California Privacy Advocates Sue Vallejo Over Cell-Site Simulator

Special thanks to legal intern Gillian Vernick, who was lead author of this post.

The Vallejo Police Department was warned: by rushing to purchase a cell-site simulator without first crafting a use policy, the agency side-stepped its legal duty to transparency. Now, Oakland Privacy has filed a first-of-its-kind suit to ensure the public has a say in how this controversial surveillance technology is deployed in their communities. 

Cell-site simulators are devices that police use to gather information from cell phones, typically to locate, identify, and track people. Also known as IMSI catchers, these devices pretend to be cell phone towers in order to trick phones into connecting to them. The technology is so controversial that, in 2015, the California legislature stepped in and passed SB 741, a law that ensures a police department cannot acquire a cell-site simulator without a city council first approving a detailed policy that is “consistent with respect for an individual’s privacy and civil liberties.” 

In mid-March, amid COVID-19 shelter-in-place orders, the Vallejo City Council approved a $766,000 purchase of a cell-site simulator manufactured by KeyW. However, instead of holding a hearing on the policy, the council simply told the police that they could write a policy later. Oakland Privacy and EFF both sent letters to the city demanding an immediate halt on the purchase. 

Those letters went unheeded. In response, Oakland Privacy—a local member in the Electronic Frontier Alliance and a winner of the 2019 Pioneer Award given by EFF— and two residents filed suit on May 21 to demand that Vallejo Police follow the law. 

In a press release issued by Oakland Privacy, plaintiff Dan Rubins stated: “Now, during a severe health and economic crisis that is already causing a $12M budget shortfall, they want to spend almost $1M to buy a powerful and unnecessary surveillance device while they write its use policy in secret. Their actions flout transparency and procurement regulations that give people a forum to raise these issues that impact all of our civil liberties.”

The complaint alleges the Vallejo Police Department violated SB 741 (California Government Code § 53166) by failing to comply with the requirement that the City Council approve a usage policy for the cell-site simulator before it is acquired and operated. Instead of adopting or reviewing a privacy policy before authorizing the purchase, the City Council simply authorized the chief of police to create a privacy policy behind closed doors, without public participation as required by the law.

The complaint further contends that not only did the Vallejo Police Department fail to present a policy for approval, but the actual policy created by the police chief fails to comply with all the requirements for the construction of a policy under SB 741.

The law has a long list of elements that must be included in a policy, many of which were addressed inadequately by the policy eventually released by the Vallejo Police Department. 

First, the policy fails to include a description of the employees authorized to access information collected with the cell-site simulator. Second, it allows the police chief or his designee to authorize an unspecified employee to use the device, without a requirement of amending the policy to show this person has been authorized to use the device or access the information collected. Finally, the policy authorizes the use of the technology without prior judicial approval based on an imminent threat of generic “bodily injury” of any kind, which is inconsistent with the California Electronic Communications Privacy Act (CalECPA). Under CalECPA, the standard for using a cell-site simulator without prior judicial authorization is “danger of death or serious physical injury,” whereas the Vallejo Police Department policy leaves room for the technology to be deployed without a warrant for something as basic as a twisted ankle. 

This battle is important. States, counties, cities, and transit agencies around the nation, particularly in California, are passing laws to ensure surveillance technology can’t be acquired or used before a policy is put in writing and approved by an elected body in a public hearing. We applaud Oakland Privacy for taking a stand against law enforcement circumventing transparency requirements intended to give the public a say in the surveillance technologies used in their communities.