2 3 4 5 6 AMERICAN CIVIL LIBERTIES UNION FOUNDATION OF SOUTHERN CALIFORNIA Peter Bibring, SBN 223981 pbibring@aclusocal.org Jessica Price, SBN 264053 jprice@aclusocal.org 13 13 West Eighth Street Los Angeles, California 90017 Telephone: (213) 977-9500 Facsimile: (213) 977-5297 7 LATHAM & WATKINS LLP Sadik Huseny, SBN 224659 8 sadik.huseny@lw.com Hanno Kaiser, SBN 262249 9 hanno.kaiser@lw.com Kyle Virgien, SBN 278747 l0 kyle. virgien@lw .com 505 Montgomery Street, Suite 2000 11 San Francisco, CA, 94111 Telephone: (415) 391-0600 12 Facsimile: (415) 395-8095 13 Luj ing Liu, SBN 300769 gavin.liu@lw.com 14 140 Scott Drive Menlo Park, CA, 94025 15 Telephone: (650) 463-4600 Facsimile: (650) 395-2600 16 AMERICAN CIVIL LIBERTIES UNION FOUNDATION OF NORTHERN CALIFORNIA Michael Risher, SBN 191627 mrisher@acl unc.com Linda Lye, SBN 215584 llye@aclunc.com Nicole Ozer, SBN 228643 nozer@aclunc.com Matthew Cagle, SBN 286101 mcagle@aclunc.com 39 Drumm Street San Francisco, CA 9411 1 Telephone: (415) 621-2493 Facsimile: (415) 25 5-1478 Attorneys for Petitioner 17 SUPERIOR COURT OF CALIFORNIA FOR THE COUNTY OF ORANGE 18 19 AMERICAN CIVIL LIBERTIES UNION OF SOUTHERN CALIFORNIA, a non-profit corporation 20 Petitioner, 21 22 23 24 v. ANAHEIM POLICE DEPARTMENT Respondent 27 28 VERIFIED PETITION FOR PEREMPTORY WRIT OF MANDATE ORDERING THE ANAHEIM POLICE DEPARTMENT TO COMPLY WITH ITS DUTIES UNDER THE CALIFORNIA PUBLIC RECORDS ACT [Cal. Gov. Code§§ 6250-6270] 25 26 CASE NO. 1+---------------------------------~ C-20 INTRODUCTION 2 1. This case concerns the public's right to access basic information about how their local 3 police use surveillance- what devices and technologies police use to gather information on residents, 4 what policies govern their use of a particular surveillance technology, what kinds of crimes justify the 5 use of a given surveillance device, what authorization the police get fi·om courts, and what protections 6 (if any) police have put in place to guard privacy and civil liberties. 7 2. IMSI catchers-commonly known by the brand name "Stingrays," for one such device- 8 are highly invasive surveillance devices. They mimic cell phone towers and force all cell phones within 9 their range to register information regarding the phones' location, data, and content with the JMSI 10 catcher. IMSI catchers allow law enforcement to indiscriminately track the cell phones of everyone who 11 happens to be within the device's significant range, including suspects and bystanders. These devices 12 are capable of not only gathering the phone numbers dialed or called by a cell phone, but can track 13 individuals' locations even when they are inside their homes. Using IMSI catcher technology, law- 14 enforcement agencies can, without the assistance of wireless carriers, send signals to cell phones- IS whether they are located in individuals' pockets, cars, or residences-and obtain information from 16 those phones regardless of who the eel I phone owner is, what data is on the phone, or whether the cell 17 phone owner intends for the phones to be on, off, or transmitting any data whatsoever. 18 3. Law-enforcement agencies increasingly use this extraordinarily invasive technology in i9 routine cases, a practice that has grave civil-liberties consequences. Moreover, local agencies have been 20 unwilling to disclose even basic information about their use of these devices-information that would 21 allow the public to understand these consequences and the extent and ramifications of the government's 22 invasion of their privacy. 23 4. In July of2014, the American Civil Liberties Union of Southern California ("ACLU- 24 SC") sent the Anaheim Police Department ("Police Department") a request for documents concerning 25 the Police Department's use ofiMSI catcher technology under the California Public Records Act 26 ("CPRA"). 27 5. The Police Department improperly withheld all of the documents the ACLU-SC 28 1 VERIFIED PETITION FOR WRIT OF MANDATE requested. By doing so, the Police Depattment violated established law. 2 6. In adopting the CPRA, the California legislature declared that "access to information 3 concerning the conduct of the people's business is a fundamental and necessary right of every person in 4 this state." Cal. Gov. Code§ 6250. This principle of transparency has also been enshrined in Section 5 3(b) of Article I ofthe state's constitution. The records the ACLU-SC seeks in this action lie at the core 6 of this statutory and constitutional purpose: the people have the right to know the circumstances under 7 which their government invades their privacy in their name. By this petition and pursuant to California 8 Government Code§§ 6250-6270, the ACLU-SC now seeks a peremptory writ of mandate to compel the 9 Police Department to produce documents in compliance with the CPRA. 10 11 THE PARTIES 7. Petitioner the ACLU-SC is a non-profit organization under the laws ofthe state of 12 California, and is an affiliate of the American Civil Liberties Union ("ACLU"), a national organization 13 of 500,000 members dedicated to the principles of libetty and equality embodied in both the United 14 States and California Constitutions and our nations' civil rights laws. Both the ACLU-SC and the 15 ACLU have long been concerned about the impact of new technologies on the constitutional protections 16 for privacy. See, e.g., United States v. Jones, 565 U.S._, 132 S.Ct. 945 (2012) (amicus curiae in case 17 holding that police officers' warrantless placement of GPS device on car to track its location violated 18 Fourth Amendment); City of Ontario v. Quon, 560 U.S. 746 (2010) (amicus curiae in case addressing 19 police officers' expectation ofprivacy in messages on department-issued pagers). As part of its 20 advocacy, the ACLU-SC routinely uses public-records laws to gather information about the policies and 21 practices of local, state, and federal governments, in order to compile information for publication in 22 reports published in hard copy and distributed electronically through the ACLU-SC's website, in amicus 23 briefs, and through the media. The ACLU-SC therefore has a strong interest in the outcome of these 24 proceedings and in the Police Department's performance of its legal duties. 25 26 8. The ACLU-SC is a person and a member of the public with the right under the CPRA to inspect public records and to seek relief in a cowt of competent jurisdiction to enforce that right. Cal. 27 Gov. Code§§ 6252(b) and (c), 6253, 6258, 6259. 