Illinois will soon require that police obtain a warrant before using cell-site simulators. Under a law signed by Illinois Governor Bruce Rauner, police now have to demonstrate probable cause to obtain a warrant. Previously, police departments had been deploying cell-site simulators, commonly known by the brand name of Stingray, without judicial authorization.
The Illinois law seeks to rectify this by mandating that police get a warrant before deploying a cell-site simulator. Under the Citizen Privacy Protection Act, the warrant application: “must include a description of the nature and capabilities of the cell site simulator device to be used and the manner and method of its deployment, including whether the cell site simulator device will obtain data from non-target communications devices.” To address the privacy of other devices in range, the law mandates that any data not from the target be immediately deleted.
The law also explicitly excludes data obtained from the use of illegal cell-site simulators from being admissible in court. “If the court finds by a preponderance of the evidence that a law enforcement agency used a cell site simulator to gather information in violation of the limits in Sections 10 and 15 of this Act, then the information shall be presumed to be inadmissible in any judicial or administrative proceeding.” Worth noting here is that it's on the preponderance of evidence which is a lower level of proof (that used in civil judgments) then is used for criminal convictions.
Cell-site simulators broadcast as a cellular tower to all devices in range. This allows the operator to track calls, SMS, data, and location. These devices have become common tools among police departments, as well as various federal agencies. However, judges across the country have ruled that their unfettered use by police violates the Fourth Amendment. They also raise the privacy concern of being able to pick up data from all cellular devices and not just an intended target. Organizations such as the Electronic Frontier Foundation have fought against their use without judicial oversight.
Because they present themselves as a tower, they affect all devices connected to that particular cellular provider. The Illinois law mandates the deletion of additional data “no later than within 72 hours of the time that the unknown communications device is identified, absent a court order preserving the non-target data and directing that it be file under seal with the court”.
The bill passed both the Illinois House and Senate unanimously. Illinois now joins California, Minnesota, Utah, Virginia, and Washington in requiring warrants for the deployment of Stingray and other simulators. The Department of Justice requires a warrant, but as a matter of policy and not a legal mandate. The law takes effect January 1, 2017.