Case 4:13-cr-00818-PJH Document 304 Filed 05/01/17 Page 1 of 27

1 BOERSCH SHAPIRO LLP
David W. Shapiro (State Bar No. 219265)
2 Dshapiro@boerschshapiro.com
Martha Boersch (State Bar No. 126569)
3
Mboersch@boerschshapiro.com
4 Lara Kollios (State Bar No. 235395)
Lkollios@boerschshapiro.com
5 1611 Telegraph Ave., Ste. 806
Oakland, CA 94612
6 Telephone: (415) 500-6640
7

Attorneys for Defendant
8 PURVIS LAMAR ELLIS
9

UNITED STATES DISTRICT COURT

10

NORTHERN DISTRICT OF CALIFORNIA

11

OAKLAND DIVISION

12

UNITED STATES OF AMERICA,

13

Plaintiff

14
15
16
17

v.
PURVIS LAMAR ELLIS, et al.

Case No. CR-13-00818 PJH
ALL DEFENDANTS NOTICE OF
MOTION; MOTION TO SUPPRESS
EVIDENCE OBTAINED FROM
STINGRAY AND FOR FRANKS
HEARING; AND MEMORANDUM IN
SUPPORT

Defendants.

18

Hearing Date: June 14, 2017
Hearing Time: 1:30 p.m.

19

Trial Date: TBD

20
21
22
23
24
25
26
27
28
MOTION TO SUPPRESS EVIDENCE OBTAINED
FROM STINGRAY AND FOR FRANKS HEARING
Case No.: CR 13-00818 PJH

 Case 4:13-cr-00818-PJH Document 304 Filed 05/01/17 Page 2 of 27

1

TABLE OF CONTENTS

2 NOTICE OF MOTION ........................................................................................................................ 1
3 MEMORANDUM OF POINTS AND AUTHORITIES.................................................................... 1
4
5

INTRODUCTION................................................................................................................................. 3
STINGRAY SURVEILLANCE TECHNOLOGY ............................................................................ 5

6
STATEMENT OF FACTS ................................................................................................................... 5
7
I. Procedural Background Relating to the Stingrays ...................................................................... 5
8
A.

Background ............................................................................................................... 5

B.

The Defense Requests for Disclosure of Electronic Surveillance ............................ 5

C.

The Government’s Initial Disclosure That A Stingray was Used Without a Warrant
And Denial That any Other Cell-Site Simulator was Used ...................................... 6

D.

13

The Government Finally Admits That Two Stingrays Were Used Without
Warrants, but Declines to Disclose Evidence Related to the Stingrays .................. 11

14

II. The Evidence Regarding the Use of the Stingrays ................................................................... 11

9
10
11
12

15

A.

The OPD Stingray ................................................................................................... 12

16

B.

The FBI Stingray..................................................................................................... 12

C.

The Exigent Circumstance Requests for Pen Registers .......................................... 13

17
18
19

ARGUMENT ....................................................................................................................................... 14
I. The Warrantless Use of the Stingrays Violated The Fourth Amendment ................................ 14

20
A.

The Use of the Stingrays was a Search Requiring a Warrant ................................ 15

B.

The Warrantless Use of the Stingrays Violated the Fourth Amendment................ 17

C.

The Use of the Stingrays Likely Violated Title III ................................................. 19

D.

Any Evidence Derived from the Illegal Surveillance Must be Suppressed ............ 21

21
22
23
24
25

II. A Franks Hearing is Required Because the Government Deliberately Misled the Court In Its
Application For a Pen Register ................................................................................................. 22

26
CONCLUSION ................................................................................................................................... 23
27
28
i

MOTION TO SUPPRESS EVIDENCE OBTAINED
FROM STINGRAY AND FOR FRANKS HEARING
Case No.: CR 13-00818 PJH

 Case 4:13-cr-00818-PJH Document 304 Filed 05/01/17 Page 3 of 27

1

TABLE OF AUTHORITIES

2 Cases
3 Bartnicki v. Vopper,
532 U.S. 514 (2001) ..........................................................................................................................20
4
Brown v. Waddell,
5
50 F.3d 285 (4th Cir. 1995) ...............................................................................................................20
6 Franks v. Delaware,
438 U.S. 154 (1978) ..........................................................................................................................22
7
In re Application for an order Authorizing Use of a Cellular Telephone Digital Analyzer,
8
885 F.Supp. 197 (C.D. Cal. 1995) .....................................................................................................18
9 Joffe v. Google, Inc.,
746 F.3d 920 (9th Cir. 2013) .............................................................................................................21
10
Katz v. United States,
11
389 U.S. 347 (1967) ..........................................................................................................................15
12 Kyllo v. United States,
533 U.S. 27 (2001) ......................................................................................................................14, 15
13
Nardone v. United States,
14
308 U.S. 338 (1939) ..........................................................................................................................21
15 Riley v. California,
134 S. Ct. 2473 (2014).......................................................................................................................15
16
Silverman v. United States,
17
365 U.S. 505 (1961) ..........................................................................................................................16
18 United States v. Barnwell,
477 F.3d 844 (6th Cir. 2007) .............................................................................................................10
19
United States v. Cardwell,
20
680 F.2d 75 (9th Cir. 1982) ...............................................................................................................19
21 United States v. Comprehensive Drug Testing, Inc.,
621 F.3d 1162 (9th Cir. 2010) ...........................................................................................................18
22
United States v. DeLeon,
23
979 F.2d 761 (9th Cir. 1992) .............................................................................................................22
24 United States v. Jones,
565 U.S. 400 (2012) ..........................................................................................................................16
25
United States v. Karo,
26
468 U.S. 705 (1984) ..........................................................................................................................15
27 United States v. Lambis,
197 F.Supp. 3d 606 (S.D.N.Y. 2016) ......................................................................................3, 14, 16
28
i

MOTION TO SUPPRESS EVIDENCE OBTAINED
FROM STINGRAY AND FOR FRANKS HEARING
Case No.: CR 13-00818 PJH

 Case 4:13-cr-00818-PJH Document 304 Filed 05/01/17 Page 4 of 27

1

United States v. Patrick,
842 F.3d 540 (7th Cir. 2016) ...............................................................................................2, 5, 20, 21

2 United States v. Ramirez-Sandoval,
872 F.2d 1392 (9th Cir. 1989) ...........................................................................................................21
3
United States v. Rubalcava-Montoya,
4
597 F.2d 140 (9th Cir. 1979) .............................................................................................................21
5 United States v. Smith,
Case No. 15-20394, 2016 WL 7453761 (E.D. Mich. Dec. 28, 2016) ...............................................21
6
United States v. Stanert,
7
762 F.2d 775 (9th Cir. 1985) .............................................................................................................22
8 Statutes
9 18 U.S.C. § 2510 ...................................................................................................................................20
10 18 U.S.C. § 2511 ...................................................................................................................................20
11 18 U.S.C. § 2518 ...................................................................................................................................21
12 Other Authorities
13 Adrian Dabrowski, et al, IMSI-Catch Me If You Can: IMSI-Catcher-Catchers, in Annual Computer
Security Applications Conference (ACSAC)(2014) ...........................................................................3
14
Department of Justice Policy Guidance: Use of Cell–Site Simulator Technology (Sept. 3, 2015) ........5
15
http://www.mercurynews.com/2006/11/30/gang-rivalrykilled-oaklandman-police-say/ .....................19
16
Linda Lye, Stingrays: The Most Common Surveillance Tool the Government Won’t Tell You About,
17
A Guide for Criminal Defense Attorneys, ACLU of Northern California 1-3 (2014) (available at
https://www.aclunc.org/sites/default/files/StingRays_The_Most_Common_Surveillance_Tool_the_
18
Govt_won%27t_Tell_You_About_0.pdf ................................................................................9, 19, 23
19
20
21
22
23
24
25
26
27
28
ii

MOTION TO SUPPRESS EVIDENCE OBTAINED
FROM STINGRAY AND FOR FRANKS HEARING
Case No.: CR 13-00818 PJH

 Case 4:13-cr-00818-PJH Document 304 Filed 05/01/17 Page 5 of 27

1
2 TO:

NOTICE OF MOTION

3

UNITED STATES OF AMERICA, PLAINTIFF; BRIAN STRETCH, ACTING UNITED
STATES ATTORNEY; AND JOSEPH ALIOTO, ASSISTANT UNITED STATES
ATTORNEY:

4

PLEASE TAKE NOTICE that on June 14, 2017, at 1:30 p.m. or as soon thereafter as the

5 matter may be heard, in the courtroom of the Honorable Phyllis Hamilton, United States District
6 Judge, all defendants, by and through undersigned counsel of record for Purvis Ellis, will move this
7 Honorable Court for an order suppressing all evidence obtained through the use of a Stingray as well
8 as all fruits of that search, and a Franks hearing regarding the same. This motion is based upon the
9 Fourth Amendment to the United States Constitution, the attached Memorandum, the Declaration of
10 Martha Boersch, all files and records in this case, and any further evidence as may be adduced at the
11 hearing on this Motion.
12
13

MEMORANDUM OF POINTS AND AUTHORITIES

14

INTRODUCTION

15

The defendants move to suppress any and all evidence obtained or derived from the use of

16 any cell-site simulators in this case, and/or for a Franks hearing.1
17

The defendants have been in pretrial custody for more than three years while the government

18 has repeatedly delayed production of relevant discovery. For more than a year after the defendants
19 were indicted, defense counsel repeatedly asked the government to confirm the use of any electronic
20 surveillance. The government ignored those requests, leaving the defense no choice but to file a
21 motion in February 2015 to compel that information. The reason for the government’s silence
22 became apparent when, in response to the motion, the government finally admitted that a Stingray
23 had been used. Dkt. 93 at 2 (“the United States confirms that a cell-site simulator was used in this
24 case to obtain the general location of an armed suspect at large.” (emphasis added).)
25
“A cell-site simulator—sometimes referred to as a ‘StingRay,’ ‘Hailstorm,’ or ‘TriggerFish’
– is a device that locates cell phones by mimicking the service provider’s cell tower (or ‘cell site’)
27 and forcing cell phones to transmit ‘pings’ to the simulator.” United States v. Lambis, 197 F.Supp.
3d 606, 609 (S.D.N.Y. July 12, 2016). The defense shall refer to the cell-site simulators as
28 “Stingrays” in this motion.
MOTION TO SUPPRESS EVIDENCE OBTAINED
1
26

1

FROM STINGRAY AND FOR FRANKS HEARING
Case No.: CR 13-00818 PJH

 Case 4:13-cr-00818-PJH Document 304 Filed 05/01/17 Page 6 of 27

1

But the government’s obfuscation continued when it persisted in denying that more than one

2 Stingray had been used. At an August 5, 2015 status conference, counsel for the defense attempted to
3 explain to the Court why the defense believed that multiple Stingrays were used. The government
4 accused the defense of baseless conjecture and affirmatively asserted that only one Stingray was
5 used, by the FBI: “I can say right now almost definitively that there were not two cell-site simulators
6 used. And all of the conjecture that you have just recently heard is just nothing more than
7 conjecture.” Boersch Decl. Ex. A. But as we now know, there were two Stingrays used, one by the
8 FBI and one by the Oakland Police Department (“OPD”). And although the government ultimately
9 admitted to using two Stingrays, after over a year of denial, it still refuses to provide necessary
10 information about its Stingray policies and guidelines, including but not limited to whether the
11 Stingrays were configured to capture content (i.e., text messages, phone conversations, etc.) or to act
12 as a microphone.2
13

The government’s opacity on its use of the Stingrays is not unique to this case or this District.

14 Just six months ago, the Honorable Chief Judge Diane Wood of the Seventh Circuit said this about
15 the government’s efforts to hide information regarding its use of Stingrays:
16
17
18
19
20
21

This is the first court of appeals case to discuss the use of a cell-site
simulator, trade name “Stingray.” We know very little about the device,
thanks mostly to the government's refusal to divulge any information
about it. Until recently, the government has gone so far as to dismiss
cases and withdraw evidence rather than reveal that the technology was
used. See Memorandum Agreement between Amy S. Hess, Assistant
Director, Operational Technology Division, FBI, and David Salazar,
Chief of Police, MPD (Aug. 13, 2013) (agreeing to dismiss cases rather
than disclose use of Stingray).

22 United States v. Patrick, 842 F.3d 540, 546 (7th Cir. 2016) (Wood, Chief J., dissenting).
23

In the present case, neither the FBI nor the OPD obtained search warrants or lawful court

24 orders before deploying the two Stingrays. The use of those Stingrays constituted a search under the
25 Fourth Amendment that required search warrants, and the court order for a pen register the
26 government obtained was obtained through deception and falsehoods. All evidence derived from the
27
2
The defense will again meet and confer with the government regarding those items and file a
28 motion to compel should the government continue to refuse to produce them.
MOTION TO SUPPRESS EVIDENCE OBTAINED
2

FROM STINGRAY AND FOR FRANKS HEARING
Case No.: CR 13-00818 PJH

 Case 4:13-cr-00818-PJH Document 304 Filed 05/01/17 Page 7 of 27

1 use of the Stingrays must therefore be suppressed. See United States v. Lambis, 197 F.Supp. 3d 606
2 (S.D.N.Y. 2016) (suppressing all evidence, including drugs and drug paraphernalia, seized from the
3 defendant’s apartment because the search stemmed from the government’s illegal use of a Stingray).
4

STINGRAY SURVEILLANCE TECHNOLOGY

5

The defense has previously described for this Court the technology of cell-site simulators and

6 incorporates that briefing here. See Dkt. 118 at 7-10. For purposes of this motion to suppress, these
7 are the salient features of Stingray technology:
•

8
9

A Stingray operates using electronic signals that penetrate walls and physical barriers
that protect homes, offices, and other private places;

•

10
11

A Stingray masquerades as a cell phone tower, forcing all wireless devices within
range to communicate with it, whether those devices are targeted or not;

•

12

From those forced communications, a Stingray can identify all phones within range,

13

and can forcibly obtain from those phones information including phone numbers,

14

IMSI, IMEI, and TMSI information;3
•

15
16

A Stingray can pinpoint the precise location of a phone within constitutionally
protected spaces with an accuracy of two meters;

17

•

A Stingray can intercept content transmitted from phones within its range;

18

•

A Stingray can force a phone to act as a microphone, essentially converting the phone

19

to a wiretap;
•

20

A Stingray operates independently of any wireless carrier.4

21

IMSI: acronym meaning “International Mobile Subscriber Identity,” a unique identifier for a
22 user of a mobile network. The IMSI is stored in the SIM card for those phones using GSM networks,
and within the phone or the R-UIM card for phones using CDMA networks. IMEI: acronym
23 meaning “International Mobile Equipment Number,” a unique identifier number tied with the specific
mobile phone device connected to the network, almost like a serial number for the specific phone.
24
TMSI: acronym meaning “Temporary Mobile Subscriber Identity,” a unique identifier number
25 ascribed temporarily to a specific mobile device by the network to which the device is connected.
See Adrian Dabrowski, et al, IMSI-Catch Me If You Can: IMSI-Catcher-Catchers, in Annual
26 Computer Security Applications Conference (ACSAC)(2014) at 2.
3

In its October 26, 2016, letter, the government claimed that “[n]o content, conversations, or text
messages were captured, so there are no records documenting any such content. The cell-site
28 simulator intercepted and temporarily collected the dialing, routing, addressing and signaling
MOTION TO SUPPRESS EVIDENCE OBTAINED
3
27

4

FROM STINGRAY AND FOR FRANKS HEARING
Case No.: CR 13-00818 PJH

 Case 4:13-cr-00818-PJH Document 304 Filed 05/01/17 Page 8 of 27

1
2
3
4

The Department of Justice has described Stingray technology as follows:
Cell-site simulators ... function by transmitting as a cell tower. In
response to the signals emitted by the simulator, cellular devices in the
proximity of the device identify the simulator as the most attractive cell
tower in the area and thus transmit signals to the simulator that identify
the device in the same way that they would with a networked tower.