28 2 VERIFIED PETITION FOR WRIT OF MANDATE 9. Respondent the Anaheim Police Department is located in Orange County, California. 2 The Police Department is a local public agency w ithin the meaning of the CPRA. Cal. Gov. Code§ 3 6252(d). 4 5 JURISDICTION AND VENUE I 0. This Court has jurisdiction under Californ ia Government Code§§ 6258 and 6259, 6 Cali forn ia Code of Civil Procedure§ 1085, and Article 6, § I 0 of the Cali forn ia Constitution. 7 l l. Venue is proper in th is Court under California Code of Civil Procedure§ 394 because the 8 Police Depa1tment is a local agency situated in Orange County. Venue is additiona lly proper in this 9 Court under Cali forni a Code of C ivil Procedure§ 393 because the acts and omissions forming the basis 10 of the cause of action occurred in Orange County and the Po lice Department is a public officer. The 11 records in question, or some pmtion ofthem, are situated in Orange County. Cal. Gov. Code§ 6259; 12 Cal. Code Civ. Proc. § 401(1). THE CALIFORNIA PUBLIC RECORDS ACT 13 14 12. Under the CPRA, upon request, any publ ic agency must make publicly available for 15 inspection and copying any record that it prepared, owns, uses, or retains that is not subject to the 16 CPRA's statutory exemptions to disclosure. Cal. Gov. Code§ 6253. 17 13. Before withholdi ng any record responsive to a valid request under the CPRA, the agency 18 must "demonstrat[e] that the record in question is exempt under [the CPRA's] express provisions ... or 19 that on the facts of the particular case the p ublic interest served by not disclosing the record clearly 20 outweighs the public interest served by d isclosure of the record." Cal. Gov. Code§ 6255. 21 14. Any person may institute proceedings by veri tied petition for a writ of mandate to 22 enforce her right to inspect or receive a copy of any public record or class of public records. Cal. Gov. 23 Code§§ 6258, 6259. 24 15. "The court shall decide the case after examining the record in camera, if petmitted by 25 subdivision (b) of Section 9 15 ofthe Evidence Code, papers filed by the parties and any oral argument 26 and additional evidence as the cowt may allow." Cal. Gov. Code§ 6259(a). "Ifthe cowt fmds that the 27 failure to disclose is not justified, it shall order the publ ic official to make the record public." Cal. Gov. 28 3 VERIFIED PETITION FOR WRIT OF MANDATE 1 Code § 6259(b). 2 16. The court must award court costs and reasonable attorney fees to a prevailing petitioner, 3 to be paid by the agency from which the petitioner requested the records. Cal. Gov. Code § 6259(d). THE CALIFORNIA CONSTITUTION 4 5 6 17. Section3(b) of Article 1 of California's constitution entrenches and venerates the public's right to access information as set forth in the CPRA. There is no ambiguity: "[t]he people have 7 the right of access to information concerning the conduct of the people's business, and, therefore, the 8 meetings of public bodies and the writings of public officials and agencies shall be open to public 9 scrutiny." Cal. Const. Art. 1, § 3(b)(1). Further, the California Constitution instructs that a CPRA l 0 provision must "be broadly construed if it furthers the people's right of access, and narrowly construed if 11 it limits the right of access." See Cal. Const. Art. 1, § 3(b)(2). FACTUAL ALLEGATIONS 12 13 18. An IMSI catcher is a surveillance device available to law enforcement entities and 14 capable of collecting inf01mation emitted by cellular devices including cell phones, all without the 15 knowledge or consent of device owners. "IMSI" refers to the unique "international mobile subscriber 16 identity" number assigned to cellular devices. 17 19. IMSI catchers function by masquerading as the cell phone towers used by wireless 18 companies such as AT&T and T-Mobile. By mimicking an actual cell phone tower, the IMSI catcher 19 forces cell phones within its range into emitting identifying signals. This information can be used to 20 identify each phone's unique numeric identifier and location, or to capture the communications content 21 of targets and bystanders alike. Law enforcement can also use the unique identifiers to demand 22 information about individuals from wireless companies.' 23 20. IMSI catchers operate in a sweeping, dragnet manner. An IMSI catcher gathers 24 information from all locations within its range, including private spaces hidden behind walls. 25 Depending on an IMSI catcher's signal strength, its broadcast radius can reach up to several kilometers, 26 l Jennifer Valentino-Devries, How 'Stingray' Devices Work, Digits Tech News & Analysis From the WSJ, WALL STREET JOURNAL ONLIN E (Sept. 21, 20 II), http:/lblogs.wsj .com/digits/2011109/21/how28 stingray-devices-work. 27 4 VERIFIED PETITION FOR WRIT OF MANDATE allowing it to scoop up information from all private locations in the area. Because of the way they 2 function, IMSI catchers may result in prolonged electronic location tracking and the collection of data 3 associated with individuals not subject to any investigation? 4 21. Law enforcement operates IMSI catchers in a manner that prevents individuals from 5 knowing that information emitted by their cell phones has been collected. IMSI catchers mimic the 6 cellular network infrastructure that individuals trust and rely on every day. Because IMSJ catchers can, 7 on their own, force cell phones to transmit information, they do not require the knowledge or consent of 8 phone owners in order to operate. The ability oflMSI catchers to operate through building walls and 9 physical structures fwther prevents individuals from knowing when the devices are being used to 10 capture their private information.3 22. 11 With the appropriate configuration, IMSI catchers can also capture the content of 12 communications, such as voice calls and text messages. And their sweep is vast: the device can be 13 maintained at police stations, other public venues, or mounted on cars or even airplanes. 4 14 23. IMSI catchers are used freely by law-enforcement agencies throughout the country. 