Georgetown Law
Technology Review

LAW ENFORCEMENT’S HISTORY OF TRACKING SUSPECTS

Locating and tracking individuals is often a vital component of law enforcement operations. Throughout its history, American law enforcement has continually adopted new methods and technologies to track suspects with greater efficiency. Nineteenth-century state governments employed bounty hunters to track suspects across state lines,1Law enforcement agencies have employed bounty hunters throughout much of American history. See, e.g., William Taylor v. Taintor, Treasurer of the State of Connecticut, 83 U.S. 366, 371 (1873) (citing the Extradition Clause of the Constitution and noting in dicta that a bail bondsman bounty hunter was within his delegated authority to recover the suspect wanted by the State of Maine). while some twentieth-century agencies used Global Positioning System (GPS) devices to track suspects’ vehicles.2See, e.g., United States v. Jones, 565 U.S. 400, 404, (2012) (holding that government agents may use GPS devices to track suspects, provided that a lawful warrant is first obtained). In recent decades, technological advances in cell phones have enabled law enforcement to track the vast majority of Americans without direct interaction, causing many federal courts to disagree about the proper use of such technology.3See, e.g., United States v. Graham, 824 F.3d 421, 437 (4th Cir. 2016) (holding that routing information, shared with third parties to allow them to deliver a message or provide a service, has never been held as protected under the Fourth Amendment.); United States v. Davis, 785 F.3d 498, 513 (11th Cir. 2015) (holding that CSLI is a business record, the obtainment of which does not constitute a search under the Fourth Amendment.); In re United States for Historical Cell Site Data, 724 F.3d 600, 614–15 (5th Cir. 2013) (holding that applications under the Stored Communications Act for cell site data are not per se unconstitutional, and stating that requiring higher standards needs Congressional action or a change to the third-party doctrine by the Supreme Court).

With the widespread adoption of cell phones, much of the American population is now carrying a tracking device by default, endowing law enforcement with ample opportunities to locate a suspect.4Ninety-two percent of adults in the United States own a cell phone. See Monica Anderson, Technology Device Ownership: 2015, PEW RESEARCH CENTER (Oct. 29, 2015), http://www.pewinternet.org/2015/10/29/technology-device-ownership-2015 [https://perma.cc/5D6K-V36D]. This article will explain the technology behind cell phone tracking methods, including the three primary means through which a cell phone’s location can be tracked. These three methods include: (1) analyzing historic cell site data, (2) real-time tracking using prospective cell site data and GPS, and (3) real-time tracking using cell site simulators. This article will focus on the technology behind each of these methods, and how the technologies’ capabilities and limitations impact the legal requirements of their use by law enforcement.

TRACKING THE LOCATION OF A CELL PHONE

When determining the appropriate method to track a cell phone, a law enforcement agency’s level of legal authority is based on the evidence already obtained. Some necessary questions might include: whether the agency has established proper probable cause to conduct the type of search contemplated; whether it has obtained a necessary search warrant; and whether more evidence of criminal activity is required. Although appellate courts are divided on whether these methods require a search warrant under the Fourth Amendment, several U.S. appellate courts have held that obtaining historic cell site data5Historic cell site data is explained in the following paragraphs. In essence, the data includes gathering a history of general locations around which a cell phone has sent and/or received communications. does not require a warrant—an issue the Supreme Court will address when it hears Carpenter v. United States.6United States v. Carpenter, 819 F.3d 880 (6th Cir. 2016), cert. granted, 85 U.S.L.W. 3567 (U.S. Jun. 5, 2017) (No. 16–402). Additionally, as a matter of policy, the U.S. Department of Justice (DOJ) requires a search warrant for the use of cell site simulators.7U.S. DEPT. OF JUSTICE, DEPARTMENT OF JUSTICE POLICY GUIDANCE: USE OF CELL-SITE SIMULATOR TECHNOLOGY 2 (2015), https://www.justice.gov/opa/file/767321/download [https://perma.cc/CE3Z-TKHB].

