Police Are Still Abusing Investigative Exemptions to Shield Surveillance Tech, While Others Move Towards Transparency

How transparent are police about surveillance technology? It depends on where you look. When it comes to acceptable levels of secrecy around police tools, states have drawn their lines in very different places, resulting in some communities where it is much harder for the public to know what invasive tools are being used.

State public records laws are designed to provide residents a way to learn about their government’s activities. They are variably effective in practice. It is not unusual for requests related to surveillance technologies to be ignored. Police departments have a few specific exemptions that they may apply to withhold or redact records, and they will commonly apply these, like those designed to prevent “law enforcement techniques” to be withheld, in broad and sometimes completely inappropriate ways.

This variance has impacted EFF’s ability to catalog known uses of CSS and other surveillance equipment across the United States in the Atlas of Surveillance. Cell-site simulators (often referred to as IMSI catchers or stingrays) are an extra-sneaky and privacy-invasive type of police tech. The device acts like a legitimate cell phone tower to trick devices within a particular range to link up to it. The CSS can then pinpoint the location of particular devices and sometimes harvest or alter sensitive information on them, like the numbers called, the duration of the call, and the content of sent messages. Law enforcement considers CSSs so secret that they have been known to throw out a criminal case rather than disclose that they used a CSS. You can learn more about CSS here.

Although the Atlas tracks CSSs, much of our data is derived from a 2017 research project by journalist Kevin Collier, which in turn is partially based on even older data collected by the ACLU. For many years, the primary purveyor of CSS technology was Harris Corporation, but in June 2020, the company ceased selling these tools to law enforcement. That means that many agencies have begun purchasing new devices from other companies.

EFF worked with students at the Reynolds School of Journalism at the University of Nevada, Reno this spring to update and add more data to the Atlas of Surveillance. EFF staff co-led a class on public records laws, and students filed their own records requests to learn more about police use of CSS, as well as drones (also known as unmanned aerial vehicles). Their work demonstrated how departments across the country provide a range of responses to community members interested in how they’re being surveilled.

The UNR students used the Atlas of Surveillance to identify agencies that had previously been documented using Harris Corporation-brand CSS devices and targeted them with state-level public requests. Because the agencies were already known to have purchased the tech, it was a fair assumption they would have responsive materials. Students requested very basic information about the company from which the tools were purchased and for how much–nothing that would jeopardize an investigation. Some students received dozens of records and others nothing at all.

The Philadelphia Police Department, for example, still hasn’t sent student Autumn Oaks an acknowledgment of the request sent about the department’s use of drones, more than three months after it was first sent.

From the San Bernardino County Sheriff (who EFF sued for rejecting public records requests related to cell-site simulators) student Gracie Gordon got records showing that the department turned to the North Carolina company Tactical Support Equipment for a new cell-site simulator system that cost $635,000. 

The Chicago Police Department, which had previously used CSS, told student Samantha Welsh that there were no records to provide because they no longer use cell-site simulators. Meanwhile, Erie County, New York chose to respond by not responding at all. Despite a mandated five-day period in which the Sheriff could respond, after five months, no acknowledgment of the request has been provided at all.

Police departments in many states buy and use cell-site simulators (CSS) and other invasive surveillance technologies, but the ways communities are able to discuss its use and the deployment of other surveillance technologies vary widely. For example, California requires policies and training materials to be posted publicly, and it has implemented requirements for police departments to provide regular public reports on surveillance and military-grade equipment. Another California law requires law enforcement using cell-site simulators (CSS) to locate and track people’s cell phones to post their policies online. But in Virginia, that same information can be withheld entirely from public view. And on the federal level, an exemption in FOIA that prohibits the disclosure of information on “law enforcement techniques” is a known obstacle to disclosure.

While some agencies were forthcoming with materials like contracts and invoices for purchases, others denied access by claiming an investigative techniques exemption. The exemption, which can be applied at the discretion of the agency, is designed to prevent disclosure of materials that would reveal techniques that the police say could impact their investigations. The exact outlines of the exemption vary from state to state, but in general, the exemption claims that an agency does not have to be transparent about certain methods of investigation it uses, lest the disclosure of the records provide enough information for wanted and potential criminals to evade the law.

EFF intern Melanie Mendez received such an exemption from Anne Arundel County in Virginia. The agency sent to her purchasing records related to a purchase from KeyW Corporation worth more than half a million dollars, but it chose to redact the names and descriptions of the actual items purchased, citing the investigative techniques exemption.

Other students received more broadly applied versions of the exemption. Chesterfield, Virginia denied Gracie Gordon access to any of the policies or procedures used to govern the use of CSS. The Attorney General of Louisiana wrote Melanie that though it had responsive records, “these records are considered investigative techniques.”

EFF has long advocated for more transparency around the use of CSS, drones, and other surveillance technologies. EFF supports local ordinances that require disclosure and elected body approval of surveillance tech measures because these “Community Control Over Police Surveillance” (CCOPS) measures share with the public the decision-making about a community’s acquisition and use of invasive surveillance technology. This allows a city to make better decisions about how resources are allocated rather than on the unilateral decisions of cops regularly being lobbied by tech salespeople. It would also help to ensure that there is basic transparency around whether a tool has been purchased and what policies are in place to guide its proper use.

Police departments regularly acquire surveillance technology — including CSS and also face recognition, drones, and license plate readers — with little public notice. A formal records request is often one of the only ways a community may learn that its local law enforcement has been using face recognition or cell-site simulators (CSS) or other invasive technologies. Policing agencies’ refusal to release basic information on surveillance technologies in their response to these requests, variably applying secrecy in the form of exemptions and redaction, means that communities have variable abilities to contribute to and question the agencies that should serve them.