BILL ANALYSIS Ó SB 741 Page 1 SENATE THIRD READING SB 741 (Hill) As Amended August 17, 2015 Majority vote SENATE VOTE: 39-0 ------------------------------------------------------------------ |Committee |Votes|Ayes |Noes | | | | | | | | | | | | | | | | |----------------+-----+----------------------+--------------------| |Privacy |11-0 |Gatto, Wilk, Baker, | | | | |Calderon, Chang, | | | | |Chau, Cooper, | | | | |Dababneh, Dahle, | | | | |Gordon, Low | | | | | | | |----------------+-----+----------------------+--------------------| |Local |9-0 |Maienschein, | | |Government | |Gonzalez, Alejo, | | | | |Chiu, Cooley, Linder, | | | | |Low, Mullin, Waldron | | | | | | | | | | | | ------------------------------------------------------------------ SUMMARY: Requires local agencies to publicly approve the SB 741 Page 2 acquisition of cellular communications interception technology (CCIT), requires local agencies to develop and release a usage and privacy policy for CCIT, and provides for civil remedies in the event of a violation. Specifically, this bill: 1)Requires a local agency that operates CCIT to: a) Maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect information gathered through the use of CCIT from unauthorized access, destruction, use, modification, or disclosure; and, b) Implement a usage and privacy policy, which shall be available in writing to the public, and posted conspicuously online if the local agency has a Web site. 2)Requires a local agency's usage and privacy policy to include, at a minimum, all of the following: a) The authorized purposes for using CCIT and for collecting information using CCIT; a) A description of the job title or other designation of the employees who are authorized to use, or access information collected through the use of CCIT, as well as the training requirements for those authorized employees; SB 741 Page 3 b) A description of how the local agency will monitor its own use of CCIT to ensure the accuracy of the information collected and compliance with all applicable laws, including laws providing for process and time period system audits; c) The existence of a memorandum of understanding or other agreement with another local agency or any other party for the shared use of CCIT or the sharing of information collected through its use, including the identity of signatory parties; d) The purpose of, process for, and restrictions on, the sharing of information gathered through the use of CCIT with other local agencies and persons; and, e) The length of time information gathered through the use of CCIT will be retained, and the process the local agency will utilize to determine if and when to destroy stored or retained information. 1)Prohibits a local agency from acquiring CCIT unless approved by its legislative body by adoption, at a regularly scheduled public meeting, as defined, of a resolution or ordinance authorizing that acquisition or use, and the usage and privacy policy as required. 2)Authorizes an individual harmed by the knowing violation of these provisions to bring a civil action in court. 3)Authorizes a court to order any or all of the following remedies: SB 741 Page 4 a) Actual damages, but not less than liquidated damages in the amount of $2,500; b) Punitive damages upon proof of willful or reckless disregard of the law; c) Reasonable attorney's fees and other litigation costs reasonably incurred; and, d) Other preliminary and equitable relief as the court determines to be appropriate. 4)Defines the terms "cellular communications interception technology" and "local agency." FISCAL EFFECT: None. This bill is keyed non-fiscal by the Legislative Counsel. COMMENTS: This bill is intended to increase transparency in the use of CCIT by local law enforcement agencies by requiring a public hearing of the acquisition of CCIT, and a usage and privacy policy to guide its implementation. This bill is author-sponsored. What this bill calls "cellular communications interception technology" or CCIT is more commonly referred to elsewhere as an "international mobile subscriber identity (IMSI) catcher" or a "StingRay," which is a brand-name for a particular line of cell site emulator. SB 741 Page 5 CCIT is a portable cell phone surveillance tool used by government agencies at the federal, state and local levels that generally consists of an antenna, a processor, and laptop computer for analysis and configuration. They work by emulating the operation of a cellular telephone network tower, which prompts nearby cell phones to switch over and communicate with it like it was the carrier's nearest base station. The CCIT can be used to collect a variety of data about "caught" cell phones, particularly the phone's unique numeric identifier and its physical location. According to the American Civil Liberties Union (ACLU), CCIT is generally used for two purposes: First, if the government knows a suspect's location, it can use CCIT to determine the unique numeric identifier association with the cell phone. Having this number can facilitate the government's efforts to obtain a wiretap or call records on the target of an investigation. Second, if the government has the unique numeric identifier, it can determine the phone's geographic location, often with an accuracy of up to two meters. CCIT can also be used to capture the content of communications (like voice calls and text messages) although the ACLU does not provide evidence that the local law enforcement agencies have done so with any frequency. According to an ACLU study, at least 34 law enforcement agencies in 15 states have purchased CCIT. The technology is reportedly used by at least 11 local law enforcement agencies in California, including Alameda County, Los Angeles County, the City of Los Angeles, Sacramento County, San Bernardino County, the City of San Diego, the City and County of San Francisco, and the City of San Jose. There is also evidence to suggest that the Santa Clara County Board of Supervisors authorized its Sheriff's Office in February 2015 to purchase CCIT. There are at least three major policy concerns over the SB 741 Page 6 unconstrained use of CCIT: a lack of public transparency, a lack of clarity over the standard of evidence needed to authorize use of CCIT, and the potentially overbroad nature of the search itself facilitated by CCIT. One problem with understanding the full impact of CCIT is that many local law enforcement agencies with the technology have signed non-disclosure agreements (NDAs) with a CCIT manufacturer, which some agencies have cited as a reason for not providing even basic information about their CCIT use. Another concern exacerbated by the lack of transparency is uncertainty about the standard of evidence for judicial authorization to use CCIT and the danger of less than fully informed judicial oversight. Furthermore, CCIT can affect all mobile users in the vicinity of the device, not just individuals under investigation. This raises important constitutional questions about dragnet-style "general searches" and their prohibition by the Fourth Amendment, as well as practical problems with service disruption for the public. This bill attempts to begin addressing these concerns by requiring local agencies to maintain reasonable security procedures and practices (to protect personal information), requiring local agencies to publicly approve or disclose the acquisition of CCIT (even retroactively), and requiring those local agencies to adopt a usage and privacy policy to guide their use of CCIT. Analysis Prepared by: Hank Dempsey / P. & C.P. / (916) 319-2200 FN: 0001400 SB 741 Page 7