Court Upholds Legal Challenge Under California Statewide Stingray Law

In late November, a California state court issued a final decision interpreting a 2015 California state law regulating government agency use of cell site simulators, devices that can be used to locate and track cell phones. The devices are commonly known as “stingrays.” The challenge—the first brought under this law—argued that the City of Vallejo was not in compliance with the law’s requirement that a local public body approve, at a public meeting, both police acquisition of the technology and a policy determining how and when these devices can be used. The court upheld this view of the law, providing an important victory for transparency.

Stingray devices present serious privacy risks because they allow law enforcement to track the physical location of anyone with a cell phone in real time. Originally billed as anti-terrorism tools, police often use them in routine investigations of nonviolent crimes. Furthermore, stingray devices can access data about all phones in an area, ranging from a few hundred yards to about 2 miles, even if the police are interested in only one device. Because of these “dragnet” capabilities, I and others have argued that localities should have the opportunity to decide if and how stingray and similar devices should be used in their communities. The California state law mandates this local decision-making process, providing an opportunity for needed transparency and democratic oversight.

The law was untested in court, allowing localities to interpret the law to their benefit, which, for city governments, often means the least resource-intensive view. Vallejo, for example, argued that as long as someone in the city government created a usage and privacy policy, it was in compliance with the law. The court’s ruling reaffirmed that a public decision-making process about when and how these devices are used is required by law.

The ruling and resulting changes to Vallejo’s policy provide a guide for other cities in California. Indeed, by being forced through a public discussion period, the policy benefited from significant changes, including explicit safeguards for First Amendment-protected activity. But, at a higher level, this litigation demonstrates the importance of having a governance process for surveillance, not just one governance mechanism. State laws, state courts and civil society all were crucial to the effective regulation of surveillance technologies used by local police forces.

In 2015, as part of its push for stronger privacy protections, the California legislature passed a law regulating local government agency acquisition and use of cellular communications interception technologies. Other states have passed laws requiring that any government agency using a stingray must first obtain a warrant, or laws that restrict the circumstances in which agencies can use the devices. But the California law is the only state law I encountered in my research that mandates a comprehensive, public governance process at the local level, which I have argued is particularly important to regulating police surveillance. The law provides that “a local agency shall not acquire cellular communications interception technology unless approved by its legislative body by adoption, at a regularly scheduled public meeting …[,] of a resolution or ordinance authorizing that acquisition and the usage and privacy policy required by this section.” It also sets out basic considerations that the policy must address—such as the purposes for which the devices can be used, which employees may use it and how resulting data will be handled—although it does not prescribe answers to those questions.

In March 2020, the city council of Vallejo, California, approved its police department’s acquisition of a stingray device at a public meeting as required by state law. However, it authorized the chief of police to develop a usage and privacy policy internally without public input. Public interest groups warned the city before, during and after the city council meeting that developing this policy internally would violate the state law’s requirement that adoption of such a policy must be public. Oakland Privacy and two residents of Vallejo filed suit in May when the city did not change course.

The plaintiffs asked the court to issue a mandate for a public process as required by state law. California civil procedure allows courts, for these types of suits, to enter an initial decision followed later by a final decision. The city argued in its filings that the state law required the city only to authorize the creation of a policy, not actually adopt a specific policy through public processes. Plaintiffs countered that the law mandated that the city must adopt a usage and privacy policy through public proceedings.

The court sided with the plaintiffs’ interpretation of the law based on the plain meaning of its text and legislative history. The court entered its initial decision in October and ordered Vallejo to either cease using its stingrays or adopt a usage and privacy policy at a city council meeting open to the public. To comply with the court’s initial decision, the city council decided to pursue the second option, adopting a usage and privacy policy, which the council did at a public meeting on Nov. 17. The court issued its final decision on Nov. 22, confirming its initial interpretation of the state law. With a conforming public policy now in place, Vallejo is compliant with the court’s final determination.

Local acquisition of these technologies frequently bypasses established local oversight mechanisms—through nondisclosure agreements with sellers or via federal grant programs that don’t require local political approval. Local use of these technologies suffers from a more general Fourth Amendment problem, too: Under Fourth Amendment law, to challenge use or misuse of new technologies, you have to wait until you can prove that they were used in a criminal prosecution. Even then, judicial scrutiny of these devices is usually slow and limited in scope to the confines of the Fourth Amendment’s “reasonableness” doctrine.

The state law’s required procedural measures help mitigate some of these problems by allowing legal challenges to “move up” in time: First, public discussion occurs much earlier, and any legal challenges can also occur well before use in a criminal prosecution. The state law also allows legal challenges about surveillance to take place in procedural and statutory terms, rather than constitutional terms. Lower courts sometimes welcome the opportunity to rule on these grounds rather than engaging with riskier questions of constitutional interpretation.

But these required procedural measures go only so far. To bring Vallejo into full compliance with the law required corrective litigation from a civil society group. Civil society was able to do so only because the original state law granted private citizens legal standing to challenge local processes. The Vallejo story shows just how important such standing provisions are to ensuring surveillance statutes have their intended effect.

The litigation also meant the resulting policy decisions in Vallejo were subject to particular public scrutiny. Civil society groups achieved substantial revisions to the policy that go beyond the minimum required by the statute, including prohibitions on the use of these devices to monitor First Amendment-protected activity and requiring logs of the device’s use. Vallejo’s policies will serve as good substantive precedent for other cities looking to acquire this technology; in this way, statutorily required procedures proved to be a gateway to improved substance.
And, indeed, many more California cities may soon be going through this statutory process. Harris Corporation, a primary manufacturer of these devices, announced that it will stop supplying local agencies. Although most of California’s major cities acquired their original cell site simulators before the 2015 law went into effect, meaning they had to comply with only a portion of the law, cities will be required to adhere to the full range of procedural requirements as they acquire new models. The City of Anaheim, for instance, went through this process—compliantly—over the summer. More litigation may be on the horizon, too: The plaintiffs in City of Vallejo believe “other cities in California may have also put cell site simulators to work without a public policy process and will be contacting those cities to insist upon compliance with state law.”