February 10, 2012 VIA FACSIMILE 1540) 868-4977 David M. Hardy Chief, Record/Information Dissemination Section, Records Management Division 170 Marcel Drive Winchester, VA 22602-4843 (540) 868-4500 (Telephone) (540) 868-4997 (Fax) Re: Freedom of Information Act Request and Ruepqguest for Expedited Processing Dear Mr. Hardy: This letter constitutes a request under the Freedom of Information Act (“FOIA”), 5 U.S.C. § 552, and is submitted on behalf of the Electronic Privacy Information Center (“EPIC”). As detailed below, EPIC seeks agency records conceming cell site simulator and other cell phone tracking technologies deployed by the Federal Bureau of Investigation (“FBI”) to covertly locate, target, and track targets of interest. Factual Background. On July 23, 2008 Daniel David Rigmaiden was indicted on various counts of conspiracy, wire fraud, and identity theft by U.S. Attorneys in Phoenix, Arizona.‘ Rigmaiden was located after “federal agents used a stingray to track a mobile device to an apartment building.” A StingRay is a device that can triangulate the source of a cellular signal by acting “like a fake cell phone tower” and measuring the signal strength of an identi ed device from several locations.3 Defendant Rigmaiden has submitted various discovery motions seeking information about the investigatory techniques used to locate him.4 In opposition to one such motion, the Department of Justice submitted a memorandum, dated October 27, 2011, by the FBI’s Supervisory Special agent who stated that all data from stingray-type devices are deleted because the devices may tend to pick up information “from all 1 UnitedStates v. Rigmaiden, on 08-814-PHX-DGC, 2010 WL 3463123 (D. Ariz. Aug. 27, 2010). 2 Jennifer Valentino-Devries, Feds say? Tracking Defense, THE WALL STREET JOURNAL, Nov. 3, 201 1, available at http:/f011line.Wsj.c0m/article/SB1UGO1424052970204-62190-457'70l436302434IO23.html. 3 Department ofJa.s*iice Nenters Faurrh Amendment with StingRay Ruling, TECHANDFILM, Nov. 6, 201 1, available ar http://techandfilm.wordpress.com/201 1/ l 1X06/department-of-justice-neuters-forth-amendment with-stingray-rulingf. 4 Id. 1 wireless devices in the immediate area of the FBI device that subscribe to a particular provider including those of innocent, non-target devices?“ In support of its October 27, 2011 memorandtun, the U.S. Attorneys submitted the af davit of supervisory special agent Bradley S. Morrison.“ Agent Morrison is the Unit Chief of the Tracking Technology Unit (TTU), Traditional Technology Section, Operational Technology Division in Quantico, Virginia.“ As such, Agent Morrison is responsible for the “development, procurement and deployment of technical assets and capabilities to covertly locate, tag and track targets of interest in support of all FBI investigative, intelligence collection and operational programs?“ Agent Morrison"s af davit stated that: FBI policy requires that at the conclusion of a location operation, FBI technical personnel are to purge all data stored in the [tracking device]. During a local operation, the electronic serial numbers (ESNs) (or their equivalent) from all wireless devices in the immediate area of the FBI device that subscribe to a particular provider may be incidentally recorded, including those of innocent, non-target devices.“ ' As the court documents submitted by the Government in US v. Rigmaiden make clear, the FBI currently uses “cell site simulator” technologies such as StingRay to “locate, tag and tracl<.”1“ These devices were procured from third party vendors, which would require contracts and/or statements of work. The devices presumably have related technical documents and descriptions of operational requirements. Given the potential impact on “innocent, non-target devices,” and the requirements of the E-Government Act of 2002, the agency is obligated to conduct a Privacy Impact Assessment (“PIA”) before using these devices . As the Department of Justice PIA Of cial Guidance book describes: Section 208 of the E-Government Act of 2002 requires all federal agencies to conduct a PIA before developing or procuring information technology that collects, maintains, or disseminates information that is in identi able form or before initiating a new collection of information that will be collected, maintained, or disseminated using information technology and that includes any information in identi able form in certain circumstances involving the public.“ 5 Affidavit of Supervisory Special Agent Bradley S. Morrison, US v. Rigmaiden, No. 08-cr—008l4 at *3 (D. Ariz. Oct. 27, 2011). 