BILL ANALYSIS Ó
-----------------------------------------------------------------
|SENATE RULES COMMITTEE | SB 741|
|Office of Senate Floor Analyses | |
|(916) 651-1520 Fax: (916) | |
|327-4478 | |
-----------------------------------------------------------------
THIRD READING
Bill No: SB 741
Author: Hill (D), et al.
Amended: 5/19/15
Vote: 21
SENATE GOVERNANCE & FIN. COMMITTEE: 7-0, 4/15/15
AYES: Hertzberg, Nguyen, Bates, Beall, Hernandez, Lara, Pavley
SENATE JUDICIARY COMMITTEE: 7-0, 5/12/15
AYES: Jackson, Moorlach, Anderson, Hertzberg, Leno, Monning,
Wieckowski
SUBJECT: Mobile communications: privacy
SOURCE: Author
DIGEST: This bill prohibits a local agency from acquiring or
using cellular communications interception technology without
first adopting a resolution or ordinance and imposes specified
requirements on any local agency that uses cellular
communication interception technology.
ANALYSIS: Existing law, with some exceptions for law
enforcement agencies, makes it a crime to manufacture, assemble,
sell, advertise for sale, possess, transport, import, or furnish
to another a device that is primarily or exclusively designed or
intended for eavesdropping upon the communication of another, or
any device that is primarily or exclusively designed or intended
for the unauthorized interception of reception of communications
between a cellular radio telephone, as defined, and a landline
SB 741
Page 2
telephone or other cellular radio telephone.
This bill:
1)Requires every local agency that operates cellular
communications interception technology to do all of the
following:
a) Ensure that information and data gathered through the
use of cellular communications interception technology is
protected with reasonable operational, administrative,
technical, and physical safeguards to ensure its
confidentiality and integrity.
b) Implement and maintain reasonable security procedures
and practices in order to protect information and data
gathered through the use of cellular communications
interception technology from unauthorized access,
destruction, use, modification, or disclosure.
c) Implement and maintain a usage and privacy policy in
order to ensure that the collection, use, maintenance,
sharing, and dissemination of information and data gathered
through the use of cellular communications interception
technology is consistent with respect for an individual's
privacy and civil liberties. This usage and privacy policy
must be available in writing, and, if the local agency has
an Internet Web site, the usage and privacy policy must be
posted conspicuously on that Internet Web site. The usage
and privacy policy must include:
i) The authorized purposes for using cellular
communications interception technology and for
collecting information or data using that technology.
ii) A description of the employees who are
authorized to use, or access information or data
SB 741
Page 3
collected through the use of, cellular communications
interception technology. The policy must identify the
training requirements necessary for those authorized
employees.
iii) A description of how the use of cellular
communications interception technology will be monitored
to ensure compliance with all applicable privacy laws
and a process for periodic system audits.
iv) A description of reasonable measures that will
be used to ensure the accuracy of information or data
gathered through the use of cellular communications
interception technology and a process to correct errors.
v) A description of how the local agency will comply
with its specified security procedures and practices.
vi) The length of time information or data gathered
through the use of cellular communications interception
technology will be stored or retained, and the process
the local agency will utilize to determine if and when
to destroy stored or retained information or data.
vii) The official custodian, or owner, of information or
data gathered through the use of cellular communications
interception technology and which employees have the
responsibility and accountability for implementing this
subdivision.
viii)The purpose of, and process for, sharing or
disseminating information or data gathered through the
use of cellular communications interception technology
with other persons. The policy shall also identify how
the use or further sharing or dissemination of that
information or data will be restricted in order to
ensure respect for an individual's privacy and civil
liberties.
SB 741
Page 4
2)Prohibits a local agency from acquiring or using cellular
communications interception technology unless the agency's
legislative body adopts an authorizing resolution or
ordinance.
3)Requires the authorizing resolution or ordinance adopted by a
local agency to:
a) Be adopted at a regularly scheduled public meeting of
the legislative body at which members of the public are
afforded a reasonable opportunity to comment upon the
proposed resolution or ordinance; and
b) Set forth the local agency's usage and privacy policy,
as specified.
4)Specifies that, in addition to any other sanctions, penalties,
or remedies provided by law, an individual who has been harmed
by a violation of this bill's provisions may bring a civil
action in any court of competent jurisdiction against a person
who knowingly caused that violation.
5)Allows a court to award a combination of any one or more of
the following:
a) Actual damages, but not less than liquidated damages in
the amount of $2,500.
b) Punitive damages upon proof of willful or reckless
disregard of the law.
c) Reasonable attorney's fees and other litigation costs
reasonably incurred.
SB 741
Page 5
d) Other preliminary and equitable relief as the court
determines to be appropriate.
