Opinion
No. 22 M 00595
2023-02-01
IN RE WARRANT APPLICATION FOR USE OF a CANVASSING CELL-SITE SIMULATOR
Alejandro G. Ortega, DOJ-USAO, Chicago, IL, AUSA, Andrew J. Dixon, United States Attorney's Office, Chicago, IL, for United States of America. William Hardwicke, Federal Defender Program, Chicago, IL, for Amicus Federal Defender Program.
Alejandro G. Ortega, DOJ-USAO, Chicago, IL, AUSA, Andrew J. Dixon, United States Attorney's Office, Chicago, IL, for United States of America. William Hardwicke, Federal Defender Program, Chicago, IL, for Amicus Federal Defender Program. MEMORANDUM OPINION AND ORDER BETH W. JANTZ, United States Magistrate Judge
In recent years, the government has submitted warrant applications to courts nationwide seeking authorization to use emerging surveillance techniques and technologies in criminal investigations, including geofences and cell tower dumps. This matter concerns a surveillance technology called a canvassing cell-site simulator, which the government wishes to use in the course of a criminal investigation and on which there is sparse caselaw to date. The Court denied the government's initial warrant application in this matter. The Court now denies the government's revised warrant application and writes to explain its decision.
BACKGROUND
Procedural Background as to the Requested Search Warrant
On July 28, 2022, the government submitted to the Court a search warrant and accompanying application and affidavit seeking to use an investigative technique known as a canvassing cell-site simulator ("CCSS"). The affidavit in support of the warrant application described a criminal investigation, which the Court will only describe in general terms, as the warrant and application remain under seal. The affidavit outlined evidence of criminal activity taking place in Chicago, Illinois, and established probable cause to believe that a specified individual is using one or more unknown cellular devices in furtherance of that activity. The application sought approval of a warrant for use of a canvassing cell-site simulator for up to 30 days to identify and locate the unknown cell phone(s) used by that individual. The warrant identified three locations at which a CCSS could be used to identify the suspect's device(s) "when the officers to whom it is directed have reason to believe that [the suspect] is present": (1) the "surrounding area" of the suspect's residence; (2) the "surrounding area" of any location where law enforcement surveillance observes or has "recently" observed the suspect; and (3) the "surrounding area" where geo-location information for one of the suspect's [other] known cellular devices indicates that that phone is located. Redacted Warrant App., Dkt. 7 at 22. The Court denied the warrant application on July 29, 2022. Dkt. 6. On that same date, the government requested that it be given time to consider whether to re-present with modifications the search warrant and application and affidavit in support of the search warrant.
About a month later, on August 26, the government re-submitted its warrant and application, this time including the additional limitations on use of a CCSS identified in In the Matter of the Use of a Cell-Site Simulator To Identify a Cellular Device in a Narcotics Trafficking Case, No. 22 M 615, 623 F.Supp.3d 888 (N.D. Ill., Aug. 24, 2022) ("Narcotics Trafficking"). See Briefing Order, Dkt. 5. Specifically, the government applied to use a CCSS for up to 30 days during all times of day and night "when the officers to whom it is directed have reason to believe that [the suspect] is present," Redacted Warrant App., Dkt. 7 at 22, in the following locations: (1) within a quarter-mile radius of the suspect's residence; (2) within a quarter-mile radius of any location where law enforcement physically sees the suspect; and (3) within a quarter-mile radius of any location where law enforcement has physically seen the suspect within the last 30 days. See Gov. Br., Dkt. 8 at 2. The government also included that it would take no further investigative steps with respect to the device identifiers collected via use of the CCSS until after the identifiers for the suspect's device(s) had been captured at multiple locations and/or multiple times at a common location. Id. Finally, the government proposed that once investigators ascertained the identity of the suspect's device(s), they would end the collection and delete (within an unspecified time period) any information collected concerning any other cellular device other than the suspect's device(s). Id.
On September 1, 2022, this Court issued an order directing the government to file a brief in support of the warrant application. Dkt. 5. The Court also invited the Federal Defender Program for the Northern District of Illinois to file an amicus brief following the government's submission. To enable the Federal Defender Program to submit an amicus brief without revealing any sensitive details of the underlying criminal investigation, the Court instructed the government to submit to the Court a redacted version of the warrant and the application and affidavit in support of the search warrant. The redacted materials were transmitted to the Executive Director of the Federal Defender Program. The Court's briefing order also instructed amicus to assume that the suspect's residence is in Chicago, Illinois, without providing any additional information regarding the suspect's location. Id. at 1.
