State v. Andrews , 227 Md. App. 350 ( 2016 )

REPORTED
IN THE COURT OF SPECIAL APPEALS
OF MARYLAND
No. 1496
September Term, 2015
______________________________________
STATE OF MARYLAND
v.
KERRON ANDREWS
______________________________________
Leahy,
Friedman,
Thieme, Raymond G., Jr.
(Retired, Specially Assigned)
JJ.
______________________________________
Opinion by Leahy, J.
______________________________________
Filed: March 30, 2016
“[M]odern cell phones . . . are now such a pervasive and insistent part of
daily life that the proverbial visitor from Mars might conclude they were an
important feature of human anatomy.”
Riley v. California, 134 S. Ct. 2473, 2484 (2014).
This case presents a Fourth Amendment issue of first impression in this State:
whether a cell phone—a piece of technology so ubiquitous as to be on the person of
practically every citizen—may be transformed into a real-time tracking device by the
government without a warrant.
On the evening of May 5, 2014, the Baltimore City Police Department (BPD) used
an active cell site simulator, without a warrant, to locate Appellee Kerron Andrews who
was wanted on charges of attempted murder. The cell site simulator, known under the
brand name “Hailstorm,” forced Andrews’s cell phone into transmitting signals that
allowed the police to track it to a precise location inside a residence located at 5032 Clifton
Avenue in Baltimore City. The officers found Andrews sitting on the couch in the living
room and arrested him pursuant to a valid arrest warrant. The cell phone was in his pants
pocket. After obtaining a warrant to search the residence, the police found a gun in the
cushions of the couch.
In the Circuit Court for Baltimore City, Andrews successfully argued that the
warrantless use of the Hailstorm device was an unreasonable search under the Fourth
Amendment of the United States Constitution. The court suppressed all evidence obtained
by the police from the residence as fruit of the poisonous tree. The State, pursuant to
Maryland Code (1973, 2013 Repl. Vol., 2015 Supp.), Courts and Judicial Proceedings
Article (“CJP”), § 12-302(c)(4), now appeals the court’s decision to suppress that evidence.
The specific questions before us, as framed by the State, are:
1) Did the motions court err in finding that the use of a cellular tracking
device to locate Andrews’s phone violated the Fourth Amendment?
2) Did the motions court err in finding that Andrews did not have to show
standing before challenging the search of the home where he was
arrested?
3) Did the motions court err in finding that the search warrant for the home
where Andrews was located was invalid?
4) Did the motions court err in excluding the items recovered in this case?
We conclude that people have a reasonable expectation that their cell phones will
not be used as real-time tracking devices by law enforcement, and—recognizing that the
Fourth Amendment protects people and not simply areas—that people have an objectively
reasonable expectation of privacy in real-time cell phone location information. Thus, we
hold that the use of a cell site simulator requires a valid search warrant, or an order
satisfying the constitutional requisites of a warrant, unless an established exception to the
warrant requirement applies.
We hold that BPD’s use of Hailstorm was not supported by a warrant or an order
requiring a showing of probable cause and reasonable limitations on the scope and manner
of the search. Once the constitutionally tainted information, obtained through the use of
Hailstorm, was excised from the subsequently issued search warrant for 5032 Clifton
Avenue, what remained was insufficient to establish probable cause for a search of that
residence. Because the antecedent Fourth Amendment violation by police provided the
only information relied upon to establish probable cause in their warrant application, those
2
same officers cannot find shelter in the good faith exception, and the evidence seized in
that search withers as fruit of the poisoned tree. We affirm.
BACKGROUND
Andrews was positively identified via photographic array as the person who shot
three people on April 27, 2014, as they were attempting to purchase drugs on the 4900
block of Stafford Street in Baltimore City.1 He was charged with attempted first-degree
murder and attendant offenses in connection with the shooting, and a warrant for his arrest
was issued on May 2, 2014.
Pen Register and Trap & Trace Order
Unable to locate Andrews, Detective Michael Spinnato of the BPD confirmed
Andrews’s cell phone number through a confidential informant, and then submitted an
application in the Circuit Court for Baltimore City for a pen register/trap & trace order for
Andrews’s cell phone.2 Specifically, Det. Spinnato requested authorization for the
1
The State later admitted that there were also two negative photo arrays.
2
As discussed further infra, pursuant to the Maryland Pen Register, Trap and Trace
Statute, found at CJP § 10-4B-01 et seq. (“Maryland pen register statute”), a court having
jurisdiction over the crime being investigated may authorize the use of a “pen register”
and/or a “trap and trace device,” defined as:
‘Pen register’ means a device or process that records and decodes dialing,
routing, addressing, or signaling information transmitted by an instrument or
facility from which a wire or electronic communication is transmitted.
CJP § 10-4B-01(c)(1). The statute continues, stating:
‘Trap and trace device’ means a device or process that captures the incoming
electronic or other impulses that identify the originating number or other
3
“installation and use of device known as a “Pen Register\Trap & Trace and Cellular
Tracking Device to include cell site information, call detail, without geographical limits,
which registers telephone numbers dialed or pulsed from or to the telephone(s) having the
number(s) . . . .” The application stated that Andrews was aware of the arrest warrant, and
that to hide from police
suspects will contact family, girlfriends, and other acquaintances to assist in
their day to day covert affairs. Detective Spinnato would like to
track/monitor Mr. Andrews’[s] cell phone activity to further the investigation
an [sic] assist in Mr. Andrews’[s] apprehension.
***
Your Applicant hereby certifies that the information likely to be obtained
concerning the aforesaid individual’s location will be obtained by learning
the numbers, locations and subscribers of the telephone number(s) being
dialed or pulsed from or to the aforesaid telephone and that such information
is relevant to the ongoing criminal investigation being conducted by the
Agency.
On May 5, 2014, Det. Spinnato’s application was approved in a signed order stating,
in part:
[T]he Court finds that probable cause exists and that the applicant has
certified that the information likely to be obtained by the use of the
above listed device(s) is relevant to an ongoing criminal investigation, To
wit: Attempted Murder.
***
(Emphasis in original). And, as requested in the application, the court,
dialing, routing, addressing, and signaling information reasonably likely to
identify the source of a wire or electronic communication.
CJP § 10-4B-01(d)(1). Under Maryland law, an order for a pen register/trap & trace is
issued without a warrant and on something less than probable cause.
4
ORDERED, pursuant to Section 10-4B-04 of the Courts and Judicial
Proceedings Article . . . [Applicants] are authorized to use for a period of
sixty (60) days from the date of installation, a Pen Register \ Trap & Trace
and Cellular Tracking Device to include cell site information, call detail,
without geographical limits . . .
***
ORDERED, . . . [t]he Agencies are authorized to employ surreptitious or
duplication of facilities, technical devices or equipment to accomplish the
installation and use of a Pen Register \ Trap & Trace and Cellular Tracking
Device, unobtrusively and with a minimum of interference to the service of
subscriber(s) of the aforesaid telephone, and shall initiate a signal to
determine the location of the subject’s mobile device . . . .
(Emphasis added).
Cell Phone in a Hailstorm
As soon as Det. Spinnato obtained the pen register\trap & trace order on May 5, he
sent a copy to the BPD’s Advanced Technical Team (the “ATT”). The ATT then issued a
form request to the service provider (Sprint) for the following: subscriber information;
historical cell site location information (“CSLI”) for the period from April 5 to May 5,
2014; pen register data for 60 days; and precision GPS data from Andrews’s phone. 3 An
additional request followed for “GPS Precise Locations and email.”
3
Two broad categories of CSLI may be sought from the service provider. The first
is historical CSLI, which is used to look back through service provider records to determine
a suspect’s location at a given point in the past. See, e.g., United States v. Graham, 796
F.3d 332, 343 (4th Cir. 2015) (“Historical CSLI identifies cell sites, or ‘base stations,’ to
and from which a cell phone has sent or received radio signals, and the particular points in
time at which these transmissions occurred, over a given timeframe. . . . The cell sites
listed can be used to interpolate the path the cell phone, and the person carrying the phone,
travelled during a given time period.”), reh’g en banc granted, 624 F. App’x 75 (4th Cir.
2015). Law enforcement frequently uses historical CSLI to prove that a defendant was in
the area where a crime of which he is accused occurred. The second category of CSLI is
real-time data, used to track the whereabouts and movements of a suspect by using the cell
5
Later on the same day—May 5—Det. Spinnato began receiving emails from ATT
with GPS coordinates for Andrews’s cell phone (within a range of a 200 to 1600 meter
radius). Det. Spinnato and officers from the Warrant Apprehension Task Force (“WATF”)
proceeded to the general area and waited until they received information from ATT that
the cell phone was in the area of 5000 Clifton Avenue, Baltimore City. They proceeded to
an area where there were approximately 30 to 35 apartments around a U-shaped sidewalk.
Detective John Haley from ATT arrived and, using a cell site simulator known by the brand
name “Hailstorm,” was able to pinpoint the location of the cell phone as being inside the
residence at 5032 Clifton Avenue.4
Det. Spinnato knocked on the door and, after obtaining the consent of the woman
who answered, entered the residence along with several other officers. They found
Andrews seated on the couch in the living room with the cell phone in his pants pocket.
phone as a tracking device. See, e.g., Tracey v. State, 152 So. 3d 504, 507 (Fla. 2014),
reh’g denied (Dec. 8, 2014). Here, the BPD obtained real-time location information from
the service provider when it received the GPS coordinates associated with the cell phone
from Sprint. Andrews’s motion to suppress, however, was focused primarily on the BPD’s
ensuing use of a cell site simulator to directly obtain pin-point location data. Therefore, on
appeal we do not address whether the real-time location information from Sprint should
have been obtained under a warrant or special order.
4
True to its brand name, the Hailstorm device generates an electronic barrage that
impacts all the mobile devices within its range. As noted in the amicus brief filed by the
American Civil Liberties Union (“ACLU”) and Electronic Frontier Foundation (“EFF”)
at page 3, the fact that cell site simulators actively locate phones by forcing them to
repeatedly transmit their unique identifying electronic serial numbers, and then calculating
the signal strength until the target phone is pinpointed, is found in several recent federal
publications and cases, including a Department of Justice Policy Guidance: Use of Cell-
Site Simulator Technology 2 (Sept. 3, 2015), available at
https://www.justice.gov/opa/file/767321/download [https://perma.cc/K99L-H643].
6
Det. Spinnato arrested Andrews and secured the location until a search warrant could be
obtained. Once they had the warrant, the BPD searched the home and found a gun in the
couch cushions.
Initial Hearings
Andrews was indicted by a grand jury on May 29, 2014, on numerous charges
related to the April 27, 2014 shooting. On July 1, 2014, the Assistant Public Defender
representing Andrews filed an “omnibus” motion including requests for discovery and the
production of documents. The State responded with an initial disclosure and supplemental
disclosure on July 9 and 11, respectively. Those disclosures, however, failed to reveal the
method used to locate Andrews on the date of his arrest.
On November 3, 2014, defense counsel filed a supplemental discovery request
seeking, inter alia, “[a]ll evidence indicating how Andrews was located at 5032 Clifton
Avenue.” The State’s response to that request, dated January 8, 2015, stated, “[a]t this time
the State does not possess information related to the method used to locate [Andrews] at
5032 Clifton Avenue.” However, five months later defense counsel received an email from
the Assistant State’s Attorney (“ASA”) assigned to the case indicating that it was her
understanding that “the ATT used a stingray to locate[] your client via his cell phone,” but
she was waiting for “the paperwork.” The next day, May 7, the ASA also notified defense
counsel of exculpatory evidence in the form of a negative photo array that was conducted
the previous January.
On May 12, 2015, defense counsel requested that the court dismiss the case based
on discovery violations and moved for suppression of evidence, including the gun, phone
7
records, and identification testimony. A few days later, on May 15, the State filed a
supplemental disclosure, which provided:
WATF did not have the Clifton Ave address as a possible location until ATT
provided that information. Det. Spinnato recalls that he was in touch with
Det. Haley from ATT. ATT was provided that information from Sprint in
the form of GPS coordinates, Det. Spinnato received the same information
either from Sprint directly, or forwarded from ATT. Det. Spinnato provided
ATT with the phone number associated to Defendant from the shooting
investigation and, [redacted in original]-Det. Spinnato recalls that ATT gave
Det. Spinnato the Clifton Ave address in the afternoon/early evening on May
5, 2014. . . .
The State’s supplemental disclosure also identified a second negative photo array
conducted on May 4, 2014.
Andrews’s initial motions were heard in the circuit court on May 12, 21, and June
4, 2015. At the conclusion of the hearing on June 4, the circuit court found that one of the
lead investigators intentionally withheld exculpatory evidence—including both negative
photo arrays. As a result, the circuit court partially granted the pending defense motion for
sanctions and excluded that detective’s testimony from trial. The court declined to dismiss
the case and denied the motion to exclude the gun and cell phone on the basis of the State’s
withholding of discoverable materials. However, as a consequence of the State’s failure to
timely disclose information concerning Hailstorm surveillance technology that was used
by the BPD, the Court granted the defense additional time to file a motion to suppress.
Motion to Suppress
Andrews filed a Motion to Suppress—over 50 pages including exhibits—on June
30, 2015, in which he challenged the BPD’s surreptitious use of the Hailstorm cell site
simulator to search Andrews’s phone, without a warrant, under the Fourth Amendment to
8
the United States Constitution. Andrews moved to suppress all evidence obtained from
5032 Clifton Avenue.
During the ensuing hearing on the motion to suppress, held August 20, 2015, the
State suggested, and the defense agreed, that the circuit court rely on the transcripts and
exhibits from the earlier motions hearings for an understanding of the function of the
Hailstorm device and its use by the BPD:
[STATE’S ATTORNEY]: . . . The exact testimony that we’re going to hear
about with regard to the Fourth Amendment issue Counsel heard as it related
to the discovery issue because the discovery issue bled into the Fourth
Amendment issue. So there is nothing new. There is nothing -- Counsel’s
aware that the equipment is called Hailstorm not Stingray because of the
testimony that Counsel heard and extracted from the detective as it relates to
this very case. So there simply is, there is nothing new. We’re at the exact
same issue that we were two months ago.
THE COURT: So do we even need, do you need to call the witness or can I
just rely on the transcript?
[STATE’S ATTORNEY]: It would seem to me to rely on the transcript.
***
THE COURT: . . . So the State is indicating that the testimony that the State
would present today is the same testimony that was presented --
[DEFENSE COUNSEL]: Right.
THE COURT: -- there.
[DEFENSE COUNSEL]: Right.
THE COURT: And that’s in the transcript, and the Court can just rely on the
transcript to rule on your motion.
