Now In Effect: Sweeping Vermont Privacy Law Will Hinder Several Federal Surveillance Programs

By Mike Maharrey

A sweeping new law that establishes robust privacy protections in Vermont went into effect today. It not only limits warrantless surveillance and helps ensure electronic privacy in the Green Mountain State, it will also hinder several federal surveillance programs that rely on cooperation and data from state and local law enforcement.

The new law bans warrantless use of stingray devices to track the location of phones and sweep up electronic communications, restricts the use of drones for surveillance by police, and generally prohibits law enforcement officers from obtaining electronic data from service providers without a warrant or a judicially issued subpoena.

Sen. Tim Ashe, Sen. Joe Benning and Sen. Dick Sears prefiled Senate Bill 155 (S.155) in December. As filed, the legislation addressed the use of drones by Vermont law enforcement, and placed some additional limits on storage and sharing of  data collected by ALPRs. An amendment in a Senate committee added provisions to limit warrantless collection of electronic data. Amendments in the House banned the warrantless use of stingray devices and ultimately put off significant changes to current ALPR law.

Gov. Shumlin signed S.155 into law on June 6. It went into effect in stages. Extension of the current ALPR statue went into effect immediately, along with study requirements. Minor changes to current ALPR law took effect July 1. Sections relating to drones, stingrays and warrantless data collection become effective today.

STINGRAYS

The new law virtually bans the use of cell site simulators, known as “stingrays.” These devices essentially spoof cell phone towers, tricking any device within range into connecting to the stingray instead of the tower, allowing law enforcement to sweep up communications content, as well as locate and track the person in possession of a specific phone or other electronic device. Under the new statute, law enforcement can only use stingrays to track a fugitive with a warrant.

A law enforcement officer shall not use a device which via radio or other electromagnetic wireless signal intercepts in real time from a user’s device a transmission of communication  content, real time cellular tower derived location information, or real time GPS derived location information, except for purposes of locating and apprehending a fugitive for whom an arrest warrant has been issued.

DRONES

The law prohibits the use of drones by Vermont law enforcement to investigate, detect, or prosecute a crime without a warrant in most situations. It does allow warrantless drone use under judicially recognized exceptions to the warrant requirement, and for purposes other than investigating a crime, including search and rescue, and to assess accident scenes, fires or other natural disasters. The legislation specifically prohibits the use of a drone  “to gather or retain data on private citizens peacefully exercising their constitutional rights of free speech and assembly.” If If a law enforcement agency uses a drone based on exigent circumstances under judicially recognized exceptions to the warrant requirement, it must still obtain a warrant within 48 hours or cease operating the drone.

S.155 bars the use of any drone-mounted facial recognition technology on any person other than one named specifically in a warrant.

The legislation also prohibits arming drones with a “Dangerous or deadly weapon,” or firing any type of projectile from an unmanned aircraft.

ELECTRONIC DATA

S.155 prohibits law enforcement from obtaining electronic information and data from service providers without a warrant or subpoena in most situations. This includes emails, web browsing history, call and text message content, location information and files stored on third-party servers such as the “cloud.”

The legislation allows warrantless collection of data in emergency situations, but law enforcement must apply for a warrant within five days. If the judge rejects the warrant application, all information must be destroyed.

The law allows warrantless collection of electronic data under judicially recognized exceptions to the warrant requirement, with the owner’s consent, or if the electronic device is found in possession of a correctional facility inmate.

S.155 allows service providers to voluntarily give information to law enforcement. Any data so gathered must be destroyed within 90 days unless the law enforcement agency obtains a court order authorizing retention, or with consent of the sender or recipient of the information.

The legislation provides a legal remedy for anybody surveilled in violation of the law.

A defendant in a trial, hearing, or proceeding may move to suppress electronic information obtained or retained in violation of the U.S. Constitution, the Vermont Constitution, or this chapter.

ALPRs

As passed, S.155 makes some tweaks to Vermont law relating to license plate readers, but more significant changes were amended out of the bill. Current law was set to sunset this year. It will now remain in place until 2018. Presumably, the legislature will have to address the issue next year.

Under current law, the state can retain ALPR data up to 18 months and share it with other law enforcement agencies, including federal, during that time frame. The legislature needs to place tighter restrictions on the storage and sharing of ALPR data next session. As it stands, information could easily end up in permanent federal databases.