The Court's order identified numerous issues for which the Court sought briefing from the government and amicus, including: (1) an explanation of the capabilities of a CCSS, including the size and user density of its coverage area; (2) how or whether the warrant application meets the Fourth Amendment's particularity requirements; (3) the standard for probable cause the government must demonstrate for the warrant to issue; and (4) whether the warrant sufficiently cabined investigators' discretion in executing the warrant. The Court instructed the government and amicus that they need not brief whether the use of a CCSS constitutes a search under the Fourth Amendment, given that the government had requested a search warrant based on probable cause. The Court also instructed the government and amicus that they need not brief the existence of probable cause for the criminal offense(s) alleged in the warrant application.
The Court thanks counsel for the government and amicus—specifically AUSAs Andrew J. Dixon, Alejandro Ortega, and Vikas Didwania, and attorneys William Hardwicke and Sarah Walker on behalf of the Federal Defender Program—for their thoughtful submissions.
What This Opinion Will Not Address
As the Court indicated in its briefing order, this opinion will not address whether, or the circumstances under which, the use of a cell-site simulator constitutes a search under the Fourth Amendment. Whether CSS use constitutes a Fourth Amendment search presents an interesting and open question on which only a handful of courts have opined. See, e.g., United States v. Ellis, 270 F. Supp. 3d 1134, 1146 (N.D. Cal. 2017) (use of CSS in location mode is a Fourth Amendment search requiring a warrant); United States v. Lambis, 197 F. Supp. 3d 606, 611 (S.D.N.Y. 2016) (same); United States v. Woodson, No. 4:16CR541AGF(SPM), 2018 WL 7150388, at *9 (E.D. Mo. Nov. 21, 2018), report and recommendation adopted, No. 4:16CR541AGF(SPM), 2019 WL 398453 (E.D. Mo. Jan. 31, 2019) (use of a CSS in canvassing mode "does not give rise to the same privacy and Fourth Amendment concerns articulated in Carpenter," and thus requires only a pen register order as opposed to a search warrant). In United States v. Patrick, the Seventh Circuit discussed—but did not decide—whether use of a cell-site simulator constituted a Fourth Amendment search. 842 F.3d 540, 543-44 (7th Cir. 2016). And in its most recent explication of the interaction between the Fourth Amendment and technology, the Supreme Court expressly left open the question of whether the government's efforts to obtain "real-time" cell-site location information ("CSLI") or "tower dumps" constituted a search, even as it determined that a warrant was required to obtain historical CSLI over a certain period of time. See Carpenter v. United States, — U.S. —, 138 S. Ct. 2206, 2220, 201 L.Ed.2d 507 (2018); see also United States v. Caira, 833 F.3d 803, 808-09 (7th Cir. 2016) (decided before Carpenter, but noting that the two concurring opinions in Jones, signed by five Supreme Court justices, "expressed the view that technology has changed the constitutional calculus" about whether monitoring a person's movements on public streets could amount to a "search").