5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

A cell-site simulator receives and uses an industry standard unique
identifying number assigned by a device manufacturer or cellular
network provider. When used to locate a known cellular device, a cellsite simulator initially receives the unique identifying number from
multiple devices in the vicinity of the simulator. Once the cell-site
simulator identifies the specific cellular device for which it is looking, it
will obtain the signaling information relating only to that particular
phone. When used to identify an unknown device, the cell-site simulator
obtains signaling information from non-target devices in the target's
vicinity for the limited purpose of distinguishing the target device.
By transmitting as a cell tower, cell-site simulators acquire the
identifying information from cellular devices. This identifying
information is limited, however. Cell-site simulators provide only the
relative signal strength and general direction of a subject cellular
telephone; they do not function as a GPS locator, as they do not obtain
or download any location information from the device or its applications.
Moreover, cell-site simulators used by the Department must be
configured as pen registers, and may not be used to collect the contents
of any communication, in accordance with 18 U.S.C. § 3127(3). This
includes any data contained on the phone itself: the simulator does not
remotely capture emails, texts, contact lists, images or any other data
from the phone. In addition, Department cell-site simulators do not
provide subscriber account information (for example, an account
holder's name, address, or telephone number).

20
21 information of the target phone in order to determine its approximate location. It did not collect any
phone numbers.” However, DOJs own Electronic Surveillance Manual makes clear that, at the very
22 least, a cell site simulator will capture phone numbers when a target phone is used to make or receive
a call. Boersch DecL., Ex. B (“If the cellular telephone is used to make or receive a call, the screen
23 of the digital analyzer/cell site simulator/ triggerfish would include the cellular telephone number
(MIN), the call's incoming or outgoing status, the telephone number dialed, the cellular telephone's
24 ESN, the date, time, and duration of the call, and the cell site number/sector (location of the cellular
25 telephone when the call was connected”). The CAD reports suggest that this is exactly what OPD
was doing. For example, at one point the following exchange occurred between two officers early on
26 the morning of January 22, 2013:
Porter, this Omega, I was told there’s some activity on the phone right
27
now, because of 108 maybe.
Yeah Omega, he’s uh, he’s live on his uh every couple minutes.
28 Boersch Decl. ¶19 (PHOTOS-VIDEOS-000035, Disc 3 Track 2 at 4:30).
MOTION TO SUPPRESS EVIDENCE OBTAINED
4
FROM STINGRAY AND FOR FRANKS HEARING
Case No.: CR 13-00818 PJH

 Case 4:13-cr-00818-PJH Document 304 Filed 05/01/17 Page 9 of 27

1 United States v. Patrick, 842 F.3d 540, 542-43 (7th Cir. 2016) (quoting Department of Justice Policy
2 Guidance: Use of Cell–Site Simulator Technology (Sept. 3, 2015) at 2.).
3

STATEMENT OF FACTS

4 I.

PROCEDURAL HISTORY RELATING TO THE STINGRAYS

5

A. Background

6

Defendant Purvis Ellis and his three co-defendants were indicted by a federal grand jury on

7 December 19, 2013, for conspiracy to violate RICO and several other offenses arising from two
8 incidents on January 20 and 21, 2013. On January 20, 2013, an individual was shot on Foothill
9 Boulevard in Oakland, and on January 21, 2013, an undercover police officer who had entered the
10 rear parking lot of an apartment building on Seminary Avenue was shot in the wrist. According to
11 discovery produced to the defense, Ellis has never been identified as involved in the shooting of the
12 officer and is not substantively charged with that offense. Defendant Ellis was allegedly identified as
13 the driver of a car on January 20 that picked up two suspects after the shooting.
14

Ellis was originally charged in state court with offenses arising from the January 21, 2013

15 incident. Those charges were dismissed, however, after Ellis’s defense counsel asked the Alameda
16 County District Attorney to produce the search warrant affidavits that led to Ellis’s arrest on those
17 charges. Boersch Decl., ¶2. Those search warrant affidavits were never produced in the state
18 proceedings. Instead, this federal indictment followed.
19

B. The Defense Requests for Disclosure of Electronic Surveillance

20

The defendants have made numerous requests for disclosure of electronic surveillance and

21 evidence related to that surveillance. On May 28, 2014 – three years ago – defense counsel made the
22 following specific request related to electronic surveillance:
23
24
25
26
27
28

18. The disclosure of any electronic video or surreptitious interception or
recording which was made of any conversation or activity in
connection with this case. This Request includes, but is not limited
to,
a. production of any memoranda, transcripts, notes or other record
thereof, preserved by any means whatsoever, which were procured
by any electronic, mechanical, or physical wiretapping,
eavesdropping, overhearing, or surveillance;
b. the circumstances under which such surveillance or eavesdropping
MOTION TO SUPPRESS EVIDENCE OBTAINED
5
FROM STINGRAY AND FOR FRANKS HEARING
Case No.: CR 13-00818 PJH

 Case 4:13-cr-00818-PJH Document 304 Filed 05/01/17 Page 10 of 27

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

was conducted; and
c. copies of any written orders, applications for orders, or memoranda
to obtain permission to intercept communications from any
executive or judicial authority.
19. A copy of all telephone toll records reviewed in connection with this
case by any government agents or attorneys, or by any other persons
working in conjunction with such agents, and copies of all
applications, orders, or subpoenas prepared in connection with the
obtaining of such telephone toll records.
20. All call data obtained in this case, all phone numbers
obtained/monitored in the course of this investigation, and all cell-site
data obtained during the investigation.
21. Full documentation of the sources of all call record data collected by
the government (including the Oakland Police Department and the
Northern California HIDTA Task Force) in this case, including data
obtained (directly or indirectly) from cell phone service providers, the
National Security Agency, the DEA Special Operations Division, the
Hemisphere Project, the Northern California Regional Intelligence
Center, or any other such government intelligence agency or task
force group.
22. Any and all communications between law enforcement and/or
Department of Justice officials involved with this case and the
Hemisphere Project, the Northern California Regional Intelligence
Center, or the DEA Special Operations Division, regarding the
collection of cell phone call record data in the investigation of this
case.
23. All call data, telephone toll records, GPS, and cell site data for
a. Any cell phone used by Officer Eric Karsseboom including his
personal and/or Oakland Police Department issued cell phone from
January 21, 2013 through March 1, 2013.
b. Any cell phone used by Officer Malcolm Miller including his
personal and/or Oakland Police Department issued cell phone from
January 21, 2013 through March 1, 2013.

22 Boersch Decl., Ex. C.
23
24

C. The Government’s Initial Disclosure That A Stingray was Used Without a Warrant
And Denial That any Other Cell-Site Simulator was Used

25

The government never responded to defense counsel’s specific requests for disclosure of

26 information related to electronic surveillance. Therefore, on February 6, 2015, defense counsel filed
27 a “Motion for Search and Disclosure of Electronic Surveillance” pursuant to 18 U.S.C. § 3504(a),
28 which provides that the United States “shall affirm or deny” the use of electronic surveillance. Dkt.
6

MOTION TO SUPPRESS EVIDENCE OBTAINED
FROM STINGRAY AND FOR FRANKS HEARING
Case No.: CR 13-00818 PJH

 Case 4:13-cr-00818-PJH Document 304 Filed 05/01/17 Page 11 of 27

1 78. The government’s response to the motion was cryptic, and, as we now know, misleading: “the
2 United States confirms that a cell-site simulator was used in this case to obtain the location of an
3 armed suspect at large.” United States’ Response to Defendants’ Motion for Disclosure of Electronic
4 Surveillance, Dkt. 93 at 2 (emphasis added). The government’s response did not indicate whether the
5 cell-site simulator was used by the FBI or the OPD, it did not identify the “armed suspect” or the
6 evidence sufficient to believe that the target of the simulator was either armed or a suspect, and it did
7 not describe exactly what technology was used or what information was obtained or reviewed.
8

The government also stated in its response that OPD “sought cell phone records” without a

9 warrant, ostensibly based on exigent circumstances. Id. at 3. The government then referenced two
10 documents executed by OPD that had been attached to the defense motion: a “Metro PCS CALEA
11 Pen and Wiretap Worksheet” for 661-862-0279, and a Metro PCS “Exigent Circumstance Request”
12 for 510-904-7509, which was allegedly executed at 23:15 on January 21, 2013. Boersch Decl., Exs.
13 D and E. The latter document specifically required: “All requests for cells site locations MUST be
14 followed-up by a legal document signed by a judge within 48 business hours.” Boersch Decl., Ex. E
15 (emphasis in original). The government did not provide any “legal document” or any further
16 information. The government has never explained how or why it focused on these two phone
17 numbers, except that it contends the second number belonged to Ellis. As noted, the government has
18 never provided any evidence to justify its focus on Ellis’s phone number: the discovery produced to
19 the defense shows that Ellis was not identified as involved in the shooting on January 21.5
20