Analyzing Historic Cell Site Data

Cell service providers (e.g., AT&T, Verizon, T-Mobile, etc.) maintain records of a mobile phone’s activity as it connects to cell sites. In the industry parlance, the term “cell sites” refers to the towers and electronic communications equipment that are placed throughout the country (comprising a service provider’s network) that make cellular communications possible. The coverage area of an individual cell site varies based on several factors, but urban areas generally have a cell site every one-half to one mile—the typical coverage area is between three and five miles in more rural areas.8Aaron Blank, The Limitations and Admissibility of Using Historical Cellular Site Data to Track the Location of a Cellular Phone, 18 RICH. J.L. & TECH. 3, 4–5 (2011). As a cell phone moves throughout a coverage area, its connection transfers from cell site to cell site, maintaining a continuous connection with the strongest available signal, and this phenomenon effectively creates a broad record of movements by the holder of the phone.9Id. at 5. These records are stored by service providers every time a phone call or text message is sent or received, and collectively are known as Historic Cell Site Location Information (CSLI) .10See id. at 8, 10–11.

CSLI comes in the form of a directional radial wedge, a slice of the coverage area circle surrounding a cell site. When a cell device connects to a cell site, CSLI can determine within which radial wedge the device is located. This information, while useful, does not provide a precise location in the same way a GPS tracker would. Instead, CSLI can locate a phone within a 60- or 120-degree radial wedge extending between one-half mile and two miles in length.11See Carpenter, 819 F.3d at 889. This precision is also dependent on the number of cell sites in an area, so the radii may be even wider in suburban or rural areas where cell sites are sparser.12See id. Broad locational information like this can help establish a pattern, but because the data is not precise and is maintained as a business record by cell service providers, the U.S. Court of Appeals for the Sixth Circuit held that obtaining it is not a search under the Fourth Amendment that would require a warrant—again, a decision that the Supreme Court will review this term.13See id. at 884.

Under the Stored Communications Act, Congress also expressly permitted a governmental entity to obtain a customer’s name, address, connection records, and telephone number, or other subscriber number or identity from a service provider, with a valid subpoena, rather than a search warrant.1418 U.S.C. § 2703(c)(2) (2009).

 Real-time Tracking with Prospective Cell Site Information and GPS

 In contrast to historic CSLI, prospective CSLI is obtained by actively sending a signal to a targeted cellular device, triggering the device to respond to the cell site with information and creating a real-time set of locational records with the same general radii as historic CSLI.15Cal Cumpstone, Game of Phones: The Fourth Amendment Implications of Real-Time Cell Phone Tracking, 65 CLEV. ST. L. REV. 77, 86 (2016). Although this information may not be precise, because the locational data is received in real-time, officers can determine the cell phone’s current general location (rather than its previous general location), significantly narrowing the search. Law enforcement can use this information also in deploying cell site simulators (another cell phone tracking innovation described below) to determine the phone’s location more precisely. The precision of prospective CSLI varies, however, based upon the number of cell sites in the area; if the targeted cell phone is within range of three cell sites, the location discerned from this data is nearly as precise as GPS.16Cell tower triangulation can determine a phone location to within a three-quarter-square-mile area. Minh Tran, FED. COMMC’N COMM’N, COST EFFECTIVE LOCATION DETECTION TECHNIQUES USED BY THE 911 HELP SMS APP TO OVERCOME SMARTPHONE FLAWS AND GPS DISCREPANCIES 2 (2015), https://transition.fcc.gov/pshs/911/Apps%20Wrkshp%202015/911_Help_SMS_WhitePaper0515.pdf [https://perma.cc/9KUM-2NE2].

A cell service provider can also activate a cell phone’s internal GPS locator (if it was manufactured with one) in order to provide a precise, real-time location of the device without using CSLI and without its user knowing.17Cumpstone, supra note 15, at 86. While there is a potential disparity in precision between prospective CSLI and GPS data, these two methods differ from historic CSLI and cell site simulators (explained below) in that they provide law enforcement with the current location of a suspect anywhere in the country based solely on their cell phone number.

Locating Cell Phones Using Cell Site Simulators

Cell site simulators operate by falsely posing as a service provider’s closest cell site, tricking a cell phone into sending and receiving signals to and from the simulator. This allows the simulator to intercept the data as it is sent from a cell phone to the service provider’s network—a scheme commonly known as a man-in-the-middle attack.18Joseph Ooi, IMSI Catchers and Mobile Security 10 (Apr. 29, 2015) (unpublished B.S.E. thesis, University of Pennsylvania), https://www.cis.upenn.edu/current-students/undergraduate/courses/documents/EAS499Honors-IMSICatchersandMobileSecurity-V18F-1.pdf [https://perma.cc/9ZHR-J433]. A man-in-the-middle attack usually entails a third party that inserts itself as an intermediary point between the sender and receiver of a communication, allowing the attacker to intercept the communications while the sender and receiver believe they are still directly communicating with each other. These simulators are also known as “IMSI catchers”, a moniker referring to a cell phone’s International Mobile Subscriber Identity number. The IMSI is unique to each device and is assigned by the service provider.19International Mobile Subscriber Identity, TECHNOPEDIA (Oct. 6, 2017, 11:00 AM), https://www.techopedia.com/definition/5067/international-mobile-subscriber-identity-imsi [https://perma.cc/A6K5-73LK]. This number is similar to a credit card number; the ISMI includes a numeric string that identifies the device and its associated service provider. Although a device can be assigned a new IMSI number, no two devices will have the same IMSI number at any given time.