[DEFENSE COUNSEL]: Right.
THE COURT: You’re fine with that?
9
[DEFENSE COUNSEL]: Yep.
The court took a recess for several hours to review the motions and transcripts. The
following excerpts from the June 4th hearing, entered as Defendant’s Exhibit 1C, pertain to
the function of the cell site simulator:
[DETECTIVE HALEY]: What happened in this case was, Detective
Sp[innato] from our WATF, which is the Warrant Apprehension Unit,
apparently interviewed somebody -- got a phone number. He then responds
down here to the Circuit Court . . . and gets a Court Order signed.
He then sends the Court order down to our office, depending on what
the carrier is, Verizon, Sprint, T-Mobile, AT&T. We then send it to them. I
ask for subscriber information, call-detail records.
They provide us with GPS locations, in this case. And once we get all
the information, then we have equipment that we can go out and locate cell
phones.
[DEFENSE COUNSEL]: Okay. When you say, we have equipment that we
can locate cell phones, you’re talking about the Stingray equipment, is that
what was used in this case?
[DETECTIVE HALEY]: Yeah, it’s called the Hailstorm. It used to be --
Stingray is kind of first generation.
***
[DEFENSE COUNSEL]: Tell me what the Hailstorm does.
[DETECTIVE HALEY]: What we get from the phone company is the
subscriber information. So, when we get the subscriber information, it has a
[sic] identifier on there, if you will, a serial number. We put that into the
Hailstorm equipment. And the Hailstorm equipment acts like a cell tower.
So, we go into a certain area, and basically, the equipment is looking for that
particular identifier, that serial number.
[DEFENSE COUNSEL]: Okay. And so, if a person is inside of a home, that
equipment peers over the wall of the home, to see if that cell phone is behind
the wall of that house, right?
10
[DETECTIVE HALEY]: Yes.
[DEFENSE COUNSEL]: And it sends an electronic transmission through the
wall of that house, correct?
[DETECTIVE HALEY]: Yes.
[DEFENSE COUNSEL]: Did you get a separate search warrant for that
search into the home?
[DETECTIVE HALEY]: You’d have to talk to Detective Spinnato about
that. Because he’s the one that got the Court Order signed.
[DEFENSE COUNSEL]: Did you do the search? You conducted the
equipment in this -- you operated –
[DETECTIVE HALEY]: Yes.
[DEFENSE COUNSEL]: -- the equipment?
[DETECTIVE HALEY]: Yes.
***
[DEFENSE COUNSEL]: Tell me all of the information the Hailstorm can
retrieve from a phone.
[DETECTIVE HALEY]: It’s going to retrieve, like I said before, the serial
number of the phone, depending on what kind of phone it is. It’s going to --
there’s [sic] different identifiers. Like for Sprint, in this case, it’s called the
MSID. And that’s like a ten-digit -- like a ten-digit number. So, it’s retrieving
that. And there’s also the electronic serial number. It’s retrieving that. And
that’s really it.
[DEFENSE COUNSEL]: Can you capture the telephone calls as they’re
being made?
[DETECTIVE HALEY]: No.
[DEFENSE COUNSEL]: And how do you know where the phone -- and it
doesn’t capture any data on the phone?
[DETECTIVE HALEY]: No.
11
[DEFENSE COUNSEL]: Are you sure?
[DETECTIVE HALEY]: Yes.
[DEFENSE COUNSEL]: So, how do you get information about where the
phone is on the machine?
[DETECTIVE HALEY]: Because when it captures that identifier that you
put into the machine or the equipment, it then tells you -- it looks like a clock
on the equipment. And it tells you where the signal’s coming from, like 12,
1, 2, 3 o’clock (indicating). And it will give you like a reading. Like if it says
1:00 at like an 80, well, then you know that you’re kind of close to it. But if
it says 1:00 at like a 40, then you know that you’re probably within, I don’t
know, probably, you know, 20 yards of it.
[DEFENSE COUNSEL]: The person doesn’t have to be using their phone
for you to get that information, do they?
[DETECTIVE HALEY]: Actually, if they’re on their phone, then they’re
already connected to -- in this case, the Sprint network. And we’re not going
to be able to pull them off of that until they’re -- until they hang -- until they
hang the call up.
[DEFENSE COUNSEL]: So, they hang the call up. And the phone can be in
their pocket, right?
[DETECTIVE HALEY]: Correct.
[DEFENSE COUNSEL]: And then you’re reaching in to grab an electronic
signal about where that phone is? It’s not pinging, in other words, right?
***
MR. HALEY: Like I said, our equipment acts like a cell tower. So, it draws
the phone to our equipment.
[DEFENSE COUNSEL]: But you just said, if the person’s on the phone, your
equipment won’t work, right?
[DETECTIVE HALEY]: Correct.
12
[DEFENSE COUNSEL]: So, it doesn’t act like a cell tower, because you can
find the phone only when they are not on the phone, correct?
[DETECTIVE HALEY]: Well, I would say it does act like a cell tower,
because the only time that you’re going to connect -- the only time that you’re
going to connect to the network, or to a tower is when you go to try to use it.
[DEFENSE COUNSEL]: But you’re connecting to where the phone is, when
they’re not on the phone, didn’t you just say that
[DETECTIVE HALEY]: Maybe I’m getting confused, or I’m not
understanding what you’re asking me.
[DEFENSE COUNSEL]: My question to you was, for example, I have my
phone in my pocket. And I’m sitting in my house, right?
[DETECTIVE HALEY]: Okay.
[DEFENSE COUNSEL]: And you want to know where I am, correct?
[DETECTIVE HALEY]: Okay.
***
[DEFENSE COUNSEL]: When I am not on my phone, you will drive by my
house, and you will get a signal from my phone indicating where I am, right?
[DETECTIVE HALEY]: Correct.
[DEFENSE COUNSEL]: If I am using the phone, you won’t get that signal,
right?
[DETECTIVE HALEY]: Correct.
[DEFENSE COUNSEL]: So, the phone cannot be in use. You are searching
for my phone as you’re driving through my neighborhood, right?
[DETECTIVE HALEY]: Yes.
[DEFENSE COUNSEL]: And in order to get to my phone, you are sending
an electronic signal into my house, right?
[DETECTIVE HALEY]: Yes.
13
When the hearing resumed, the court made several preliminary findings, and invited
counsel to respond. In regard to the pen register/trap & trace order, the court observed:
I don’t find that Judge Williams’ order is invalid as a pen register or trap and
trace, but I do find that the order does not authorize the use of Hailstorm and
I . . . invite the State to tell me otherwise.
***
So this is very different from an order authorizing, for example, GPS or cell
site information, because that is information that’s generated by the phone.
And my understanding of this equipment is essentially that it’s forcing the
phone to emit information, or its taking information from the phone that the
phone is not sort of on its own generating at the time which is very different.
On the issue of whether Andrews’s arrest was lawful, the parties acknowledged that
a valid warrant was outstanding for his arrest. However, the court questioned whether, as
argued by defense counsel, Andrews’s presence at 5032 Clifton Avenue “or the warrant
they got as a result of him being there is fruit of the poisonous tree because there was a
violation of his Fourth Amendment rights by [Det. Haley] using the Hailstorm on this
phone to locate him at that residence in the first place.” Looking then to the application
for the warrant to search 5032 Clifton Avenue, the court noted that there was no
independent corroboration for the warrant because, “all it says he was located at this
address and so we want to search this address. I mean that’s really all it says.”
After hearing argument, the circuit court found that “the use of the Hailstorm
violates the Defendant’s Fourth Amendment rights,” and “any information generated from
the use of the Hailstorm [must] be suppressed.” The court continued on the record:
And so just so that I’m clear, it means that the jury cannot hear any
testimony or evidence about information obtained from the Hailstorm,
obtained through the Hailstorm device. And just so that I’m clear, it’s my
14
understanding that the Hailstorm device is what told the police that the
Defendant was at that location.
And so that includes any testimony or evidence then that the
Defendant was at that location, if that’s what -- because that’s what the
Hailstorm told the police. And so the jury would be prohibited from hearing
evidence or testimony of that. It does not invalidate the arrest or the search
[incident to] the arrest with the phone that’s in his pocket.[5]
Now anything that came off the phone, again if it came through the
Hailstorm device it is suppressed. There can be no evidence or testimony
about it. And then again, any police knowledge that the Defendant was at that
location again also suppressed, so the jury would not be able to hear any
evidence or testimony of that.
So then that leaves us with the fruit of the poisonous tree argument for
the search and seizure warrant. I reviewed the warrant and it literally says the
Defendant was in there so now we need a warrant. And information
generated from the use of the Hailstorm be suppressed, that’s all that it is.
And so I analyze this different, a little bit different from a normal sort of
motion to suppress a search and seizure warrant or even Franks in terms of
standing.
I don’t -- I understand the State’s argument in terms of standing and
this not being his residence, and the Defense’s argument that he was at a
minimum an overnight guest and has some reasonable expectation of
privacy. I don’t think I need to reach those issues because the warrant is really
just fruit of the poisonous tree of the illegally obtained information about the
Defendant’s location. That’s what it is.
And so I am granting the suppression of that for that very reason. And
so that the record is clear – and I know that the State is asking to take an
appeal, the record is clear. The ruling of the Court is that the government
violated the Defendant’s Fourth Amendment rights by essentially using the
Hailstorm to locate him at that residence.
The State noticed its appeal on September 3, 2015.
5
Mr. Andrews did not challenge the legality of his arrest or search incident to arrest,
either in the circuit court or before this Court. He did, however, seek to suppress the cell
phone, but that motion was denied and Mr. Andrews did not file a cross-appeal to contest
that ruling.
15
DISCUSSION
Motion to Dismiss
Before turning to the merits, we must address Andrews’s motion to dismiss this
appeal on the ground that the notice of appeal was defective, and therefore, not filed within
the time prescribed by Rule 8-202.
The State filed its notice of appeal on September 3, 2015; however, the signed
certificate of service—indicating that a copy of the notice was “mailed first-class, postage
prepaid” on that same day—failed to list the party that was served. Andrews acknowledges
that a copy of the notice was delivered to the Office of the Public Defender on September
4, 2015. Nevertheless, Andrews argues that the State’s notice did not comply with the
certificate of service requirements of Maryland Rule 1-323, and that the clerk should not
have accepted the filing. Consequently, according to Andrews, no valid notice of appeal
was filed in this case. The State concedes that the failure to name the party to be served
was a defect in the certificate of service, but maintains the clerk was required to accept the
filing because the certificate complied with the literal requirements of Rule 1-323. The
State urges that it would be improper to dismiss the appeal because there is no dispute that
the opposing party was served in a timely fashion.
Maryland Rule 1-323 directs that the court clerk may not accept for filing a pleading
or other paper requiring service, unless it is accompanied by “an admission or waiver of
service or a signed certificate showing the date and manner of making service.” In Director
of Finance of Baltimore City v. Harris, this Court addressed whether a certificate of service
that failed to identify all the persons upon whom service was required should have been
16
rejected for filing by the court clerk. 90 Md. App. 506, 513-14 (1992). Looking to the
1984 revision of the Maryland Rules that produced the current Rule 1-323, this Court
observed:
Under the old Rule, the clerk may have had some obligation to determine
whether the certificate actually showed service on the “opposite party.” But,
as noted, that obligation, if it ever did exist, has been eliminated. . . . The
obligation of the clerk under the current Rule is simply to assure that there
is, in fact, an admission, a waiver, or a certificate showing the date and
manner of service. If such a certificate is attached to the paper, the clerk
must file the paper, leaving it then to the parties or the court to deal with any
deficiency.[6]
More recently, in Lovero v. Da Silva, this Court clarified that, by mandating that
proof of service (or a waiver of service) appear on each pleading or paper, “Rule 1-323
assures the court . . . that each party has been duly notified before action is taken by the
court in response to or as a result of the subject pleading or paper.” 200 Md. App. 433,
6
This Court further illuminated the evolution of Rule 1-323 stating:
Rule 1-323 is derived ultimately from Rule 1(a)(2), Part Two, V, of
the General Rules of Practice and Procedure, adopted by the Court of
Appeals and approved by the General Assembly pursuant to 1939 Md. Laws,
ch. 719, § 35A. Rule 1(a)(2) provided, in relevant part, that a paper “shall not
be received and filed by the clerk of the court unless accompanied by an
admission or proof of service of a copy thereof upon the opposite party or
his attorney of record in accordance with this rule.” (Emphasis added.) Other
parts of the Rule prescribed how service was to be made. That Rule was
carried over into the Maryland Rules of Procedure as Rule 306 a.2., which
stated that “[t]he clerk shall not accept or file any paper requiring service
other than an original pleading unless it is accompanied by an admission or
proof of service of a copy thereof upon the opposite party, or his attorney of
record.” (Emphasis added.)
Until the 1984 revision of the Maryland Rules, the Rule remained in
that form.
Harris, 90 Md. App. at 511-12.
17
446 (2011). We determined that Lovero’s notice of appeal should have been rejected by
the clerk, explaining that
[w]here, as in the instant case, the notice of appeal contains no proof of
service whatsoever, we have no basis upon which to conclude that the notice
of appeal was served on the opposing party or parties. Indeed, it is
undisputed here that the Notice of Appeal was never served on Da Silva.
Id. at 449.
In the present case, there is no dispute that the notice was served on defense counsel.
Indeed, the State made it clear at the August 20 hearing that it would be filing an appeal as
reflected in the court’s ruling; “and so that the record is clear – and I know that the State is
asking to take an appeal, the record is clear.” It is also clear now that, although the
omission in the certificate of service is a defect, the certificate met the literal requirements
of Rule 1-323—it provided the date and manner of service. Where there is no evidence
that Andrews was prejudiced or that the course of the appeal was delayed by a defect, “it
is the practice of this Court to decide appeals on the merits rather than on technicalities.”
Bond v. Slavin, 157 Md. App. 340, 352-53 (2004). Cf. Williams v. Hofmann Balancing
Techniques, Ltd., 139 Md. App. 339, 356-57 (2001) (holding that the appellant’s failure to
identify one of the appellees on his notice of appeal did not deprive this Court of
jurisdiction). To be sure, the Court of Appeals has observed that “[o]ur cases, and those of
the Court of Special Appeals, have generally been quite liberal in construing timely orders
for appeal.” Newman v. Reilly, 314 Md. 364, 386 (1988); see also Lovero, 200 Md. App.
at 450-51 n.8 (and the cases cited therein) (recognizing that where a challenged notice of
18
appeal was timely filed the courts of Maryland construe the notice in favor of deciding the
appeal on the merits). We deny Andrews’s motion to dismiss the appeal.
