Blog
Privileged Methods, Parallel Construction: How Government Secrecy Undermines the Fourth Amendment
Image via Imgur
The Fourth Amendment provides the strongest constitutional right to privacy that people in the United States have against their government. It reads:
The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.
Practically, the right has two parts. First, the government cannot execute “unreasonable searches or seizures” without a court-ordered warrant supported by “probable cause.” Second, the ordered search or seizure must be narrowly tailored, specifying the “place to be searched, and the persons or things to be seized.” Over time, the Supreme Court has interpreted “unreasonable searches” to include most intrusions – physical, electronic, or digital – that would violate a person’s “reasonable expectation of privacy.”
Courts sometimes rule on whether the state’s use of a particular technique amounts to a constitutionally protected “search” or not. But over the past three decades, law enforcement methods have evolved rapidly, and cutting-edge surveillance technology may enter common use without being challenged in court. As a result, law enforcement agencies now employ a variety of surveillance methods that are dubiously constitutional.
Normally, prosecutors share evidence with defendants during discovery, and defense attorneys have a chance to launch Fourth Amendment challenges against evidence gathered by overly intrusive methods. But law enforcement can skirt this safeguard using "parallel construction:” the process of collecting evidence via techniques that the agency does not want to disclose, and then finding other evidence which leads to the same conclusion that can be presented in court. This undermines the defendant’s right to see the evidence against them and hides significant parts of the criminal justice process from the public eye.
Public records laws can shed light on surveillance methods that do not get their day in court. The federal Freedom of Information Act (FOIA) and similar laws in all 50 states and the District of Columbia give U.S. residents the right to access records concerning government activities, including law enforcement. But broadly interpreted exemptions to those laws often shield the details, and even the very existence, of law enforcement surveillance programs from public disclosure.
Parallel construction
In 2013, a Reuters report based on a tranche of records from the Drug Enforcement Administration (DEA) revealed that the agency explicitly instructed agents on how to use and conceal the use of information from the U.S. intelligence community in their normal investigations. The DEA used the term “parallel construction” to describe the process of masking the true source of an investigative lead.
During a criminal investigation, pieces of evidence are “chained” together, with each piece used to justify the search for the next. Officers often start by using a lead – perhaps a tip from a source, or a conversation overheard on a wiretap – to justify performing a constitutionally-protected search of an individual. Evidence from that search might then be used to justify further searches of their property or associates. Parallel construction involves concealing a particular link in the chain by finding, or fabricating, alternative evidence that leads to the same conclusion. This creates a secondary chain of evidence that runs “in parallel” to the first. For example, the DEA might receive a tip from an intelligence agency that a person is trafficking drugs. Rather than disclose that tip, it could then surveil the person’s car until the target commits a minor traffic violation, and use that to justify a search of their vehicle. If agents find drugs, they can prosecute the target without revealing the confidential tip in court.
The normal remedy for a Fourth Amendment violation during a criminal investigation is suppression of evidence. Generally, any evidence gathered during an illegal search or seizure cannot be used by the prosecution in court. Any evidence that law enforcement would not have located but for the illegally obtained evidence, sometimes referred to as the “fruit of the poisonous tree,” is also subject to exclusion. Therefore, if parallel construction is used to mask that evidence was gathered in an unconstitutional way, the secondary chain of evidence is likely also subject to suppression.
But to launch a Fourth Amendment challenge to a piece of evidence, the defense must know where the evidence came from. If the prosecution creates a secondary evidence chain to completely mask its actual investigative process, the defendant may never realize that it was subject to an unconstitutional search. Parallel construction thus shields the underlying surveillance methods from legal scrutiny.
The limits of public records law
Defense attorneys can look out for possible cases of parallel construction if they know what surveillance techniques law enforcement may be trying to hide. Journalists and researchers have used public records laws to uncover controversial law enforcement surveillance equipment and methods, including the DEA’s parallel construction guidance. But public records laws are not always amenable to that purpose. Many laws give law enforcement broad power to avoid publicly disclosing controversial methods.
The Freedom of Information Act (FOIA) is the primary law that governs how federal agencies must disclose records. FOIA Section 552(b)(7)(E) exempts from disclosure any records that "would disclose techniques and procedures for law enforcement investigations or prosecutions, or would disclose guidelines for law enforcement investigations or prosecutions if such disclosure could reasonably be expected to risk circumvention of the law." The U.S. Department of Justice argues that this applies to all records implicating "techniques and procedures for investigations," regardless of whether the disclosure could "risk circumvention." This allows federal agencies to effectively withhold all information about “techniques and procedures” unless those methods are already “well known to the public.” This creates a catch-22 for researchers: they cannot learn about new law enforcement surveillance techniques, even ones which are rumored or suspected to be in use, until the public knows about them.
Furthermore, most public records laws also exempt "trade secrets" and other "proprietary" information from disclosure, making public-private partnerships even harder to uncover than other government methods. 5 U.S.C. § 552(b)(4) exempts “trade secrets and commercial or financial information obtained from a person and privileged or confidential” from FOIA disclosure. This creates an extra barrier to reporting on surveillance techniques that are provided by private companies. Many surveillance technology vendors add language into government contracts that demands confidentiality of even the vaguest details about their services.
Stingrays and the consequences of secrecy
Law enforcement’s use of cell site simulators demonstrates how police secrecy can distort the Fourth Amendment.
A cell site simulator (or CSS, often referred to by the brand name "Stingray") operates by mimicking a cellular tower and causing nearby cell phones to connect to the CSS instead of a real tower. The CSS can then forward data between the phone and the real cellular network so that the phone’s user does not experience any interruption in service and does not realize they are being monitored. Once connected to a phone, the CSS can gather metadata about nearly all of its activities, including incoming and outgoing calls, text messages, and web browsing.