15 Law-enforcement agencies use these devices with little or no oversight by the public, legislative 16 agencies, or courts and can obtain cellular data and information by using IMSI catchers without the 17 assistance or even the knowledge of the cellular providers themselves. Some law-enforcement agencies 18 seek a warrant to authorize the use of an IMSI catcher; others seek a Pen Register and Trap and Trace 19 2 20 21 22 23 24 25 26 27 28 See Kate Klonick, Stingrays: Not Just for the Feds!, SLATE (Nov. I 0, 2014), http://www.slate.com/articles/technology/future_tense/20 14/11 /stingrays_imsi_catchers_how_local_ law _enforcement_uses_an_invasive_surveillance.html ("That's every location and outgoing call and text log of every phone within a cettain radius- up to several kilometers .... "); Kim Zetter, Government Fights for Use ofSpy Tool That Spoofs Cell Towers, WIRED (March 29, 2013), http://www. wired.com/20 13/03/gov-fights-stingray-case/ ("It captures data from 'all wireless devices in the immediate area of the FBI device that subscribe to a particular provider' according to government documents- including data of innocent people who are not the target of the investigation."). 3 See Kim Zetter, Secrets of FBI Smartphone Surveillance Tool Revealed in Court Fight, WIRED (April 9, 20 13), http://www. wired.corn/20 13/04/verizon-rigmaiden-aircard/all/ ("The stingray then 'broadcast[s] a very strong signal' to force the [cellular device) into connecting to it ...."). 4 See Michael Bott and Thorn Jensen, Cellphone spying technology being used throughout Northern California, NEWS I 0 ABC (March 6, 2014), http://www.news 1O.net/story/news/investigations/watchdog/20 14/03/06/cellphone-spying-technologyused-throughout-northern-cali fomia/6144949/. 5 VERIFIED PETITION FOR WRIT OF MANDATE authorization from the court. Other law-enforcement agencies, however, may not seek judicial 2 authorization at all for the use of an IMSI catcher. When they do seek a warrant or court order, law 3 enforcement may not adequately explain the nature of IMSI catchers to the court: multiple news repot1s 4 have uncovered evidence of judges unwittingly signing hundreds of warrants authorizing the use of 5 TMSI catchers.5 24. 6 7 Much is known about the existence and capabi li ties ofTMSI catchers. 6 The Department of Justice has made publicly available extensive information on the agency's legal positions regarding 8 their use and hundreds of articles have been published about TMSJ catchers, their capabilities, and 9 controversies in criminal cases in which the use oflMSI catchers may have been a factor in identifying a l0 suspect's location. These news articles describe how IMST catchers work. They also describe the 11 technology underlying IMSI catchers, including technical background, descriptions of how they 12 function, estimates of their service range, and details about the information they are capable of 13 monitoring and collecting. However, little is known about how much public taxpayer money law- 14 enforcement agencies spend on these devices, and about their deployment: i.e., how and the extent to 15 which law-enforcement agencies use them, what law-enforcement agencies do with the data on innocent 16 bystanders that is collected by the devices, and whether certain law-enforcement agencies permit any 17 18 19 20 21 22 23 24 25 26 27 28 5 See, e.g., Ell en Nakashima, Secrecy around police surveillance equipment proves a case's undoing, WASIIINGTON PosT, Feb. 22, 20 15; Adam Lynn, Tacoma police change how they seek permission to use cellphone tracker, THE NEWS TRIBUNE, Nov. 15, 2014; Cyrus Farivar, Legal experts: Cops lying about cell tracking "is a stupid thing to do", ARS TECHNICA (June 20, 20 14), http://arstechnica.com/techpol icy/20 14/06/legal-experts-cops-lying-about-cell-tracking-is-a-stupid-thing-to-do/; Kim Zetter, Florida Cops ' Secret Weapon: Warrantless Cellphone Tracking, WIRED (March 3, 20 14), http://www.wired.com/2014/03/stingray/; Ellen Nakashima, Little-known Surveillance Tool Raises Concerns by Judges, Privacy Activists, WASH. POST, March 27,2013. 6 Several academic papers explain the functioning ofthe technology. See, e.g., Daehyun Strobel, IMSI Catcher, Seminararbeit, Ruhr-Universitat, Bochum, Germany, 13, July 13, 2007; Juliam Dammann, "TMSI-Catcher and Man-in-the-Middle Attacks," presentation at Seminar on Mobile Security, University of Bonn at 5, Feb. 9, 20 II. Security researchers have also duplicated and explained IMSICatcher technology to the public. Sean Hollister, Hacker intercepts phone calls with homebuilt $1,500 JMSI catcher, claims GSM is beyond repair, ENGADGET (July 3 1, 20 I 0), http://www.engadget.com/20 10/07/31/hacker-intercepts-phone-calls-with-homebuilt-1-500-imsicatcher/. 6 VERIFIED PETITION FOR WRIT OF MANDATE judicial oversight of their use oftMSI catchers. 7 2 25. On July 29,20 14, the ACLU-SC sent a CPRA request to the Police Department for the 3 disclosure of certain public records. See Cal. Gov. Code§§ 6258, 6252(c) and (e), 6253. A true and 4 correct copy of this request is attached to this petition as Exhibit A. The request sought the following 5 records related to Police Department's use oflMSI catcher surveillance technology, all of which are 6 "public records" under the CPRA: a. Records related to the number of Cell Site Simulators owned or used by the 7 agency; 8 9 b. Records related to the technical specifications of any such Cell Site Simulators8 ; 10 c. Records related to policies, practices, customs, or training on the use of such Cell Site Simulators, including when and how to seek a warrant; II 12 d. Records mentioning the number of times agency employees have used Cell Site 13 Simulators from January 1, 2008 to the present, including the number of times a 14 warrant was obtained for such use; e. Records refen·ing to any applications for grants or other funding for the 15 acquisition of such Cell Site Simulators; 16 f. 17 Records referring to what information and data agency officials collect through 18 the use of Cell Site Simulators, such as IMSl numbers, names, PEN registers, text, 19 or audio communication; g. Records related to policies, practices, customs, or training regarding the handling 20 21 of data obtained by Cell Site Simulators, including but not limited to access 22 restrictions on such data, security of such data, limitations on sharing data with 23 7 24 25 26 27 28 See, e.g., Fred C1asen-Kelly, CMPD 's cellphone tracking cracked high-profile cases, CHARLOTTE OBSERVER, Nov. 22, 2014; John Kelly, Cellphone spying: It 's notjustthe NSA, USATODAY, June 13, 20 14; Ryan Gallagher, Meet the Machines That Steal Your Phone's Data, ARS TECHNICA (Sept. 25, 20 13), http://arstechnica.com/tech-policy/20 13/09/meet-the-machines-that-steal-yourphones-data/ (describing various models of HatTis Corporation's cell site simulators and related equipment). 8 This petition does not seek to enforce this one category of documents in the ACLU-SC's CPRA request. lt seeks to enforce all other categories in the request, including seeking documents that fa ll under other categories of the request and also fall under this category. 