When a cellular device wants to connect to a network, it will attempt to get the best connection by connecting to whichever cell site is emitting the strongest signal.20Ooi, supra note 18, at 10. IMSI catchers take advantage of this behavior and, by emitting an artificially strong signal, will force all cellular devices within a small area to connect to the device instead of the normal cell site.21Id. Per DOJ policy, cell site simulators used by law enforcement are configured to intercept only metadata, akin to a traditional pen register.22Pen registers are devices utilized by law enforcement to “record telephone numbers, e-mail addresses, and other dialing, routing, addressing, or signaling information” transmitted by telephones or computers. Trap and trace devices record the same information received by telephones or computers. These devices are used to intercept metadata associated with communications without notifying the individuals being observed. See U.S. DEPT. OF JUSTICE, A REVIEW OF THE FBI’S USE OF PEN REGISTER AND TRAP AND TRACE DEVICES UNDER THE FOREIGN INTELLIGENCE SURVEILLANCE ACT IN 2007 THROUGH 2009 1 (2015), https://oig.justice.gov/reports/2015/o1506.pdf [https://perma.cc/W8C6-SPR4]. The simulators are capable of intercepting a much broader variety of data, however (ranging from collecting IMSI numbers, to reading the content of text messages and phone calls, or even intercepting files from the phone), depending on the sophistication of the cell site simulator being used and the network to which it is connected.23DEPARTMENT OF JUSTICE POLICY GUIDANCE: USE OF CELL-SITE SIMULATOR TECHNOLOGY, supra note 7, at 2; see Ooi, supra note 18, at 11–13.

Although cell site simulators can intercept a variety of data, when they are configured as a pen register, law enforcement focuses on only the strength and direction of the signal from the targeted IMSI number. Law enforcement can also place cell site simulators in roving vehicles. Roving simulators allow agents to take the initiative in locating stationary suspects, monitoring changes in the strength and direction of a cellular device’s stationary signal. Police officers have employed similar tactics by placing radio transmitters (colloquially referred to as beepers) in contraband, allowing officers to track a contraband item’s location through a directional-receiver able to detect the strength of the emitted radio signal.24See United States v. Karo, 468 U.S. 705, 706–08 (1984). According to the Supreme Court, law enforcement requires a search warrant when transmitting devices are tracked as the target takes them beyond the view of the general public.25Id. Applying that principle, a warrant would presumably be required for the use of a cell site simulator if, and when, the phone is not within public view.26See id.

CONCLUSION

As cell phone technology advances and networks become more sophisticated, the ability of law enforcement to track a cellular device will almost certainly become more precise.27See Brief for Petitioner at 21, United States v. Carpenter, 819 F.3d 880 (6th Cir. 2016), cert. granted, 85 U.S.L.W. 3567 (U.S. Jun. 5, 2017) (No. 16–402). These advances will likely deepen the divide between law enforcement’s capabilities and the average user’s understanding of the information collected by carriers—furthering the consumer’s already-meek expectation of privacy in their data under the third-party doctrine.28See Smith v. Maryland, 442 U.S. 735, 743–44 (1979) (holding that a person has no legitimate expectation of privacy in information voluntarily turned over to third parties).

As courts have been slow to apply Fourth Amendment protections to CSLI and cell site simulators, Congress and federal agencies might be better equipped to hold law enforcement more accountable. The DOJ has already taken steps in this direction, requiring law enforcement agencies under its authority to obtain a warrant before using a cell site simulator. Similarly, pertinent legislation, such as the Electronic Communications Privacy Act and the Stored Communications Act, can be updated to more appropriately protect consumer privacy given the current state of electronic communication technologies—covering many of the gray areas in which courts have struggled to apply Fourth Amendment protections.