BILL ANALYSIS Ó
SENATE JUDICIARY COMMITTEE
Senator Hannah-Beth Jackson, Chair
2015 - 2016 Regular Session
SB 741 (Hill)
Version: February 27, 2015
Hearing Date: May 12, 2015
Fiscal: No
Urgency: No
TH
SUBJECT
Mobile Communications: Privacy
DESCRIPTION
This bill would prohibit a local agency from acquiring or using
cellular communications interception technology, as defined,
unless its legislative body adopts a resolution or ordinance
authorizing the use or acquisition of that technology. This
bill would provide that adoption of such a resolution or
ordinance may only occur at a regularly scheduled public meeting
at which members of the public are afforded an opportunity to
comment. This bill would also specify that the resolution or
ordinance must set forth the policies of the local agency
pertaining to the use of cellular communications interception
technology, as specified.
BACKGROUND
Cellular communications interception technology is a type of
surveillance tool used by law enforcement to track the location
and movements of mobile cellular telephones. About the size of
a suitcase, these devices are also known as "International
Mobile Subscriber Identity catchers" (IMSI catchers) or more
commonly as "StingRays." They work by simulating a cellphone
tower, automatically connecting to all mobile telephones within
a given area. "When cellphones within its range connect," these
devices harvest "the IMSI from all of them, which could include
data from thousands of unsuspecting people." (Eric Kurhi,
Stingray Surveillance: Cellphone Tracker Has High Potential For
Abuse, Say Critics of Santa Clara County Proposal, San Jose
SB 741 (Hill)
Page 2 of ?
Mercury News (Feb. 24, 2015)
[as of May 4,
2015].) "If the authorities have the IMSI of a subject . . .
they can focus on where the phone's signal is coming from and,
after moving the device a few times, triangulate a location to
within 10 feet." (Id.) According to recent media reports, law
enforcement agencies in Oakland, Fremont, and San Francisco have
acquired IMSI catchers, and nationwide "[a]s many as four dozen
federal and local agencies have acknowledged using the devices."
(Richard Winton, Anaheim Police, Sacramento Sheriff Sued Over
Surveillance Device, Los Angeles Times (Mar. 10, 2015)
[as of May 4, 2015].) At least
one of these law enforcement agencies has stated its intent to
use the device to collect data on protesters.
In response to the issues raised by the use of those devices,
this bill would require local agencies to seek approval from
their legislative bodies prior to acquiring or using IMSI
catchers. This bill would provide that approval may only be
granted at a regularly scheduled public meeting of the
legislative body, where members of the public are given an
opportunity to comment upon the proposed acquisition or use of
this technology, as well as the policies of the local agency
governing its use.
CHANGES TO EXISTING LAW
Existing law provides that, among other rights, all people have
an inalienable right to pursue and obtain privacy. (Cal.
Const., art. I, Sec. 1.)
Existing case law permits a person to bring an action in tort
for an invasion of privacy and provides that in order to state a
claim for violation of the constitutional right to privacy, a
plaintiff must establish the following three elements: (1) a
legally protected privacy interest; (2) a reasonable expectation
of privacy in the circumstances; and (3) conduct by the
defendant that constitutes a serious invasion of privacy. (Hill
v. National Collegiate Athletic Assn. (1994) 7 Cal.4th 1, 40.)
Existing case law states that legally recognized privacy
interests are generally of two classes: interests in precluding
the dissemination or misuse of sensitive and confidential
SB 741 (Hill)
Page 3 of ?
information (informational privacy), and interests in making
intimate personal decisions or conducting personal activities
without observation, intrusion, or interference (autonomy
privacy). (Hill v. National Collegiate Athletic Assn. (1994) 7
Cal.4th 1, 35.)
This bill would state that no local agency may acquire or use
cellular communications interception technology, as defined,
unless approved by its legislative body by adoption of a
resolution or ordinance authorizing that acquisition or use.
This bill would provide that the legislative body of a local
agency shall not approve a resolution or ordinance authorizing
the acquisition or use of cellular communications interception
technology, unless the resolution or ordinance is adopted at a
regularly scheduled public meeting of the legislative body at
which members of the public are afforded a reasonable
opportunity to comment upon the proposed resolution or
ordinance.
This bill would provide that the resolution or ordinance shall
set forth the policies of the local agency as to the
circumstances when cellular communications interception
technology may be employed, and usage and privacy policies,
which shall include, but need not be limited to, how data
obtained through use of the technology is to be used, protected
from unauthorized disclosure, and disposed of once it is no
longer needed.
This bill would state that if the local agency maintains an
Internet Web site, the cellular communications interception
technology usage and privacy policies shall be posted
conspicuously on that site.