7 VERIFIED PETITION FOR WRIT OF MANDATE other entities and oversight and auditing practices to ensure any restrictions on use 2 or access; 3 h. Records reflecting standard language, forms, or templates used by the agency for 4 obtaining a warrant or other court order, including subpoenas, authorizing the use 5 of StingRay devices or other Cell Site Simulator technologies; 6 1. Unsealed warrants or court orders reflecting the use of StingRay devices or other Cell Site Simulator technologies from January 1, 2008 to the present; 7 8 J. 9 The number oftimes each year that data gathered through the use of StingRay devices or other Cell Site Simu lator technologies was used in the investigation of 10 any crime from January 1, 2008 to the present; 11 k. Which depa1tments and individuals currently have access to the data gathered by 12 Cell Site Simulator devices or technologies and for what pw-poses; I. 13 All other Records including but not limited to emails, notes, presentations, 14 manuals proposals, pol icies, maps, computer files, or other documents related to 15 Cell Site Simulators owned, operated, or used by the agency that are not 16 responsive to the other requests in this letter. 17 Exhibit A, 1-3. 18 26. For any records the Police Department contends are subject to a CPRA exemption, this 19 request instructed the Police Department to provide a written response describing with specificity each 20 record withheld and the specific exemption or exemptions that apply to that record. The request also 21 instructed the Police Department that, even if it contends that some records or portions of records are 22 subject to an exemption, it must provide the records and portions of records not subject to any 23 24 25 26 27 exemption. Exhibit A at 3. 27. The ACLU-SC requested that copying fees be waived and indicated its willingness to pay fees in the event that Police Department would not waive the copying fees. Exhibit A at 3. 28. On August ll, 2014, the Police Department, through the City Attorney's Office of Anaheim, responded to the ACLU-SC's request. A true and correct copy of this response is attached as 28 8 VERIFIED PETITION FOR WRIT OF MANDATE Exhibit B. This response took the position that the ACLU-SC's twelve enumerated requests did not 2 reasonably describe the records sought to be produced. Without further specificity, the Police 3 Department listed Cal. Gov. Code §§ 6254(f), 6254(k), and 6255, the Trade Secret Privilege (Evidence 4 Code§ 1060), and the Official Information Privilege (Evidence Code§§ 1040(b)(2), 104l(a)(2)) as 5 support for its position that all of the requested records were exempt from disclosure. Despite the 6 ACLU-SC's explicit offer to speak with the Police Department to clarify its requests, the Police 7 Department still took the position that it would not produce because, among other reasons, the requests 8 were not adequately specific. 9 29. On September 29, 2014, the ACLU-SC replied to the Police Department's letter, 10 explaining that the Police Department's blanket objections were not adequate to justify withholding 11 under the CPRA. See Cal. Gov. Code§ 6255. The ACLU-SC also responded to the Police 12 Department 's claims that the requests did not reasonably describe the records sought to be produced, 13 offering to work with the Police Department to clarify or appropriately narrow the requests. A true and 14 correct copy of this letter is attached as Exhibit C. 15 30. Not having received a response from the Police Department, the ACLU-SC again reached 16 out on October 10, 2014 with a letter offering to clarify any confusion the Police Department might have 17 18 about the records sought. A true and correct copy of this letter is attached as Exhibit D. 31. On October 14,2014, the Police Department replied with another letter, in which it 19 maintained the positions it set out in its initial letter, while acknowledging that records responsive to the 20 ACLU-SC's request existed. A true and correct copy of this letter is attached as Exhibit E. 21 22 23 24 25 26 27 32. To date, the Police Department has not produced a single document in response to the ACLU-SC's requests. FIRST CAUSE OF ACTION (for a writ of mandate compelling production of documents under the California Public Records Act, Cal. Gov. Code §§ 6250-6270) 33. The ACLU-SC incorporates by reference the allegations of paragraphs 1 through 32 above as though fully set forth herein. 34. Under the CPRA, the ACLU has a right to inspect, and the Police Department has a duty 28 9 VERIFIED PETITION FOR WRIT OF MANDATE to provide promptly and without delay, public records subject to disclosure. 2 35. The ACLU submitted a valid request for records under the CPRA on July 29, 2014. As it 3 stated in this request, the ACLU was at all times ready to pay any associated fees. 4 36. The Police Department adm its that it possesses records responsive to the ACLU's 5 requests. 6 37. The Police Department cannot demonstrate that any record subject to the ACLU's 7 requests, or any portion of those records, is exempt under express provisions of the CPRA or any other 8 authority, or that on the facts of this particular case the public interest served by not disclosing the 9 record clearly outweighs the public interest served by disclosing the record. PRAYERFORRELIEF 10 11 12 13 WHEREFORE, the ACLU-SC prays as follows: J. That the Court issue a peremptory writ of mandate directing the Police Department to provide the ACLU-SC with all requested records; 14 2. That the ACLU-SC be awarded attorneys' fees and costs; and 15 3. For such and further relief as the Court deems proper and just. 16 17 18 19 20 21 22 23 24 25 26 27 28 10 VERIFIED PETITION FOR WRIT OF MANDATE 1 Dated: March 10, 2015 Respectfully submitted, ~ 2 By: 3 4 Jessica G. Price 5 6 7 8 9 10 11 12 13 14 15 16 17 18 l9 20 21 22 23 24 25 26 27 28 II VERIFIED PETITION FOR WRIT OF MANDATE 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 AMERICAN CIVIL LIBERTIES UNION FOUNDATION OF SOUTHERN CALIFORNIA Peter Bibring, SBN 223981 pbibring@aclusocal.org Jessica Price, SBN 26405 jprice@aclusocal.org 1313 West Eighth Street Los Angeles, California 90017 Telephone:(213) 977-9500 Facsimile: (213) 977-5297 AMERICAN CIVIL LIBERTIES UNION FOUNDATION OF NORTHERN CALIFORNIA Linda Lye, SBN 215584 llye@aclunc.com Michael Risher, SBN 191627 mrisher@aclunc.com Nicole Ozer, SBN 228643 nozer@aclunc.com Matthew Cagle, SBN 286101 mcagle@aclunc.com 