Illinois moves to limit cellphone spying by police 

Police departments across the nation have the technology to trick your smartphone into giving up mountains of information about you, and you may never know it happened. That could soon change in Illinois, due to legislation which would limit how police use cellphone spying technology.

The bill passed the Illinois General Assembly unanimously last month, striking a balance between privacy and law enforcement’s need to adapt as criminals do.

The technology is known by a variety of names like Stingray, IMSI catcher or cell-site simulator, and it allows police to intercept and manipulate data from cellphones. Stingrays and similar devices work by pretending to be the strongest nearby cellphone tower. Phones which connect to a Stingray may give up the phone’s location, messages, numbers dialed and other data. Stingrays can also be used to eavesdrop on calls, block calls, send fake text messages, drain a phone’s battery, install malware and more.

Although Staingrays can target a single cellphone, they can also be used to gather information about any nearby phones, meaning innocent people may have their data swept up in a surveillance dragnet.

“It’s a virtual pat-down of your phone without you even knowing it’s happening,” said Khadine Bennett, associate legislative director for the ACLU of Illinois. “Nobody knows when it’s being used, so they can’t complain.”

The Illinois State Police acquired Stingrays in 2008, but federal agencies like the FBI have been using similar technology for much longer.

Senate Bill 2343 would limit what kind of data police in Illinois can collect with Stingrays, ban certain uses like draining batteries and installing malware, and require police to explain the technology to judges when seeking a warrant to use Stingrays.

Under the bill, police would still be able to use the devices to locate phones, but doing so would require a court order except under certain conditions. When police know which phone they must target, any data collected from other phones in the process would have to be deleted within 24 hours. In cases where police don’t know which phone they need to target – such as a drug dealer using a temporary “burner” phone, police would have 72 hours to examine the data before deleting information from non-target phones. A judge may allow data about non-target phones to be kept longer.

The bill applies only to state and local law enforcement, although Bennett notes that similar regulations exist for federal agencies already. In fact, Bennett says the existence of the federal regulations made it easier to pass SB2343. Bennett worked with the Illinois State Police and other law enforcement agencies in Illinois to craft the bill, which helps explain how it passed the legislature without a single vote of opposition in either chamber.

“This was one of the easier privacy bills to move because the feds had already done it,” she said. “It’s also a really good bipartisan issue; if you look at the cosponsors of the bill, you see people who are super-conservative, super-liberal and in the middle.”

On June 16, the bill was sent to the desk of Gov. Bruce Rauner, who has until Aug. 15 to approve or veto it.

Without controls on how data can be collected and used, Bennett says, it can become less a tool and more a weapon.

“It’s easy to get into the trap of ‘I don’t have anything to hide,’ but the ability to accumulate massive amounts of information about every aspect of our lives means it can be used in a wide range of ways,” she said. “Even if you don’t have anything to hide, that shouldn’t be the standard for why privacy rights are protected.”

Contact Patrick Yeagle at [email protected].