COMMENT
1.Stated need for the bill
According to the author:
Residents should be made aware of what type of surveillance
technology law enforcement agencies use within their
community. Residents should also be able to participate in a
public process to decide whether or not those surveillance
technologies should be used in their communities and if
SB 741 (Hill)
Page 4 of ?
adopted, how the technology should be used. Current law,
however, does not guarantee this for the use of cell phone
intercept technology by local law enforcement agencies.
Throughout the state, local governments and law enforcement
agencies have been adopting the use of cell phone intercept
technology without providing an opportunity for community
input.
The technology, which can be used to mimic a cell phone tower
and intercept cell phone information, including locational
data, is growing more common. According to the most recent
data, at least 11 local jurisdictions in California have
purchased the technology. None of the local governments have
allowed public input or adopted publicly available policies
governing the use of the cell phone tracking technology.
SB 741 would prevent local governments from authorizing cell
phone intercept technology unless use of the technology is
approved by a resolution or ordinance at a regularly scheduled
public meeting at which community members are afforded an
opportunity to comment on the proposed resolution or
ordinance. The proposed resolution or ordinance must include
a privacy and usage policy pertaining to when the technology
may be employed, how the data is to be used, how the data will
be protected from unauthorized disclosure and disposed of once
it is no longer needed. If the resolution or ordinance is
approved, the legislation requires the local agency to post
the privacy and usage policy on its website.
2.Fundamental Right to Privacy
The right to privacy is a fundamental right protected by Section
1 of Article I of the California Constitution. This
constitutional right to privacy restricts the government and
others from infringing upon legally protected privacy interests
of California residents. The California Supreme Court has
found that "[l]egally recognized privacy interests are generally
of two classes: (1) interests in precluding the dissemination or
misuse of sensitive and confidential information (informational
privacy); and (2) interests in making intimate personal
decisions or conducting personal activities without observation,
intrusion, or interference (autonomy privacy). (Hill v.
SB 741 (Hill)
Page 5 of ?
National Collegiate Athletic Assn. (1994) 7 Cal.4th 1, 35
[internal quotation marks omitted].) Information and data
collected by an IMSI catcher falls into the "informational
privacy" class of protected privacy interests.
The Court has held that "[i]nformational privacy is the core
value" furthered by the constitutional right of privacy. (Id.)
"A particular class of information is private when
well-established social norms recognize the need to maximize
individual control over its dissemination and use to prevent
unjustified embarrassment or indignity. Such norms create a
threshold reasonable expectation of privacy in the data at
issue." (Id.) The Court has held that "the usual sources of
positive law governing the right to privacy -- common law
development, constitutional development, [and] statutory
enactment"-- illuminate "[w]hether established social norms
safeguard a particular type of information . . . from public or
private intervention." (Id. at 36.)
Recent Fourth Amendment jurisprudence strongly indicates that
locational data of the type collected by International Mobile
Subscriber Identity catchers (IMSI catchers) falls within a
class of information safeguarded by established social norms.
In United States v. Jones (2012) 132 S. Ct. 945, the U.S.
Supreme Court examined the significant privacy concerns raised
by locational tracking technology. The Jones case considered
whether the attachment of a Global Positioning System (GPS)
tracking device to an individual's vehicle, and the subsequent
use of that device to track the vehicle's movements on public
streets, constituted a search within the meaning of the Fourth
Amendment. In her concurring opinion, Justice Sotomayor made
the following observations:
Awareness that the Government may be watching chills
associational and expressive freedoms. And the Government's
unrestrained power to assemble data that reveal private
aspects of identity is susceptible to abuse. The net result
is that GPS monitoring--by making available at a relatively
low cost such a substantial quantum of intimate information
about any person whom the Government, in its unfettered
discretion, chooses to track--may alter the relationship
between citizen and government in a way that is inimical to
democratic society.
I would take these attributes of GPS monitoring into account
SB 741 (Hill)
Page 6 of ?
when considering the existence of a reasonable societal
expectation of privacy in the sum of one's public movements.
I would ask whether people reasonably expect that their
movements will be recorded and aggregated in a manner that
enables the Government to ascertain, more or less at will,
their political and religious beliefs, sexual habits, and so
on. (United States v. Jones (2012) 132 S. Ct. 945, 955-956
[internal citations and quotation marks omitted].)