Background
Some California sheriff's offices and police departments are
using surveillance devices that allow investigators to gather
cellphone signals to pinpoint a suspect's location. By
simulating a cellular communications tower's functions, these
devices force all cell phones within the vicinity to transmit
information to the devices. The information that these devices
can collect reportedly includes a cell phone's number, a phone's
unique "International Mobile Subscriber Identification" (IMSI)
number, its electronic serial number, the location of the most
recent cell tower the phone connected with, and phone numbers
dialed from the cell phone. Some reports indicate that the
devices can accurately identify a cell phone's location, even if
the phone is turned off, and could be modified to capture the
content of calls or text messages from a phone. These devices
are known as "IMSI catchers" and sometimes referred to by brand
names like "StingRay" or "HailStorm."
Exact information about how IMSI catchers work and what they can
do is difficult to obtain. Local law enforcement agencies'
acquisition and use of these devices is apparently subject to
non-disclosure requirements that, according to various sources,
are imposed by the devices' manufacturer, the Federal Bureau of
Investigation, or both, to prevent the release of information
that could compromise the devices' effectiveness. Public
information requests for documents relating to the devices are
either denied or reveal only heavily-redacted materials. Some
news reports indicate that local law enforcement authorities
even refuse to reveal information about IMSI catchers to elected
officials who are considering whether to approve the acquisition
and use of the devices by a sheriff or police department.
IMSI catchers are reportedly used by at least 11 local law
enforcement agencies in California including Alameda County, Los
Angeles County, the City of Los Angeles, Sacramento County, San
SB 741
Page 6
Bernardino County, the City of San Diego, the City and County of
San Francisco, and the City of San Jose. On February 24, 2015,
the Santa Clara County Board of Supervisors authorized the
Sheriff's Office to use funding from the State Homeland Security
Grant Program to procure a "mobile phone triangulation system,"
presumably an IMSI catcher.
The secrecy surrounding this technology raises substantial
unanswered questions about the privacy and civil liberties
implications of these devices, particularly because IMSI
catchers collect information from the phones of anyone in the
devices' vicinity, not just individuals targeted by law
enforcement.
Comments
Because of the non-disclosure agreements that law enforcement
officials have used to justify the secrecy surrounding IMSI
catchers, the public and their elected representatives know very
little about this technology. Some of the unanswered questions
about IMSI catchers raise fundamental civil liberty and privacy
concerns that deserve to be considered by the public. Important
questions that merit public consideration include:
What data is gathered from the phones of third-parties who are
unrelated to the purpose for which an IMSI catcher is
deployed? Is that data stored for any period of time? Who
can access it? How is it used? Is it secured against
unauthorized access?
Can IMSI catchers be modified to capture voice and text
content from cell phones? Can law enforcement agencies
determine whether the devices are being used to capture
content, regardless of whether such use is authorized by the
department?
What policies govern local law enforcement agencies'
deployment and use of IMSI catchers? To what extent do
SB 741
Page 7
agencies comply with those policies?
Must local law enforcements agencies' use of IMSI catchers
always be subject to a warrant issued by a judge? Do warrants
specifically allow for the collection of data from every cell
phone that transmits to the devices?
To get answers to some of the above questions, this bill
requires that a law enforcement agency that acquires or uses an
IMSI catcher must disclose information about the policies that
govern how the agency will use the device and the data gathered
by the device. This bill doesn't prohibit any law enforcement
agency from obtaining or using IMSI catchers. This bill simply
allows members of the public and their elected representatives
to make informed decisions about law enforcement's deployment of
surveillance technology in their communities.
Local control. County sheriffs are elected officials. Because
they are directly accountable to the public, they should be
allowed to make independent decisions about procuring and
deploying law enforcement technology to reflect local needs and
priorities. State-imposed restrictions on certain types of
technology undermine a sheriff's ability to use his or her
discretion to enforce the law and maintain public safety. By
making it more difficult for sheriffs to use IMSI catchers, this
bill may compel them to use alternative technologies that may be
less effective and result in higher investigative costs. Those
decisions may be more appropriately left up to sheriffs and the
voters who elect them.
FISCAL EFFECT: Appropriation: No Fiscal
Com.:NoLocal: No
SUPPORT: (Verified5/19/15)
Bay Area Civil Liberties Coalition
Media Alliance
Small Business California
SB 741
Page 8
OPPOSITION: (Verified5/19/15)
California Police Chiefs Association
California State Sheriffs' Association
ARGUMENTS IN SUPPORT: >
ARGUMENTS IN OPPOSITION: >
Prepared by:Brian Weinberger / GOV. & F. / (916) 651-4119
5/21/15 11:46:42
**** END ****