39 Drumm StStreet San Francisco, CA 94111 Telephone:(415) 621-2493 Facsimile: (415) 255-1478 LATHAM & WATKINS LLP Sadik Huseny, SBN 224659 sadik.huseny@lw.com Hanno Kaiser, SBN 262249 hanno.kaiser@lw.com Kyle Virgien, SBN 278747 kyle.virgien@lw.com 505 Montgomery St San Francisco, CA, 94111 Telephone:(415) 391-0600 Facsimile: (415) 395-8095 Lujing Liu, SBN 300769 gavin.liu@lw.com 140 Scott Dr Menlo Park, CA, 94025 Telephone:(650) 463-4600 Facsimile: (650) 395-2600 23 24 Attorneys for Petitioner 25 26 27 28 12 VERIFIED PETITION FOR WRIT OF MANDATE VERIFICATION I, Jessica Price, am a Staff Attorney at the American Civil Liberties Union of Southern California. I have read the foregoing Verified Petition for Peremptory Writ of Mandate Ordering the Anaheim Police Department to Comply with its Duties under the California Public Records Act, and the facts alleged in paragraphs 4 and 25-32 are within my knowledge, and I know them to be true. I declare under penalty of perjury under the laws of the State of California that the foregoing is true and correct. Jessica G. Price 13 VERIFICATION I, Hector 0. Villagra, am the Executive Director of the American Civil Liberties Union of Southern California. I have read the foregoing Verified Petition for Peremptory Writ of Mandate Ordering the Anaheim Police Depattment to Comply with its Duties under the California Public Records Act, and the facts alleged in paragraph 7 are within my knowledge, and I know them to be true. The allegations in paragraphs 1-6 and 8-41 are stated on information and belief and as to those matters I believe them to be true. I declare under penalty of perjury under the laws of the State of California that the foregoing is true and conect. Dated: 14 EXHIBIT A Via United States Postal Service Certified Mail July 29, 2014 Anaheim Police Department c/o Linda N. Andal, CMC City Clerk, City of Anaheim 200 S. Anaheim Blvd., #217 Anaheim, CA 92805 Re: California Public Records Act Request re: Cell Site Simulators, or “StingRays” To Whom It May Concern: The ACLU of Southern California (“ACLU SoCal”) has long been concerned by the increasing use of new surveillance technologies by law enforcement agencies across California without appropriate privacy safeguards. One such technology that raises concerns are “cell site simulators.” Also called “IMSI catchers,” referring to the International Mobile Subscriber Identity that uniquely identifies each cellular device, or StingRays, after the brand name of one such device sold by the Harris Corporation., Cell site simulators mimic a wireless carrier’s antenna and base station. 1 The simulator signals to devices in the area, and wireless devices in the area respond and identify themselves, communicating with the device as if it were a wireless carrier’s cell tower. This allows the user to identify the location of all mobile devices in the area, and potentially other information about the device or its communications. Because of our concerns with the expanding use of Stingrays and other cell site simulators, I am writing to request, pursuant to the California Public Records Act (California Government Code § 6250 et seq.), a copy of the following public records related to the use of cell site simulators that are in possession of your agency: (1) All Records related to the number of Cell Site Simulators owned, operated and/or used by the agency, unit, position and/or individuals with access to and/or control over the devices.2 1 For purposes of these requests, the term “Cell Site Simulators” shall be interpreted to include “IMSI catchers”, or other technologies designed to imitate the cellular towers or base stations of wireless carriers and receive signals (including IMSI information) emitted from wireless cellular telephones, including but not limited to the Gossamer, Triggerfish, Hailstorm, Kingfish, Amberjack, or Digital Analyzer. 2 The term “Records,” for purposes of these requests, is defined to include “writing” as that term is defined by Govt. Code § 6252(g), as “any handwriting, typewriting, printing, photostating, photographing, photocopying, transmitting by electronic mail or facsimile, and every other 1313 WEST EIGHTH ACLUSOCAL.ORG STREET LOS ANGELES CA 15 90017 t 213.977.9500 f 213.977.5299 Page 2 (2) All Records related to the technical specifications of any Cell Site Simulators owned, operated, used or sought by the agency. (3) All Records related to the policies, practices, customs, or training on the use of Cell Site Simulators, including but not limited to any policies, practices, customs, or training on when and how to seek a warrant to use the devices or whether there are any locations on where Cell Site Simulators can be used. (4) All Records related to, referring to, or mentioning the number of times agency employees have used Cell Site Simulators from January 1, 2008 through present, as well as the number of those instances agency employees obtained a warrant to use the device. (5) All Records relating or referring to any applications for grants or other funding seeking to pay, in part or in whole, for Cell Site Simulators to be operated or used by the agency from January 1, 2008 through present. (6) All Records relating or referring to what information and data agency officials collect through the use of Cell Site Simulators (such as IMSI numbers, names, PEN registers, text or audio communications). (7) All Records relating or referring to any policies, practices, protocols or training relating to the handling of data obtained by Cell Site Simulators, including but not limited to access restrictions on such data, security of such data, limitations on sharing data with other entities, and oversight and auditing practices to ensure any restrictions on use or access are followed. (8) All Records reflecting standard language, form(s) or template(s) utilized by the agency for requesting a warrant or other court order, including subpoenas, authorizing use of the StingRay device or other cell site simulator technologies or technologies to detect radio signals emitted from wireless cellular telephones from January 1, 2008 through present. (9) Unsealed warrants or court orders reflecting the use of the StingRay device or other cell site simulator devices or technologies to detect radio signals emitted from wireless cellular telephones from January 1, 2008 through present. (10) The number of times each year that data gathered through use of the StingRay or other cell site simulator devices or technologies was used in the investigation of any crime, including the role, if any, it played in identifyin, arresting and/or convicting suspects from January 1, 2008 through present. means of recording upon any tangible thing any form of communication or representation, including letters, words, pictures, sounds, or symbols, or combinations thereof, and any record thereby created, regardless of the manner in which the record has been stored,” and includes but is not limited to emails, notes, presentations, manuals, proposals, policies, maps, training materials, powerpoints, handouts, computer files, memos, drafts or other documents. 