SACRAMENTO, Calif. (Oct. 9, 2015) – Yesterday, California Gov. Jerry Brown signed into law not just one, but two bills putting into place privacy protections among the strongest in the country. The new laws work together to protect privacy from some of the worst spying programs on the state level, and also take on a part of the federal surveillance state.
Sen. Mark Leno (D) and Sen. Joel Anderson (R) introduced Senate Bill 178 (SB178), the California Electronic Communications Privacy Act (CalECPA) in February. Touted as a major electronic data privacy act, the bill would prohibit government entities from “compelling the production of or access to electronic communication information or electronic device information,” and bar them from obtaining electronic device information by means of “physical interaction or electronic communication with the electronic device” without a search warrant, a wiretap order, an order for electronic reader records, or “pursuant to a subpoena issued pursuant to existing state law, provided that the information is not sought for the purpose of investigating or prosecuting a criminal offense,” with only a few exceptions.
As noted by the Electronic Frontier Foundation (EFF), “CalECPA protects Californians by requiring a warrant for digital records, including emails and texts, as well as a user’s geographical location. These protections apply not only to your devices, but to online services that store your data. Only two other states have so far offered these protections: Maine and Utah.”
SB178 passed the Assembly and Senate by wide margins.
“Governor Brown just signed a law that says ‘no’ to warrantless government snooping in our digital information. This is a landmark win for digital privacy and all Californians,” Nicole Ozer, a lawyer with the American Civil Liberties Union of California ACLU, said in a statement. “We hope this is a model for the rest of the nation in protecting our digital privacy rights.”
The legislation will also require law enforcement to obtain a warrant, wiretap order, an order for electronic reader records or a subpoena before compelling any person other than the owner of the device to produce electronic information. This specifically includes third party providers.
Passage will also help block the use of cell site simulators, known as “stingrays.” These devices essentially spoof cell phone towers, tricking any device within range into connecting to the stingray instead of the tower, allowing law enforcement to sweep up communications content, as well as locate and track the person in possession of a specific phone or other electronic device. SB178 will require a warrant, wiretap order, or an order for e-reader records before police could deploy these devices under most circumstances.
SB178 does include an exception to the warrant requirement “If the government entity, in good faith, believes that an emergency involving danger of death or serious physical injury to any person requires access to the electronic device information.” It also allows access to information in order to locate a lost or stolen device and with the “specific consent” of the owner of the device.
Under the new law, a service provider may voluntarily disclose electronic communication information or subscriber information when that disclosure is not otherwise prohibited by state or federal law. If a government entity receives electronic communication information voluntarily provided pursuant to subdivision, it must destroy that information within 90 days absent a court order or specific consent of the sender of recipient of the information.
The law also stipulates that law enforcement gather no more information than is necessary to achieve the objective of the search, and imposes other conditions on the use of the search warrant or wiretap order and the information obtained, including retention and disclosure requirements. Information obtained in violation of these provisions would be inadmissible in criminal, civil, or administrative proceedings.
A second bill that works together with SB178 to create a powerful one-two punch against the use of stingray devices passed both houses and was signed by Brown today.
Sen. Jerry Hill, Sen. Joel Anderson and Sen. Mark Leno introduced SB741 earlier this year. The new law prohibits a local agency from acquiring or using a stingray device unless approved by a resolution or ordinance adopted by its legislative body at a regularly scheduled public meeting held pursuant to the Ralph M. Brown Act. Under the act, residents must have an opportunity for public comment.
An Assembly amendment to the legislation exempts county sheriffs. They need only to provide public notice before acquiring stingrays. They do not have to get local government approval.
The bill also requires the resolution or ordinance to set forth policies on stingray use based on specific guidelines outlined in the legislation.
SB741 passed the Assembly by a vote of 79-0. The Senate concurred with the Assembly Amendments 38-0.
Since local police generally receive these devices directly from the FBI, or through grant money provided to them by the FBI, passage of SB741 allows local communities to interpose themselves in this process and block the FBI’s programs from coming to fruition.
IMPACT ON FEDERAL SURVEILLANCE PROGRAMS
The federal government funds the vast majority of state and local stingray programs, attaching one important condition. The feds require agencies acquiring the technology to sign non-disclosure agreements, as alluded to by the Tacoma police chief. This throws a giant shroud over the program, even preventing judges, prosecutors and defense attorneys from getting information about the use of stingrays in court. The feds actually instruct prosecutors to withdraw evidence if judges or legislators press for information.The Baltimore Sun reported that last fall, a Baltimore detective refused to answer questions on the stand during a trial, citing a federal non-disclosure agreement.
Defense attorney Joshua Insley asked Cabreja about the agreement.
“Does this document instruct you to withhold evidence from the state’s attorney and Circuit Court, even upon court order to produce?” he asked.
“Yes,” Cabreja said.
As privacysos.org put it, “The FBI would rather police officers and prosecutors let ‘criminals’ go than face a possible scenario where a defendant brings a Fourth Amendment challenge to warrantless stingray spying.”
The feds sell the technology in the name of “anti-terrorism” efforts. With non-disclosure agreements in place, most police departments refuse to release any information on the use of stingrays. But information obtained from the Tacoma Police Department revealed that it uses the technology primarily for routine criminal investigations.
Some privacy advocates argue that stingray use can never happen within the parameters of the Fourth Amendment because the technology necessarily connects to every electronic device within range, not just the one held by the target. And the information collected by these devices undoubtedly ends up in federal data bases. The feds can share and tap into vast amounts of information gathered at the state and local level through a system known as the “information sharing environment” or ISE. In other words, stingrays create the potential for the federal government to track the movement of millions of Americans with no warrant, no probable cause, and without the people even knowing it.
According to its website, the ISE “provides analysts, operators, and investigators with information needed to enhance national security. These analysts, operators, and investigators… have mission needs to collaborate and share information with each other and with private sector partners and our foreign allies.” In other words, ISE serves as a conduit for the sharing of information gathered without a warrant.
The federal government encourages and funds stingrays at the state and local level across the U.S., thereby undoubtedly gaining access to a massive data pool on Americans without having to expend the resources to collect the information itself. By placing restrictions on stingray use, state and local governments limit the data available that the feds can access.
In a nutshell, without state and local cooperation, the feds have a much more difficult time gathering information. This represents a major blow to the surveillance state and a win for privacy.
By making information “obtained” in violation of the law inadmissible in court, SB178 would effectively stop one practical effect of NSA spying in California.
Reuters revealed the extent of such NSA data sharing with state and local law enforcement in an August 2013 article. According to documents obtained by the news agency, the NSA passes information to police through a formerly secret DEA unit known Special Operations Divisions and the cases “rarely involve national security issues.” Almost all of the information involves regular criminal investigations, not terror-related investigations.
In other words, not only does the NSA collect and store this data, using it to build profiles, the agency encourages state and local law enforcement to violate the Fourth Amendment by making use of this information in their day-to-day investigations.
This is “the most threatening situation to our constitutional republic since the Civil War,” Binney said.