BILL ANALYSIS Ó
SB 741
Page 1
SENATE THIRD READING
SB
741 (Hill)
As Amended August 31, 2015
Majority vote
SENATE VOTE: 39-0
--------------------------------------------------------------------
|Committee |Votes|Ayes |Noes |
| | | | |
| | | | |
| | | | |
|----------------+-----+-----------------------+---------------------|
|Privacy |11-0 |Gatto, Wilk, Baker, | |
| | |Calderon, Chang, Chau, | |
| | |Cooper, Dababneh, | |
| | |Dahle, Gordon, Low | |
| | | | |
|----------------+-----+-----------------------+---------------------|
|Local |9-0 |Maienschein, Gonzalez, | |
|Government | |Alejo, Chiu, Cooley, | |
| | |Linder, Low, Mullin, | |
| | |Waldron | |
| | | | |
| | | | |
--------------------------------------------------------------------
SUMMARY: Requires local agencies to publicly approve or
disclose the acquisition of cellular communications interception
SB 741
Page 2
technology (CCIT), requires local agencies to develop and
release a usage and privacy policy for CCIT, and provides for
civil remedies in the event of a violation. Specifically, this
bill:
1)Requires a local agency that operates CCIT to:
a) Maintain reasonable security procedures and practices,
including operational, administrative, technical, and
physical safeguards, to protect information gathered
through the use of CCIT from unauthorized access,
destruction, use, modification, or disclosure; and,
b) Implement a usage and privacy policy, which shall be
available in writing to the public, and posted
conspicuously online if the local agency has a Web site.
2)Requires a local agency's usage and privacy policy to include,
at a minimum, all of the following:
a) The authorized purposes for using CCIT and for
collecting information using CCIT;
a) A description of the job title or other designation of
the employees who are authorized to use, or access
information collected through the use of CCIT, as well as
the training requirements for those authorized employees;
SB 741
Page 3
b) A description of how the local agency will monitor its
own use of CCIT to ensure the accuracy of the information
collected and compliance with all applicable laws,
including laws providing for process and time period system
audits;
c) The existence of a memorandum of understanding or other
agreement with another local agency or any other party for
the shared use of CCIT or the sharing of information
collected through its use, including the identity of
signatory parties;
d) The purpose of, process for, and restrictions on, the
sharing of information gathered through the use of CCIT
with other local agencies and persons; and,
e) The length of time information gathered through the use
of CCIT will be retained, and the process the local agency
will utilize to determine if and when to destroy stored or
retained information.
1)Prohibits a local agency from acquiring CCIT unless approved
by its legislative body by adoption, at a regularly scheduled
public meeting, as defined, of a resolution or ordinance
authorizing that acquisition and the usage and privacy policy.
2)Prohibits a county sheriff from acquiring CCIT unless the
sheriff provides public notice of the acquisition, which must
be posted conspicuously on the department's Web site, and his
or her department has a usage and privacy policy.
3)Authorizes an individual harmed by the knowing violation of
SB 741
Page 4
these provisions to bring a civil action in court.
4)Authorizes a court to order any or all of the following
remedies:
a) Actual damages, but not less than liquidated damages in
the amount of $2,500;
b) Punitive damages upon proof of willful or reckless
disregard of the law;
c) Reasonable attorney's fees and other litigation costs
reasonably incurred; and,
d) Other preliminary and equitable relief as the court
determines to be appropriate.
5)Defines the terms "cellular communications interception
technology" and "local agency."
FISCAL EFFECT: None. This bill has been keyed non-fiscal by
the Legislative Counsel.
COMMENTS: This bill is intended to increase transparency in the
use of CCIT by local law enforcement agencies by requiring
public approval or disclosure of the acquisition of CCIT, and
the creation of a usage and privacy policy to guide
implementation. This bill is author-sponsored.
What this bill calls "cellular communications interception
SB 741
Page 5
technology" or CCIT is more commonly referred to elsewhere as an
"international mobile subscriber identity (IMSI) catcher" or a
"StingRay," which is a brand-name for a particular line of cell
site emulator.
CCIT is a portable cell phone surveillance tool used by
government agencies at the federal, state and local levels that
generally consists of an antenna, a processor, and laptop
computer for analysis and configuration. They work by emulating
the operation of a cellular telephone network tower, which
prompts nearby cell phones to switch over and communicate with
it like it was the carrier's nearest base station.
The CCIT can be used to collect a variety of data about "caught"
cell phones, particularly the phone's unique numeric identifier
and its physical location. According to the American Civil
Liberties Union (ACLU), CCIT is generally used for two purposes:
First, if the government knows a suspect's location, it can use
CCIT to determine the unique numeric identifier association with
the cell phone. Having this number can facilitate the
government's efforts to obtain a wiretap or call records on the
target of an investigation. Second, if the government has the
unique numeric identifier, it can determine the phone's
geographic location, often with an accuracy of up to two meters.
CCIT can also be used to capture the content of communications
(like voice calls and text messages), although the ACLU does not
provide evidence that the local law enforcement agencies have
done so with any frequency.
According to an ACLU study, at least 34 law enforcement agencies
in 15 states have purchased CCIT. The technology is reportedly
used by at least 11 local law enforcement agencies in
California, including Alameda County, Los Angeles County, the
City of Los Angeles, Sacramento County, San Bernardino County,
the City of San Diego, the City and County of San Francisco, and
the City of San Jose. There is also evidence to suggest that
SB 741
Page 6
the Santa Clara County Board of Supervisors authorized its
Sheriff's Office in February 2015 to purchase CCIT.
There are at least three major policy concerns over the
unconstrained use of CCIT: a lack of public transparency, a lack
of clarity over the standard of evidence needed to authorize use
of CCIT, and the potentially overbroad nature of the search
itself facilitated by CCIT.
One problem with understanding the full impact of CCIT is that
many local law enforcement agencies with the technology have
signed non-disclosure agreements (NDAs) with a CCIT
manufacturer, which some agencies have cited as a reason for not
providing even basic information about their CCIT use. Another
concern exacerbated by the lack of transparency is uncertainty
about the standard of evidence for judicial authorization to use
CCIT and the danger of less than fully informed judicial
oversight. Furthermore, CCIT can affect all mobile users in the
vicinity of the device, not just individuals under
investigation. This raises important constitutional questions
about dragnet-style "general searches" and their prohibition by
the Fourth Amendment, as well as practical problems with service
disruption for the public.
This bill attempts to begin addressing these concerns by
requiring local agencies to maintain reasonable security
procedures and practices (to protect personal information),
requiring local agencies to publicly approve or disclose the
acquisition of CCIT (even retroactively), and requiring those
local agencies to adopt a usage and privacy policy to guide
their use of CCIT.
Analysis Prepared by:
SB 741
Page 7
Hank Dempsey / P. & C.P. / (916) 319-2200 FN:
0001594