Standard of Review
We review the grant of a motion to suppress based on the record of the suppression
hearing, and we view the facts in the light most favorable to the prevailing party. State v.
Donaldson, 221 Md. App. 134, 138 (citing Holt v. State, 435 Md. 443, 457, 78 A.3d 415
(2013)), cert. denied, 442 Md. 745 (2015). Further, “we extend ‘great deference’ to the
factual findings and credibility determinations of the circuit court, and review those
findings only for clear error.” Id. (citing Brown v. State, 397 Md. 89, 98 (2007)). But we
make an independent, de novo, appraisal of whether a constitutional right has been violated
by applying the law to facts presented in a particular case. Williams v. State, 372 Md. 386,
401 (2002) (citations omitted); see also Brown, 397 Md. at 98 (“[W]e review the court’s
legal conclusions de novo and exercise our independent judgment as to whether an officer’s
encounter with a criminal defendant was lawful.” (Citation omitted)).
I.
Fourth Amendment Search
In 1966, in the wake of prominent Congressional hearings on government invasions
of privacy, Justice Douglas, dissenting in Osborn v. United States and Lewis v. United
States, and concurring in Hoffa v. United States, observed:
We are rapidly entering the age of no privacy, where everyone is open
to surveillance at all times; where there are no secrets from government. The
aggressive breaches of privacy by the Government increase by geometric
proportions. Wiretapping and ‘bugging’ run rampant, without effective
judicial or legislative control.
19
***
Taken individually, each step may be of little consequence. But when viewed
as a whole, there begins to emerge a society quite unlike any we have seen—
a society in which government may intrude into the secret regions of man’s
life at will.
Osborn v. United States, 385 U.S. 323, 340-43 (1966) (Douglas, J., dissenting).7 Fifty
years later we face the same concern—to what extent have advances in technology created
an “age of no privacy.”8
The Fourth Amendment to the United States Constitution, made applicable to the
States by the Fourteenth Amendment, Mapp v. Ohio, 367 U.S. 643, 655 (1961), provides:
The right of the people to be secure in their persons, houses, papers, and
effects, against unreasonable searches and seizures, shall not be violated, and
no Warrants shall issue, but upon probable cause, supported by Oath or
affirmation, and particularly describing the place to be searched, and the
persons or things to be seized.
U.S. Const. amend. IV. The first clause protects individuals against unreasonable searches
and seizures,9 see Katz v. United States, 389 U.S. 347, 359 (1967) (“Wherever a man may
7
The question presented in Osborn, as cast by Justice Douglas, was
“whether the Government may compound the invasion of privacy by using hidden
recording devices to record incriminating statements made by the unwary suspect to a
secret federal agent.” Osborn, 385 U.S. at 340.
8
See also City of Ontario, Cal. v. Quon, 560 U.S. 746, 760 (2010) (“Cell phone and
text message communications are so pervasive that some persons may consider them to be
essential means or necessary instruments for self-expression, even self-identification.”).
9
Although the parties do not present their arguments under the Maryland
Constitution, Declaration of Rights, we note that Article 26—governing warrants for search
and seizure—is generally construed to be co-extensive with the Fourth Amendment. See
Upshur v. State, 208 Md. App. 383, 397 (2012) (citing Hamel v. State, 179 Md. App. 1, 18
(2008)). Article 26 of the Maryland Declaration of Rights provides:
20
be, he is entitled to know that he will remain free from unreasonable searches and
seizures[]”), and the second clause requires that warrants must be particular and supported
by probable cause, see Payton v. New York, 445 U.S. 573, 584 (1980).
A “search” within the meaning of the Fourth Amendment occurs where the
government invades a matter in which a person has an expectation of privacy that society
is willing to recognize as reasonable. Kyllo v. United States, 533 U.S. 27, 33 (2001) (citing
Katz, 389 U.S. at 361 (Harlan, J., concurring)). As we made clear in Raynor v. State, “[t]he
burden of demonstrating a ‘legitimate’ or ‘reasonable’ expectation of privacy includes both
a subjective and an objective component.” 201 Md. App. 209, 218 (2011), aff’d, 440 Md.
71 (2014) (citation and footnote omitted). “[I]n order to claim the protection of the Fourth
Amendment, a defendant must demonstrate that he personally has an expectation of privacy
in the place searched, and that his expectation is reasonable; i.e., one that has ‘a source
outside of the Fourth Amendment, either by reference to concepts of real or personal
property law or to understandings that are recognized and permitted by society.’”
Minnesota v. Carter, 525 U.S. 83, 88 (1998) (quoting Rakas v. Illinois, 439 U.S. 128, 143-
44 n.12 (1978)).
That all warrants, without oath or affirmation, to search suspected places, or
to seize any person or property, are grievous and oppressive; and all general
warrants to search suspected places, or to apprehend suspected persons,
without naming or describing the place, or the person in special, are illegal,
and ought not to be granted.
21
The Fourth Amendment protects not against all intrusions as such, “but against
intrusions which are not justified in the circumstances, or which are made in an
improper manner.” Maryland v. King, 133 S. Ct. 1958, 1969 (2013) (emphasis added)
(quoting Schmerber v. California, 384 U.S. 757, 768 (1966)). “Although the underlying
command of the Fourth Amendment is always that searches and seizures be reasonable,
what is reasonable depends on the context within which a search takes place.” State v.
Alexander, 124 Md. App. 258, 265 (1998) (emphasis added in Alexander) (quoting New
Jersey v. T.L.O., 469 U.S. 325, 337 (1985)). Subject to a few well-delineated exceptions,
“warrantless searches ‘are per se unreasonable under the Fourth Amendment.’” Quon, 560
U.S. at 760 (2010) (quoting Katz, 389 U.S. at 357); see also United States v. Karo, 468
U.S. 705, 717 (1984) (citations omitted).
a. Effects of the Nondisclosure Agreement
Before we examine the reasonableness of the State’s intrusion in context, we address
the nondisclosure agreement entered into between the State’s Attorney for Baltimore City
and the Federal Bureau of Investigation in early August 2011 as a condition of BPD’s
purchase of certain “wireless collection equipment/technology manufactured by Harris
[Corporation].” The nondisclosure agreement provided, in part:
[T]o ensure that [] wireless collection equipment/technology continues to be
available for use by the law enforcement community, the
equipment/technology and any information related to its functions,
operation, and use shall be protected from potential compromise by
precluding disclosure of this information to the public in any manner
including b[ut] not limited to: in press release, in court documents,
during judicial hearings, or during other public forums or proceedings.
Accordingly, the Baltimore City Police Department agrees to the following
22
conditions in connection with its purchase and use of the Harris Corporation
equipment/technology:
***
5. The Baltimore City Police Department and Office of the State’s Attorney
for Baltimore City shall not, in any civil or criminal proceeding, use or
provide any information concerning the Harris Corporation wireless
collection equipment/technology, its associated software, operating
manuals, and any related documentation (including its
technical/engineering description(s) and capabilities) beyond the
evidentiary results obtained through the use the equipment/technology
including, but not limited to, during pre-trial matters, in search
warrants and related affidavits, in discovery, in response to court
ordered disclosure, in other affidavits, in grand jury hearings, in the
State’s case-in-chief, rebuttal, or on appeal, or in testimony in any phase
of civil or criminal trial, without the prior written approval of the FBI.
...
(Emphasis added). The agreement directs that in the event of a Freedom of Information
Act request, or a court order directing disclosure of information regarding Harris
Corporation equipment or technology, the FBI must be notified immediately to allow them
time to intervene “and potential[ly] compromise.” If necessary “the Office of the State’s
Attorney for Baltimore will, at the request of the FBI, seek dismissal of the case in lieu of
using or providing, or allowing others to provide, any information concerning the Harris
Corporation wireless collection equipment/technology[.]”
We observe that such an extensive prohibition on disclosure of information to the
court—from special order and/or warrant application through appellate review—prevents
the court from exercising its fundamental duties under the Constitution. To undertake the
Fourth Amendment analysis and ascertain “the reasonableness in all the circumstances of
the particular governmental invasion of a citizen’s personal security,” Terry v. Ohio, 392
23
U.S. 1, 19 (1968), it is self-evident that the court must understand why and how the search
is to be conducted. The reasonableness of a search or seizure depends “‘on a balance
between the public interest and the individual’s right to personal security free from
arbitrary interference by law officers.’” Pennsylvania v. Mimms, 434 U.S. 106, 109 (1977)
(emphasis added) (quoting United States v. Brignoni-Ponce, 422 U.S. 873, 878 (1975)).
The analytical framework requires analysis of the functionality of the surveillance device
and the range of information potentially revealed by its use. A nondisclosure agreement
that prevents law enforcement from providing details sufficient to assure the court that a
novel method of conducting a search is a reasonable intrusion made in a proper manner
and “justified by the circumstances,” obstructs the court’s ability to make the necessary
constitutional appraisal. Cf. King, 133 S. Ct. at 1970 (“Even if a warrant is not required, a
search is not beyond Fourth Amendment scrutiny; for it must be reasonable in its scope
and manner of execution. Urgent government interests are not a license for indiscriminate
police behavior.”). In West v. State, this Court stated that “to assure that the purpose of the
Fourth Amendment is upheld, police officers must provide details within affidavits when
attempting to acquire search warrants, even if such information would seem to the police
officer of trivial consequence at the time.” 137 Md. App. 314, 331 (2001).
As discussed further in Section III infra, it appears that as a consequence of the
nondisclosure agreement, rather than apply for a warrant, prosecutors and police obtained
an order under the Maryland pen register statute that failed to provide the necessary
information upon which the court could make the constitutional assessments mandated in
this case. The BPD certified to the court that pursuant to the order “the information likely
24
to be obtained concerning the aforesaid individual’s location will be obtained by learning
the numbers, locations and subscribers of the telephone number(s) being dialed or pulsed
from or to the aforesaid telephone . . . .” However, the suppression court, having the
benefit of Det. Haley’s testimony (reproduced above), learned that the BPD actually
employed the Hailstorm device, which is capable of obtaining active real-time location
information—far different from a pen register (a device or process that records and decodes
dialing, routing, addressing, or signaling information transmitted by an instrument) or track
and trace device (a device or process that captures the incoming electronic or other
impulses that identify the originating number). See fn.2 supra.10
We perceive the State’s actions in this case to protect the Hailstorm technology,
driven by a nondisclosure agreement to which it bound itself, as detrimental to its position
and inimical to the constitutional principles we revere.
b. What Constitutes a “Search”—Level of Intrusion
and Expectation of Privacy
The State argues that the use of a cell site simulator does not constitute a “search”
under the Fourth Amendment. The State maintains that the circuit court’s decision “was
based upon both factually unreasonable conclusions about how the cell site simulator
worked in this case, and legally incorrect determinations about what constitutes a ‘search.’”
The State acknowledges that the factual bases for the circuit court’s rulings are found in
the June 4, 2015 testimony of Det. Haley. However, the State argues that Det. Haley’s
10
It is not clear from the record whether Det. Haley’s testimony was authorized
through written approval from the FBI as required in paragraph 5 of the nondisclosure
agreement.
25
testimony “was necessarily rather summary,” and does not support the factual conclusions
of the circuit court.
According to the State, the cell site simulator “acts like a cell tower, and waits to
receive a signal bearing the target IMSI” [International Mobil Subscriber Identity]. The
State maintains that, properly construed, Det. Haley’s testimony reveals that “the process
of a cell phone sending its identifying information to a cell tower was indistinguishable
from the process of a cell phone sending its identifying information to a cell site simulator.”
The State asserts that the Hailstorm device “merely reads the ID number regularly
transmitted by activated cell phones as part of their ordinary use” and “[w]hen the device
detects a signal from the target phone, it notifies the operator the direction of the signal and
the relative strength, allowing the operator to estimate the probable location of the phone.”
Therefore, the State argues that no reasonable expectation of privacy existed in the
information obtained by the Hailstorm device and no intrusion or “search” occurred.
Andrews countercharges that there was ample, explicit support in the record for the
circuit court’s finding that the Hailstorm device operated by emitting a signal “through the
wall of a house” and “into the phone” triggering the phone to respond to the device.
Andrews argues that, through the use of an “active cellular surveillance device,” the State
violated his reasonable expectation of privacy in the personal information contained and
generated by his cell phone, without which the government would not have been able to
discover his location inside the home.
Presumably because of the nondisclosure agreement discussed above, the State
provided limited information regarding the function and use of the Hailstorm device. And
26
presumably, the State would have limited itself in this manner regardless of whether it
relied on testimony from the prior hearing or produced live testimony before the
suppression court.11 Notwithstanding this, it is clear from Det. Haley’s testimony that “the
Hailstorm equipment acts like a cell tower,” but, unlike a cell tower awaiting incoming
signals, the Hailstorm is an active device that can send an electronic signal through the wall
of a house and “draw[] the phone to [the] equipment.” Based on the direction and strength
of the signal the Hailstorm receives from a cell phone in response, law enforcement can
pinpoint the real-time location of a cell phone (and likely the person to whom it belongs)
within less than 20 yards.
These points from Det. Haley’s testimony regarding the function of the Hailstorm
device are consistent with what other courts and legal scholars have been able to discern
about the device. Hailstorm, along with the earlier-model cell site simulator known as
“StingRay,” to which Det. Haley referred, are far from discrete, limited surveillance tools.
Rather, as described in a recent article in the Harvard Journal of Law and Technology cited
by Appellee and the amici:12
This technology, commonly called the StingRay, the most well-known brand
name of a family of surveillance devices known more generically as “IMSI
11
In a suppression hearing, “[w]here . . . the defendant establishes initially that the
police proceeded warrantlessly, the burden shifts to the State to establish that strong
justification existed for proceeding under one of the ‘jealously and carefully drawn’
exceptions to the warrant requirement.” Jones v. State, 139 Md. App. 212, 226 (2001)
(citation omitted). Where the evidence presented is inconclusive, the consequence for the
State is that the defendant wins. Id.
12
In addition to the ACLU and EFF, Professor David Gray of the University of
Maryland Francis King Carey School of Law filed a detailed and informative amicus brief
in this case.
27
catchers,” is used by law enforcement agencies to obtain, directly and in real
time, unique device identifiers and detailed location information of cellular
phones—data that it would otherwise be unable to obtain without the
assistance of a wireless carrier.
***
By impersonating a cellular network base station, a StingRay—a surveillance
device that can be carried by hand, installed in a vehicle, or even mounted on
a drone—tricks all nearby phones and other mobile devices into
identifying themselves (by revealing their unique serial numbers) just as
they would register with genuine base stations in the immediate vicinity. As
each phone in the area identifies itself, the StingRay can determine the
location from which the signal came.
