SFPD’s sophisticated surveillance technology raises concerns about usage

The National Security Agency has faced backlash from the public for the past year and a half for its mass surveillance of everyday Americans, but it appears the program extends all the way to the local law enforcement level.

A recent San Francisco Examiner investigation found that the federal government's efforts might be aided by sophisticated cellphone data surveillance technology obtained by the Police Department. However, there is no specific public policy in place for use of this technology, which has raised some red flags.

Critics say this technology — commonly known as StingRay after one of the brands made by manufacturer Harris Corp. — taps cellphone data without the use of a warrant to broadly collect information from anyone, whether under investigation or not, that is then shared with the federal government.

The FBI touts the new surveillance method as a key to aiding police departments' fight against terrorism.

The Police Department has not publicly acknowledged it uses such surveillance tactics — it actually is not allowed to — but in a grant application to buy a StingRay device, officials wrote its use would reduce manpower needed for surveillance and thus lower the department's budget.

StingRay technology is employed in many cities. But like San Francisco, local police nationwide have not admitted use of it.

But the Police Department obtained the technology as early as 2009, records from the California Emergency Management Agency show, and no public policies are apparent to determine its use.

And despite the discovery of these documents, Police Chief Greg Suhr told The Examiner the department would not acknowledge or deny ownership of the technology.

“We have a [nondisclosure agreement] with the FBI,” Suhr said. “You can draw your own conclusions.”

Officials say that answer isn't good enough.

“If [the] SFPD has a StingRay,” Supervisor John Avalos said, “they need to be frank.”

The surveillance technology — bearing brand names StingRay, KingFish and RayFish — can be used to locate or intercept data from cellphones. When targeting a criminal suspect, the device is mounted in a police vehicle and paired with sophisticated antennas and computer software, acting as a phony cellphone tower. Nearby cellphones then automatically connect with it.

The full range of these devices is proprietary and well-guarded by the FBI — so far, it is not even legally obligated to share the information with judges. Once a criminal suspect's cellphone connects to the device, its position can be pinpointed within 9 feet, according to the American Civil Liberties Union. Text messages, call logs, emails and Web history, among other data, are subsequently scooped up by the device.

But criminal suspects are not the only ones whose data is captured in these sweeps. Any cellphone — owned by anyone in range of the device — will have its data automatically captured.

“There's no difference in using a StingRay than using a bug in someone's house,” Public Defender Jeff Adachi said. “It allows you to almost enter a residence, to find out what people are talking about.

“That is a severe intrusion.”

Read the document revealing the SFPD's surveillance technology below. Click on the yellow notations to see the reporter's notes, explaining the document.

DV.load(“//www.documentcloud.org/documents/1383919-fy09-san-francisco-sole-source-approval-and.js”, { width: 540, height: 400, sidebar: false, text: false, container: “#DV-viewer-1383919-fy09-san-francisco-sole-source-approval-and” }); FY09 San Francisco Sole Source Approval and Request Plus Equip Ledger RF Signal Collection Harris Corp 041112 (PDF)
FY09 San Francisco Sole Source Approval and Request Plus Equip Ledger RF Signal Collection Harris Corp 041112 (Text)

The Electronic Frontier Foundation, a digital privacy nonprofit located in San Francisco, calls the technology an “unconstitutional, all-you-can-eat data buffet.”

Most of what police do with the data of civilians is unclear. But the ACLU said this excess data is passed on to the federal government for further review, aiding mass surveillance efforts.

A public-records request to the California Emergency Management Agency, now the Office of Emergency Management, revealed that the Police Department not only applied for the surveillance technology in 2012 but already owned an older version.

The April 11, 2012, document is titled a “Request For Sole Source Procurement Authorization” and makes the case for the Police Department to be awarded funding for a RayFish (sister device to StingRay).

“The San Francisco Police Department currently owns the first generation of the Harris RF signal collection system, which was compatible with 2G phones,” reads a letter from the Department of Emergency Management. “This device acts as a cell tower receiver and provides location positioning of a targeted phone. However, based on current, updated cell phone and 3G and 4G network protocols, this device is no longer sufficient for the needs of the city and county of San Francisco.

“Departmental personnel were previously trained on the original Harris RF signal collection system, so proficiency in the operation of the new equipment would be seamless.”

The Police Department was granted $350,000 in federal funding for the RayFish device, two antennas, a laptop, software, training sessions in Florida and other equipment. Records show the Police Department acquired the new device May 29, 2012.

For many years, journalists have endeavored to determine if the Police Department has a StingRay or similar device. Many documents hint at such ownership or that the Police Department used one, but were not explicit.

“This seems to be further confirmation” that the Police Department has the surveillance technology, said Linda Lye, a staff attorney with the ACLU's Northern California division. The FBI and Department of Homeland Security defend the technology as a means to catch terrorists, Lye said, but often local police departments use it for other purposes.

“Mission creep is a common phenomenon,” she said of the practice of police using tools in less and less extreme circumstances.

For instance, Lye suggested that a possible use that she said would be inconsistent with the intention of the device would be for police to use the technology to catch drug dealers instead of terrorists.

Soon the Police Department may find justification in surveilling even lower-priority targets, Lye said, if no policies stop them from doing so.

What is needed is public discussion and rules for police use of surveillance tech, Lye said.

In the Police Department's case, Department General Orders 8.10 govern First Amendment activities, including surveillance, but make no specific mention of these sophisticated new devices.

And without policies in place to restrict surveillance conduct, information might be collected on everyday citizens.

The Office of Citizen Complaints does perform an annual review of police undercover actions, including use of surveillance. The year after the department was awarded money to purchase the surveillance technology, the complaint office presented its findings.

In a Feb. 13, 2013, Police Commission meeting, complaint office Director Joyce Hicks said police monitored Occupy movements, though she did not specify how.

“There were records of two investigations authorized during the year” that utilized undercover techniques, Hicks said. “There was an investigation into San Francisco Occupy … it also involved monitoring of violent factions within the Occupy movement.”

The second investigation involved Black Bloc, Hicks said, referring to a purportedly violent faction of the Occupy movement that allegedly vandalized storefronts in Oakland. The requests for the surveillance began Nov. 4, 2011, and were terminated March 6, 2012.

“The investigation conformed to [department general order] guidelines and appears limited in scope,” Hicks said.

The Police Commission did not respond to requests for comment.

The ACLU's Lye said this lack of transparency worries the organization, which is also concerned that the sophisticated surveillance could be used to monitor protest demonstrations such as those taking place in the Bay Area following grand jury decisions not to indict white police officers in the killings of unarmed black men.

“Political demonstrations are a perfect example of a concern we have about StingRay usage,” Lye said. “When people are out in force in political protest, StingRay would allow police to quickly catalogue all attendees at the protest in rapid fashion.”

The FBI has said that revelations about this sophisticated surveillance technology is a national security threat.

Cellphone surveillance from local police is critical to the FBI because in exchange for granting the money to purchase the technology, the FBI is given data that local police obtain, said Nicole Ozer, technology policy director for the ACLU.

When questioned, Suhr acknowledged the Police Department routinely shares data with the FBI, but would not specify if surveillance data was shared.

This is why Avalos said he is writing legislation to require city agencies to have public discussions around creating policies to govern use of surveillance.

But the effort could have no effect since local police are required to sign a nondisclosure agreement with the FBI in order to obtain the technology.