After the defendants filed a reply brief arguing that the warrantless use of a cell-site simulator

21 violated their Fourth Amendment rights and seeking further information about the device, the Court
22 allowed the government to file a brief in response. In that brief, the government asserted that it was
23 continuing to search for other relevant discovery, and claimed, erroneously, that “the defense did not
24 send any discovery requests before filing their motion.” Dkt. 120 at 2.
25

On May 26, 2015, after a status conference, defense counsel sent another letter to the

26 government specifically requesting the following:
27
5
The government has not produced any witness statements and the search warrant affidavits
28 are heavily redacted.
MOTION TO SUPPRESS EVIDENCE OBTAINED
7

FROM STINGRAY AND FOR FRANKS HEARING
Case No.: CR 13-00818 PJH

 Case 4:13-cr-00818-PJH Document 304 Filed 05/01/17 Page 12 of 27

1
2
3
4
5
6
7
8
9
10
11
12
13
14

1. Please identify the name of the “armed suspect at large.”
2. Identify any and all cell phones and/or cell phone numbers that were
intercepted or tracked by the cell-site simulator;
3. Identify the type of information intercepted by the cell-site simulator,
e.g., whether location or contents and if contents whether text
messages, emails, phone calls or any other form of content;
4. Provide any and all evidence and records – whether written, audio,
digital or in whatever form – obtained or reviewed as a result of the use
of the cell-site simulator;
5. Provide any and all applications, requests, warrants, affidavits,
notifications, or orders related to the use of the cell-site simulator in
this case and/or which purport to seek the authorization or authorize the
use of the cell-site simulator;
6. Provide copies of any and all agreements between the Oakland Police
Department and any federal agency, including the Department of
Justice, the United States Attorney’s Office, the Federal Bureau of
Investigation, or the Federal Communications Commission, relating to
the use of any cell-site simulator, including, but not limited to, any nondisclosure agreement executed by the Oakland Police Department or
any state or local law enforcement agency involved in the investigation
of this matter as a condition of receiving the cell-site simulator
equipment or technology.

15 Boersch Decl., Ex. F. The defense received no response. In June 2015, in further briefing on the
16 Stingray issues and in view of the substantial delays in the production of discovery, the defendants
17 filed a brief requesting that the Court order the government to produce all records relating to
18 electronic surveillance within 14 days.
19

On August 4, 2015, three months later and one day before a scheduled hearing, the

20 government finally responded to the defense letter:
21
22
23
24
25
26

I have confirmed through our investigative agency that on January 22,
2013, the FBI used a cell-site simulator to track the phone associated
with Purvis Ellis, (510) 904-7509, who was a suspect in the shooting of
an Oakland police officer hours earlier. The cell-site simulator
intercepted and temporarily collected the dialing, routing, addressing,
and signaling information of the target phone in order to determine its
approximate location. It did not collect any GPS location information.
It did not collect any phone numbers. It did not collect any content,
including text messages, emails, phone calls or any other form of
content. The information collected from the cell-site simulator was
purged after Mr. Ellis was arrested.

27
28
8

MOTION TO SUPPRESS EVIDENCE OBTAINED
FROM STINGRAY AND FOR FRANKS HEARING
Case No.: CR 13-00818 PJH

 Case 4:13-cr-00818-PJH Document 304 Filed 05/01/17 Page 13 of 27

1 Boersch Decl., Ex. G (emphasis added).6 The letter did not specify whether this FBI use of a cell-site
2 simulator was the use the government referenced in its response to the defense motion for disclosure
3 of electronic surveillance. Nor did the letter describe the specific technology used or explain the
4 basis for the government’s belief that the phone number was “associated with Purvis Ellis.”
5

Attached to this August 4 letter, the government produced, for the first time and more than a

6 year after the defendants’ specific request, an FBI “Exigent Request” for pen register information
7 directed to “Metro PCS, AT&T Wireless Services, Nextel Communications, Spring PCS, Cricket
8 Communications, Cingular Wireless, MCI Worldcomm, Sure West Wireless, T-Mobile, Voice
9 Stream Wireless, Citizens Utilities, Pacific Bell Telephone Company, SBC Communications and any
10 other affected telecommunication companies, subsidiaries, or entities” and a “state court order
11 providing for the use of the pen register to track the phone at issue.” Boersch Decl., Exs. H and I.
12 The FBI “Exigent Circumstances” request was made by the FBI at 7:30 am on January 22, 2013, and
13 sought “subscriber data and pen register or Title III intercept.”7 The letter did not indicate whether
14 the government considered this document responsive to the defense request for any order authorizing
15 the use of a cell-site simulator.
16

The state court order, which is not file-stamped8 but was allegedly signed at some unknown

17 time on January 22, 2013, was an order allowing the use of a device described as “pen register and
18 trap and trace device” on 510-904-7509. Id. at 1. The order ostensibly was issued under the
19 authority of 18 U.S.C. § 2703(c) and (d). The order allowed the installation and use of a pen register
20

6

The government has never specified the technology that was used, and different cell-site
simulators have different capabilities. See Linda Lye, Stingrays: The Most Common Surveillance
21 Tool the Government Won’t Tell You About, A Guide for Criminal Defense Attorneys, ACLU of
Northern California 1-3 (2014) (available at https://www.aclunc.org/sites/default/files/StingRays_
22 The_Most_Common_Surveillance_Tool_the_Govt_Won%27t_Tell_You_About_0.pdf)
(hereinafter “Lye, Stingrays”).
23
7
In another example of the government’s abuse of its ability to withhold information from
24 the defense, it has redacted the name of the FBI agent who applied for the pen register. There can be
no legitimate basis for this redaction.
25
8
The defense has repeatedly asked the government for file-stamped copies of all search
26 warrants, affidavits and orders related to any electronic surveillance or searches because, for instance,
the purported search warrant for apartment 212, like the recently produced order for a pen register, is
27 not file-stamped so there is no way to confirm from the document when it was executed or whether it
was ever filed with any court.
28
9

MOTION TO SUPPRESS EVIDENCE OBTAINED
FROM STINGRAY AND FOR FRANKS HEARING
Case No.: CR 13-00818 PJH

 Case 4:13-cr-00818-PJH Document 304 Filed 05/01/17 Page 14 of 27

1 and trap and trace device by the service provider:
2

to register numbers dialed or pulsed from the Target Telephone number
(510) 904-7509, to record the date and time of such dialing or pulsing, to
record the length of the time the telephone receiver is off the hook for
incoming or outgoing calls, and to receive cell site and/or location sites, for
a period of thirty (30) days.

3
4

5 Boersch Decl., Ex. I at 1. The order says nothing about the use of a Stingray, cell-site simulator, or
6 any equivalent technology.
7

Attached to the order was an application submitted by the OPD, not by the FBI, which is

8 heavily redacted and which repeated the information also set forth in the heavily redacted search
9 warrant affidavits, information that has never been provided to the defense.9 The application did not
10 mention the use of a Stingray, cell site simulator, or any equivalent device. The government again
11 did not indicate whether it considered this order to be responsive to defense request, above, and did
12 not respond to any of the other specific requests made in the defense May 26 letter.
13

Based on the information described above and the evidence that had been produced in

14 discovery, the defense believed that the government was withholding information that at least two
15 Stingrays had been used, but the government denied it. On August 5, 2015, at the hearing on the
16 various motions, counsel for the government stated: “I can say right now almost definitively that
17 there were not two cell-site simulators used. And all of the conjecture that you have just heard is
18 nothing but conjecture.” Dkt.129 at 41:11-14 (emphasis added). At the hearing, the Court ordered the
19 defense to meet and confer with the government regarding outstanding discovery requests related to
20 the use of electronic surveillance. Id. at 42-43.
21

On August 12, 2015, in response to the government’s August 4 letter and the Court’s

22 admonition, the defense made a further request for discovery based on information the government
23
24
25
26
27
28