Stephanie K. Pell & Christopher Soghoian, A Lot More Than A Pen Register, and Less
Than A Wiretap: What the Stingray Teaches Us About How Congress Should Approach
the Reform of Law Enforcement Surveillance Authorities, 16 Yale J. L. & Tech. 134, 142,
145-46 (2014) (emphasis added; footnotes omitted).
The Supreme Court of Wisconsin examined whether law enforcement could obtain
location data through cell site information or a StingRay pursuant to a warrant and, before
holding that the warrant was sufficiently particularized, based on probable cause, and
passed constitutional muster, observed:
A stingray is an electronic device that mimics the signal from a cellphone
tower, which causes the cell phone to send a responding signal. If the
stingray is within the cell phone’s signal range, the stingray measures signals
from the phone, and based on the cell phone’s signal strength, the stingray
can provide an initial general location of the phone. By collecting the cell
phone’s signals from several locations, the stingray can develop the location
of the phone quite precisely.
State v. Tate, 849 N.W.2d 798, 826 n.8 (Wisc. 2014) (citation omitted), cert. denied, 135
S. Ct. 1166 (2015); see also, e.g., In re Application for Pen Register and Trap/Trace Device
28
with Cell Site Location Authority, 396 F. Supp. 2d 747, 755 (S.D. Tex. 2005) (defining an
earlier-model device, the “Triggerfish,” as equipment that “enables law enforcement to
gather cell site location information directly, without the assistance of the service
provider”). We cannot say that the factual findings of the circuit court, in this case, were
erroneous; they are firmly grounded in the testimony before that court, and the State has
provided no evidence to the contrary.
In determining then whether a Fourth Amendment “search” occurred, we apply the
court’s factual findings to the test pronounced in Katz, supra. Rather than limit the
constitutional appraisal to a trespass analysis,13 the Katz test requires a two-fold showing:
“first that a person have exhibited an actual (subjective) expectation of privacy and, second,
that the expectation be one that society is prepared to recognize as ‘reasonable.’” 389 U.S.
at 361 (Harlan, J., concurring).14 Even under the more flexible Katz test, however, rapid
13
In Olmstead v. United States, the Supreme Court held that the government’s use
of a wire-tapping device over an extended period of time did not constitute a violation of
the Fourth Amendment because the wires were installed in a manner that did not constitute
a trespass upon the property of the petitioners. 277 U.S. 438, 464 (1928). Thus, the Court
stated that a Fourth Amendment violation would occur where there was a tangible, physical
intrusion by the government. Cf. id. at 466. Olmstead was overruled in part by the Court
in Katz. 389 U.S. at 353.
14
Maryland appellate courts have, so far, only addressed the admissibility of
historical CSLI obtained from a service provider. See State v. Payne, 440 Md. 680, 690-
91 (2014) (stating that whether a detective “should have been qualified as an expert before
being allowed to engage in the process of identifying the geographic location of the cell
towers and the locations themselves depends on understanding just what are cell phone
records and what their contents reveal.”); Hall v. State, 225 Md. App. 72, 91 (2015)
(concluding that the State’s witness was properly qualified as an expert to testify regarding
the mapping of appellant’s cell phone data); Stevenson v. State, 222 Md. App. 118, 129-30
(determining that a Frye-Reed hearing on admissibility of novel scientific evidence and
expert scientific testimony was not required for admission of cellular tower “ping”
29
advancements in technology make ascertaining what constitutes a search under the Fourth
Amendment ever more challenging.15
Charles Katz was charged with transmitting wagering information by telephone in
violation of federal law. Katz, 389 U.S. at 348. He objected during his trial to the
evidence), cert. denied, 443 Md. 737 (2015); Wilder v. State, 191 Md. App. 319, 364 (2010)
(holding that the admission of CSLI required the qualification of the sponsoring witness as
an expert); Coleman-Fuller v. State, 192 Md. App. 577, 619 (2010) (same). Maryland
courts have not previously addressed CSLI in the context of a Fourth Amendment
challenge and have never addressed police use of cell site simulators or obtaining real-time
CSLI. Because key factual distinctions in this case involve the function of Hailstorm and
the ability of law enforcement to track a cell phone directly and in real time, our own cases
provide limited guidance.
15
See generally Renée McDonald Hutchins, Tied Up In Knotts? GPS Technology
and The Fourth Amendment, 55 UCLA L. Rev. 409 (2007). Professor Hutchins notes that
the Supreme Court has developed a differential treatment in its intrusiveness analysis under
the Fourth Amendment based on the type of information revealed, explaining:
When gauging the objective reasonableness of various privacy
expectations, the Court has leaned heavily on its assessment of the type of
information revealed to segregate challenged surveillance technologies into
two rough groups: sense-augmenting surveillance and extrasensory
surveillance. Sense augmenting surveillance refers to surveillance that
reveals information that could theoretically be attained through one of the
five human senses. With regard to this type of surveillance, the Court has
tended to find that simple mechanical substitutes for or enhancements of
human perception typically trigger no Fourth Amendment concerns in cases
in which human perception alone would not have required a warrant.
Extrasensory surveillance, conversely, is that which reveals
information otherwise indiscernible to the unaided human senses. The Court
has adopted a more privacy-protective view of this form of technologically
enhanced police conduct. In fact, the case law suggests that surveillance of
this type is largely prohibited in the absence of a warrant.
Id. at 432-33.
30
government’s introduction of evidence collected by FBI agents who overheard and
recorded his end of telephone conversations from inside a public telephone booth. Id. The
agents had placed a recording device on the outside of the phone booth from which Katz
placed his calls. Id. The government contended on appeal that their surveillance did not
constitute a search prohibited by the Fourth Amendment because Katz was in a public
location that was not constitutionally protected and because the technique they employed
involved no physical penetration of the telephone booth. Id. at 352. Writing for the
majority, Justice Stewart rejected the formulation of the issues by the parties, premised on
whether the telephone booth was a “constitutionally protected area,” and instructed that
“[t]he Fourth Amendment protects people, not places . . . what [Katz] seeks to preserve as
private, even in an area accessible to the public, may be constitutionally protected.” Id. at
361 (citations omitted). The Court continued, stating that “once it is recognized that the
Fourth Amendment protects people—and not simply ‘areas’—against unreasonable
searches and seizures it becomes clear that the reach of that Amendment cannot turn upon
the presence or absence of a physical intrusion into any given enclosure.” Id. at 350, 353.
Almost 20 years after establishing in Katz that an examination of intrusiveness
under the Fourth Amendment is not simply measured by physical invasion, the Supreme
Court addressed the constitutionality of the government’s surreptitious use of a radio
transmitter to track the movements of a container to and inside a private residence. United
States v. Karo, supra, 468 U.S. at 709-10. The physical installation of the transmitter was
not at issue; rather, the question before the Court was “whether the monitoring of a beeper
in a private residence, not open to visual surveillance, violates the Fourth Amendment
31
rights of those who have a justifiable interest in the privacy of the residence.” Id. at 714.
Although the Court noted that the monitoring of an electronic device is “less intrusive than
a full-scale search,” it, nevertheless, reveals information about the interior of the residence
that the government “could not have otherwise obtained without a warrant.” Id. at 715.
The Supreme Court stated:
We cannot accept the Government’s contention that it should be completely
free from the constraints of the Fourth Amendment to determine by means
of an electronic device, without warrant and without probable cause or
reasonable suspicion, whether a particular article—or a person, for that
matter—is in an individual’s home at a particular time. Indiscriminate
monitoring of property that has been withdrawn from public view would
present far too serious a threat to privacy interests in the home to escape
entirely some sort of Fourth Amendment oversight.
Id. at 716 (footnote omitted). Notably, the Court also soundly rejected the government’s
contention that it should be able to engage in warrantless monitoring of an electronic device
inside a private residence “if there is the requisite justification in the facts for believing that
a crime is being or will be committed and that monitoring the beeper wherever it goes is
likely to produce evidence of criminal activity.” Id. at 717 (emphasis added). The Court
recognized limited exceptions to the general rule, such as in the case of exigency, but
explained why in its view the government exaggerated the difficulties associated with
obtaining a warrant:
The Government argues that the traditional justifications for the warrant
requirement are inapplicable in beeper cases, but to a large extent that
argument is based upon the contention, rejected above, that the beeper
constitutes only a minuscule intrusion on protected privacy interests. The
primary reason for the warrant requirement is to interpose a ‘neutral and
detached magistrate’ between the citizen and ‘officer engaged in the often
competitive enterprise of ferreting out crime.’
32
***
The Government contends that it would be impossible to describe the ‘place’
to be searched, because the location of the place is precisely what is sought
to be discovered through the search. [ ] However true that may be, it will still
be possible to describe the object into which the beeper is to be placed, the
circumstances that led agents to wish to install the beeper, and the length of
time for which beeper surveillance is requested.
Id. at 717-18 (citing Johnson v. United States, 333 U.S. 10, 14 (1948)).
In Kyllo, supra, the Supreme Court considered whether a Fourth Amendment search
had occurred when the government used a thermal imaging device to detect infrared
radiation inside a home. 533 U.S. at 29-30. Federal agents, suspecting that Danny Kyllo
was growing marijuana inside his home, were able to confirm areas of heat coming from
high intensity lamps used to grow marijuana plants indoors. Id. At the threshold of his
analysis, Justice Scalia, writing for the majority, observed:
It would be foolish to contend that the degree of privacy secured to
citizens by the Fourth Amendment has been entirely unaffected by the
advance of technology. . . . The question we confront today is what limits
there are upon this power of technology to shrink the realm of guaranteed
privacy.
Id. at 33-34. The Court then noted that, although the Katz test—“whether the individual
has an expectation of privacy that society is prepared to recognize as reasonable”—may be
difficult to apply to some locations, such as telephone booths and automobiles—the
expectation of privacy in the home had “roots deep in the common law.” Id. at 34.
In support of the use of its thermal imaging technology, the government in Kyllo
argued that there was no “search” because the device detected “‘only heat radiating from
the external surface of the house[.]’” Id. at 35. The Supreme Court, however, cast aside
33
this contention as the kind of mechanical interpretation rejected in Katz and stated, “so also
a powerful directional microphone picks up only sound emanating from a house—and a
satellite capable of scanning from many miles away would pick up only visible light
emanating from a house.” Id. Rather than abandon Katz and take such a mechanical
approach, the Court sought to adopt a rule “tak[ing] account of more sophisticated
[surveillance] systems that are already in use or in development.” Id. at 35-36 (footnote
omitted). Accordingly, the Court held that “[w]here . . . the Government uses a device that
is not in general public use, to explore the details of the home that would previously have
been unknowable without physical intrusion, the surveillance is a ‘search’ and is
presumptively unreasonable without a warrant.” Id. at 40. Furthermore, the Court repeated
the caveat of Silverman v. United States, that the “protection of the home has never been
tied to the measurement of the quality or quantity of information obtained” for any invasion
of the home, “‘by even a fraction of an inch’ [is] too much.” Id. at 37 (quoting Silverman,
365 U.S. 505, 512 (1961)).
From Katz to Kyllo, the Supreme Court has firmly held that use of surveillance
technology not in general public use to obtain information about the interior of a home, not
otherwise available without trespass, is a “search” under the Fourth Amendment. These
decisions resolved to protect an “expectation of privacy that society is prepared to
recognize as reasonable.” After Kyllo, however, the question remained whether electronic
tracking or surveillance outside the home could constitute a search under the Fourth
Amendment.
34
In United States v. Jones, the Supreme Court reviewed the use of a GPS tracking
device affixed to the undercarriage of a vehicle to track the movements of the defendant
over a period of 28 days. 132 S. Ct. 945, 948 (2012). The Court unanimously affirmed
the United States Court of Appeals for the District of Columbia Circuit’s holding that the
electronic location surveillance over a period of 28 days was a search and that admission
of evidence obtained by the warrantless use of the GPS device violated the Fourth
Amendment. The Court was unable, however, to reach full agreement as to the basis for
its decision. See id. at 953 (majority opinion); 954 (Sotomayor, J., concurring); 967 (Alito,
J., concurring in the judgment). Justice Scalia’s majority opinion found that a search
occurred under the traditional, pre-Katz “trespass” rationale, but acknowledged that
“[s]ituations involving merely the transmission of electronic signals without trespass would
remain subject to Katz analysis.” Id. at 953 (emphasis in original).
Agreeing with Justice Brennan’s concurrence in Knotts v. United States, Justice
Scalia expounded that “‘when the Government does engage in physical intrusion of a
constitutionally protected area in order to obtain information, that intrusion may constitute
a violation of the Fourth Amendment.’” Id. at 951 (quoting Knotts, 460 U.S. 276, 286
(1983)). When law enforcement placed the GPS tracking system on Jones’s vehicle,
without a warrant, the government physically invaded a constitutionally protected area, id.
at 949, 952, and factors beyond trespass need not be considered to find there was a Fourth
Amendment violation. Id. at 953-54. Justice Scalia explained that the common-law
trespass test was essentially a minimum test and that the Katz test was “added to, not
substituted for, the common-law trespassory test.” Id. at 952.
35
Justice Sotomayor revisited the Katz analysis in her concurring opinion, stating that,
“even in the absence of a trespass, ‘a Fourth Amendment search occurs when the
government violates a subjective expectation of privacy that society recognizes as
reasonable.’” Id. at 954-55 (Sotomayor, J., concurring) (citations omitted). Recognizing
that “[i]n cases of electronic or other novel modes of surveillance that do not depend upon
a physical invasion on property, the majority opinion’s trespassory test may provide little
guidance[,]” Justice Sotomayor opined that the unique attributes of GPS location
surveillance will require careful application of the Katz analysis. Id. She urged the Court
to update its understanding of peoples’ expectations of privacy in the information age:
GPS monitoring generates a precise, comprehensive record of a person’s
public movements that reflects a wealth of detail about her familial, political,
professional, religious, and sexual associations. See, e.g., People v. Weaver,
12 N.Y.3d 433, 441–442, 882 N.Y.S.2d 357, 909 N.E.2d 1195, 1199 (2009)
(“Disclosed in [GPS] data . . . will be trips the indisputably private nature of
which takes little imagination to conjure: trips to the psychiatrist, the plastic
surgeon, the abortion clinic, the AIDS treatment center, the strip club, the
criminal defense attorney, the by-the-hour motel, the union meeting, the
mosque, synagogue or church, the gay bar and on and on”). The Government
can store such records and efficiently mine them for information years into
the future. [United States v.] Pineda–Moreno, 617 F.3d[ 1120,] 1124 [(9th
Cir. 2010)] (opinion of Kozinski, C.J.). And because GPS monitoring is
cheap in comparison to conventional surveillance techniques and, by design,
proceeds surreptitiously, it evades the ordinary checks that constrain abusive
law enforcement practices: “limited police resources and community
hostility.” Illinois v. Lidster, 540 U.S. 419, 426, 124 S. Ct. 885, 157 L. Ed. 2d
843 (2004).
