FBI’s stingray (future tech???) quickly found suspect after local cops’ device couldn’t
New court filings in US v. Ellis show the lengths that Oakland police, FBI went to.
OAKLAND, Calif.—According to new government affidavits filed earlier this week, the Oakland Police Department (OPD) used its stingray without a warrant in 2013 for several hours overnight as a way to locate a man accused of being involved in shooting a local police officer. The OPD called in the FBI when that effort was unsuccessful. The FBI was somehow able to locate the suspect in under an hour, and he surrendered to OPD officers.
That suspect, Purvis Ellis, is the lead defendant in the case of United States v. Ellis et al. The case involves four men who are charged with the January 21, 2013 attempted murder of local police officer Eric Karsseboom in the parking area in front of a Seminary Avenue apartment complex in East Oakland. The men are also charged with running an alleged local gang, centered around Seminary Avenue (known as "SemCity").
While these new filings fill out the timeline a bit more, they also raise new questions in Ellis. The case has provided rare insight into how this surveillance device, also known as a cell-site simulator, is used in practice to find suspects and the seeming lengths the government is willing to go to keep it quiet. The tool has come under increasing scrutiny by lawmakers and activists in recent years. Since this case began, the Department of Justice, which oversees the FBI, and the State of California now require a warrant when a stingray is used in most circumstances.
According to the government, Ellis, who is not accused of being the actual shooter, was the target of both the Oakland Police Department’s and the FBI’s stingrays. (The victim of the shooting, Karsseboom, previously identified co-defendant Deante Kincaid as the man who actually fired the non-fatal shot that struck Karsseboom in the wrist.)
Earlier this month, US Magistrate Judge Donna Ryu ordered the government to formally declare how the stingrays were used to find Ellis, who was either in the apartment building or immediately present for the shooting of Karsseboom. He ultimately surrendered to the OPD when he emerged from Apartment #112 at about 11am on January 22, 2013.
His attorney, Martha Boersch, told Ars that she was unable to comment on her client’s precise location during the encounter with Karsseboom, who testified that his encounter involved the other three defendants. It is also unclear why the stingray solely targeted Ellis when the other three suspects had fled the scene by the time the stingray was activated at the Seminary Ave. apartment complex.
These new filings are the government's attempt to address Ryu's judicial order. All of the discussion regarding stingrays, among other issues pending before the court, are part of the criminal discovery process, which has been ongoing for nearly three years.
“We’re nowhere near setting a trial date,” US District Judge Phyllis Hamilton told both sides during a Wednesday hearing in federal court in Oakland.Four men remain accused
All parties agree that Karsseboom was shot at about 6:15pm on January 21. Karsseboom arrived at the apartment not in uniform and not in a marked patrol car—he was sent there to look for a car the OPD believed was involved in an earlier shooting. Karsseboom told a state court hearing in 2013 (before the case was moved to federal court) that he did not declare he was a cop until after the trigger was pulled, at which point the three men he says confronted him ran away.
Karsseboom later recalled the shooting during that preliminary examination, but in retrospect, court documents show that details start becoming murky at this point. OPD declared the scene "secure" by 6:29pm. But a few hours after the incident, OPD Officer Steve Valle received a call from a confidential informant who is labeled in court documents only as "X." X told Valle that she or he received a call where X learned the names of two people involved in the original, January 20 shooting: Deante Kincaid and Damien McDaniel. X said two others were present: Purvis Ellis and someone named Lil’ Joe, later identified as Joseph Pennymon. (Kincaid, McDaniel, and Pennymon are the other three co-defendants in US v. Ellis.)
The government has argued that while two stingrays were used to locate Ellis, it did not need a warrant given “exigent circumstances,” a particular situation that provides an exception to the 4th Amendment. According to American criminal procedure law, an exigent circumstance involves imminent bodily harm or injury, the destruction of evidence, or the flight of a suspect.
Prosecutors argued that because the three men involved in the altercation were at large, there was a clear exigency. Ellis’ defense, meanwhile, has countered that because the OPD had declared the scene “secure” 14 minutes after Karsseboom was shot, there was no exigency. This issue remains unresolved.
Calling in the feds
FURTHER READING
Baltimore police accused of illegal mobile spectrum use with stingrays
The new Monday filings consist of a pair of affidavits, one from an FBI special agent, whose name was redacted, and another by an OPD officer, whose name was also withheld.
The OPD officer wrote that she or he was alerted to the incident at 6:40pm and was told to respond. But given that the officer was off-duty, and as most OPD officers live outside the city, the officer told the court that it would have taken up to two hours to return to Oakland. By the time the officer arrived on the scene with what seems to have been an OPD surveillance van, it was around 9:00pm.
The Oakland cop wrote that her or his team finally turned on the stingray at about midnight, in the early morning hours of January 22.
The officer continued:
Prior to operating the cell site simulator, OPD first contacted the telephone carrier of the subject cellular telephone and completed the required exigent circumstance request form to obtain a pen register/trap trace and subscriber information for phone number 510-904-7509 to assist in locating the cellular telephone with the cell site simulator. I did not begin operating the device until after OPD obtained this information from the telephone provider.