The defense continues to object to the government’s heavy reliance in this case on “secret”
ex parte submissions and again asks that the information that has been redacted be disclosed to the
defense as a matter of due process. There is no reason the information could not be provided to
defense counsel. The government’s use of secret submissions not only deprives the defendants of
their Fifth and Sixth Amendment right to due process and effective assistance of counsel, but also run
the risk of tainting the objectivity of the Court and creating bias against the defendants. See, e.g.,
United States v. Barnwell, 477 F.3d 844, 850-51 (6th Cir. 2007) (stating that “[a]n ex parte
communication between the prosecution and the trial judge can only be ‘justified and allowed by
compelling state interest.’ . . . . The Government bears a heavy burden in showing that the defendant
was not prejudiced when his counsel was excluded from these communications.” (footnote and
citations omitted).
MOTION TO SUPPRESS EVIDENCE OBTAINED
10
9

FROM STINGRAY AND FOR FRANKS HEARING
Case No.: CR 13-00818 PJH

 Case 4:13-cr-00818-PJH Document 304 Filed 05/01/17 Page 15 of 27

1 had by now disclosed. Boersch Decl., Ex. J.
2

On August 17, 2015, this Court issued a written order on various motions and denied as moot

3 the defense motion for disclosure of electronic surveillance, and ordered the parties to meet and
4 confer on the defendants’ further discovery requests and the government to “complete production
5 responsive to those requests within 60 days of the hearing, unless the parties agree to a later date.”
6 Dkt. 127 at 23.
7
8

D. The Government Finally Admits That Two Stingrays Were Used Without Warrants,
but Declines to Disclose Evidence Related to the Stingrays

9

On October 26, 2015, after a meet and confer between defense and government counsel, the

10 government responded by letter to the defense discovery requests. Boersch Dec., Ex. K. In that
11 letter, the government disclosed, for the first time, that indeed two cell site simulators were used –
12 one by the FBI, the use of which the government had disclosed on August 4, 2015, and another by
13 OPD, the use of which the government had not previously disclosed. The government also stated that
14 OPD used a pen register “during the course of the evening of the incident and perhaps the next
15 morning.” Id. The government declined to provide any further discovery in response to the majority
16 of the defense requests for information, citing the law enforcement privilege. In several subsequent
17 meet-and-confer sessions, the government continued to refuse to disclose any further evidence about
18 the use of the cell-site simulators and told the defense to file a motion.
19

In December 2015, the Court referred the discovery disputes, including the Stingray issues, to

20 the Honorable Donna M. Ryu for a discovery conference. Dkt. 147. Over the next six months, the
21 defense engaged in several meet-and-confers with the government and submitted a number of briefs
22 to the Court in an effort to get the government to disclose material information related to the
23 Stingrays and other issues. Ultimately, Magistrate Ryu ordered the government to submit, by August
24 22, 2016, declarations based on personal knowledge regarding the use of the two Stingrays.
25 II.

THE EVIDENCE REGARDING THE USE OF THE STINGRAYS

26

On August 22, 2016, the government submitted a declaration from an FBI agent and one from

27 an OPD officer. Dkts. 225-1 and 225-2. According to those declarations, OPD deployed a cell site
28 simulator on the evening of January 21 to locate the cell phone with number 510-904-7509, which the
11

MOTION TO SUPPRESS EVIDENCE OBTAINED
FROM STINGRAY AND FOR FRANKS HEARING
Case No.: CR 13-00818 PJH

 Case 4:13-cr-00818-PJH Document 304 Filed 05/01/17 Page 16 of 27

1 OPD officer “understood belonged to defendant Purvis Ellis” (Dkt. 225-2 ¶ 8), and the FBI deployed
2 its Stingray the next morning (Dkt. 225-1 ¶ 8). The government has never explained to the defense or
3 the Court why Ellis’s phone was targeted or why OPD believed that phone number 510-904-7509
4 belonged to Ellis.
5

A. The OPD Stingray

6

According to the OPD officer’s declaration, the OPD deployed a Stingray to 1759 Seminary

7 around two hours after 6:40 p.m. on January 21, 2013. Dkt. 225-2 ¶ 10. “Sometime after midnight,”
8 the officer “powered on and began operating the cell site simulator.” Id. ¶ 11. Before powering on
9 the Stingray sometime after midnight, OPD contacted the telephone carrier and filled out “an exigent
10 circumstances request to obtain pen register information/trap trace and subscriber information for
11 phone number 510-904-7509 to assist in locating the cellular telephone with the cell site simulator.”
12 The OPD officer claims he did not begin operating the Stingray until after receiving “this information
13 from the telephone provider.”
14

At some point later that morning, OPD requested FBI assistance in locating Ellis’s phone.

15 Dkt. 225-2 ¶ 13. The declarant does not indicate why OPD needed FBI assistance or when the
16 request for assistance was made. At around 10:00 a.m. on January 22, OPD shut down its Stingray
17 and the FBI began operating their device. Id. At that point, the declarant claims that OPD purged all
18 the information it had collected. Id. ¶ 15.
19

B. The FBI Stingray

20

The FBI declarant states that at approximately 7:00 a.m. on January 22, he received a request

21 from an FBI agent in Oakland indicating that OPD was “requesting FBI assistance in the use of its
22 cell site simulator.” Dkt. 225-1 ¶ 8. The declarant then contacted the carrier for the “subject cellular
23 telephone” and filled out an exigent circumstances request to get pen register/trap trace and
24 subscriber information, including MIN, for phone number 510-904-7509 “to assist in locating the
25 cellular telephone in conjunction with the cell site simulator.” Id. ¶ 9. But the request form produced
26 to the defense makes no reference to a Stingray and there was no court order obtained pursuant to this
27 request. The declarant states that he “simultaneously requested FBI approval to deploy the cell site
28 simulator in support of” OPD. Id. The declarant states that he turned on the FBI Stingray at 10:00
12

MOTION TO SUPPRESS EVIDENCE OBTAINED
FROM STINGRAY AND FOR FRANKS HEARING
Case No.: CR 13-00818 PJH

 Case 4:13-cr-00818-PJH Document 304 Filed 05/01/17 Page 17 of 27

1 a.m. on January 22 and that once it was turned on it “detected the presence of the subject cellular
2 phone.” Id. ¶¶ 10 & 11.
3

The discovery produced to the defense suggests that the FBI Stingray was in use much earlier.

4 According to that discovery, one Stingray, likely the FBI’s, was apparently on its way to the scene by
5 around 1:00 am on January 22, and “paperwork” was “pretty much done,” according to radio
6 broadcasts. See Boersch Decl., ¶20 (PHOTOS-VIDEOS-000028, Disc 3, Track 1 at 2:40) (an officer
7 states “our friends that we have been talking to with the toy – what’s the ETA?” and another responds
8 that the last he checked it would be 45 minutes to an hour. Another officer then states “that’s for the
9 equipment to be here – I don’t know about paperwork that has to go with it,” and the first officer
10 responds, “that’s pretty much done”); see also id. at Ex. M (this radio broadcast happened just before
11 the 00:56 line in the CAD about “SUBJ/BLK DOO RAG NO SHI BLU JNS JUST WALKED UP
12 FRM CAR ON STREET”); see also Dkt. 118 at 1 n.2. At 2:56 am, Officer Crum reported “activity
13 on phone related to [apartment] 108” but it is not clear what phone was “active,” what device made
14 that determination, or what the “activity” was. Dkt. 118, Ex. C. According to the CAD report, at
15 5:21 the morning of January 22 OPD had a “lock” on the phone, but again it is not clear what phone
16 or what device was used. Dkt. 78, Ex. A.
17

The declarant further states that at some point, “in an effort to reduce the error radius and

18 increase the accuracy of the location of the cellular telephone, a cell site simulator augmentation
19 device was deployed into the interior of the apartment building.” Dk. 225-1, ¶ 12. The government
20 does not explain what this device is, why it was necessary, where in the apartment building it went, or
21 how it got in there. Confusingly, the declarant then states that “[a]t all times during the deployment
22 of the cell site simulator and the augmentation device, the equipment and I were located in a publicly
23 accessible areas in and around the target apartment building.” Id.
24

At approximately 11:00 a.m., the FBI deleted or purged “all data for this incident . . . once [it]

25 learned that the subject was arrested and in custody.” The declarant does not identify the suspect.
26

C. The Exigent Circumstances Requests for Pen Registers

27

At 2:11 a.m. on January 22, 2013, “MetroPCS CALEA Pen and Wiretap Worksheet” for

28 phone number 510-904-7509 was faxed from OPD Officer Jason Saunders to Metro PCS seeking
13