Awareness that the Government may be watching chills associational
and expressive freedoms. And the Government’s unrestrained power to
assemble data that reveal private aspects of identity is susceptible to abuse.
The net result is that GPS monitoring—by making available at a relatively
low cost such a substantial quantum of intimate information about any person
whom the Government, in its unfettered discretion, chooses to track—may
“alter the relationship between citizen and government in a way that is
36
inimical to democratic society.” United States v. Cuevas–Perez, 640 F.3d
272, 285 (C.A.7 2011) (Flaum, J., concurring).
I would take these attributes of GPS monitoring into account when
considering the existence of a reasonable societal expectation of privacy in
the sum of one’s public movements. I would ask whether people reasonably
expect that their movements will be recorded and aggregated in a manner
that enables the Government to ascertain, more or less at will, their political
and religious beliefs, sexual habits, and so on. I do not regard as dispositive
the fact that the Government might obtain the fruits of GPS monitoring
through lawful conventional surveillance techniques. See Kyllo, 533 U.S., at
35, n.2, 121 S. Ct. 2038; ante, at 954 (leaving open the possibility that
duplicating traditional surveillance “through electronic means, without an
accompanying trespass, is an unconstitutional invasion of privacy”). I would
also consider the appropriateness of entrusting to the Executive, in the
absence of any oversight from a coordinate branch, a tool so amenable to
misuse, especially in light of the Fourth Amendment’s goal to curb arbitrary
exercises of police power to and prevent “a too permeating police
surveillance,” United States v. Di Re, 332 U.S. 581, 595, 68 S. Ct. 222, 92
L. Ed. 210 (1948).
Jones, 132 S. Ct. at 955-56 (Sotomayor, J., concurring) (footnote omitted).
Justice Alito, concurring only in the judgment, disagreed with the majority’s
reliance on a trespassory theory. Jones, 132 S. Ct. at 958. Instead, Justice Alito found the
appropriate inquiry to be “whether respondent’s reasonable expectations of privacy were
violated by the long-term monitoring of the movements of the vehicle he drove.” Id.
Justice Alito stated that the majority’s reasoning “disregard[ed] what is really important
(the use of a GPS for the purpose of long-term tracking)” and “will present particularly
vexing problems in cases involving surveillance that is carried out by making electronic,
as opposed to physical, contact with the item to be tracked.” Id. at 962 (emphasis in
original).
37
From the above precedent, we glean two broad principles regarding the Fourth
Amendment analysis of surveillance technology. First, where surveillance technology is
used without a warrant to obtain information about the contents of a home, not otherwise
discernable without physical intrusion, there has been an unlawful search. See Kyllo, 533
U.S. at 34-35. Second, where the government has engaged in surveillance using “electronic
signals without trespass[,]” the intrusion will “remain subject to Katz analysis.” Jones, 132
S. Ct. at 953 (emphasis in original). The Supreme Court has recognized, however, that cell
phones present novel privacy concerns.
In Riley, supra, the Supreme Court made clear that a search of the information
contained in a cell phone is subject to the warrant requirement regardless of its location.
134 S. Ct. at 2489-91. The Court held that even during a search incident to arrest, the
government must first obtain a warrant before searching the digital contents of a cell phone
found on the person being arrested. Id. at 2485-86.
Chief Justice Roberts described the modern cell phone as much more than a phone:
Cell phones differ in both a quantitative and a qualitative sense from
other objects that might be kept on an arrestee’s person. The term “cell
phone” is itself misleading shorthand; many of these devices are in fact
minicomputers that also happen to have the capacity to be used as a
telephone. They could just as easily be called cameras, video players,
rolodexes, calendars, tape recorders, libraries, diaries, albums, televisions,
maps, or newspapers.
One of the most notable distinguishing features of modern cell phones
is their immense storage capacity. Before cell phones, a search of a person
was limited by physical realities and tended as a general matter to constitute
only a narrow intrusion on privacy. Most people cannot lug around every
piece of mail they have received for the past several months, every picture
they have taken, or every book or article they have read—nor would they
have any reason to attempt to do so. And if they did, they would have to drag
38
behind them a trunk of the sort held to require a search warrant in Chadwick,
supra, rather than a container the size of the cigarette package in Robinson.
Id. at 2489.
The State argues that its use of the Hailstorm here should be analogized to Knotts,
460 U.S. 276, wherein the Supreme Court upheld law enforcement officers’ use of a radio
transmitter to track the movements of a container, by automobile, to a defendant’s home.
In Knotts, the Court noted that “[t]he governmental surveillance conducted by means of
the beeper in this case amounted principally to the following of an automobile on public
streets and highways.” Id. at 281. The Court concluded that:
A person travelling in an automobile on public thoroughfares has no
reasonable expectation of privacy in his movements from one place to
another. When [the defendant] travelled over the public streets he voluntarily
conveyed to anyone who wanted to look the fact that he was travelling over
particular roads in a particular direction, the fact of whatever stops he made,
and the fact of his final destination when he exited from public roads onto
private property.
Id. at 281-82. Here, the State argues that because Andrews’s cell phone was “constantly
emitting ‘pings’ giving its location to the nearest cell tower, . . . there can be no reasonable
expectation of privacy in [that] information” under Knotts.
The State’s reliance on Knotts, however, is misplaced. In Karo, the Supreme Court
clarified that in Knotts the electronic device “told the authorities nothing about the interior
of Knotts’ cabin.” 468 U.S. at 715. Rather, the information obtained in Knotts was
“voluntarily conveyed to anyone who wanted to look[,]” id. (quoting Knotts, 460 U.S. at
281), and the subsequent search warrant was also supported by “intermittent visual
surveillance” of the cabin, Knotts, 460 U.S. at 279. As noted in Kyllo, the Supreme Court
39
has long recognized that “[v]isual surveillance [i]s unquestionably lawful because ‘the eye
cannot by the laws of England be guilty of a trespass.’” 533 U.S. at 31-32 (quoting Boyd
v. United States, 116 U.S. 616, 628 (1886)).
Here, there was no visual surveillance. The mere fact that police could have located
Andrews within the residence by following him as he travelled over public thoroughfares
does not change the fact that the police did not know where he was, so they could not
follow him. Unlike Knotts, the information obtained in this case did reveal at least one
critical detail about the residence; i.e., that its contents included Andrews’s cell phone, and
therefore, most likely Andrews himself. Further, “pings” from Andrews’s cell phone to
the nearest tower were not available “to anyone who wanted to look.” We find the
surreptitious conversion of a cell phone into a tracking device and the electronic
interception of location data from that cell phone markedly distinct from the combined use
of visual surveillance and a “beeper to signal the presence of [the defendant’s] automobile
to the police receiver” to track a vehicle over public roads. See Knotts, 460 U.S. at 282.
Put simply, the information obtained by police in this case was not readily available and in
the public view as it was in Knotts.
Cell site simulators, such as Hailstorm, can locate and track the movements of a cell
phone and its user across both public and private spaces. Unchecked, the use of this
technology would allow the government to discover the private and personal habits of any
user. As Justice Sotomayor predicted in her concurring opinion in Jones, supra, we are
compelled to ask “whether people reasonably expect that their movements will be recorded
and aggregated in a manner that enables the Government to ascertain, more or less at will,
40
their political and religious beliefs, sexual habits, and so on.” 132 S. Ct. at 956 (Sotomayor,
J., concurring). We conclude that they do not.
We agree with the United States Court of Appeals for the Fourth Circuit in United
States v. Graham, in declaring, “[w]e cannot accept the proposition that cell phone users
volunteer to convey their location information simply by choosing to activate and use their
cell phones and to carry the devices on their person.” 796 F.3d 332, 355 (4th Cir.), reh’g
en banc granted, 624 F. App’x 75 (4th Cir. 2015).16 Federal courts reviewing pen
register\trap & trace applications have similarly recognized a reasonable expectation of
privacy in cell site location information. See, e.g., In re the Application of the United States
for an Order Authorizing (1) Installation and Use of a Pen Register and Trap and Trace
Device or Process, (2) Access to Customer Records, and (3) Cell Phone Tracking, 441 F.
Supp. 2d 816, 837 (S.D. Tex. 2006) (“[D]etailed location information, such as triangulation
and GPS data, … unquestionably implicate Fourth Amendment privacy rights.”); In re
16
The recent cell phone encryption battle between Apple and the United States
Government illustrates how fervently people care about protecting their personal location
information. In 2011, consumers learned that their iPhones stored months of data regarding
Wi-Fi hotspots and cell towers around their location in a format that was not encrypted.
The ensuing barrage of complaints caused Apple to revise its operating system to protect
consumers’ location information. Apple, Inc. Press Release, Apple Q&A on Location Data
(April 27, 2011) (available at https://www.apple.com/pr/library/2011/04/27Apple-Q-A-
on-Location-Data.html) [https://perma.cc/PJ5V-KHGE]. Apple refused to comply with a
court order to create software to disable certain security protections of an iPhone. See
Testimony of Bruce Sewell, Encryption Tightrope: Balancing American’s Security and
Privacy, Hearing before the House Comm. on the Judiciary, 114th Cong. (March 1, 2016);
Timothy B. Lee, Apple's Battle with the FBI over iPhone Security, Explained, Vox (Feb.
17, 2016), http://www.vox.com/2016/2/17/11037748/fbi-apple-san-bernardino
[http://perma.cc/4MFA-JZ4D].
41
Application of the United States for an Order Authorizing Installation and Use of a Pen
Register and a Caller Identification System on Telephone Numbers (Sealed), 402 F. Supp.
2d 597, 604–05 (D. Md. 2005) (recognizing that monitoring of cell phone location
information is likely to violate a reasonable expectation of privacy)). We also accept the
circuit court’s finding in this case that “no one expects that their phone information is being
sent directly to the police department on their apparatus.”17 Recognizing that the Fourth
Amendment protects people and not simply areas, Katz, 389 U.S. at 353, we conclude that
people have a reasonable expectation of privacy in real-time cell phone location
information.
Moreover, because the use of the cell site simulator in this case revealed the location
of the phone and Andrews inside a residence, we are presented with the additional concern
that an electronic device not in general public use has been used to obtain information about
the contents of a home, not otherwise discernable without physical intrusion. See Kyllo,
533 U.S. at 34-35. Under the applicable precedent, this is undoubtedly an intrusion that
rises to the level of a Fourth Amendment “search.” See id. Indeed, “the Fourth
Amendment draws a firm line at the entrance to the house[.]” Id. at 40 (citation and internal
quotation marks omitted). Although we recognize that the use of a cell site simulator to
track a phone will not always result in locating the phone within a residence, we agree with
the Fourth Circuit’s observation that “the government cannot know in advance of obtaining
17
As the Supreme Court stated in Katz, “[t]o read the Constitution more narrowly
is to ignore the vital role that the … telephone has come to play in private communication.”
389 U.S. at 352.
42
this information how revealing it will be or whether it will detail the cell phone user’s
movements in private spaces.” Graham, 796 F.3d at 350 (citation omitted). The United
States District Court for the District of Maryland articulated the same concern when
addressing the government’s use of a particular cell phone as a tracking device to aid in
execution of an arrest warrant. The district court stated:
Location data from a cell phone is distinguishable from traditional physical
surveillance because it enables law enforcement to locate a person entirely
divorced from all visual observation. Indeed, this is ostensibly the very
characteristic that makes obtaining location data a desirable method of
locating the subject of an arrest warrant. This also means, however, that
there is no way to know before receipt of location data whether the
phone is physically located in a constitutionally-protected place. In
other words, it is impossible for law enforcement agents to determine
prior to obtaining real-time location data whether doing so infringes
upon the subject’s reasonable expectation of privacy and therefore
constitutes a Fourth Amendment search.
In re Application of United States for an Order Authorizing Disclosure of Location Info. of
a Specified Wireless Tel., 849 F. Supp. 2d 526, 540 (D. Md. 2011) (emphasis added).
It would be impractical to fashion a rule prohibiting a warrantless search only
retrospectively based on the fact that the search resulted in locating the cell phone inside a
home or some other constitutionally protected area. See, e.g., Kyllo, 533 U.S. at 38-39
(declining to adopt a Fourth Amendment standard that would only bar the use of thermal
imaging to discern “intimate details” in the home because “no police officer would be able
to know in advance whether his through-the-wall surveillance picks up ‘intimate’ details—
and thus would be unable to know in advance whether it is constitutional.” (emphasis in
original)); cf. Karo, 468 U.S. at 718 (“We are also unpersuaded by the argument that a
warrant should not be required because of the difficulty in satisfying the particularity
43
requirement of the Fourth Amendment.”). Such a rule would provide neither guidance nor
deterrence, and would do nothing to thwart unconstitutional intrusions. Cf. In re the
Application of the United States for an Order (1) Authorizing the Use of a Pen Register
and a Trap and Trace Device, 396 F. Supp. 2d 294, 323 (E.D.N.Y.2005) (“Because the
government cannot demonstrate that cell site tracking could never under any circumstance
implicate Fourth Amendment privacy rights, there is no reason to treat cell phone tracking
differently from other forms of tracking . . . which routinely require probable cause.”
(Internal quotations and citations omitted)).
We determine that cell phone users have an objectively reasonable expectation that
their cell phones will not be used as real-time tracking devices through the direct and active
interference of law enforcement. We hold, therefore, that the use of a cell site simulator,
such as Hailstorm, by the government, requires a search warrant based on probable cause
and describing with particularity the object and manner of the search, unless an established
exception to the warrant requirement applies.
We turn to consider whether such an exception applies in this case.
c. The Third Party Doctrine
The State maintains that the “Third Party Doctrine” exception to the warrant
requirement applied to the BPD’s use of Hailstorm to track down Andrews’s cell phone.
The doctrine—providing that an individual forfeits his or her expectation of privacy in
information that is turned over to a third party—finds its strongest expression in United
States v. Miller, 425 U.S. 435 (1976) and Smith v. Maryland, 442 U.S. 735 (1979).