IMPACT ON FEDERAL SURVEILLANCE PROGRAMS VIA STINGRAY

The federal government funds the vast majority of state and local stingray programs, attaching one important condition. The feds require agencies acquiring the technology to sign non-disclosure agreements. This throws a giant shroud over the program, even preventing judges, prosecutors and defense attorneys from getting information about the use of stingrays in court. The feds actually instruct prosecutors to withdraw evidence if judges or legislators press for information. As the Baltimore Sun reported last fall, a Baltimore detective refused to answer questions on the stand during a trial, citing a federal non-disclosure agreement.

Defense attorney Joshua Insley asked Cabreja about the agreement.

“Does this document instruct you to withhold evidence from the state’s attorney and Circuit Court, even upon court order to produce?” he asked.

“Yes,” Cabreja said.

As privacysos.org put it, “The FBI would rather police officers and prosecutors let ‘criminals’ go than face a possible scenario where a defendant brings a Fourth Amendment challenge to warrantless stingray spying.”

The feds sell the technology in the name of “anti-terrorism” efforts. With non-disclosure agreements in place, most police departments refuse to release any information on the use of stingrays. But information obtained from the Tacoma Police Department revealed that it uses the technology primarily for routine criminal investigations.

Some privacy advocates argue that stingray use can never happen within the parameters of the Fourth Amendment because the technology necessarily connects to every electronic device within range, not just the one held by the target. And the information collected by these devices undoubtedly ends up in federal data bases. The feds can share and tap into vast amounts of information gathered at the state and local level through a system known as the “information sharing environment” or ISE. In other words, stingrays create the potential for the federal government to track the movement of millions of Americans with no warrant, no probable cause, and without the people even knowing it.

According to its website, the ISE “provides analysts, operators, and investigators with information needed to enhance national security. These analysts, operators, and investigators… have mission needs to collaborate and share information with each other and with private sector partners and our foreign allies.” In other words, ISE serves as a conduit for the sharing of information gathered without a warrant.

The federal government encourages and funds stingrays at the state and local level across the U.S., thereby undoubtedly gaining access to a massive data pool on Americans without having to expend the resources to collect the information itself. By placing restrictions on stingray use, state and local governments limit the data available that the feds can access.

In a nutshell, without state and local cooperation, the feds have a much more difficult time gathering information. This would represent a major blow to the surveillance state and a win for privacy.

IMPACT ON FEDERAL SURVEILLANCE PROGRAMS VIA DRONE

Although S.155 focuses exclusively on state and local drone use and does not apply directly to federal agencies, it throws a high hurdle in front of some federal programs.

Much of the funding for drones at the state and local level comes from the federal government, in and of itself a constitutional violation. In return, federal agencies tap into the information gathered by state and local law enforcement through fusion centers and a federal program known as the information sharing environment.

According to its website, the ISE “provides analysts, operators, and investigators with information needed to enhance national security. These analysts, operators, and investigators… have mission needs to collaborate and share information with each other and with private sector partners and our foreign allies.” In other words, ISE serves as a conduit for the sharing of information gathered without a warrant.

The federal government encourages and funds a network of drones at the state and local level across the U.S., thereby gaining access to a massive data pool on Americans without having to expend the resources to collect the information itself. By placing restrictions on drone use, state and local governments limit the data available that the feds can access.

In a nutshell, without state and local cooperation, the feds have a much more difficult time gathering information. This represents a major blow to the surveillance state and a win for privacy.

PARALLEL CONSTRUCTION

By allowing defendants to suppress information obtained in violation of the law, S.155 would effectively stop one practical effect of NSA spying in Vermont.

Reuters revealed the extent of such NSA data sharing with state and local law enforcement in an August 2013 article. According to documents obtained by the news agency, the NSA passes information to police through a formerly secret DEA unit known Special Operations Divisions and the cases “rarely involve national security issues.” Almost all of the information involves regular criminal investigations, not terror-related investigations.

In other words, not only does the NSA collect and store this data, using it to build profiles, the agency encourages state and local law enforcement to violate the Fourth Amendment by making use of this information in their day-to-day investigations.

This is “the most threatening situation to our constitutional republic since the Civil War,” Binney said.