MOTION TO SUPPRESS EVIDENCE OBTAINED
FROM STINGRAY AND FOR FRANKS HEARING
Case No.: CR 13-00818 PJH

 Case 4:13-cr-00818-PJH Document 304 Filed 05/01/17 Page 18 of 27

1 “call data records from 1-10-13 until 1-21-13 and start pen register if phone is active and being used.”
2 See Boersch Decl., Ex. N. That document makes no reference to a cell site simulator nor does it
3 provided any probable cause or even reasonable suspicion for the requested information and there is
4 no court order accompanying the faxed request, even though the request asserts that the “court order”
5 authorizes the disclosure of information including cell site location. Id. At 2:29 am on January 22,
6 2013, an exigent circumstances request for phone number 510-904-7509 was faxed from Metro PCS
7 to someone (the name is illegible). Dkt. 89-4. At 2:45 am, Officer Saunders faxed a pen and wiretap
8 worksheet for number 661-682-0279 to Metro PCS. Dkt. 89-3. Neither of these documents makes
9 any reference to a Stingray. Five hours later, at approximately 7:30 am, the FBI executes an exigent
10 circumstances request to Metro PCS for phone number 510-904-7509. Boersch Decl. Ex. H.
11

At some unknown time, allegedly on January 22, 2013, State Superior Court Judge Horner

12 signed a court order for a pen register and trap and trace device on phone number 510-904-7509. The
13 government suggests that the court order is related to the CALEA worksheet Officer Saunders faxed
14 at 2:11 am on January 22, 2013. But the court order is not file-stamped so it is impossible to tell
15 when it was signed or whether it was ever filed. In any event, the court order does not refer to or
16 authorize the use of a Stingray.
17

Phone records relating to phone number 510-904-7509 were produced, although it is not clear

18 when or pursuant to what request. PhoneRecords-00001-00002.
19
20 I.
21
22
23
24
25

ARGUMENT
THE WARRANTLESS USE OF THE STINGRAYS VIOLATED THE FOURTH
AMENDMENT
The Fourth Amendment of the United States Constitution states:
The right of the people to be secure in their persons, houses, papers, and
effects against unreasonable searches and seizures, shall not be violated,
and no Warrants shall issue, but upon probable cause, supported by Oath
or affirmation, and particularly describing the place to be searched, and the
persons or things to be seized.

26 Warrantless searches are presumptively unreasonable. Kyllo v. United States, 533 U.S. 27, 32
27 (2001); Lambis, 197 F.Supp. 3d at 609. A warrant must be based on probable cause and must be
28 specific as to the place searched and persons and things seized. If a warrant violates either of these
14

MOTION TO SUPPRESS EVIDENCE OBTAINED
FROM STINGRAY AND FOR FRANKS HEARING
Case No.: CR 13-00818 PJH

 Case 4:13-cr-00818-PJH Document 304 Filed 05/01/17 Page 19 of 27

1 requirements, it violates an individual’s constitutional rights.
2

The government’s warrantless uses of the Stingrays in this case were unlawful, unreasonable

3 searches in violation of the Fourth Amendment and all evidence obtained or derived from those
4 searches must be suppressed.
5

A. The Use of the Stingrays was a Search Requiring a Warrant

6

The government’s use of the Stingrays to monitor and track Ellis’s phone – and/or any of the

7 dozens of phones that were monitored – was a search under the Fourth Amendment requiring a
8 warrant because the Stingrays emitted signals that penetrated the walls of Ellis’s and others’ private
9 dwellings that were not open to visual surveillance. Such use of technology constitutes a search
10 under the Fourth Amendment requiring a warrant. United States v. Karo, 468 U.S. 705, 714 (1984)
11 (the monitoring of a beeper in a private residence, not open to visual surveillance, “violates the
12 Fourth Amendment rights of those who have a justifiable interest in the privacy of the residence”);
13 see also, id. at 715 (there is a Fourth Amendment violation when “without a warrant, the Government
14 surreptitiously employs an electronic device to obtain information that it could not have obtained by
15 observation from outside the curtilage” of a residence). As the Supreme Court reiterated in Kyllo,
16 “obtaining by sense-enhancing technology any information regarding the interior of the home that
17 could not otherwise have been obtained without physical ‘intrusion into a constitutionally protected
18 area’ . . . constitutes a search – at least where the technology is not in general public use.” 533 U.S.
19 at 33 (citation omitted).
20

Even if the monitored phones were not physically within a residence, the use of the Stingrays

21 was still a search under the Fourth Amendment because the individuals whose communications were
22 monitored or intercepted had a privacy interest in the use and location of their phones. Katz v. United
23 States, 389 U.S. 347, 361 (1967) (Fourth Amendment search occurs when the government violates a
24 subjective expectation of privacy that society recognizes as reasonable (Harlan, J., concurring)); Riley
25 v. California, 134 S. Ct. 2473, 2489-92 (2014) (discussing the privacy interests in the data on modern
26 smart phones).
27

Furthermore, because a Stingray emits signals that penetrate the walls of constitutionally

28 protected spaces, it essentially trespasses and, therefore, its use constitutes a search which, unless
15

MOTION TO SUPPRESS EVIDENCE OBTAINED
FROM STINGRAY AND FOR FRANKS HEARING
Case No.: CR 13-00818 PJH

 Case 4:13-cr-00818-PJH Document 304 Filed 05/01/17 Page 20 of 27

1 authorized by a warrant, violates the Fourth Amendment. See Silverman v. United States, 365 U.S.
2 505 (1961) (insertion of spike mike into the walls of a home without a warrant violated the Fourth
3 Amendment); United States v. Jones, 565 U.S. 400 (2012) (warrantless installation of GPS device on
4 a car violated the Fourth Amendment). Finally, because the Stingray can track an individual’s every
5 move with an accuracy of about two meters, including within private homes, its use again constitutes
6 a search and requires a warrant. See Jones, 565 U.S. at 415 (because GPS device generated “a
7 precise, comprehensive record of a person’s public movements” its use infringed upon reasonable
8 expectation of privacy (Sotomayor, J., concurring)).
9

In United States v. Lambis, 197 F.Supp. at 608-09, the DEA obtained a warrant for pen

10 register information and cell site location information (“CSLI”) for a target cell phone. As described
11 by the court, pen register information, which is a record from the service provider of the telephone
12 numbers dialed from a specific phone, while “CSLI is a record of non-content-based location
13 information from the service provider derived from ‘pings’ sent to cell sites by a target cell phone.
14 CSLI allows the target phone's location to be approximated by providing a record of where the phone
15 has been used.” Id. Using the CSLI, the DEA was able to locate the general area in which the target
16 phone was being used but could not “identify ‘the specific apartment building,’ much less the specific
17 unit in the apartment complexes in the area.” Id. at 609. To do that, the DEA deployed a Stingray
18 and, using that technology, identified the apartment building and the specific apartment in which the
19 target phone was located. Id. After obtaining consent from the occupants, the DEA searched the
20 apartment and discovered drugs and drug paraphernalia. Id.
21
22
23
24
25
26
27
28

Granting the defendant’s motion to suppress that evidence, the court held as follows:
[T]he DEA’s use of the cellsite simulator to locate Lambis's apartment
was an unreasonable search because the “pings” from Lambis’s cell
phone to the nearest cell site were not readily available “to anyone who
wanted to look” without the use of a cell-site simulator. See United States
v. Knotts, 460 U.S. 276, 281, 103 S.Ct. 1081, 75 L.Ed.2d 55 (1983); see
also State v. Andrews, 227 Md.App. 350, 395–96, 134 A.3d 324 (2016)
(holding that the use of a cell site simulator requires a search warrant
based on probable cause, and finding that the trial court properly
suppressed evidence obtained through the use of the cell-site simulator).
The DEA’s use of the cell-site simulator revealed “details of the home
that would previously have been unknowable without physical
16

MOTION TO SUPPRESS EVIDENCE OBTAINED
FROM STINGRAY AND FOR FRANKS HEARING
Case No.: CR 13-00818 PJH

 Case 4:13-cr-00818-PJH Document 304 Filed 05/01/17 Page 21 of 27

intrusion,” Kyllo, 533 U.S. at 40, 121 S.Ct. 2038, namely, that the target
cell phone was located within Lambis’s apartment. Moreover, the cellsite simulator is not a device “in general public use.” Kyllo, 533 U.S. at
40.