44
In Smith v. Maryland, the Supreme Court was presented with the issues of whether
the warrantless installation and use of a pen register to collect the telephone numbers dialed
from a telephone at the petitioner’s home constituted a “search” within the meaning of the
Fourth Amendment. 442 U.S. at 736-37. The Court described the function of pen registers,
stating that they “‘disclose only the telephone numbers that have been dialed—a means of
establishing communication. Neither the purpose of any communication between the caller
and the recipient of the call, their identities, nor whether the call was even completed is
disclosed by pen registers.’” Id. at 741 (quoting United States v. New York Tel. Co., 434
U.S. 159, 167 (1977)). Accordingly, the Court narrowed the issue before it, stating:
Given a pen register’s limited capabilities, therefore, petitioner’s argument
that its installation and use constituted a “search” necessarily rests upon a
claim that he had a “legitimate expectation of privacy” regarding the numbers
he dialed on his phone.
Id. at 742. In United States v. Miller, the Supreme Court held that no reasonable
expectation of privacy existed once the owner of financial checks turned financial
instruments over to a bank and “exposed [them] to [bank] employees in the ordinary course
of business.” 425 U.S. at 442.
The State argues that the cell site simulator used in this case merely “detects the
signal emitted by the cell phone, just as a regular cell tower would[,]” and, therefore, “the
police used data that Andrews voluntarily shared with third parties—specifically his cell
phone provider—to locate his phone.” The State maintains that, under Smith no Fourth
Amendment “search” occurred because Andrews had no reasonable expectation of privacy
in information he voluntarily transmitted to a third party. The State contends that, by
45
carrying and using a cell phone that regularly communicates with nearby cell towers,
Andrews assumed the risk that the information transmitted to the cell towers would be
revealed to the police.
According to Andrews, the third-party doctrine of Smith v. Maryland, is
inapplicable because “a cell phone user takes no conscious, voluntary action to constantly
share location information with a third party.” Andrews maintains that the Supreme Court
in Smith reached its conclusion using a specific line of reasoning, recognizing that
“telephone subscribers ‘realize’ that they send dialed numbers to the telephone company”
and by virtue of those numbers appearing on their monthly bills “subscribers ‘realize’ that
the dialed numbers are recorded by the telephone company.” Andrews contends that the
same cannot be said in the instant case. As Andrews points out, the Court in Smith focused
on the actual knowledge attributed to telephone users and stated:
All telephone users realize that they must “convey” phone numbers to the
telephone company, since it is through telephone company switching
equipment that their calls are completed. All subscribers realize, moreover,
that the phone company has facilities for making permanent records of the
numbers they dial, for they see a list of their long-distance (toll) calls on their
monthly bills.
Id. at 742. In that context, the court determined that because the “petitioner voluntarily
conveyed to [the telephone company] information that it had facilities for recording and
that it was free to record[,] . . . petitioner assumed the risk that the information would be
divulged to police.” Id. at 745.
Although the Supreme Court’s decision in Smith has been applied broadly, see, e.g.,
United States v. Bynum, 604 F.3d 161, 162-64 (4th Cir. 2010) (upholding the government’s
46
use of a subpoena to obtain a website user’s name, email address, telephone number, and
physical address—all information that the user entered on the website when he opened his
account—from a website operator), it remains that a party must voluntarily convey
information to a third-party, before there is no longer a reasonable expectation of privacy
in that information. Cf. Jones, 132 S. Ct. at 957 (Sotomayor, J., concurring) (“This
approach [in Smith] is ill suited to the digital age, in which people reveal a great deal of
information about themselves to third parties in the course of carrying out mundane tasks.
. . . I would not assume that all information voluntarily disclosed to some member of the
public for a limited purpose is, for that reason alone, disentitled to Fourth Amendment
protection.” (citation omitted)). Recently, in United States v. Graham, supra, the Fourth
Circuit addressed the application of the third-party doctrine to CSLI and stated:
[The precedents] simply hold that a person can claim no legitimate
expectation of privacy in information she voluntarily conveys to a third party.
It is that voluntary conveyance—not the mere fact that the information winds
up in the third party’s records—that demonstrates an assumption of risk of
disclosure and therefore the lack of any reasonable expectation of privacy.
We decline to apply the third-party doctrine in the present case because a cell
phone user does not “convey” CSLI to her service provider at all—
voluntarily or otherwise—and therefore does not assume any risk of
disclosure to law enforcement.
796 F.3d at 354 (footnote omitted).
We agree, once again, with the Graham court and join in the view shared by other
courts that, “[t]he fiction that the vast majority of the American population consents to
warrantless government access to the records of a significant share of their movements by
‘choosing’ to carry a cell phone must be rejected.” Graham, 796 F.3d at 355-56 (quoting
In re United States for an Order Authorizing the Release of Historical Cell-Site Info., 809
47
F. Supp. 2d 113, 127 (E.D.N.Y. 2011)). Cell phone users do not actively submit their
location information to their service provider.
In the present case, there was no affirmative act like “dialing.” This is made
abundantly clear by Det. Haley’s testimony stating that “if they’re on the phone, then
they’re already connected to . . . the [] network[, a]nd we’re not going to be able to pull
them off of that until . . . they hang up the call.” Det. Haley’s testimony reveals that, in the
event that an individual is actively using the cell phone to knowingly transmit signals to
nearby cell towers, the cell site simulator will not be able to access the phone.
The pin-point location information that led to finding Andrews was obtained
directly by law enforcement officers and not through a third-party. It is not the case that
Andrews’s cell phone transmitted information to the service provider that was then
recorded and shared with law enforcement. Thus, it cannot be said that Andrews “assumed
the risk” that the information obtained through the use of the Hailstorm device would be
shared by the service provider as in Smith. The function of the Hailstorm device foreclosed
that possibility. When asked “how do you get information about where the phone is on the
[Hailstorm] machine,” Det. Haley responded: “[W]hen [Hailstorm] captures that identifier
that you put into the machine or the equipment, it then tells you . . . where the signal’s
coming from[.]” Under the facts of this case, the ultimate location data relied on by the
police was never transmitted to a third party voluntarily by Andrews. Because there was
no third-party element to the use of the Hailstorm by the BPD to locate Andrews, Smith is
inapposite. We conclude the Third Party Doctrine does not apply in this case.
48
II.
Standing
One of the State’s primary arguments on appeal is that Andrews lacks standing to
challenge the search of 5032 Clifton Avenue. The State argues that once it challenged
Andrews’s standing to protest the search of 5032 Clifton Avenue, the burden was on
Andrews to put on evidence during the suppression hearing to establish Andrews’s “basis
for claiming he had a reasonable expectation of privacy in the contents of someone else’s
home.” The State posits the suppression court erred in “finding that there was no need to
prove standing.”
Certainly, “[t]he burden is on the defendant to show standing; it is not on the State
to show non-standing.” State v. Savage, 170 Md. App. 149, 177 (2006). In Savage,
however, this Court clarified that standing “[i]s exclusively a threshold question of
applicability, concerned only with the coverage by the Fourth Amendment of the defendant
who seeks to raise a Fourth Amendment challenge.” Id. at 174. Thus, the burden on a
proponent of a motion to suppress is to establish “that his own Fourth Amendment rights
were violated by the challenged search or seizure.” Id. at 175 (emphasis in Savage)
(quoting Rakas v. Illinois, 439 U.S. 128, 130 n.1 (1978)).
Andrews points out that the State “failed to respond in any meaningful way” to his
motion to suppress, and did not raise the issue of standing to challenge the search of 5032
Clifton Avenue until well into the June 4, 2015 suppression hearing. Andrews asserts that
it was the State’s suggestion that the parties stipulate that the issues before the court be
decided based on the transcripts, the arrest warrant, the pen register\trap & trace
49
application, and the search warrant. Andrews contends the State did not raise the standing
issue until after the fact-finding portion of the hearing had concluded. At that time, the
court requested that Andrews address the issue, and defense counsel made a proffer that
Andrews was an overnight guest at 5032 Clifton Avenue and offered to put him on the
stand to provide supporting testimony.18 Andrews argues that the State waived any
argument regarding standing, pointing to the State’s delay, its failure to challenge his
proffer, and its concession that its trial theory was the fact “that [Andrews] has some
interest [in 5032 Clifton Avenue] and that is why the gun from this crime, the murder
weapon, was there with him.”
We need not pursue the nuances of the parties’ “standing” argument as they have
framed the issue. We have already determined that Andrews had a reasonable expectation
of privacy in his aggregate and real-time location information (CLSI) contained in his cell
phone. See Rakas, 439 U.S. at 139-140 (stating that “the better analysis forthrightly
focuses on the extent of a particular defendant’s rights under the Fourth Amendment, rather
than on any theoretically separate, but invariably intertwined concept of standing[,]” and
18
It is plain that an overnight guest has a legitimate expectation of privacy in his
host’s home and “may claim the protection of the Fourth Amendment.” Carter, supra, 525
U.S. at 90; Savage, 170 Md. App. at 188-89. As Andrews points out, defense counsel made
a proffer that Andrews was an overnight guest and offered to put testimony to that effect
on the record. The State has not seriously challenged Andrews’s connection to the
residence, but seeks merely to assert that his unopposed proffer was not sufficient to rebut
their late challenge. We observe that—after the State sought to rely on earlier transcripts
to provide necessary testimony, failed to challenge standing during the evidentiary portion
of the suppression hearing, and left uncontroverted Andrews’s proffer that he was an
overnight guest—Andrews’s proffer under the circumstances may have been sufficient to
counter the State’s standing argument.
50
“[t]hat inquiry in turn requires a determination of whether the disputed search and seizure
has infringed an interest of the defendant which the Fourth Amendment was designed to
protect.”). The search warrant search for 5032 Clifton Avenue was based solely on
constitutionally tainted information. As the suppression court explained, “I reviewed the
warrant and it literally says the Defendant was in there so now we need a warrant. And
information generated from the use of the Hailstorm [is to] be suppressed, that’s all that it
is.” Because the Fourth Amendment violation of Andrews’s privacy in his real-time CSLI
provided the only nexus to 5032 Clifton Avenue, Andrews was entitled to challenge that
search. See Wong Sun v. United States, 371 U.S. 471, 487-88 (1963) (stating that, in
determining whether evidence is fruit of the poisonous tree, “the more apt question in such
a case is whether, granting establishment of the primary illegality, the evidence to which
instant objection is made has been come at by exploitation of that illegality or instead by
means sufficiently distinguishable to be purged of the primary taint.” (citation and internal
quotation marks omitted)). For the foregoing reasons, Andrews had standing to challenge
the “search” of 5032 Clifton Avenue.
III.
The Warrant Requirement
Having determined that the government’s use of a cell site simulator to obtain
location information directly from an individual’s cell phone is a “search” under the Fourth
Amendment, and, therefore, requires a warrant based on probable cause, we now examine
the state’s reliance on the pen register\trap & trace order issued by the circuit court. First,
we examine whether the Maryland pen register statute authorized the use of a cell site
51
simulator. Second, we examine whether the putative pen register\trap & trace order in this
case operated as the equivalent of a warrant as the State contends.
a. The Maryland Pen Register Statute Does Not Authorize the Use of Cell Site
Simulators Such as Hailstorm
The function of the Hailstorm device, as illuminated by testimony before the
suppression court, places it outside the statutory framework of the Maryland pen register
statute. The statute authorizes the use of the following surveillance methods defined in
CJP §10-4B-0.1:
Pen register
(c)(1) “Pen register” means a device or process that records and decodes
dialing, routing, addressing, or signaling information transmitted by an
instrument or facility from which a wire or electronic communication is
transmitted.
(2) “Pen register” does not include any device or process used:
(i) By a provider or customer of a wire or electronic communication service
for billing, or recording as an incident to billing, for communications services
provided by the provider or any device used by a provider or customer of a
wire communication service for cost accounting or other similar purposes in
the ordinary course of its business; or
(ii) To obtain the content of a communication.
Trap and trace device
(d)(1) “Trap and trace device” means a device or process that captures the
incoming electronic or other impulses that identify the originating number or
other dialing, routing, addressing, and signaling information reasonably
likely to identify the source of a wire or electronic communication.
(2) “Trap and trace device” does not include a device or process used to
obtain the content of a communication.
Wire communication, electronic communication, and electronic
communication service
(e) “Wire communication”, “electronic communication”, and “electronic
communication service” have the meanings stated in § 10-401 of this title.
52
The statute specifies that any order issued must identify, if known, “the person to
whom is leased or in whose name is listed the telephone line or other facility to which
the pen register or trap and trace device is to be attached or applied.” CJP § 10-4B-
04(b)(1) (emphasis added).
Construing the plain language of CJP § 10-4B-01, we determine that it does not, on
its face, apply to the use of cell site simulators. A “pen register” is “a device or process
that records . . . signaling information transmitted by an instrument . . . from which a wire
or electronic communication is transmitted.” CJP § 10-4B-01(c)(1) (emphasis added).
As discussed above, the Hailstorm device does not passively intercept an electronic
communication that has been transmitted. Rather, it initiates contact with a cell phone and
traces the signal received in response. A “trap and trace device” is a “device or process
that captures the incoming electronic or other impulses that identify the originating
number or other dialing, routing, addressing, and signaling information reasonably likely
to identify the source of a wire or electronic communication.” CJP § 10-4B-01(d)(1)
(emphasis added). The function of the Hailstorm device—to shower an electronic barrage
of signals into a target area to actively engage the target cell phone—goes well beyond the
bounds of the pen register statute which by its terms is limited to authorizing devices that
record or identify the source of a communication or capture an originating number.
The Maryland pen register statute has been examined in only one reported opinion
by a Maryland appellate court.19 See Chan v. State, 78 Md. App. 287, 293 (1989)
19
In the federal district court in United States v. Wilford, a defendant more recently
argued that cell phone pinging was not authorized by Maryland’s pen register statute. 961
53
(upholding the use of a trap and trace device pursuant to a court order to obtain data from
over 5,000 calls over an eighty-day period). In Chan, although this Court determined that
the newly enacted Maryland pen register statute was not applicable because it did not take
effect until July 1, 1988, it stated that the new statute “unquestionably cover[ed]” the “trap
and trace” of incoming calls and observed:
In response to the Electronic Communications Privacy Act of 1986 passed
by the Federal Congress, the Maryland General Assembly moved for the first
time to regulate “pen registers” and “trap and trace” devices by Chapter 607
of the Acts of 1988. The new regulation is not part of the “Wiretapping and
Electronic Surveillance” subtitle but is a separate subtitle of its own, 4B,
dealing with the distinct subject matter of “Pen Registers and Trap and Trace
Devices.” Its provisions and its wording are virtually verbatim with
those of its Federal counterpart.
Id. at 308 (emphasis added).