6 Id. at *1. “ Id. 8 Ia. 9 Id. ‘U Id. (“As the Unit Chief of the TTU, I am responsible for the development, procurement and deployment of technical assets and capabilities to covertly locate, rag, and track targets of interest in support of all FBI investigative, intelligence collection and operational programs”). “ OFFICE or P1uvAcv AND Clvn. LIBERTIES, UNITED STATES DEPARTMENT or JUSTICE, PR1vAcv IMPACT Assessments -- OFFICIAL GUIDANCE (Revised August 2010), avairable at http:ffwww.justicegov/opcl/pia_manual.pdf. 2 Because the “[Government’s] position continues to be that, as a factual matter, the [aircard tracking] operation did not involve a search or seizure under the Fourth Amendment,”12 and because Special Agent Morrison insists that the equipment qualifies as “a pen register/trap and trace device, as de ned in l8 U.S.C. §§ 3127(3) and (4),==‘3 it is likely that the FBI or another office has issued a legal basis memorandum regarding the use of cell site simulator technology. Documents Requested EPIC requests copies of the following agency records in possession of the __: 1. All documents concerning technical speci cations of the StingRay device or other cell site simulator technologies. 2. All documents concerning procedural requirements or guidelines for the use of StingRay device or other cell site simulator technologies (e.g. con guration, data retention, data deletion). 3. All contracts and statements of work that relate to StingRay device or other cell site simulator technologies. 4. All memoranda regarding the legal basis for the use of StingRay device or other cell site simulator technologies. 5. All Privacy Impact Assessments or Reports concerning the use or capabilities of StingRay device or other cell site simulator technologies. Request for,,,li};;p_edited Processing This request warrants expedited processing because it is made by “a person primarily engaged in disseminating information ...” and it pertains to a matter about which there is an “urgency to inform the public about an actual or alleged federal govermnent activity.” 5 U.S.C. § 552(a)(6)(E)(v)(II) (2008); Al-Fayed v. CIA, 254 F.3d 300, 306 (D.C. Cir. 2001). EPIC is “primarily engaged in disseminating information.” American Civil Liberties Union v. Department ofJustice, 321 F. Supp. 2d 24, 29 n.5 (D.D.C. 2004). There is a particular urgency for the public to obtain information about location tracking technology, given the heated debate surrounding the recent US Supreme Court decision, US v. Jones, holding unanimously that the use of a GPS Tracking Device was a Fourth Amendment search requiring a warrant. United States v. Jones, 565 U.S. Z (2012). The public’s interest in and desire for information about the Government’s '1 Government Memorandum re Motion for Discovery, US v. Rigmaiden, No. 08-cr—008l-4 at *1 n.l (D.A1‘iZ OCT. 27, 201 l). 13 Affidavit of Supervisory Special Agent Bradley S. Morrison, US v. Rigmaiden, No. 08-cr—008l4 at *3 (D. Ariz. Oct. 27, 2011). 3 tracking activities is re ected in the sheer volume of news coverage that Jones and 14 related cases have received in the last six months. For examples, see EPIC: US v. Jones. Request for “News Media” Fee Status EPIC is a “representative of the news media” for fee waiver purposes. EPIC v. Department ofDefense, 241 F. Supp. 2d 5 (D.D.C. 2003). Based on our status as a “news media” requester, we are entitled to receive the requested record with only duplication fees assessed. Further, because disclosure of this information will “contribute significantly to public understanding of the operations or activities of the government,” any duplication fees should be waived. Thank you for your consideration of this request. As provided in 6 C.F.R. § 5.5(d)(-4), I will anticipate your determination on our request for expedited processing within ten (10) calendar days. Respectfu y ubmitted, Alan Butler EPI Appellate *1, acyFellow Gi erMcCall Director, EPIC Ope if overnment Project M Available at httpz.//epic.orgi’amicusfjones)’. 4 Exhibit 1 Case 2:08-cr-00814-DGC Document 674 Filed 10/27/11 Page 1 of 4 ANN BIRMINGHAM SCHEEL United States_Attorney District of Arizona FREDERICK A. BATTI STA Ma%and State Bar Member PE R S. SEXTON Arizona State Bar No. 011089 JAMES R. KNAPP Arizona State Bar No. 021166 Assistant U.S. Attorneys Two Renaissance Square _ 40 North First Avenue, Suite 1200 Phoenix, Arizona 85004 Telp-‘phone: (602) 5_I4—7500 Fre .Battista usdo_].gov Peter.Sexton usdocjlgov Jaiiies.K.napp @us o_].gov UNITED STATES DISTRICT COURT DISTRICT OF ARIZONA United States of America, No. CR-08-0814-PHX-DGC Plaintiff v. i GOVERNMENT’S MEMORANDUM RE MOTION FOR DISCOVERY Daniel David Rigmaiden, et al., Defendant. The United States, through undersigned counsel, submits this Memorandum in an attempt to clarify and narrow some issues for the upcoming October 28, 2011, hearing regarding Defendant’s Motion for Discovery. First, the United States proposes that the Court assume, arguendo, for Defendant’ s Motion for Discovery and any forthcoming motion to suppress, that the aircard tracking operation was a Fourth Amendment search and seizure. “ “ The United States’ position continues to be that, as a factual matter, the operation did not involve a search or seizure under the Fourth Amendment. The United States explained in its March l 1, 2011, Memorandum Regarding Law Enforcement