Use of an IMSI catcher to track the location of a mobile
cellular telephone - and, by extension, its owner - is arguably
more invasive than GPS tracking of a vehicle's movements on
public streets. As some commentators have noted, the swathe of
data collected by an IMSI catcher is considerably broader than
that collected by a GPS tracker. According to the Electronic
Frontier Foundation:
A Stingray-which could potentially be beamed into all the
houses in one neighborhood looking for a particular signal-is
the digital version of the pre-Revolutionary war practice of
British soldiers going door-to-door, searching Americans'
homes without rationale or suspicion, let alone judicial
approval. . . . And when police use a Stingray, it's not just
the suspects' phone information the device sucks up, but all
the innocent people around such suspect as well. Some devices
have a range of several kilometers, meaning potentially
thousands of people could have their privacy violated despite
not being suspected of any crime. (Stingrays: The Biggest
Technological Threat to Cell Phone Privacy You Don't Know
About
[as of May 4,
2015].)
Additionally, unlike other law enforcement surveillance tools
such as Automated License Plate Readers and GPS trackers, IMSI
catchers are not limited to operating in public places where an
individual's expectation of privacy is arguably diminished. As
a federal court in California recently observed, "a cell phone
can accompany its owner anywhere. Thus the exposure of the cell
site location information can convert what would otherwise be a
private event into a public one. . . A cell phone user's
reasonable expectation of privacy in his or her location is
especially acute when the call is made from a constitutionally
protected area, such as inside a home." (U.S. v. Elijah Cooper,
SB 741 (Hill)
Page 7 of ?
Order Denying Defendant's Motion to Suppress (Dkt. 117),
3:13-cr-00693-SI [filed Mar. 2, 2015].)
This bill seeks to bring some transparency to the use of IMSI
catchers by requiring local agencies to secure approval of their
legislative bodies before using or acquiring these devices.
During the approval process, this bill would require a local
agency to disclose its usage and privacy policies governing how
it will employ these devices. However, without additional
guidance, these policies may not be sufficient to ensure that
the use of an IMSI catcher does not violate the constitutional
right to privacy. In order to provide additional guidance to
local agencies about the proper use of these devices and to
ensure that local agency use and privacy policies appropriately
respect individuals' privacy and civil liberties, the author
offers the following amendments.
Author's Amendments :
On page 2, between lines 17 and 18, insert:
(c) (1) Implement and maintain a usage and privacy policy in
order to ensure that the collection, use, maintenance,
sharing, and dissemination of information and data gathered
through the use of cellular communications interception
technology is consistent with respect for individuals' privacy
and civil liberties. This usage and privacy policy shall be
available in writing, and, if the local agency has an Internet
Web site, the usage and privacy policy shall be posted
conspicuously on that Internet Web site.
(2) The usage and privacy policy shall, at a minimum, include
all of the following:
(A) The authorized purposes for using cellular
communications interception technology, and for collecting
information or data using such technology.
(B) A description of the employees who are authorized to
use, or access information or data collected through the
use of, cellular communications interception technology.
The policy shall identify the training requirements
necessary for those authorized employees.
(C) A description of how the use of cellular communications
interception technology will be monitored to ensure
compliance with all applicable privacy laws and a process
for periodic system audits.
(D) A description of reasonable measures that will be used
SB 741 (Hill)
Page 8 of ?
to ensure the accuracy of information or data gathered
through the use of cellular communications interception
technology and a process to correct errors.
(E) A description of how the local agency will comply with
the security procedures and practices implemented and
maintained pursuant to subdivision (b).
(F) The length of time information or data gathered through
the use of cellular communications interception technology
will be stored or retained, and the process the local
agency will utilize to determine if and when to destroy
stored or retained information or data.
(G) The official custodian, or owner, of information or
data gathered through the use of cellular communications
interception technology and which employees have the
responsibility and accountability for implementing
subdivision (b) and this subdivision.
(H) The purpose of, and process for, sharing or
disseminating information or data gathered through the use
of cellular communications interception technology with
other persons. The policy shall also identify how the use
or further sharing or dissemination of such information or
data will be restricted in order to ensure respect for
individuals' privacy and civil liberties.
On page 2, strike lines 29 through 30, strike page 3 in its
entirety, and insert: "of the local agency as required by
subdivision (c)."
3.Data Security
As discussed in Comment 2, the type of information collected
through the use of an IMSI catcher is highly sensitive.
Locational data taken from a mobile cellular telephone,
especially over time, can be used to determine the owner's
political and religious beliefs, known associates, frequented
places, and even their medical conditions. Before a local
agency can obtain authorization to use an IMSI catcher, this
bill would require the legislative body approving the use or
acquisition of such a device to formulate a use and privacy
policy describing how data collected by the device would be
protected from unauthorized disclosure. However, the bill does
not impose any direct requirements to ensure that collected data
is protected from misuse or data breach with appropriate
safeguards. To ensure that data collected using an IMSI catcher
remains confidential and is protected from unauthorized access
or use, the author offers the following amendments that would
SB 741 (Hill)
Page 9 of ?
require local agencies to implement and maintain specific
security procedures to safeguard this data.