The Court need not wade into this issue, however, because in this case, the government asks the Court to approve a search warrant for use of a canvassing cell-site simulator—and thus must meet all of the attendant Fourth Amendment requirements for obtaining a search warrant. See, e.g., Matter of Search of Info. Stored at Premises Controlled by Google, 481 F. Supp. 3d 730, 740 (N.D. Ill. 2020) ("Google II") (declining to reach question of whether proposed geofence constituted a search where government sought a search warrant); Matter of Search of Info. that is Stored at Premises Controlled by Google LLC, 579 F. Supp. 3d 62, 74 n. 14 (D.D.C. 2021) ("Google III") (noting that the court "need not take a position" on whether a geofence requires a warrant because "the government has applied for a warrant"). The Court notes that the government spent a substantial portion of its opening brief asserting that the proposed use of a canvassing cell-site simulator does not implicate any Fourth Amendment interest whatsoever. See Gov. Br., Dkt. 8 at 10-14. Under the government's view, no warrant is necessary, and it may use a cell-site simulator in the manner identified in the warrant and application without the Court's imprimatur. The Application and Affidavit also notes that a "search warrant may not be legally necessary to compel the investigative technique described herein. Nevertheless, I hereby submit this warrant application out of an abundance of caution." Redacted Warrant App., Dkt. 7 at 21. In any case, the government—in accordance with Department of Justice policy—did ask for a search warrant, so the Court does not reach the issue of whether the use of a canvassing cell site simulator constitutes a Fourth Amendment search. The Technology of Canvassing Cell-Site Simulators , and How They Are Different From Location Cell-Site Simulators
See United States Department of Justice, Department of Justice Policy Guidance: Use of Cell-Site Simulator Technology (Sept. 3, 2015) ("DOJ Guidance"), available at https://www.justice.gov/opa/file/767321/download ("While the Department has, in the past, appropriately obtained authorization to use a cell-site simulator by seeking an order pursuant to the Pen Register Statute, as a matter of policy, law enforcement agencies must now obtain a search warrant supported by probable cause and issued pursuant to Rule 41 of the Federal Rules of Criminal Procedure (or the applicable state equivalent), except as provided below."). One of the exceptions that the government cites is exigent circumstances, which in its view "can vitiate a Fourth Amendment warrant requirement . . . . When an officer has the requisite probable cause, a variety of types of exigent circumstances may justify dispensing with a warrant. These include the need to protect human life or avert serious injury; the prevention of the imminent destruction of evidence; the hot pursuit of a fleeing felon; or the prevention of escape by a suspect or convicted fugitive from justice." Id.
Unless where otherwise noted, the factual information in this section is drawn from the government's redacted Application and Affidavit for a Search Warrant, as well as any unrebutted information in the parties' briefs.
Cellular phones and other cellular devices (e.g., tablets or iPads that have cellular service) communicate wirelessly across a network of cellular infrastructure, including towers ("cell towers") that route and connect communications. Redacted Warrant Application and Affidavit ("App."), Dkt. 7 ¶ 35. Cell phones broadcast certain signals to cell towers that route communication. Id. Among these signals is a unique device identifier—a long string of numbers—specific to each cellular device, known as an International Mobile Subscriber Identity ("IMSI"). Id. A cell-site simulator ("CSS") is a device that imitates a cell tower, sending signals to nearby cellular devices, which in turn will broadcast signals that include their unique device identifiers. Id. ¶ 36; see also United States v. Patrick, 842 F.3d 540, 542 (7th Cir. 2016) (noting that a CSS "pretends to be a cell-phone access point and, by emitting an especially strong signal, induces nearby cell phones to connect and reveal their direction relative to the device"). A CSS functions by attempting to emit a more attractive signal than a cell tower, such that devices in the proximity of the CSS connect to the CSS rather than a cell tower. Gov. Br. at 10. A cellular device need not be in active use to connect to a cell-site simulator—just as a cell phone automatically connects to a cell tower for service once it is turned on, an idle cell phone will still connect to a CSS if it determines the CSS is the most attractive cell site. Gov. Br. at 3-4. Unlike a cell tower, however, a CSS is not connected to a cellular network and cannot be used to communicate with others. App. ¶ 36. When law enforcement uses a CSS, it may interrupt cellular service of cellular devices in the CSS's immediate vicinity. Id. ¶ 37.
Generally, cell-site simulators can serve two purposes in a law enforcement investigation. First, a cell-site simulator may be used to locate a cellular device with already known identifiers. Gov. Br. at 5. When a cell-site simulator is used in this way, it is referred to as a "location" cell-site simulator. Although a cell-site simulator cannot identify specific GPS coordinates of a known cellular device, it can identify the strength of the known cellular device's signal, as well as the direction in which the cellular device is located. Id. When coupled with prospective cell-site information provided by a wireless service carrier (based on a separate warrant), investigators can use the data gleaned from a cell-site simulator to obtain more precise information about where a device user is located. Id.