1
2
3
4

Id. at 610. The court further recognized that the DOJ now prohibits the use of a Stingray without first
obtaining a warrant.

5
Absent a search warrant, the Government may not turn a citizen's cell
phone into a tracking device. Perhaps recognizing this, the Department
of Justice changed its internal policies, and now requires government
agents to obtain a warrant before utilizing a cell-site simulator. See
Office of the Deputy Attorney General, Justice Department Announces
Enhanced Policy for Use of Cell-Site Simulators, 2015 WL 5159600
(Sept. 3, 2015); Deputy Assistant Attorney General Richard Downing
Testifies Before House Oversight and Government Reform Committee
at Hearing on Geolocation Technology and Privacy, 2016 WL 806338
(Mar. 2, 2016) (“The Department recognizes that the collection of
precise location information in real time implicates different privacy
interests than less precise information generated by a provider for its
business purposes.”).

6
7
8
9
10
11
12
13

Id. at 611.

14

B. The Warrantless Use of Stingrays Violated the Fourth Amendment

15

1. There was no Warrant

16
17

Neither OPD nor the FBI obtained a search warrant permitting either agency to use a Stingray
or any similar technology to monitor Ellis’s or anyone else’s phone.

18

2. The Pen Register Order Did Not Authorize the Use of the Stingrays

19
20

The government may contend that the unfiled order signed by Judge Horner was legally
sufficient to authorize the use of both of the Stingrays here. The government would be wrong.

21
22
23
24
25
26
27

First, as noted, the use of a Stingray requires a warrant, not a pen register order under Section
2703.
Second, even if under some circumstances an order under Section 2703 could lawfully
authorize the use of a Stingray, this order certainly did not. The order instead requires a list of cell
phone carriers to implement the “installation and use of pen register, to register numbers dialed or
pulsed from the Target Telephone number (510) 904-7509, to record the date and time of such dialing
or pulsing, to record the length of time the receiver is off the hook for incoming or outgoing calls, and

28
17

MOTION TO SUPPRESS EVIDENCE OBTAINED
FROM STINGRAY AND FOR FRANKS HEARING
Case No.: CR 13-00818 PJH

 Case 4:13-cr-00818-PJH Document 304 Filed 05/01/17 Page 22 of 27

1 to receive cell site and/or location sites.” Boersch Decl., Ex. I. The order did not allow the FBI or
2 OPD to bypass the carriers and independently use a roaming cell-site simulator, which, as discussed
3 above, performs very different and more intrusive functions than these. In fact, the affidavit in
4 support of the order did not mention cell-site simulators at all or seek authorization to conduct any of
5 the sort of electronic surveillance that the Stingrays were apparently performing.
6

Third, if the government intended this order to cover its use of the two Stingrays, it

7 deliberately misled the state court judge by failing to inform him of the technology being used, the
8 materials to be collected or the nature of the surveillance it was conducting. The affidavit in support
9 of the order fails to mention that the FBI or OPD would be using a Stingray, cell-site simulator or any
10 other similar device. The application does not inform the judge that law enforcement will be using
11 devices wholly independent of the carriers to whom the order was directed. And the affidavit fails to
12 inform the judge that the FBI and OPD would be monitoring everyone’s phone within range. If the
13 government contends that the order authorized the use of the Stingray, then the agent’s statements
14 were necessarily deliberately misleading. See United States v. Comprehensive Drug Testing, Inc.,
15 621 F.3d 1162, 1176 (9th Cir. 2010) (Kozinski, J., concurring) (“A lack of candor in this or any other
16 aspect of the warrant application must bear heavily against the government in the calculus of any
17 subsequent motion to return or suppress seized data). Had the government honestly informed the
18 judge of its intention to use a cell site simulator rather than to obtain records from the carriers, the
19 court undoubtedly would have denied the pen register application. See In re Application for an order
20 Authorizing Use of a Cellular Telephone Digital Analyzer, 885 F.Supp. 197, 201 (C.D. Cal. 1995)
21 (denying statutory application to use a Stingray because “telephone numbers and calls made by others
22 than the subjects of the investigation could be inadvertently be intercepted”).
23

Fourth, the pen register order was directed only to a single phone number, 510-904-7509, but

24 there is nothing in the application for the order to demonstrate probable cause that that phone number
25 had any relevance to the investigation. The only mention of the phone number in the application is at
26 the end, when the affiant states that he “queried the target number for Ellis” but that statement is not
27 based on any facts demonstrating that the number was in fact Ellis’s number and, in fact, the phone
28 was registered to another individual. Boersch Decl. Ex. I at 7 [“Your applicant queried the target
18

MOTION TO SUPPRESS EVIDENCE OBTAINED
FROM STINGRAY AND FOR FRANKS HEARING
Case No.: CR 13-00818 PJH

 Case 4:13-cr-00818-PJH Document 304 Filed 05/01/17 Page 23 of 27

1 number for Ellis 510-904-7509 . . . . The target number shows to be assigned to Metro PCS and
2 registered to a ‘Wendell Stevens’ who was a leader of the West Oakland ACORN Gang who [sic]
3 was murdered. Ellis is a member of the [sic] Acorn.”]).10 In short there was nothing to show that the
4 phone number to be “searched” had any connection to the alleged offense.
5

Fifth, the pen register order certainly does not authorize the use of two Stingrays, and appears

6 to have been obtained (if at all) only in response to a request by OPD.
7

Finally, the pen register order – which is neither filed nor time-stamped – was apparently

8 signed after the FBI or OPD began using a Stingray so could not have authorized its use by either
9 agency.
3. Even if there had been a Warrant, the Use of the Stingrays Violated the
Fourth Amendment as a General Warrant and Lacked Probable Cause

10
11

Even if the government had obtained a search warrant for the use of the Stingray, the warrant

12 would be invalid for its lack of particularity because the cell site simulator collected information from
13 and monitored anyone’s phone that was within range. The Stingray collects information from all
14 phones and sends electronic signals into all homes and devices within its range. Such dragnet
15 surveillance is the sort of general warrant that the Fourth Amendment was explicitly designed to
16 preclude. The purpose of the constitutional requirement of specificity for search warrants is to
17 prevent law enforcement from engaging in general, exploratory searches with no limits on their
18 discretion. United States v. Cardwell, 680 F.2d 75, 77 (9th Cir. 1982). Stingrays necessarily collect
19 and monitor all phones within their range, regardless of which particular phone may be “targeted.”
20 See Lye, Stingrays. The government here failed to obtain any judicial authorization for the use of the
21 Stingrays nor was there any safeguard in place to prevent the government from conducting the
22 general, exploratory search the Fourth Amendment is intended to prevent.
23

C. The Use of the Stingray Likely Violated Title III

24

If the Stingrays used by OPD and the FBI captured content, or if they could be used as a

25 microphone to eavesdrop on conversations, even if not “capturing” them, as they are capable of
26

10

An individual named Wendell Stevenson was alleged to have been a member of a West
27 Oakland gang prior to his murder in 2005. http://www.mercurynews.com/2006/11/30/gangrivalrykilled-oaklandman-police-say/ (last visited May 1, 2017). The defense is not aware of any
28 alleged Acorn gang member named “Wendell Stevens.”
MOTION TO SUPPRESS EVIDENCE OBTAINED
19
FROM STINGRAY AND FOR FRANKS HEARING
Case No.: CR 13-00818 PJH