16 Page 3 (11) Which departments, units, assignments individuals currently have access to the data gathered by cell site simulator devices or technologies to detect radio signals emitted from wireless cellular telephones and for what purposes. (12) All Records, including but not limited to emails, notes, presentations, manuals, proposals, policies, maps, computer files, or other documents, related to cell site simulators owned, operated and/or used by the agency or its employees, not responsive to one of the other requests in this letter. These requests are made pursuant to the California Public Records Act (“CPRA”), California Government Code § 6250 et seq. The CPRA requires responding agencies to provide a response within ten (10) days of receipt of a request. See Gov. Code § 6256. In enacting the PRA, the Legislature recognized that “a requester, having no access to agency files, may be unable to precisely identify the documents sought. Thus, writings may be described by their content. . . . An agency is thus obliged to search for records based on criteria set forth in the search request.” California First Amendment Coalition v. Superior Court, 67 Cal. App. 4th 159, 165-66 (1998); see also § 6253(b). The PRA also requires the government to “assist the member of the public make a focused and effective request that reasonably describes an identifiable record or records” by taking steps to “[a]ssist the member of the public to identify records and information that are responsive to the request or to the purpose of the request, if stated. § 6253.1(a). An agency that receives a request must also “[p]rovide suggestions for overcoming any practical basis for denying access to the records or information sought.” Id. If any records are claimed to be exempt from disclosure, I request that: (1) you exercise your discretion to disclose some or all of the records notwithstanding the exemption; and (2) with respect to records containing both exempt and non-exempt content, you redact the exempt content and disclose the rest, consistent with California Government Code § 6253(a). Additionally, if any records are withheld or redacted, please provide a written response that describes with specificity each and every record that is being withheld or redacted and the claimed reason for exemption under the California Public Records Act, along with supporting legal authority or authorities. I request that you waive any copying fees because the ACLU of Southern California is a non-profit civil rights organization. See North County Parents Organization v. Department of Education, 23 Cal. App. 4th 144 (1994). No part of the information obtained will be sold or distributed for profit. If you do not agree to waive the copying fees, please inform me of any potential duplication costs exceeding $50.00 prior to copying. I also request that you provide any public record identified above that exists in the following electronic formats to me in that electronic format, instead of in paper format: PDF format or all Microsoft Office formats, including Word, Excel, and PowerPoint. See California Government Code § 6253.9. I look forward to working with you to obtain the public records we have requested and look forward to your response to this request within ten days of receipt of this letter. See 17 Page 4 California Government Code § 6253(c). Please send all public records responsive to this request to my attention, either by mail or email. If you have any questions about this request, please do not hesitate to contact me at (213) 977-5295 or my legal assistant, Geneva Tien, at (213) 977-5279. Sincerely, Peter Bibring Staff Attorney ACLU of Southern California 1313 West 8th Street Los Angeles, CA 90017 pbibring@aclusocal.org 18 EXHIBIT City of Anaheim OFFICE OF THE CITY ATTORNEY August II, 2014 Mr. Peter Bibring Staff Attorney ACLU of Southern California 1313 West 8'h Street Los Angeles, CA 90017 Re: Public Records Act Request (Gov. Code§ 6250, et seq.) Request No. 07312014-3 Dear Mr. Bibring: The City of Anaheim ("City") is in receipt of your Public Records Act request dated July 29,2014 wherein you have requested the following records: I. "All records related to the number of Cell Site Simulators owned, operated and/or used by the agency, unit, position and/or individuals with access to and/or control over the devices;" 2. "All records related to the technical specifications of any Cell Site Simulators owned, operated, used or sought by the agency;" 3. "All records related to the policies, practices, customs or training on the use of Cell Site Simulators, including but not limited to any policies, practices, customs or training n when and how to seek a warrant to use the devices or whether there are any locations where Cell Site Simulators can be used;" 4. "All records related to, referring to or mentioning the number of times agency employees have used Cell Site Simulators from January I, 2008 through present, as well as the number of those instances agency employees obtained a warrant to use the device;" 5. "All records relating or referring to any applications for grants or other funding seeking to pay, in part or in whole, for Cell Site Simulators to be operated or used by the agency from January I, 2008 through present;" 6. "All records relating or referring to what information and data agency officials collect through the use of Cell Site Simulators (such as IMSI numbers, names, PEN registers, text or audio communications);" 7. "All records relating or referring to any policies, practices, protocols or training relating to the handling of data obtained by Cell Site Simulators including, but not limited to, access restrictions on such data, security of such data, limitations on sharing data with other entities and oversight and auditing practices to ensure any restrictions on use or access or followed;" 8. "All records reflecting standard language, form(s) or template(s) utilized by