Second, a cell-site simulator can be used to identify an unknown cellular device's IMSI. Gov. Br. at 5. When a cell-site simulator is used in this way, it is referred to as a "canvassing" cell-site simulator ("CCSS"). When a cellular device connects with a cell-site simulator as it would a cell tower, the cell-site simulator obtains the device's IMSI. Id. at 5-6. Because the specific device sought by law enforcement is not yet known at the time the CCSS is used, the CCSS obtains the IMSIs associated with each of the devices within the CSS's coverage area. Then, depending on the location of the unknown device and the manner in which the cell-site simulator is used, law enforcement officials may be able to use the information obtained by the CCSS to identify the IMSI of the specific target device. In addition to identifying the cellular device, the IMSI also reveals the associated device's network provider, allowing the government without any further information or data to subpoena the provider for de-anonymized subscriber information based on the IMSI. Id. at 4. This subscriber information includes the device's phone number and the name and address associated with the device's account (though the account may not be registered to the target). See Gov. Reply Br. at 9 n. 5; see also DOJ Guidance at 2 (noting that "subscriber account information" includes an account holder's name, address, and telephone number). The warrant requested by the government in this matter is for a canvassing cell-site simulator, to be used by law enforcement to identify the unknown cellular device (or devices) used by a suspect who resides in Chicago, Illinois.
Courts and commentators have expressed concerns about law enforcement use of cell-site simulators. See, e.g., Patrick, 842 F.3d at 552 ("It is time for the Stingray [a cell-site simulator brand name] to come out of the shadows, so that its use can be subject to the same kind of scrutiny as other mechanisms, such as thermal imaging devices, GPS trackers, pen registers, beepers, and the like. Its capabilities go far beyond any of those . . . .") (Wood, J., dissenting); In the Matter of the Application of the United States of Am. for an Ord. Relating to Telephones Used by Suppressed, No. 15 M 0021, 2015 WL 6871289, at *3 (N.D. Ill. Nov. 9, 2015) ("Telephones Used by Suppressed") (Johnston, M.J.) ("[T]he Court believes that a process must be created to reasonably ensure that innocent third parties' information collected by the use of a [canvassing] cell-site simulator is not retained by the United States or any government body. The concern over the collection of innocent third parties' information is not theoretical. It has been reported that the federal government collects telephone numbers, maintains those numbers in a database and then is very reluctant to disclose this information."); see also Carrie Leonetti, A Hailstorm of Uncertainty: The Constitutional Quandary of Cell-Site Simulators, 85 U. Cin. L. Rev. 665 (2017); Brian L. Owsley, Triggerfish, Stingrays, and Fourth Amendment Fishing Expeditions, 66 Hastings L.J. 183 (2014). When used in canvassing mode, a CCSS will capture the IMSIs of a potentially large number of devices belonging to individuals who are uninvolved in criminal activity, as investigators try to distinguish which is the target device. Canvassing cell-site simulators thus pose a risk to the privacy rights of innocent third parties whose location (and possibly via subpoena subscriber) data is collected en masse by investigators as part of their effort to identify a single device (or a small number of devices) used by a criminal suspect.
The geographic range within which a CCSS captures IMSIs and location of cellular devices varies based on conditions at the time of collection (such as the time of day, weather conditions, volume of cellular devices connecting to nearby towers, power of and distance from nearby cell sites, network load, and signal strength set by the operating technician). Gov. Br. at 8-10. The government explains that "the CCSS may capture the same number of IMSI regardless of whether the CCSS is a quarter mile from the target, versus a mile from the target," depending upon these variables. Id. at 8. But, with exceptions such as rural areas, a CCSS is likely to cast a wide net so that law enforcement may try to identify a narrow sliver of information. To illustrate, one study cited by amicus estimated that the median range of an urban cell tower (tested in Milwaukee and Seattle) as 1303 meters (roughly .81 miles), with a mean range of 1731 meters (roughly 1.07 miles). Because a CCSS works by attempting to emit a more attractive signal than a cell tower, it is likely that a CCSS' range would be at least similar or perhaps even slightly greater, covering large swaths of urban neighborhoods in densely populated cities, such as Chicago.
See Peter Ney et. al, SeaGlass: Enabling City-Wide IMSI-Catcher Detection, Proceedings on Privacy Enhancing Technologies (2017), at 45-46, available at https://techpolicylab.uw.edu/wp-content/uploads/2018/07/SeaGlass-Enabling-City-Wide-IMSI-Catcher-Detection.pdf.