In 2001, Congress amended the definition of the term “pen register” in the federal
counterpart as part of the USA PATRIOT Act. See PL 107–56, October 26, 2001, 115 Stat
272. Subsequently, in 2002, the Maryland pen register statute was also amended to the
current versions, reproduced above. 2002 Md. Laws, ch. 100 (H.B. 1036). Notably, since
F. Supp. 2d 740, 768 (D. Md. 2013), on reconsideration in part (Nov. 27, 2013). In that
case, the defendant maintained that the statutory language “is limited to providing law
enforcement numbers that dialed into the target phone and numbers dialed out,” but does
“not contemplate” the use of a cell phone as a “physical locator/tracking device.” Id. at
769. The district court noted that “[n]o judicial decision offers any guidance as to the scope
of the Maryland statute with respect to pinging.” Id. However, rather than address whether
the collection of CSLI was authorized by the pen register statute, the district court accepted
that contention arguendo and, instead, based its holding on the unavailability of
suppression as a remedy for violation of the statute. Id. at 770.
54
Chan was decided in 1989, the wording of the Maryland statute remains virtually verbatim
with its federal counterpart. See 18 U.S.C. § 3127; 18 U.S.C. § 2510.
Looking then, at the federal statutory scheme, we note that the federal
Communications Assistance for Law Enforcement Act (“CALEA”), which delineates a
telecommunications carrier’s duty to cooperate in the interception of communications for
law enforcement purposes, provides that “with regard to information acquired solely
pursuant to the authority for pen registers and trap and trace devices (as defined in section
3127 of Title 18), such call-identifying information shall not include any information
that may disclose the physical location of the subscriber (except to the extent that the
location may be determined from the telephone number).” 47 U.S.C. § 1002 (2015)
(emphasis added). Thus, federal law specifies that the federal equivalent to the Maryland
pen register statute does not authorize location information. Rather, the federal scheme
allows the government to use a mobile tracking device through warrant or other order as
contemplated in 18 U.S.C. § 3117 and Federal Rule of Criminal Procedure 41.
Although there are no reported opinions that address whether the collection of real-
time cell site location information (CSLI) is authorized under the Maryland’s pen register
statute, numerous federal courts construing the virtually identical federal statutes have
found no statutory authorization for obtaining such information without demonstrating
probable cause. In 2005, the United States District Court for the Southern District of Texas
held that the government must demonstrate probable cause and obtain a search warrant to
obtain real-time CSLI. In re Application for Pen Register & Trap/Trace Device with Cell
55
Site Location Auth., 396 F. Supp. 2d 747, 759 (S.D. Tex. 2005). Construing the federal
statutes, the district court stated:
Tracking device information such as cell site data is plainly not a form of
electronic communication at all.
***
This type of surveillance is unquestionably available upon a traditional
probable cause showing under Rule 41 [for a mobile tracking device]. On the
other hand, permitting surreptitious conversion of a cell phone into a tracking
device without probable cause raises serious Fourth Amendment concerns,
especially when the phone is monitored in the home or other places where
privacy is reasonably expected.
Id. at 759, 765. See also In re Application of the United States for an Order Authorizing
Installation & Use of a Pen Register, 415 F. Supp. 2d 211, 219 (W.D.N.Y. 2006) (holding
that the government was not entitled to real-time CSLI by statute and thus, was required to
make a “showing that there exists probable cause to believe that the data sought will yield
evidence of a crime.”). Directly addressing the use of a cell site simulator (such as Stingray
or Hailstorm) to obtain real-time CSLI for tracking purposes, the District Court for the
Southern District of Texas determined that, rather than merely capturing signaling
information as contemplated in the federal pen register statute, the use of a cell site
simulator constituted a mobile tracking device. In re the Application of the United Sates.
for an Order Authorizing the Installation & Use of a Pen Register & Trap & Trace Device,
890 F. Supp. 2d 747, 752 (S.D. Tex. 2012).
We acknowledge that law enforcement has long relied on pen register\trap & trace
orders for valid and vital investigative purposes. They will continue to do so. The pen
register statute, however, is limited by its terms and is not intended to apply to other, newer
56
technologies. Thus we hold that a pen register\trap & trace order is not sufficient to
authorize use of the Hailstorm.20
Criminal Procedure § 1-203.1
Although at the time Andrews was arrested Maryland did not have a corollary to the
provision in Federal Rule of Criminal Procedure 41 that specifically authorizes issuance of
a warrant for a mobile tracking device, Maryland has since enacted a statute authorizing
law enforcement to obtain real-time CSLI, effective October 1, 2015. Maryland Code
(2001, 2008 Repl. Vol., 2015 Supp.) Criminal Procedure Article (“CP”) § 1-203.1. The
statute provides that a court may issue an order allowing an officer to obtain real-time
location information from an electronic device based on probable cause that:
(i) a misdemeanor or felony has been, is being, or will be committed by the
owner or user of the electronic device or by the individual about whom
location information is being sought; and
(ii) the location information being sought:
1. is evidence of, or will lead to evidence of, the misdemeanor or
felony being investigated; or
20
Federal law enforcement agencies have recognized that they need to obtain
warrants rather than rely on less rigorous legal authorizations before utilizing cell site
simulators. On September 3, 2015, the United States Justice Department of Justice
announced a new policy setting forth required practices with respect to the treatment of
information collected through the use of cell site simulators and stated:
While the department has, in the past, obtained appropriate legal
authorizations to use cell-site simulators, law enforcement agents must
now obtain a search warrant supported by probable cause before using
a cell-site simulator.
Justice News, Justice Department Announces Enhanced Policy for Use of Cell-Site
Simulators, DOJ 15-1084 (2015) (emphasis added).
57
2. will lead to the apprehension of an individual for whom an arrest
warrant has been previously issued.
CP § 1-203.1(b)(1). The Fiscal and Policy Note prepared by the Department of Legislative
Services for the General Assembly concerning this statute when it was first proposed,
recognized that law enforcement officers were using the Maryland pen register statute to
obtain cell phone-related information. It explained that the proposed statute would
specifically authorize the capture of CSLI in accord with several recent federal court
decisions finding that probable cause was needed to obtain such information. Fiscal and
Policy Note (Revised), Senate Bill 698, Criminal Procedure – Electronic Device Location
Information – Order (2014). The fiscal and policy note also contemplated the use of cell
site simulators and stated:
While cell phone records are usually obtained from a cell phone provider,
technology is making it possible for law enforcement to bypass these
companies altogether. Certain devices allow law enforcement to obtain
location data by imitating a cell phone tower, getting a phone to connect with
it, and measuring signals from the phone to pinpoint its location. The device,
which is being used by the Federal Bureau of Investigation, the military, and
local law enforcement, is known by several trade names, including StingRay,
KingFish, and LoggerHead.
Notably, CP § 1-203.1 contains safeguards and limitations not found in the
Maryland pen register statute, including a thirty-day durational limit on the collection of
location information unless an extension is sought on continuing probable cause, and a
provision requiring notice to the user or owner of the monitored device within 10 days
absent a showing of good cause to delay. CP § 1-203.1(c) & (d).
The parties have briefed extensively their view of the meaning and application of
CP 1-203.1. Other than to provide context for the history of the Maryland pen register
58
statute and our conclusion that it was not intended to cover cell site simulators, we do not
address the application of CP 1-203.1 and decline to opine as to whether an order under
CP 1-203.1 will suffice to satisfy the requirements of a warrant based on probable cause.
In sum, we conclude that the purpose of Maryland’s pen register statute is to capture
information resulting from two-way, electronic or wire communications. Nothing in the
plain language of CJP § 10-4B-01 et seq. suggests that it was ever intended to allow
surveillance technology that can exploit the manner in which a cell phone transmits data to
convert it into a mobile tracking device. Accordingly, an order issued pursuant to CJP §
10-4B-04 cannot authorize the use of a cell site simulator, such as Hailstorm. Because
there was no statutory authorization for the BPD’s use of the Hailstorm cell site simulator,
we hold that the BPD should have sought a warrant or a specialized order upon a
particularized showing of probable cause, and based on sufficient information about the
technology involved to permit the court to contour reasonable limitations on the scope and
manner of the BPD’s use of the device.21 See, e.g., In re Application of the United States
for an Order Authorizing Installation & Use of a Pen Register, 415 F. Supp. 2d at 219.
b. The Order Obtained by the State Was Not Equivalent to a Warrant
The State insists that its use of the Hailstorm device to track Andrews’s cell phone
was authorized by the court order. In the absence of a specific statute that would have
21
To the extent that the State makes a limited argument that there is no suppression
remedy available for violation of the sections 10-4B-01 et seq., we respond simply that the
circuit court found, and we agree, that the use of the cell site simulator was a Fourth
Amendment violation and, thereby, the exclusionary rule applies. The fact that there may
have been a contemporaneous violation of sections 10-4B-01 et seq. does not limit the
available remedy.
59
authorized the use of a cell site simulator at the time Andrews was arrested, the State
presses that “the police erred on the side of caution and obtained a court order specifically
authorizing the use of a cellular tracking device to find Andrews’s phone[,]” pursuant to
the “nearest analog”—the Maryland pen register statute. The State acknowledges that the
court order described in the Maryland pen register statute does not use the words “warrant”
or “probable cause.” Nevertheless, the State argues that, in this case, the BPD’s application
and the resulting order “went far beyond the requirements of the statute.”
The State points out that the BPD application was for an order allowing the police
to employ surreptitious or duplication of facilities, technical devices or
equipment to accomplish the installation and use of a Pen Register\Trap &
Trace and Cellular Tracking Device [. . .] and shall initiate a signal to
determine the location of the subject’s mobile device on the service
provider’s network or with such other reference points as may be
reasonabl[y] available . . .
The State also notes that the resultant order states that probable cause exists to authorize
the use of a “Cellular Tracking Device.” Thus, the State contends that because the pen
register\trap & trace order stated that it was based upon a finding of probable cause, it was,
therefore, “the functional equivalent of a warrant.”
Andrews emphasizes that the order may issue on just a showing “that the
information likely to be obtained by the installation and use is relevant to an ongoing
criminal investigation.” CJP § 10-4B-04(a)(1). In addition to the fact that a pen
register\trap & trace order does not contemplate the use of a cell site simulator, Andrews
points out that it also does not satisfy the requirements that a warrant based on probable
cause be attached to a specific suspected crime, be confined in scope, or describe with
60
particularity the place to be searched or the person to be seized. Andrews contends that
“[t]he moment BPD conducted surveillance with something other than a pen register, it
exceeded the purview of the pen register order.” Further, Andrews contends that BPD’s
application “For an Order Authorizing the Installation and Use of a Device Known as a
Pen Register/Trap & Trace,” was intentionally captioned to ensure that the circuit court
scrutinized it according to the statutory pen register factors. Andrews argues that BPD’s
“disingenuous efforts” hid from the circuit court “the scope, intensity, [and] nature of the
search,” and prevented the court from conducting a proper probable cause analysis.
We begin with our appraisal that an order issued under the pen register statute is not
the equivalent of a warrant based on probable cause—a fact the State implicitly concedes
in its argument that it “went beyond the requirement of the statute.” The applicable
requirements of the statute are contained first in § 10-4B-03:
(b) Contents. — An application under subsection (a) of this section shall
include:
(1) The identity of the State law enforcement or investigative officer
making the application and the identity of the law enforcement agency
conducting the investigation; and
(2) A statement under oath by the applicant that the information likely
to be obtained is relevant to an ongoing criminal investigation being
conducted by that agency.
Additionally, 10-4B-04(a) states that an order may issue if the court finds the information
likely to be obtained by the device is relevant to an ongoing criminal investigation, and the
order must:
(3) Specify the attributes of the communications to which the order applies,
including the number or other identifier and, if known, the location of the
telephone line or other facility to which the pen register or trap and trace
61
device is to be attached or applied, and, in the case of a trap and trace device,
the geographic limits of the trap and trace order;
(4) Contain a description of the offense to which the information likely to be
obtained by the pen register or trap and trace device relates[.]
CJP § 10-4B-04(b)(3) & (4). Plainly, this limited showing falls short of the particularity
required for the issuance of a search warrant. See Illinois v. Gates, 462 U.S. 213, 238
(1983) (“The task of the issuing magistrate is simply to make a practical, common-sense
decision whether . . . there is a fair probability that contraband or evidence of a crime will
be found in a particular place.”); Nero v. State, 144 Md. App. 333, 345-46 (2002) (“General
warrants, of course, are prohibited by the Fourth Amendment. . . . [T]he problem [posed
by the general warrant] is not that of intrusion per se, but of a general, exploratory
rummaging in a person’s belongings. . . . [The Fourth Amendment addresses the problem]
by requiring a ‘particular description’ of the things to be seized.” (quoting Andresen v.
Maryland, 427 U.S. 463, 480 (1976))).
Moving to the State’s argument that the order was sufficient because it went beyond
the requirements of the statute, we start by rejecting the State’s contention that the words
“probable cause” contained in the pen register application and order converted the over-
reaching order into a warrant. The “probable cause” articulated in the resulting order is
merely that “information likely to be obtained . . . is relevant to an ongoing criminal
investigation.” (Emphasis in original). Certainly, while this reflects the standard required
for issuance of an order under CJP § 10-4B-04, it falls far short of the particularity required
to support a search warrant. See Gates, 462 U.S. at 238; Nero, 144 Md. App. at 345-46.
In the information “offered in support of probable cause” the application states:
62
Your Applicant hereby certifies that the information likely to be
obtained concerning [Andrews’s] location will be obtained by learning the
numbers, locations and subscribers of the telephone number(s) being dialed
or pulsed from or to the aforesaid telephone and that such information is
relevant to the ongoing criminal investigation.
Plainly, the State’s use of the Hailstorm device extended far beyond this certification as to
how information concerning Andrews’s location would be obtained.
Here, the State inserted language into its application and proposed order attempting
to, without being specific, obtain court authorization for more than a pen register\trap &
trace order. Although the application does request authorization to use a “Cellular
Tracking Device,” it fails to name or describe any cell site simulator. In fact, there is
absolutely nothing in the application or order that identifies the Hailstorm device, or
provides even a rudimentary description of cell site simulator technology. The application
also failed to identify any geographical limitation to the BPD’s use of the undisclosed
surveillance technology, and did not explain what was to be done with the information
collected. Nor did the application disclose the possibility that the technology employed
may capture the cell phone information (unique serial numbers) of innocent third parties in
range of the target area. Finally, we are troubled that the application for a pen register\trap
& trace order did not fully apprise the circuit court judge from whom it was sought of the
information that it would yield. Based on the application that he received, the circuit judge
was entitled to expect that the results would be a list of telephone numbers that Andrews
called and that called Andrews—not a real-time fix on his location.