Privilege that Defendant does not have a reasonable expectation of privaqy in his %eneral location or in the cell site records he transmitted wirelessly to Verizon. (CR 65 at l -17% Therefore, the use of the cell site simulator is not a search under the Fourth Amendment. ee, e.g.,,S,n'1ith v. Marylaiitl, 442 U.S. Y35, '_740 _(l979) (“applicatio1'i of the Fourth Amendment depends on whether the person invoking its protection can claim a ‘justifiable,’ a ‘reasonable,’ or a ‘legitimate expectation of privacy’ that has been invaded by government action”). Nevertheless, in an attempt to simpli the analysis and to avoid unnecessary disclosure ofprivileged information, the United States wi l (continued...) Case 2:08-cr-00814-DGC Document 674 Filed 10/27/11 Page 2 of-4 Second, the United States agrees to rely solely on the Rule 41 tracking warrant, application, and af davit, No. CR08-90330-MISC, to authorize the use of equipment to communicate directly with Defendanfs aircard and determine its location. 2’ Third, the United States will agree to allow the Court to factually assume, that, at the conclusion of the July 16, 2008, aircard tracking operation, the FBI located the aircard within Unit 1122 of the Domocilio Apartments. 3’ Fourth, with respect to whether the equipment used to locate the aircard was operated in a “man in the middle” manner or caused a brief “disruption of service,” the United States will agree that the Court can assume, arguendo, that it did. 4" Fifth, for the purpose of defendant’s pending motion(s) to compel discovery and his prospective motion to suppress, the United States does not expect to present facts in any in camera proceeding that it would then request the Court to consider for the purpose of rebutting any of defendant’s claims without disclosing those facts to the defendant. 1’ (...cont_inued) _ - no longer argue in this case only that the aircard tracking operation was not a search or seizure under t e Fourth Amendment, and will instead rel on its authority under the hybrid order and tracking warrant, Defendant’s lack of standing, and: ifnecessary, the agents’ good faith reliance on these court orders. 2" Again, the United States’ position is that the hybrid order confers sufficient authority to use a c_ell site simulator and that a tracking warrant is unnecessary. Nevertheless, the United States will rely solely on the Rule 41 warrant application, af davit and order in this case to authorize its use ofa cell site simulator. The hybri order, No. CRO8-90331-MISC, will be used to justify obtaining cell site and other iron-content information from Verizon Wireless. 3" h This isdngt, in facti,1accura1%e. As explained greviously, éhg Flill was qnly able to narrow t_ e a1rcar_ own to t ree or our a artments. ut to avoi isc osure o privileged information and sim lify the Fourth Amendiment analysis, the United States will concede, for puiéposes of any fort coming motion to suppress, that the FBI located the aircard within Unit 1 2 of the Domocilio Apartments. _ 4’ The United States indicated at the September 22, 2011, hearin that it believed “the simulator in this case was taking the message it received from the aircarg and sending it on to a Verizon tower.” (RT 9/22/2011 (CR 6 7) at 61:5-8.) As FBI Agent Bradley Morrison clari es in the attached af davit, however, the equipment did not ca ture an content and it did not act as a “man in the middle,” collecting data and passing it alliing to iierizon Wireless. (Morrison Aff. 2-3 1] 4.) 2s 2 l I" I 1 Case 2:08-or-00814-DGC Document 674 Filed 10/27/11 Page3of4 Finally, the United States is submitting a sworn af davit from Bradley Morrison, the Unit 2 '- Chief of the FBI Tracking Technology Unit, to describe facts regarding the aircard tracking 3 operation and clarify some remaining factual issues. The United States will make Agent 4 Morrison available ex. parte and in camera to answer questions the Court may have about the '5 tracking operation and the equipment used. In addition, the United States will make this 6 individual available for testimony at any future suppression hearing, so long as the United States 7 - has an opportunity to le a motion in limine in order to seek to limit cross-examination regarding 8 privileged law enforcement sensitive material. In order to proceed in this fashion, the United 9 States requests an opportunity to explain, in camera, the basis for its claims of privilege. 