The government candidly admits and explains that it cannot "provide this Court with a precise answer regarding (a) the size of the area containing phones that would connect to the CCSS, or (b) the number of subscribers within that area," due to the variables noted above. Gov. Br. at 8. The government also explains that "a CCSS cannot be aimed, and it captures radio signals from all directions" and that it "cannot be configured precisely enough to, for example, zero in on just the target's residence or even just the target's block." Gov. Br. at 10. Although the Court therefore cannot calculate the precise range or coverage area of a CCSS, the Court notes that even a conservative estimate of the CCSS's range in this case could result in thousands or tens of thousands of individuals' device identifiers and locations collected by the CCSS, as follows. The Census Bureau identifies Chicago's 2020 population density at 12,059.8 people per square mile. If a CCSS has an actual coverage range of one mile, and thus could capture data from devices within a land area of approximately 3.14 square miles, using a CCSS at an average density location in Chicago could capture data from devices belonging to over 37,000 individuals. Given the nature of a dense, urban area such as Chicago, it is virtually certain that the CCSS would capture identifying and location data from uninvolved devices located in residences, businesses, government buildings, places of worship, and any other kind of establishment that exists in a city like Chicago. Even if a CCSS has a range of only .25 miles, and thus captures devices within only a roughly .2 square mile area, a CCSS could capture data from devices from over 2,000 individuals in an average density area of Chicago. These are, of course, very rough estimates and are subject to the variables noted above, but they demonstrate the basic magnitude of the endeavor for which the government seeks approval. In fact, these may be underestimates, given that the warrant proposes to use a CCSS near the suspect's residence (which is presumably in a residential—and thus more populated—area, as opposed to an industrial area with less density), and given that the warrant would permit CCSS use anywhere the suspect is seen (which could, hypothetically, include downtown Chicago during working hours or the United Center during a Bulls game). For instance, the following graphic (provided by amicus) demonstrates the potential reach of a CCSS, assuming a conservative .25-mile radius from a target location (a post office), if used in downtown Chicago:
See United States Census Bureau, Quick-Facts Chicago, Illinois, United States (July 1, 2021), available at https:// www.census.gov/ quickfacts/fact/table/chicagocityillinois,US/PST045221 .
The Court uses a one-mile radius as an example of a possible estimate of a CCSS's geographic reach, for the following reasons. Although the search warrant, as amended, seeks leave to use a CCSS within a quarter-mile of various locations, the distance between the CCSS and a location does not reflect the geographic range within which the CCSS can capture information from cellular devices. The government expressly noted that a "CCSS may capture the same number of IMSI regardless of whether the CCSS is a quarter mile from the target, versus a mile from the target." Gov. Br. at 8. In other words, proximity radius does not necessarily equal coverage area. And given the average range of an urban cell tower, as noted above, and the fact that a CCSS must be more attractive than a cell tower to entice devices to connect, the Court concludes that a one-mile radius is a rough, but plausible enough, estimate of a CCSS's range to use for demonstrative purposes.
The Court calculates land area using the pr² formula, and assumes that most individuals own or use a cellular device, except for small children, see, e.g., Carpenter, 138 S. Ct. at 2220 (carrying a cell phone is "indispensable to participation in modern society").
Image materials not available for display. Among other buildings, a CCSS used at the center of this image would cover landmarks such as the Rookery Building, the Chicago Board of Trade Building, the Palmer House Hilton Hotel, the Harold Washington Library, and the Dirksen Federal Courthouse. Also keep in mind that the foregoing calculations are for usage of the CCSS at one fixed location at one point in time, and that the government has proposed to use the instant CCSS for different locations for up to 30 days. Indeed, although the Court's calculations are rough and included here for explanatory purposes, the government does not meaningfully dispute that using a CCSS could capture data from some indeterminate large number of devices. See, e.g., Gov. Br. at 8-10 (noting that using a CCSS in some circumstances "will result in an exponentially greater number of cellular devices connecting to the CCSS" than other circumstances would, and noting that the nearby cell activity "might yield a higher quantity" of devices connecting to the CCSS even if law enforcement expects a "relatively low quantity").