CSSs such as stingrays have been used by police for most of the 21st century. For example, in 2003, the Miami-Dade Police Department purchased a CSS to surveil protestors at a trade conference. But the first major public reporting on stingrays did not come until 2011, after an imprisoned hacker spent years researching how the government had tracked him, and it was several more years before the public fully understood how the devices were used. This was by design: the federal government went to great lengths to keep details about the technology under wraps. The FBI required local law enforcement agencies to route all FOIA requests relating to the tool through the agency, which it then vehemently fought against; in one case, U.S. Marshals stepped in to physically remove records that were pending release from a Florida police department. Local agencies were also required to sign an NDA stating that they would not disclose their use of stingrays to anyone, including in court, and instructing them to drop cases rather than violate that secrecy. If police wanted to use stingrays in investigations, they would have to use parallel construction to mask it (or else flat-out lie).
For years, the Department of Justice justified warrantless use of stingrays under past judicial precedent regarding “pen registers” and “trap and trace” devices. Those techniques allow law enforcement to gather data about the incoming and outgoing calls of a single phone subscriber, and courts have held that they do not require a warrant under the Fourth Amendment (though statute requires a court order with less stringent requirements). But cell site simulators are significantly more powerful tools. Rather than targeting one device, a CSS can surveil every cellular device in an area – up to 10,000 phones at a time. And because it gathers information from all devices in a short range, the CSS collects rough location data as well. For example, a stingray activated at a protest can be used to establish which devices were present in the area over an extended period of time.
As reporters and activists brought stingrays to light, legal scrutiny on their use increased. Stingray-derived evidence finally started to appear in courtrooms, and a series of rulings produced conflicting doctrines regarding its constitutionality. For example, in U.S. v. Patrick, police obtained a generic location-tracking warrant to track a suspect, but allegedly misled the judge who issued the warrant about how they would execute it. The 7th Circuit held that evidence gathered by the secret stingray could not be suppressed, and expressed doubt that CSS use would constitute a “search” at all. A few months later, in U.S. v. Lambis, the United States District Court for the Southern District of New York ruled that stingray use did constitute a constitutional search and ordered evidence suppressed.
Meanwhile, as public awareness grew, so did public pressure. State legislatures around the country began passing laws to affirmatively limit the use of stingrays and related technology. And in September 2015, the Department of Justice announced that it would start seeking a warrant before using cell-site simulators in most cases (though it did not concede that this was constitutionally required). Although the Supreme Court has never affirmatively ruled that cell-site simulator use is a Fourth Amendment search, law in many jurisdictions now requires or strongly implies that stingrays may only be used with a warrant.
Surveillance contractors abound
Stingrays are far from the only example of a new technology kept deliberately secret. Federal and local law enforcement agencies contract with private companies for a wide variety of surveillance tools and services. These companies may be unknown to the general public, including defense attorneys, and they purposefully keep details of their products secret. At the intersection of “law enforcement methods” and “trade secrets,” private surveillance methods can be uniquely difficult to expose with public records laws.
Grayshift is a company that develops GrayKey, a device that unlocks encrypted iPhones and extracts as much data as possible. Grayshift has aggressively opposed disclosure of any details about its business via public records laws. In an illustrative case, Upturn, Inc. v. New York City Police Dept., the NYPD refused to disclose the names of products or services it purchased from Grayshift. When the requester sued, Grayshift insisted to a court that “even the broad contours of how [its] product works” were privileged trade secrets exempt from disclosure. The court ruled in favor of NYPD and Grayshift, denying the plaintiff’s request for unredacted purchase orders and invoices.
Grayshift has also required police agencies to sign non-disclosure agreements and other confidentiality agreements in order to use its product. One such agreement forbade disclosing the existence of GrayKey features designed to circumvent “USB Restricted Mode,” an iOS feature meant to prevent exactly the kind of access that GrayKey allows. That document was released in response to a public records request, although much of the language was apparently left unredacted by mistake.
Fog Data Science is another private surveillance contractor hostile to publicity. Fog sells access to geolocation information derived from smartphone apps via a point-and-click service called Fog Reveal. The data it sells is directly analogous to location data that the Supreme Court has held requires a warrant, but there is evidence that at least some police departments access Fog’s data without using warrants. Fog Reveal is advertised as a way to “generate leads” and “monitor high-risk areas,” purposes well-suited for concealment by parallel construction. And the company is intensely secretive: a software license agreement for the service declares that nearly all information about Fog, including the license agreement itself, is “confidential,” and a police analyst who worked with the company said it made clear that Fog Reveal should be kept secret from the public. Until recently, the company’s very existence was almost entirely unknown outside of law enforcement circles.
Conclusion
As novel surveillance methods are adopted by law enforcement, and as more evidence collection is outsourced to the private sector, police and prosecutors will have more incentives to keep their methods out of the courtroom via parallel construction. Meanwhile, exceptions in public records law may shield substantial details of these methods from disclosure.
We cannot take legal rights against invasive, overbroad state surveillance for granted. Rights can only be enforced in court, and only when their violation is exposed. New law enforcement methods rarely map neatly onto existing legal precedent, and police lawyers are incentivized to interpret case law in favor of police power. Courts must be able to evaluate the constitutionality of new technologies as soon as they are put into practice. And even when judges find that new surveillance methods are constitutional, voters and legislatures must be able to decide whether they are acceptable as a matter of public policy.
Secret surveillance methods allow law enforcement to spy without accountability to courts or voters. And with parallel construction, information obtained in unconstitutional ways can be used to put people behind bars. That’s why it is critical that public records laws expose how the government monitors us, even when the monitoring is outsourced to private companies. If law enforcement is allowed to keep its methods out of court and out of public records, we grant police and prosecutors sole power to decide when and how they surveil.