When the clock struck midnight Dec. 31 and rolled over into 2016, a new law mandating how law enforcement agencies could collect electronic communications and data took effect in California.
Under the new rule, formally known as the California Electronic Communication Privacy Act (CalECPA), law enforcement agencies in the state are responsible for obtaining search warrants before they go after forms digital communications and information stored on devices like cellphones.
For civil rights advocates, the new law was a big win in a nationwide movement to halt the haphazard use of controversial tools and tactics. For law enforcement, the law would mean changes in how they employ certain technologies, like use of bulk data collection tools.
Sacramento County Sheriff Scott Jones, who also serves as the president of the California Peace Officers’ Association (CPOA), said the law won’t have a devastating impact on how agencies throughout the state operate, but will slow processes that had not previously been outlined.
“I think, generally speaking, it’s not going to change the way we do business in most cases because the thing that the law was most concerned with are mostly covered under other areas of law," he said. "So, wiretapping and actually going in to see the content of peoples’ cellphones and things like that are already well established areas of law."
Under the new law, authorities are required to notify the person under investigation, unless conditions of a 90-day delay exemption are met. And this requirement that investigators notify their intended target threatens the ability to gather evidence and could pose issues from a criminal evidence perspective, Jones argued.
“This really had a couple of impacts," he said. "No. 1, it will create an additional burden and protocol for areas that were not already covered by areas of law and [No. 2,] the requirement that you give notice of the person being sought and the impracticality of that when you are obviously trying to gather criminal evidence against that person."
Despite having a role in the legislative conversation, Jones said the CPOA was largely at the mercy of an impassioned issue and pressure by advocacy groups in the post-Snowden environment.
“I get it. I think we get what the genesis was. We were part of the conversation, recognizing of course that it was a train that had already left the station,” he said. “CPOA was part of the discussion, but ultimately it was something that there was a lot of passion for in the legislature to pass and for the governor to sign.”
The so called Stingray, a device that mimics cellphone towers to target and locate specific cellphone numbers, was among the devices posing concern for privacy advocates and legislators.
Jones’ office was the focus of media reports about the technology, and what he said were misconceptions over how and when it was being used, and exactly what it is capable of doing.
The sheriff said his office developed a departmental policy ahead of CalECPA being signed into law, which outlined a warrant requirement prior to the use of Stingray technology. Jones went on to say that many of the reports about the technology's capabilities were incorrect, but because of a confidentiality agreement with the Federal Bureau of Investigations, could not be publicly disputed.
“What it doesn’t do, and what has been widely reported that it is doing — because no one can say anything to the contrary — is it does not and has never captured content of text messages, browsing data, content of telephone calls nothing like that. It’s really not that sexy when you know what it is. ... It does not do all the stuff that people are concerned that it does," Jones said, adding that what it does do is look for a specific cellphone identifier.
"In other words it’s not just sucking in every cellphone identifier in Sacramento County. You have to know what you’re looking for, and it gives you within a mile radius and lets you know if there is a hit on that particular cellphone,” he said. “Within that area it does act as a cell site simulator, so all the other cellphone subscriber information filters through the machine, but it’s like white noise to the machine.”
The American Civil Liberties Union (ACLU) sees the legislation as a necessary step toward protecting illegal electronic searches and data seizures. From the potential collection of metadata to the physical search of a cellphone following an arrest, the organization said existing laws left too many opportunities for invasive digital information gathering.
Chris Conley, a policy attorney with the ACLU of Northern California, said many of the laws governing digital communications have not kept pace with rapidly advancing technologies, like cellular phones, email and metadata.
“We have been looking at a situation where our digital information has not had the same kind of protection that our physical possessions have had,” he said. “If you had a letter in your home or if you have a personal computer in your home, law enforcement needs a warrant to search that. But if you have an account on Google or you’re using your smartphone for maps to figure out where you’re going, arguably law enforcement has not needed a warrant to search that information.”
Conley noted that revelations about the National Security Agency’s domestic intelligence program by former CIA contractor Edward Snowden helped to draw attention to the amount of information that resided in the digital world.
“The courts have begun to handle this, and they have begun recognizing and extending constitutional protections to digital information. There was the case Riley v. California that held that the Fourth Amendment requires a warrant to search the contents of a cellphone,” Conley said. “You can’t arrest someone and in the context of checking their pockets for weapons or contraband that might be easily destroyed, search through a portable computer that is essentially a detailed record of pretty much everything these days.”
Gaps in public knowledge and reporting as far as the tools and tactics being employed by law enforcement, the ACLU representative said, has been cause for ongoing concern on the part of privacy and rights groups.
“Our position is not that law enforcement should not get this information," he said. "It’s that we need to have a meaningful public dialog about what is the right balance, what are the rules that can make sure that both public safety and individual rights are protected. Without information about what is actually going on, it’s very hard to have that dialog."
As for digital protections on the national level, Conley said more courts have started to recognize the implications of digital information and communications. And while California is the first to enact such comprehensive protection legislation, he is hopeful other states and the federal government will take note.
“The reality is, I think, this is restoring the balance. Again in the physical world, where we have fought crime for hundreds of years, the rule has been if you want information, you get a warrant. And that has worked. Law enforcement has solved crimes, solved mysteries, fought all sorts of criminal activities, kept the public safe through that process,” Conley said. "In the digital world, there is more and more sensitive information, more and more detailed records of our personal lives that are available, and yet, the argument has been for some reason that requires less protection than would traditionally exist in the physical world."
This article was originally published on Government Technology.