Contrast the geofence, which has been the subject of an increasing number of judicial opinions. In recent years, law enforcement has requested and at times obtained search warrants for location information transmitted from cellular devices to Google. In a typical geofence case, law enforcement requests a warrant for Google to provide anonymized information about the Google-connected devices that were present within a finite area during a particular time period. Once the government receives the anonymized data, it can subpoena Google for the subscriber information associated with certain devices that appeared within the geofence. Geofence requests are often targeted at a single building or a narrow stretch of road for usually one partial day at most. Compare Matter of Search of Info. Stored at Premises Controlled by Google, as further described in Attachment A, No. 20 M 297, 2020 WL 5491763 (N.D. Ill. July 8, 2020) ("Google I") (denying a warrant application for a geofence with a 100-meter radius during three forty-five minute periods of time on three different dates), with Matter of Search Warrant Application for Geofence Location Data Stored at Google Concerning an Arson Investigation, 497 F. Supp. 3d 345 (N.D. Ill. 2020) ("Arson Investigation") (approving a geofence warrant limited to discrete properties and short stretches of roadway for periods in the middle of two nights, when it was unlikely that many people other than the suspects or witnesses would be present). Although a geofence has a margin of error—in Arson Investigation, Google identified it as approximately 20 meters when a user has a strong GPS signal, 497 F. Supp. 3d at 360—a geofence can be narrow and targeted in both geographic area as well as time period. Where a geofence can be a fine-tip pen, a CCSS is often a Sharpie.
The precise capabilities of a cell-site simulator (including the specific cell-site simulator the government seeks to use here) are fuzzy, and appear to depend in part upon the generation of the technology law enforcement utilizes. Until around 2020, most cell-site simulators used by law enforcement—which were sold under brand names including Stingray, Triggerfish, Kingfish, and Hailstorm—were produced by a single company, Harris Corporation, which required government agencies to enter into non-disclosure agreements to obtain the technology. Public reports suggested that the versions of the cell-site simulator sold to the federal government—as opposed to local and state governments—were capable, when configured in a certain mode, of intercepting not only the identifiers and rough location of each captured device, but also numbers calling in and out and the content of communications made through the device. Indeed, a 2005 Department of Justice Electronic Surveillance Manual noted that "Digital analyzers/cell site simulators/triggerfish and similar devices may be capable of intercepting the contents of communications and, therefore, such devices must be configured to disable the interception function, unless interceptions have been authorized by a Title III order." The Court, of course, expects and assumes that law enforcement uses cell-site simulators (and, indeed, all surveillance technology) in compliance with the law and within any limitations set by the courts. Indeed here, the government's requested warrant expressly notes that it "does not authorize the interception of any telephone calls, text messages, or other electronic communications[.]" Redacted Warrant App., Dkt. 7 at 23.
See Dell Cameron & Dhruv Mehotra, Cops Turn to Canadian Phone-Tracking Firm After Infamous 'Stingrays' Become 'Obsolete', Gizmodo (Oct. 23, 2020), available at https:// gizmodo.com/american-cops-turns-to canadian-phone-tracking-firm-aft-1845442778; see also In the Matter of the Application of the United States of Am. for an Ord. Relating to Telephones Used by Suppressed, No. 15 M 0021, 2015 WL 6871289, at *1 (N.D. Ill. Nov. 9, 2015) ("Harris requires law enforcement officers, and others, to sign non-disclosure agreements (NDAs) regarding the devices.").
Id.
United States Department of Justice, Electronic Surveillance Manual (June 2005), available at https://www .justice .gov/sites/default/fi les/criminal/legacy/2014/10/29/elec-surmanual.pdf; see also Patrick, 842 F.3d at 547 (explaining that a CSS, with certain software, "can capture 'emails, texts, contact lists, images,' " and "can eavesdrop on telephone conversations and intercept text messages") (Wood, J., dissenting).
The Department of Justice's Cell-Site Simulator policy notes that "cell-site simulators used by the Department must be configured as pen registers, and may not be used to collect the contents of any communication." United States Department of Justice, Department of Justice Policy Guidance: Use of Cell-Site Simulator Technology (Sept. 3, 2015), available at https://www.justice.gov/opa/file/767321/download. This suggests that at least some cell-site simulators used in DOJ-involved investigations may be capable of being configured to collect the contents of communications, but that DOJ policy is to configure them otherwise.