Prosecutors did not respond to Ars’ request for further information about how authorities obtained Ellis’ number, why he was targeted, or how long the OPD's stingray was in operation.
It's likely that the “subscriber information” MetroPCS provided included not only the name on the account but also the IMSI number associated with that number, which allowed the stingray to begin its search. The affidavit seems to suggest (but does not outright say) that the OPD stingray was in operation continuously for nearly 10 hours.
As Ars reported previously, according to an OPD log that was later redacted, a notice soon went out at 5:24am: "PING SUSP PHONE IN BLDG TWDS REAR STILL." In addition to a Computer Aided Dispatch log notation from 3am, this message seems to be the second indication in all of the publicly available records that some sort of cell phone surveillance was taking place.
Despite seemingly being able to ping Ellis’ phone, the OPD wasn’t actually able to locate it—so then they called in the FBI. According to the FBI affidavit, the special agent was notified at about 7:00am on January 22 and got to work. The FBI showed up at about 9:00am and had its stingray set up by about 10:00am, at which point the OPD shut down its cell-site simulator.
The FBI agent wrote:
Upon powering the cell site simulator on, it detected the presence of the subject cellular telephone within the apartment building located at 1759 Seminary Street, Oakland, California. Once the cell site simulator identified the subject cellular device, it only obtained the signaling information relating to that particular phone. As previously noted, such signaling information did not include content such as e-mails, texts, contact lists, images, or other data from the phone, nor did it provide subscriber account information.
At one point, in an effort to reduce the error radius and increase the accuracy of the location of the cellular telephone, a cell site simulator augmentation device was deployed into the interior of the apartment building. This device is used in conjunction with the cell site simulator and has no data storage capability whatsoever. As before, during this operation of the cell site simulator, only limited signaling data and identifying information was collected from the targeted cellular telephone. At all times during the deployment of the cell site simulator and the augmentation device, the equipment and I were located in publicly accessible areas in and around the target apartment building.
The stingray seems to have been successful—Ellis emerged from Apartment #112 just before 11:00am and was taken into custody. The FBI shut down its operation immediately and “all data for this incident was purged.” Similarly, the OPD affidavit noted that it “did not retain any information regarding the information encountered by its cell site simulator.”
Was Oakland’s stingray obsolete?
FURTHER READING
Cities scramble to upgrade “stingray” tracking as end of 2G network looms
Ars presented these new affidavits to two privacy activists, who both seem to believe that the FBI had a more advanced stingray at the time.
In September 2014—nearly two years after the Seminary Ave. shooting—Ars reported that Oakland was one of a handful of cities across America that was pursuing a “Hailstorm” upgrade to its existing stingray system. The Hailstorm is necessary because older models cannot penetrate a more modern 4G LTE connection.
“It's unclear from the Oakland declaration how continuous the operation of their equipment was,” Brian Hofer, chair of the City of Oakland Privacy Advisory Commission, told Ars. His newly created commission has been scrutinizing the city’s procurement process for surveillance and has pushed for new policies overseeing its use.
“We believe that Oakland only had an older 2G/3G Stingray, based on public records in our possession,” he continued. “It is possible that the FBI already possessed a Hailstorm or similar 4G capable device at this time, or an older 2G/3G system but with enhanced amplification, or maybe Oakland's equipment was simply malfunctioning."
Daniel Rigmaiden, who was the defendant in the most well-known stingray case, US v. Rigmaiden, agreed with this analysis.
“The FBI was probably using whatever is the top of line at the time, while OPD was likely using whatever public records may tell us,” he said. “In any event, it probably just came down to the FBI being better at using the equipment (the OPD person may have had some technical problems), or maybe the equipment used by OPD was too old to work with the target phone. If I had to guess, OPD tried all night, finally conceded, and then called in the pros. This is a good argument as to why local governments don't need this equipment, i.e., if the FBI is willing to just step in at anytime.”
Rigmaiden also speculated that the FBI’s “augmentation device” was a KEYW device or something similar.
He also noted that he believes the policies to immediately delete all data are “just a cover to destroy information that could reveal technical details of the equipment.”
“It's ridiculous to think that all data needs to be deleted from a Stingray in order to protect the privacy of third parties (or whatever their other reasons are),” he said, speculating that this could be a Brady violation, a legal ruling where the government has found to not provide evidence that could be exculpatory to the defense.
“Like any computer, it's very easy to delete some files or data while saving other files or data,” he continued.
“When law enforcement clears a stingray of data, it could very easily save and preserve the data collected on the target phone. When this is not done, it is a Brady violation—like what the attorneys argued in Ellis. This isn't an ‘all or nothing’ scenario. You can delete third-party data from a stingray while preserving relevant evidence for the defense. The fact that this is not done is what alarms me. The fact that the OPD has no set policy to destroy Brady material (while the FBI does) is just incidental to me. It's more alarming to me that law enforcement continues to get away with destroying evidence. These are serious charges and this is evidence that would be helpful to the defense. It was wrong for the OPD and FBI to delete it.”