We determine that the pen register\trap & trace order in this case failed to meet the
requirements of a warrant. To allow the government to collect real-time location
63
information on an unknown number of private cell phones, without any geographic
boundaries, without any reporting requirements or requirements that any unrelated data be
deleted, and without a showing of probable cause that contraband or evidence of a
particular crime will be found through the particular manner in which the search is
conducted would certainly run afoul of the Fourth Amendment. As stated in our holding
above, unless a valid exception to the warrant requirement applies,22 the government may
not use a cell phone simulator without a warrant or, alternatively, a specialized order that
requires a particularized showing of probable cause, based on sufficient information about
the technology involved to allow a court to contour reasonable limitations on the scope and
manner of the search, and that provides adequate protections in case any third-party cell
phone information might be unintentionally intercepted. To hold otherwise would be to
22
One of the exceptions more commonly relied upon applies when ‘the exigencies
of the situation make the needs of law enforcement so compelling that [a] warrantless
search is objectively reasonable under the Fourth Amendment.’” Kentucky v. King, 563
U.S. 452, 460 (2011) (some internal quotation marks omitted) (quoting Mincey v. Arizona,
437 U.S. 385, 394 (1978)). Maryland has recognized that “[e]xigent circumstances exist
when a substantial risk of harm to the law enforcement officials involved, to the law
enforcement process itself, or to others would arise if the police were to delay until a
warrant could be issued.” Williams v. State, 372 Md. 386, 402 (2002) (citations omitted).
It remains the State’s burden to establish exigent circumstances sufficient to justify a
warrantless search. Wengert v. State, 364 Md. 76, 85 (2001) (citations omitted). We note
that the Supreme Court in Riley, supra, rejected the argument that officer safety, in that
case, presented an exigent circumstance that justified officer’s accessing content on a cell
phone seized in a search incident to arrest. The Court observed that “[t]o the extent dangers
to arresting officers may be implicated in a particular way in a particular case, they are
better addressed through consideration of case-specific exceptions to the warrant
requirement, such as the one for exigent circumstances.” 134 S. Ct. at 2486.
64
abandon the Fourth Amendment by assuming, without any foundation, that the citizens of
Maryland have forfeited their reasonable expectation of privacy in their personal location.
IV.
The Exclusionary Rule
a. The Search Warrant Does Not Survive Removal of the Constitutionally
Tainted Information.
The State contends that the search warrant that was obtained for 5032 Clifton
Avenue was valid because probable cause existed once “Andrews was found in the home.”
According to the State, Andrews was arrested pursuant to a valid arrest warrant and the
police had “the consent of the apparent owner of the home to enter the home to take
Andrews into custody.” Thus, the State argues, “[n]othing about the way in which
Andrews was located negated the probable cause to believe that there could be evidence of
the crimes at that address.”
In riposte, Andrews avers that without the location data provided by the cell site
simulator, “the BPD possessed no nexus between the criminal activity at hand and 5032
Clifton Avenue.” Andrews asserts that, “[b]ecause the search warrant relied entirely on
that nexus, it withers as fruit of the poisonous tree.”
First, we note that where entry into a protected space “was demanded under color
of office” and “granted in submission to authority,” that submission does not equate to a
waiver of a constitutional right. Johnson, supra, 333 U.S. at 13 (citing Amos v. United
States, 255 U.S. 313 (1921). Thus, the existence of an arrest warrant and the consent of
65
the owner of the residence do not, in themselves, diminish Andrews’s protection under the
Fourth Amendment. Nor do they render the later-acquired search warrant unassailable.
Second, the courts of Maryland have recognized that where a search warrant relies
on information obtained in violation of the constitution, the question is “whether ‘after the
constitutionally tainted information is excised from the warrant, the remaining information
is sufficient to support a finding of probable cause.’” Redmond v. State, 213 Md. App.
163, 191-92 (2013) (quoting Williams v. State, 372 Md. 386, 419 (2002)). See also Karo,
468 U.S. at 720-21 (stating that in determining whether evidence seized pursuant to a
contested warrant remains admissible, one of the pertinent questions is whether “the
warrant affidavit, after striking the [constitutionally tainted] facts . . . contained sufficient
untainted information to furnish probable cause for the issuance of the search warrant.”)
Here, there can be no doubt that the only information linking Andrews and 5023 Clifton
Avenue was the fruit of the Fourth Amendment violation. The State presents no credible
argument that evidence of Andrew’s presence in the home was obtained by independent
lawful means.
In Redmond v. State, the BPD were investigating an armed robbery in which a cell
phone was stolen. 213 Md. App. at 169. During their investigation, detectives contacted
the victim’s mobile service provider and, “by triangulating the signal from cell phone
towers in the area, determined that the stolen cell phone was in the proximity of 3303
Round Road.” Id. at 169. Thereafter, detectives began moving from house to house in the
area, speaking to residents using a ruse that they were “looking for a pedophile named
‘Leroy Smalls.’” Id. at 170. After obtaining consent to enter the appellant’s residence
66
under those false pretenses, one of the detectives surreptitiously dialed the number of the
stolen cell phone, heard it ringing upstairs, and then walked through the entire house
conducting a “protective sweep” including opening closet doors and checking under beds.
Id. at 171. Officers then sought a search warrant for the home on the basis of what they had
discovered in the home. Id. at 171-72.
After a careful analysis, we determined that “[b]y dialing the number of the stolen
cell phone and walking upstairs to locate it, the police exceeded the scope of any consent
that was given to their presence inside 3303 Round Road.” Id. at 189-90. Applying the
exclusionary rule, we noted that “all the information . . . attested to in applying for the
search warrant (and on which the search warrant was granted) . . . was discovered during
the initial illegal entry.” Id. at 192. We determined that the search warrant was not issued
based on an independent lawful source and the unlawfully obtained evidence should be
suppressed.23 Id. And, we soundly rejected the argument that evidence in a warrant
23
Although the warrant application in Redmond mentioned reliance on
“sophisticated mobile and/or portable surveillance equipment” to locate the stolen cell
phone, in that case we observed that:
Detective Jendrek did not testify that the ATT used any “sophisticated mobile
and/or portable surveillance equipment” while in the 3300 block of Round
Road. Rather, his testimony was that the ATT detectives confirmed the
precise location of the cell phone by use of ordinary police investigatory
tactics: speaking to the occupants of two houses, dialing the number of the
stolen cell phone, listening for it to ring, and, ultimately, physically observing
the stolen cell phone lying on a dresser.
Thus, to the extent that the averments in the search warrant application
represent that the ATT detectives used “sophisticated” means to locate the
67
application was obtained by independent lawful means “(1) where the officer’s decision to
seek the warrant was prompted by what they had seen during the initial entry; and (2) where
information obtained during that entry was presented to the [judge] and affected his [or
her] decision to issue the warrant.” Id. at 191 (internal quotation marks omitted)
(alterations in Redmond) (quoting Kamara v. State, 205 Md. App. 607, 627-28 (2012). See
also Murray v. United States, 487 U.S. 533, 534 (1988) (“The ultimate question is whether
the search pursuant to warrant was in fact a genuinely independent source of the
information and tangible evidence at issue. This would not have been the case if the agents’
decision to seek the warrant was prompted by what they had seen during the initial entry
or if information obtained during that entry was presented to the Magistrate and affected
his decision to issue the warrant.”).
As in Redmond, here, the evidence that forms the only basis for probable cause in
the State’s search warrant application—that Andrews was at 5032 Clifton Avenue—was
that obtained through an unlawful search—in this case, the BPD’s use of the Hailstorm
device. We agree with the circuit court’s determination that there was no independent
lawful source to establish a nexus between Andrews and the residence. Cf. Agurs v. State,
415 Md. 62, 84 (2010) (stating that “police should have been aware that there must be a
stolen cell phone while at the scene on the afternoon of March 2, 2010, they
are simply inaccurate.
213 Md. App. at 193. The defendant in Redmond did not challenge the use of any such
device or the use of cell tower information. Accordingly, in Redmond we did not address
the use of sophisticated mobile surveillance systems, as we must in the matter sub judice.
68
nexus between criminal activity and the place to be searched.”). Accordingly, once the
constitutional taint is removed from the search warrant in this case, what remains is
insufficient to establish probable cause for a search of 5032 Clifton Avenue and, as
discussed further infra, the evidence seized in that search withers as the fruit of the
poisoned tree. Franks v. Delaware, 438 U.S. 154, 156 (1978) (stating that if “the affidavit’s
remaining content is insufficient to establish probable cause, the search warrant must be
voided and the fruits of the search excluded to the same extent as if probable cause was
lacking on the face of the affidavit.”). Therefore, we affirm the suppression court’s
exclusion of all evidence found at 5032 Clifton Avenue.
b. The State Cannot Rely on the Good Faith Exception
Finally, the State argues that BPD’s relied in good faith on the search warrant issued
for 5032 Clifton Avenue after locating Andrews inside that address. The State asserts that
police officers relied on, first, the pen register\trap & trace order, and, second, on the later
issued search warrant for the premises. The State maintains that “[t]his is good faith
squared[,]” and there is “simply no officer misconduct to deter in this case.” Thus, the
State contends that the exclusionary rule should not apply in this case.
Andrews contends that without the location information provided by the cell site
simulator the BPD possessed no nexus between him and 5032 Clifton Avenue, and,
“[b]ecause the search warrant relied entirely on that nexus, it withers as the fruit of the
poisonous tree.” Andrews asserts that where the information relied on to obtain a warrant
is the product of a Fourth amendment violation, the fruit of the poisonous tree doctrine
69
trumps the good faith exception. Moreover, Andrews argues that good faith cannot apply
where “law enforcement officers, from the outset, dealt dishonestly with the judiciary.”
In United States v. Leon, the Supreme Court held that, where officers have acted in
good faith pursuant to a warrant that was later discovered to be invalid, exclusion is not
warranted to deter police over-reach or misconduct. 468 U.S. 897, 924 (1984). The
Supreme Court cautioned, however, that
[t]he good-faith exception for searches conducted pursuant to warrants is not
intended to signal our unwillingness strictly to enforce the requirements of
the Fourth Amendment, and we do not believe that it will have this effect. As
we have already suggested, the good-faith exception, turning as it does on
objective reasonableness, should not be difficult to apply in practice. When
officers have acted pursuant to a warrant, the prosecution should ordinarily
be able to establish objective good faith without a substantial expenditure of
judicial time.
In Fitzgerald v. State, this Court aptly summarized the “good faith” exception:
Because the only purpose of the Exclusionary Rule of Mapp v. Ohio, 367
U.S. 643, 81 S. Ct. 1684, 6 L. Ed. 2d 1081 (1961), is to deter unreasonable
police behavior, Leon and [Massachusetts v. Sheppard, 468 U.S. 981 (1984)]
held that a mistake made by a judge in issuing a warrant should not be
attributed to the police officer who executes it. Because the officer has been
reasonable in relying on the judge’s legal expertise, it would serve no
deterrent purpose to exclude otherwise competent, material, and trustworthy
evidence. See Connelly v. State, 322 Md. 719, 720–21, 589 A.2d 958 (1991).
153 Md. App. 601, 655-56 (2003) aff’d, 384 Md. 484 (2004). However, this Court
observed that in Karo, supra, the Supreme Court instructed that, if the information obtained
through a Fourth Amendment violation “proved critical to establishing probable cause for
the issuance of the warrant,” it would invalidate the subsequent search warrant for the
house. Id. at 656 (citing Karo, supra, 468 U.S. at 719). Accordingly, “the conclusion may
readily be drawn that in the case of an antecedent Fourth Amendment violation which
70
contributes to a warrant application, the ‘fruit of the poisoned tree’ doctrine ‘trumps’ the
officer’s ‘good faith’ reliance under Leon and Sheppard.” Id.
Here, as we noted above, the BPD submitted an overreaching pen register\trap &
trace application that failed to clearly articulate the intended use, i.e., to track Andrews’s
cell phone using an active cell site simulator. The ensuing order did not support the use of
the Hailstorm device, nor did it, in any way, serve as a de facto warrant for the use of the
Hailstorm device. As the State’s May 15, 2015 supplemental disclosure made clear,
“WATF did not have the Clifton Ave address as a possible location until ATT provided
that information.” Only after receiving that information through the use of the Hailstorm
device and arresting Andrews at the premises did the same BPD officers who submitted
the pen register\trap & trace application then apply for a search warrant.
As Andrews points out, without the antecedent Fourth Amendment violation the
nexus between the residence to be searched and the alleged criminal activity could not have
been established. Cf. Agurs, 415 Md. at 84 (stating that “police should have been aware
that there must be a nexus between criminal activity and the place to be searched.”). In the
present case, the antecedent Fourth Amendment violation was the only basis upon which
the search warrant application stood, and the fruit of the poisoned tree doctrine does,
indeed, trump alleged good faith reliance on the part of BPD. See Fitzgerald, 153 Md.
App. at 656.
The Supreme Court in Leon, was clear that “the officer’s reliance on the magistrate’s
probable-cause determination and on the technical sufficiency of the warrant he issues must
be objectively reasonable.” 468 U.S. at 922. See, e.g., Spence v. State, 444 Md. 1, 12-13
71
(2015) (wherein the police officer, in searching a cell phone and reading text messages
during a search incident to arrest, was acting in good faith reliance on then-controlling
authority in Maryland); Agurs, 415 Md. at 83 (concluding that the good faith exception did
not apply where “no reasonably well-trained police officer could have relied on the warrant
that authorized the search of Agurs’ home.”). We cannot say the BPD officers in this case
reasonably relied on the warrant obtained through their own misleading order application
and unconstitutionally intrusive conduct. To do so would allow law enforcement to
insulate its own errors merely by presenting limited information to a magistrate, obtaining
a warrant post-intrusion, and then re-entering the place to be searched. The good faith
exception to the exclusionary rule seeks to avoid “[p]enalizing the officer for the
magistrate’s error, rather than his own.” Leon, 468 U.S at 921. That is, however, not that
case here. See id. at 919 (“The deterrent purpose of the exclusionary rule necessarily
assumes that the police have engaged in willful, or at the very least negligent, conduct
which has deprived the defendant of some right. By refusing to admit evidence gained as
a result of such conduct, the courts hope to instill in those particular investigating officers,
or in their future counterparts, a greater degree of care toward the rights of an accused.”
(quoting United States v. Peltier, 442 U.S. 531, 539 (1975))).
It is for all of these reasons that we hold that the evidence obtained in the search of
5032 Clifton Avenue is inadmissible as fruit of the poisoned tree and was properly
excluded by the suppression court.
72
JUDGMENTS OF THE CIRCUIT
COURT FOR BALTIMORE CITY
AFFIRMED.
COSTS TO BE PAID BY MAYOR AND
CITY COUNCIL OF BALTIMORE.
73