10 Respectfully submitted this 2'7“ day of October, 2011. ii ' ANN BIRMINGHAM SCHEEL 12 District of Arizona 13 14 S/Frederick A. Battista 15 FREDERICK A. BATTISTA PETER S. SEXTON 16 Assistant U.S. Attomeys Acting United States Attorney JAMES R. KNAPP 17 18 19 20 21 22 23 24 25 26 27 2s 3 Case 2:08-cr-00814-DGC Document 674 Filed 10127/11 Page 4 of 4 l CERTIFICATE OF SERVICE 2 I I_hereby certify that on October 27, 2011, I caused the attached document to be 3 l electronically transmitted to the Clerk’s Office 11S1I(1_:%tl‘l6 ECF system for ling and transmittal of a Notice of Electronic Filing to the following E registrants: 4 5 Philép Seglow Sha ow ounsel for Defendant Daniel David Rigmaiden 6 I Taylor Fox 7 Counsel for Defendant Ransom Carter 8 A copy of the attached docturient was also mailed to: 9 10 11 Daniel David Rigmaiden Agencér No. 10966111 C A- ADC PO Box 6300 Florence, AZ 85132 12 i S/James Knapp 13' l4 15 16 17 18 19 20 21 22 23 24 25 26 27 2s 4 Exhibit 2 oci27i1o6:59p Case 2:08-cr-00814-DGC Document 674-1 Filed 10/27/11 Page1of3 P-1 _A_F_ OF SUPERVIS ORY SPECIAL AGENT BRADLEY S. MORRISON y 1. I, Bradley S . Morrison, am a Superviscry"Special Agent with the Federal Bureau of Investigation. I am assigned as the Unit Chief of the Tracking Technology Unit (TTU), Traditional Technology Section, Operational Technology Division in Quantico, Virginia. I have been an FBI Special Agent since 1996. As the Unit Chief of the TTU, I am responsible for the development, procurement and deployment of technical assets and capabilities to covertly locate, tag and track targets of interest in support of all FBI investigative, intelligence collection and operational promams. As part of these duties, I am responsible for overseeing deployment and monitoring policy compliance governing the FBl’s use of equipment to locate cellular devices. 2. On July 16, 2008, FBI technical personnel used equipment to locate an aircard believed to be used by the defendant in this matter, and that equipment falls within the statutory definition of a pen register/trap and trace device. The actual make and model of the equipment used in airy particular operation by the FBI is law enforcement sensitive, and pursuant to FBI policy, cannot be released to the general public. 3. As a pen registerftrap and trace device, as de ned in 18 U.S.C. §§ 3127(3) and (4), the equipment used in this case can only record, decode or capture clcctronic impulses which identify the originating number of a source of electronic coinmuiiications, or other 1 3¢i271107I00P Case 2:08-cr-00814-DGC Document674-1 Filed 10/27/11 Page2of3 P-2 dialing, routing, signaling and addressing infonriation utilized in the processing and transmitting of electronic communications. To comply with the legal definition of a pen regsterftrap and trace device, the equipment used in this case is unable to upload, encode or write any information to a target device. If the equipment were capable of these functions, it would no longer be in compliance with the statutory de nition of a pen register/trap and trace device. Therefore, the equipment used in this case is technologically unable to take any action to reprogram the hardware or software in the aircard or the defendanfs laptop. - 4. Further, 18 U.S.C. §§ 3 127(3) and (4) speci cally prohibit pen register or trap and trace devices "orn recording, decoding or capturing the substantive content of any communication. Were the equipment to do this, by statute, it would no longer be a pen registerftrap and trace device. Instead, it would be an electronic intercept device rcgulated by Title I11. To ensure that the content of communications is not intercepted, in accordance with 18 U.S.C. §3 121(0), all pen register/trap and trace devices used by government agencies must be restricted from recording or decoding any data or impulses not strictly related to the dialing, routing, signaling or addressing information utilized in the processing or transmitting of wire or electronic conununications. The equipment used in this case was in compliance with the requirements of the statutes cited above. . Therefore, the pen register/trap and trace equipment used to locate the defendanfs aircard did not capture, collect, decode, view, or otherwise obtain any content transmitted horn 2 Oct271107:00D Case 2:O8—~cr-00814-DGC Document 674-1 Filed 10/27/11 Page-3of3 P-3 the aircard, and therefore was unable to pass any of this information from the aircard to Verizon Wireless. 5. FBI policy requires that at the conclusion of a location operation, FBI technical personnel are to purge all data stored in the pen registerftrap and trace equipment. During a location operation, the electronic serial numbers (ESNS) (or their equivalent) from all wireless devices in the immediate area of the FBI device that subscribe to a particular provider may be incidentally recorded, including those of innocent, non-target devices. Purging is done by the FBI as an additional, internal procedural safeguard to ensure (1) that the privacy rights of those innocent third parties are maintained, (2.) that the FBI does not store or maintain pen register/trap and trace data beyond the scope of its legal authorization, or (3) that the FBI does not collect information about individuals who are not the subject of criminal or national security investigations. 6. I declare under penalty of perjury that the foregoing facts are true and correct. I 0 /$2 2*»///.. . . Date ' B adley S Moruson Supervisory Special Agent FBI 3 L“ —'