the agency for requesting a warrant or other comi order, including subpoenas, authorizing use of the StingRay device or other cell site simulator technologies or 200 S. Anaheim Blvd., Suite 356 Anaheim, California 92805 TEL (714) 765·5169 FAX (714) 765-5123 www.anaheim.net 19 Mr. Peter Bibring August II, 2014 Page 2 technologies to detect radio signals emitted from wireless cellular telephones fi·om January I, 2008 through present;" 9. "Unsealed warrants or court orders reflecting the use of StingRay device or other cell site simulator devices or technologies to detect radio signals emitted from wireless cellular telephones fi·om January I, 2008 through present;" I 0. "The number of times each year that data gathered through use of the StingRay or other cell site simulator devices or technologies was used in the investigation of any crime, including the role, if any, it played in identifying, arresting and/or convicting suspects fi·om January I, 2008 through present;" II. "Which departments, units, assignments, individuals currently have access to the data gathered by cell site simulator devices or technologies to detect radio signals emitted from wireless cellular telephones and for what purposes;" and 12. "All records including, but not limited to, emails, notes, presentations, manuals, proposals, policies, maps, computer files or other documents related to cell site simulators owned, operated and/or used by the agency or its employees, not responsive to one of the other requests in this letter." Overall, your request does not reasonably describe or identify the records sought to be produced. Government Code § 6253(b ). In addition, the records you seek are exempt from disclosure pursuant to the following provisions of the Public Records Act: • The records are subject to the Trade Secret Privilege (Evidence Code §I 060 and Government Code §6254(k)); • The records are subject to the Official Information Privilege (Evidence Code §§1040(b) (2), 1041(a)(2)); • Documents reflecting police techniques or "security procedures" are expressly exempt from disclosure pursuant to Government Code §6254(f); and • The records are subject to the public interest exemption provided by Government Code §6255. Should you have any questions, please contact the undersigned. Thank you for your kind cooperation in this regard. Very truly yours, Michael R.W. Houston, City Attornex. ., .../ Bryn· . Morley Deputy ity Attorney cc: Jennifer Hall, City Clerk Linda Andal, City Clerk Barbara Nail, APD 104092 20 . / EXHIBIT 90 YEARS OF YOR Vin United States Posted 1. ervi?ee Certified Matt September 29, 2014 Anaheim Police Department c/o M. Morley Office of the City Attorney 200 S. Anaheim Blvd, #365 Anaheim, CA 92805 Re: July 29, 2014 Public Records Act Request re: Cell Site Simulators, or ?Stingrays? To Whom It May Concern: On July 29, 2014, the ACLU ofSouthern California SoCal?) mailed to your agency a request for certain public records, pursuant to the California Public Records Act Cal. Gov?t Code 6250 et seq. The request concerned records of ?cell site simulators,? also known as StingRays, that are in the possession of your agency. Your response dated August 1 l, 2014, however, was not adequate to discharge your agency?s statutory duties. To the extent your agency has determined that part or all of the requested records are not disclosable or are exempt from disclosure, you must?in writing ?justify withholding? by speci?cally ?demonstrating? that the records are exempt as applied to the ?facts of the particular case.? Cal. Gov?t Code 6255. Blanket objections and citations do not satisfy this statutory obligation. ee Am. Civil Liberties Union ofN. Cat. v. Super. Ct, 202 Cal. App. 4th 55, 82 (Cal. Ct. App. 201 l) do not believe an agency?s bare conclusion that information is not responsive to a request is any more self?explanatory than its bare conclusion that information is exempt. . . . [T]he agency must be required to provide the requesting party ?adequate speci?city . . . to assur[e] properjustil'ication by the governmental agency?) (citing Vaughn v. Rosen, 484 F.2d 820, 827 (DC. Cir. 1973)). I look forward to working with you to obtain the public records we have requested. if you think that our request can be improved by any narrowing or clarification, please do not hesitate to write me atjprice@aclusocal.org or call me at (213) 977?5233. Jesca Price Staff Attorney Enclosures: Request dated July 29, 2014 Response dated August 1 i, 2014 1313 WEST EIGHTH STREET LOS ANGELES CA 90017 213.977.9500 213.977.5299 21 City of Anaheim OFFICE OF THE CITY ATTORNEY August 11,2014 Mr. Peter Bibring Staff Attorney ACLU of Southern California 13 13 West 8111 Street Los Angeles, CA 90017 Re: Public Records Act Request (Gov. Code§ 6250, et seq.) Request No. 07312014-3 Dear Mr. Bib ring: The City of Anaheim ("City") is in receipt of your Public Records Act request dated July 29, 2014 wherein you have requested the following records: 1. "All records related to the number of Cell Site Simulators owned, operated and/or used by the agency, unit, position and/or individuals with access to and/or control over the devices;" 2. "All records related to the technical specifications of any Cell Site Simulators owned, operated, used or sought by the agency;" 3. "All records related to the policies, practices, customs or training on the usc of Cell Site Simulators, including but not limited to any policies, practices, customs or training n when and how to seek a warrant to use the devices or whether there are any locations where Cell Site Simulators can be used;" 4. "All records related to, referring to or mentioning the number of times agency employees have used Cell Site Simulators from January 1, 2008 through present, as well as the number of those instances agency employees obtained a warrant to use the device;" 5. "All records relating or referring to any applications for grants or other funding seeking to pay, in part or in whole, for Cell Site Simulators to be operated or used by the agency from January 1, 2008 through present;" 6. "All records relating or referring to what information and data agency officials collect through the use of Cell Site Simulators (such as JMSI numbers, names, PEN registers, text or audio communications);" 7. "All records relating or referring to any policies, practices, protocols or training relating to the handling of data obtained by Cell Site Simulators including, but not limited to, access restrictions on such data, security of such data, limitations on sharing data with other entities and oversight and auditing practices to ensure any restrictions on use or access or followed;" 8. "All records reflecting standard language, form(s) or templatc(s) utilized by the agency for requesting a warrant or other court order, including subpoenas, authorizing use of the StingRay device or other cell site simulator technologies or 2DO S.l\naheim Blvtl., Suite 356 Auahe!m, California 92805 TEL (714) 765·5169 r:IIX {714) 765·5123 VJ\','\'l.;m~hcirn .net 22 Mr. Peter Bibring August 11,2014 Page 2 technologies to detect radio signals emitted from wireless cellular telephones t!