 Case 4:13-cr-00818-PJH Document 304 Filed 05/01/17 Page 24 of 27

1 doing, then their use violated Title III. Patrick, 842 F.3d at 547 (7th Cir. 2016) (Wood, Chief J.,
2 dissenting) (“It seems clear that if the [Stingray] intercepted any cellphone conversations, text
3 messages, or data, Title III covered those interceptions.”). It is known that cell-site simulators are
4 “capable of intercepting the contents of communications” and, even more troubling, can convert the
5 target phone into a microphone. Id.; Ex. O (“It may be possible [to use a cell site simulator to] to
6 flash the firmware of a cell phone so that you can intercept conversations using a suspect’s cell phone
7 as the bug. You don’t even have to have possession of the phone to modify it; the ‘firmware’ is
8 modified wirelessly”). Although the government claims that the Stingrays used in this case did not
9 “capture” or “collect” content, that claim is unsubstantiated and is inconsistent with the evidence
10 produced to the defense. See, e.g., Boersch Decl., Ex. M at REPORTS-DOCUMENTS-000385 and
11 Boersch Decl. ¶19 (PHOTOS-VIDEOS-000035, Disc 3 Track 2 at 4:30) (“Porter, this Omega, I was
12 told there’s some activity on the phone right now, because of 108 maybe.” “Yeah Omega, he’s uh,
13 he’s live on his uh every couple minutes.”). Those claims also do not address the question whether
14 the Stingrays were simply enabling the FBI and OPD to use Ellis’s phone as a microphone.
15

Under 18 U.S.C. § 2511, any person who “intentionally intercepts . . . any wire, oral, or

16 electronic communication” without following the proper procedures is liable under the statute. 18
17 U.S.C. § 2511(1)(a). “[E]lectronic communication” is defined as “any transfer of signs, signals,
18 writing, images, sounds, data, or intelligence of any nature transmitted in whole or in part by a wire,
19 radio, electromagnetic, photoelectronic or photooptical system that affects interstate or foreign
20 commerce.” 18 U.S.C. § 2510(12). Conversations over cell phones satisfy that definition. Bartnicki v.
21 Vopper, 532 U.S. 514, 524 (2001) (applying Title III to cell phones, stating “Title III now applies to
22 the interception of conversations over both cellular and cordless phones.”). Text messages and
23 cellphone data transmissions also satisfy that definition. Patrick, 842 F.3d at 547-48 (Wood, Chief J.,
24 dissenting) (“None of the relevant exceptions to that definition [of electronic communication] applies,
25 . . . and there is no reason to think that the interception of text messages or data transmissions would
26 otherwise be excluded from it.” (citing Brown v. Waddell, 50 F.3d 285, 289 (4th Cir. 1995) (“The
27 principal purpose of the [Electronic Communications Privacy Act] amendments to Title III was to
28 extend to ‘electronic communications' the same protections against unauthorized interceptions that
20

MOTION TO SUPPRESS EVIDENCE OBTAINED
FROM STINGRAY AND FOR FRANKS HEARING
Case No.: CR 13-00818 PJH

 Case 4:13-cr-00818-PJH Document 304 Filed 05/01/17 Page 25 of 27

1 Title III had been providing for ‘oral’ and ‘wire’ communications via common carrier
2 transmissions.”); and Joffe v. Google, Inc., 746 F.3d 920, 930 (9th Cir. 2013) (electronic information
3 transmitted over Wi–Fi network does not fit 18 U.S.C. § 2511(g) exceptions). United States v. Smith,
4 Case No. 15-20394, 2016 WL 7453761, at *2 (E.D. Mich. Dec. 28, 2016) (if the Stingray “enabled
5 the Government to possibly intercept the contents of conversations and text messages, a Title III
6 order would still be necessary . . . .”).
7

It is undisputed that neither the FBI nor OPD followed the procedures required for an order

8 for electronic surveillance under 18 U.S.C. § 2518. As such, all communications and evidence
9 derived from those communications must be suppressed. Patrick, 842 F.3d at 548 (Wood, Chief J.,
10 dissenting) (“The remedy for a Title III violation is normally the suppression of the illegally
11 intercepted communications and any evidence derived from them.”).
12

D. Any Evidence Derived from the Illegal Surveillance Must be Suppressed

13

Evidence derived from an illegal search must be suppressed as the “fruit of the poisonous

14 tree.” Nardone v. United States, 308 U.S. 338 (1939). Such evidence may include, as it does in this
15 case, the testimony of witnesses. United States v. Ramirez-Sandoval, 872 F.2d 1392, 1395-96 (9th
16 Cir. 1989) (testimony of illegal aliens found in van after unlawful search of van suppressed); United
17 States v. Rubalcava-Montoya, 597 F.2d 140 (9th Cir. 1979) (testimony of illegal aliens found in trunk
18 of car suppressed as fruits of unlawful search of car). Therefore, any testimony from the people that
19 OPD and/or FBI located and interviewed as a result or because of the information they learned from
20 the illegal use of the Stingray must be suppressed. The discovery produced in the state cases
21 indicates that immediately after or even during the illegal use of the Stingray, the OPD and/or FBI
22 interviewed at least five individuals, whose names were disclosed in the state court proceeding. The
23 government in this case has failed to produce to the defense any witness names or statements;
24 nevertheless, any statements by any witness interviewed as a result of the use of the Stingrays must
25 be suppressed. In addition, any physical evidence that was seized as a result of the illegal use of the
26 Stingrays must also be suppressed.
27
28
21

MOTION TO SUPPRESS EVIDENCE OBTAINED
FROM STINGRAY AND FOR FRANKS HEARING
Case No.: CR 13-00818 PJH

 Case 4:13-cr-00818-PJH Document 304 Filed 05/01/17 Page 26 of 27

1 II.
2

A FRANKS HEARING IS REQUIRED BECAUSE THE GOVERNMENT
DELIBERATELY MISLED THE COURT IN ITS APPLICATION FOR A PEN
REGISTER

3

If the government contends and this Court concludes that the pen register order somehow

4 authorized the use of the two Stingrays in this case, then it must hold a Franks hearing because the
5 government deliberately misled the court about the surveillance it intended to conduct. The
6 government’s omission from its application of any information regarding the use or capabilities of the
7 Stingrays violated its duty of candor to the court and prevented the court from exercising its
8 constitutionally mandated role as a neutral reviewer of government action.
9

A defendant is entitled to a hearing under Franks if he makes a substantial preliminary

10 showing that (1) the government “knowingly and intentionally, or with reckless disregard for the
11 truth” made a false or misleading statement to the court; and (2) the affidavit cannot support a finding
12 of probable cause without the allegedly false or misleading information. Franks v. Delaware, 438
13 U.S. 154, 155-56 (1978). The Franks rule applies not only to false or misleading statements, but also
14 to deliberate or reckless omissions of material facts. United States v. Stanert, 762 F.2d 775, 781 (9th
15 Cir. 1985). “Clear proof of deliberate or reckless omission is not required” to show entitlement to an
16 evidentiary hearing. Id. All that is required is that the defendant make a substantial showing that the
17 government “intentionally or recklessly omitted facts required to prevent technically true statements .
18 . . from being misleading.” Id. If, after an evidentiary hearing, the Court finds that the court was
19 misled by false or omitted information, then suppression of the evidence is required. United States v.
20 DeLeon, 979 F.2d 761, 763 (9th Cir. 1992).
21

If the government contends that the order authorized the use of the two Stingrays, its

22 application for the order was seriously deceptive. Nowhere in the application does the affiant – OPD
23 Officer Jason Saunders – refer to or describe a Stingray, cell site simulator, or any equipment similar
24 to the Stingrays actually used. Nowhere in the application does the government reveal that it is not
25 Metro PCS who will be conducting the surveillance but instead that the FBI and OPD will each be
26 using Stingrays to roam around the streets of Oakland monitoring potentially hundreds of individuals’
27 phone calls. Nowhere in the application does the government particularize the information that will
28 be collected from the Stingrays or from whom.
22

MOTION TO SUPPRESS EVIDENCE OBTAINED
FROM STINGRAY AND FOR FRANKS HEARING
Case No.: CR 13-00818 PJH

 Case 4:13-cr-00818-PJH Document 304 Filed 05/01/17 Page 27 of 27

1

If the government contends that the pen register order and accompanying application were

2 authorization for the Stingrays, there can be no doubt but that the misstatements and omissions in the
3 application were intentional and deliberate. In fact, the government has admitted as much. See, e.g.,
4 Lye, Stingrays.
5
6

CONCLUSION
All evidence derived from the use of the Stingrays should be suppressed. In the alternative, a

7 Franks hearing is warranted.
8
9

Dated: May 1, 2017

10

_/s/ Martha Boersch______________
Martha Boersch
Attorney for Defendant
PURVIS LAMAR ELLIS

11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
23

MOTION TO SUPPRESS EVIDENCE OBTAINED
FROM STINGRAY AND FOR FRANKS HEARING
Case No.: CR 13-00818 PJH