DISCUSSION
I. Relevant Caselaw and Considerations
In addressing the government's warrant application for use of a CCSS, the Court does not write on a blank slate. In United States v. Sanchez-Jara, 889 F.3d 418, 419 (7th Cir. 2018), the Seventh Circuit confronted the argument that a warrant authorizing use of a location cell-site simulator was an impermissible general warrant because it permitted law enforcement to follow the particular device wherever it went. The court rejected that argument, explaining that "a warrant authorizing police to follow an identified phone, to see where it goes and what numbers it calls, particularly describes the evidence to be acquired. It is no different in principle from a warrant authorizing a GPS device that enables police to track the location of a moving car, and none of the Justices in United States v. Jones, 565 U.S. 400, 132 S.Ct. 945, 181 L.Ed.2d 911 (2012), saw any problem with such a warrant." Sanchez-Jara, 889 F.3d at 421 (emphasis added). The use of a location cell-site simulator, according to the Sanchez-Jara court, "is not an open-ended authorization for public officials to rummage where they please in order to see what turns up." Id.
But a canvassing cell-site simulator may more closely resemble the kind of "rummaging" that the Sanchez-Jara court suggested is impermissible. At least when used in a dense urban area, a CCSS operates by gathering the signaling information of many uninvolved devices for the purpose of trying to distinguish and identify the target device. On the other hand, when a cell-site simulator is used to locate and track an already known device, "a cell-site simulator initially receives the unique identifying number from multiple devices in the vicinity of the simulator. Once the cell-site simulator identifies the specific cellular device for which it is looking, it will obtain [and presumably track] the signaling information relating only to that particular phone." Patrick, 842 F.3d 540, 543 (7th Cir. 2016) (quoting DOJ Guidance) (emphasis added). By contrast, when used in canvassing mode to identify an unknown device, "the cell-site simulator obtains signaling information from non-target devices in the target's vicinity" to enable agents to distinguish the target device. Id.
The Patrick court evidently considered a location cell-site simulator, not a canvassing cell-site simulator. The court noted that "Patrick's location had been pinned down using data from a cell-site simulator," explained that the machine may have discarded extraneous information "before alerting officials to the presence of the sought-after person," and indicated that the warrant at issue implied that law enforcement "planned to track [Patrick] down using his phone company's data"—all of which suggests that the government used a CSS to track a device with a known number. Patrick, 842 F.3d at 542-544. Nor does the Patrick opinion ever suggest that a CSS was used to obtain Patrick's device's IMSI. Indeed, to identify Patrick's device's IMSI, the government would have needed information about where Patrick was located, which evidently was not the case—conversely, the government needed to use the CSS to locate Patrick. Consequently, it appears, and the government does not contest, Gov. Br. at 17, that Patrick considered a location cell-site simulator, and not a canvassing cell-site simulator.
Thus, a warrant for use of a location cell-site simulator contains an inherent limitation—law enforcement is permitted to track only the signal emitted by a specific, known device identified in the warrant. A warrant for use of a canvassing cell-site simulator, by contrast, contains no such inherent limitation. Indeed, a CCSS cannot track only a known device because -- by definition -- it is being used in order to identify and locate an unknown device by distinguishing it from other devices. Unless a court imposes additional restrictions on when and where the CCSS may be used, and what data the government may seize, law enforcement could and indeed may need to continue to gather and keep signaling information about a potentially indeterminate number of uninvolved device users, for up to the entire time period authorized by the warrant, in order to try to distinguish the target device. A CCSS thus by its operation presents a unique and more serious concern about uninvolved third parties than does the location cell-site simulator addressed in Sanchez-Jara and Patrick.