·om January 1, 2008 through present;" 9. "Unsealed warrants or court orders reflecting the use of StingRay device or other cell site simulator devices or technologies to detect radio signals emitted tl·om wireless cellular telephones t!·om January I, 2008 through present;" 10. "The number of times each year that data gathered through use of the StingRay or other cell site simulator devices or technologies was used in the investigation of any crime, including the role, if any, it played in identifying, arresting and/or convicting suspects f1·om January I, 2008 through present;" II. "Which departments, units, assignments, individuals currently have access to the data gathered by cell site simulator dcviecs or technologies to detect radio signals emitted tl'cnn wireless cellular telephones and for what purposes;" and 12. "All records including, but not limited to, emails, notes, presentations, manuals, proposals, policies, maps, computer tiles or other documents related to cell site simulators owned, operated and/or used by the agency or its employees, not responsive to one of the other requests in this letter." Overall, your request docs not reasonably describe or identify the records sought to be produced. Government Code § 6253(b ). In addition, the records you seek arc exempt t!·om disclosure pursuant to the following provisions of the Public Records Act: • The records arc subject to the Trade Secret Privilege (Evidence Code §1060 and Government Code §6254(k)); • The records are subject to the OHicial Information Privilege (Evidence Code §§!040(b) (2), 1041(a)(2)); • Documents reflecting police techniques or "security procedures" are expressly exempt fl·mn disclosure pursuant to Government Code §6254(1); and • The records arc subject to the public interest exemption provided by Government Code §6255. Should you have any questions, please contact the undersigned. Thank you for your kind cooperation in this regard. Very truly yours, Michael R.W. Houston, City Attorncx_, (:))~r~\~1t;rli'_( . ()\\ \7-l /.) \ By: Deputy-City Attorney cc: J<.'nnifcr Hall, Ci\y Clerk Linda Andal, City Clerk 104092 !3arlmru Nail, APD 23 ' .... ) EXHIBIT Via United States Postal Service Certified Mail October 10, 2014 Anaheim Police Department c/o Bryn M. Morley Office of the City Attorney 200 S. Anaheim Blvd., #365 Anaheim, CA 92805 Re: July 29, 2014 Public Records Act Request re: Cell Site Simulators, or “Stingrays” To Whom It May Concern: On July 29, 2014, we sent your agency a Public Records Act request for records related to Cell Site Simulators. On August 11, 2014, your agency responded, stating in part that the request did not reasonably describe or identify the records sought. Per the voicemail I left you today, I write to ensure we can communicate to reasonably describe or identify the records sought to be produced. Please do give me a call or send me a letter to the extent there is any confusion about the records sought. Thank you. Sincerely, Jessica Price Staff Attorney (213) 977-5233 1313 WEST EIGHTH STREET LOS ANGELES CA 90017 24 t 213.977.9500 f 213.977.5299 ACLUSOCAL.ORG EXHIBIT City of Anaheim OFFICE OF THE CITY ATTORNEY October 14,2014 Ms. Jessica Price Staff Attorney ACLU of Southern California 1313 West 8th Street Los Angeles, CA 90017 Re: Sent Via First Class Mail and Email Transmission to: jprice@aclusocaL org ACLU Public Records Act Request No. 07312014-3 Dear Ms. Price: The City of Anaheim ("City") is in receipt of your recent correspondence dated September 29, 2014 addressing the City's earlier response to the Public Records Act Request from the ACLU dated July 29, 2014 fi·om Staff Attorney Peter Bibring. The City has determined that records, which the ACLU has requested concerning "'cell site simulators,' also known as StingRays," that are in the City's possession are exempt from disclosure pursuant to the following provisions of the Public Records Act: • The records are subject to the Trade Secret Privilege (Evidence Code § 1060 and Government Code §6254(k)); • The records are subject to the Official Information Privilege (Evidence Code §§1040(b) (2), 1041(a)(2)); • Documents reflecting police techniques or "security procedures" are expressly exempt from disclosure pursuant to Government Code §6254(f); and • The records are subject to the public interest exemption provided by Government Code §6255. The City has not taken the position that it possesses no responsive records or that documents are being withheld because they contain non-responsive material as discussed in American Civil Liberties Uuion of Northern California v. Superior Court (2011) 202 Cal.App.41h 55, 82. Rather, the City is denying access to its records pursuant to exemptions enumerated by the Public Records Act. Fairley v. Superior Court (1998) 66 Cal.App.41h 1414. The Public Records Act does not require local agencies to create a "privilege log" or list (i.e. a Vaughn Index as referenced in Vaughn v. Rosen 484 F .2d 820, 827 (D.C. Cir. 1973)) that identifies the specific records being withheld. Havnie v. Superior Court (2001) 26 Cal.41h 1061. See State Board of Equalization v. Superior 200 S. Anaheim Blvd., Suite 356 Anaheim, California 92805 TEL (714) 765-5169 FAX (714) 765-5123 www.anaheim.net 25 Ms. Jessica Price October 14, 2014 Page 2 Court (1992) 10 Cal.App.4'h 1177, 1193 ("The Public Records Act does not, like the FOIA, require the maintenance of an index of records available for public inspection and copying.") Furthennore, "a list of documents withheld may also reveal information ordinarily deemed exempt from disclosure." Havnie supra at I 075. The City's response only needs to identify the legal grounds for nondisclosure, which the City has done above and in the previous response to Mr. Bibring. Should you have any questions, please contact the undersigned. Thank you for your kind cooperation in this regard. Very truly yours, Sr. Assistant City Attorney 105451 26