetoed in 2015 by Gov. Terry McAuliffe (D), a state legislator said. McAuliffe signed bills requiring warrants for drones and cellsite simulators, but vetoed a bipartisan bill restricting use of license plate readers and other surveillance technologies. The vetoed bill’s House sponsor, Del. Mark Cole (R), has “no plans to introduce such legislation and I am not aware if anybody else plans to or not,” he emailed Friday.