Author's Amendment :
On page 3, between lines 17 and 18, insert:
(b) Every local agency that operates cellular communications
interception technology shall do all of the following:
(1) Ensure that information and data gathered through the
use of cellular communications interception technology is
protected with reasonable operational, administrative,
technical, and physical safeguards to ensure its
confidentiality and integrity.
(2) Implement and maintain reasonable security procedures
and practices in order to protect information and data
gathered through the use of cellular communications
interception technology from unauthorized access,
destruction, use, modification, or disclosure.
4.Pending Litigation
In the past, this Committee has raised concerns about bills that
interfere with pending litigation. Any such interference could
result in a direct financial windfall to a private party,
prevent a court from deciding an action based upon the laws in
place at the time the cause of action accrued, or create a
situation where the legislative branch is used to circumvent the
discretion and independence of the judicial branch.
The author has informed the Committee that the Electronic
Frontier Foundation (EFF) is engaged in litigation with the
United States over an alleged failure to release documents
related to IMSI catchers pursuant to a federal Freedom of
Information Act (FOIA) request. This bill is unlikely to impact
that litigation since it does not impact FOIA, or the
withholding or production of documents related to IMSI catchers.
To the extent the usage and privacy policies that must be
implemented under this bill would require the disclosure of
information also subject to EFF's FOIA litigation, the
disclosures required by this bill would be prospective only.
Under California law, "a statute may be applied retroactively
only if it contains express language of retroactivity or if
other sources provide a clear and unavoidable implication that
the Legislature intended retroactive application." (Myers v.
SB 741 (Hill)
Page 10 of ?
Philip Morris Companies, Inc. (2002) 28 Cal.4th 828, 844.) This
bill neither contains express retroactivity language, nor
provisions evincing a clear Legislative intent that it should be
given retroactive effect. Consequently, were it to be enacted,
this bill would likely have no legal impact on the claims or
defenses at issue in EFF's FOIA suit.
5.Opposition Concerns
The Citizens for Criminal Justice Reform (CCJR) states that they
are opposed to this bill because it "grants too much power to
local municipalities and does not go far enough to protect the
private data of unsuspecting citizens." They state that "[l]aw
enforcement use of cell phone intercept technology absent a
warrant or probable cause . . . is ipso facto unconstitutional,"
and that "leaving the implementation of such technology to be
determined by local municipalities will result in inconsistency
throughout the state and adversely impact the lawful privacy
expectations of transient citizens."
To ensure that aggrieved parties are able to redress harms
caused by a local agency's unlawful use or implementation of
IMSI catcher technology, the author offers the following
amendments to provide a right of action to challenge a local
agency's non-compliance with the provisions of this bill.
Author's Amendment:
On page 3, after line 6, insert:
(d) In addition to any other sanctions, penalties, or remedies
provided by law, an individual who has been harmed by a
violation of this title may bring a civil action in any court
of competent jurisdiction against a person who knowingly
caused that violation. The court may award a combination of
any one or more of the following:
(1) Actual damages, but not less than liquidated damages in
the amount of two thousand five hundred dollars ($2,500).
(2) Punitive damages upon proof of willful or reckless
disregard of the law.
(3) Reasonable attorney's fees and other litigation costs
reasonably incurred.
(4) Other preliminary and equitable relief as the court
determines to be appropriate.
SB 741 (Hill)
Page 11 of ?
The California Police Chiefs Association, in opposition, writes
that this bill "would prohibit a local agency from borrowing a
StingRay from a neighborhood agency for a specific investigation
if the borrowing agency did not yet have an adopted city
resolution or ordinance," compelling them "to use alternative,
less effective, technologies." Similarly, the California State
Sheriffs' Association, also in opposition, states that "this
measure unduly interferes with the ability of independently
elected constitutional officers to deploy the latest technology
when investigating and prosecuting criminals," and that this
bill may "[alert] criminal enterprises of a specific type of
technology that would be deployed by a sheriff's department."
Support : Bay Area Civil Liberties Coalition; Media Alliance;
Small Business California
Opposition : Citizens for Criminal Justice Reform; California
Police Chiefs Association; California State Sheriffs'
Association
HISTORY
Source : Author
Related Pending Legislation : None Known
Prior Legislation : None Known
Prior Vote : Senate Governance and Finance Committee (Ayes 7,
Noes 0)
**************