The warrant requested in this case would not allow law enforcement to obtain a cellular device's contents or intercept the contents of communications made through the device: it expressly "does not authorize the interception of any telephone calls, text messages, or other electronic communications." Redacted Warrant, Dkt. 7-1 at 4. So while use of a CCSS implicates privacy concerns, it does not pose as serious an intrusion as does the search of the actual contents of a phone, which can reveal all "the privacies of life"—search histories, private communications, diaries, prescriptions, bank statements, and so on. Riley v. California, 573 U.S. 373, 394-95 & 403, 134 S.Ct. 2473, 189 L.Ed.2d 430 (2014). But neither does the use of a CCSS -- at least as identified in the requested warrant -- merely reveal "information that reflect[s] a person's location in one moment in time," as the government suggests. Gov. Br. at 13. The requested warrant would permit law enforcement to use a CCSS for up to 30 days, when they have reason to believe the suspect is present, near the suspect's residence or any place the suspect is or has been seen within the last 30 days by law enforcement—at least until law enforcement agents, in their own discretion, decide they have "ascertain[ed] the identity of the Target Cellular Device." Redacted Warrant App., Dkt. 7 at 23. At that point, the government could use the collected IMSI(s) to obtain subscriber information from cellular provider(s) via subpoena(s), for any that the investigators deem to be the Target Device. A CCSS thus may enable the government to learn about not only the location "in one moment in time" of a suspect—and, potentially, uninvolved third parties—but also their movements and patterns of location over potentially a 30-day period. While the government has provided the Court with little information about the specific cell-site simulator (or generation of simulator) it intends to use, the government has represented that a CCSS "cannot be configured precisely enough to, for example, zero in on just the target's residence or even just the target's block." Gov. Br. at 10. The government also explains, however, that information gleaned from a simulator, when combined with prospective CSLI from a service provider (authorized by a separate warrant), can identify a suspect's location with more precision than within just "blocks in an area." Gov. Br. at 5. Although the government could not get warrant-authorized prospective CSLI from a service provider until it identifies the target device and phone number, it seems possible that the government could later combine its CCSS data with historical CSLI obtained via a separate warrant to increase its ability to more precisely track an individual's movements over time.
The term "Target Cellular Device," as defined in the warrant application, includes "the cellular device or devices carried by" the target. Redacted Warrant App., Dkt. 7 at 1. The warrant thus does not limit the government to taking further investigative steps with respect to just one device; the "Target Cellular Device" can in fact be multiple devices.
Based on the foregoing capabilities, a CCSS could potentially reveal, or be used to reveal, when an individual is at or near a place of worship, their significant other's house, a cannabis dispensary, a political rally, or their own home—the space in which the Fourth Amendment's protections are at their paramount. See, e.g., Kyllo v. United States, 533 U.S. 27, 37, 121 S.Ct. 2038, 150 L.Ed.2d 94 (2001) ("In the home, our cases show, all details are intimate details, because the entire area is held safe from prying government eyes."). This Court need not resolve any dispute over what level of location precision can be collected by using a CCSS. Nor likely could it, given the variables—network conditions, weather conditions, and simulator settings and configuration, among others—that can change with each use of a CCSS. It is enough to observe that the government must find the locational data that can be gleaned using a CCSS sufficiently helpful to make its use worthwhile, and that there is a concomitant privacy interest of device users in that location data. And unless clear standards are imposed limiting where the government may search and what information harvested by a CCSS may be seized, there is a substantial risk that this data collection will extend to many uninvolved third parties—and potentially an indeterminate number of them. See, e.g., Telephones Used by Suppressed, 2015 WL 6871289, at *3 (expressing concern about use of a CCSS in crowded areas, such as a high school graduation or sporting event). These considerations lead into an analysis of the particularity and breadth of the requested warrant, as will be discussed more fully below.
Case law addressing canvassing cell-site simulators is fairly limited, especially at the warrant stage. The Seventh Circuit's opinions in Patrick, 842 F.3d at 542-44, and Sanchez-Jara, 889 F.3d at 418, addressed location cell-site simulators but did not address canvassing cell-site simulators. In this District, two judges have opined on the kinds of limitations on CCSS use that appropriately balance law enforcement and Fourth Amendment interests. See Narcotics Trafficking, 623 F.Supp.3d 888; Telephones Used by Suppressed, 2015 WL 6871289. Also instructive, however, are cases addressing other relatively new surveillance technologies used by law enforcement to track cellular devices, including geofences and tower dumps. As noted above, a geofence can provide historical location information for Google-connected devices that appeared in a given area in a given time period. A tower dump can provide historical CSLI for cellular devices that connected to a particular cell tower during a particular time interval. See Carpenter, 138 S. Ct. at 2220 (defining a tower dump as "a download of information on all the devices that connected to a particular cell site during a particular interval"); see also United States v. Adkinson, 916 F.3d 605, 610-11 (7th Cir. 2019) (per curiam) (affirming denial of suppression of a warrantless tower dump conducted by a private party). The data that can be gleaned by use of these techniques is similar to that of cell-site simulators -- relative location of a device at certain points in time.
True, there is a distinction between historical CSLI—which could be used to track an individual's past movements for months or years or whatever is the requested period of time—and the real-time data captured by a CCSS. Compare Carpenter, 138 S. Ct. at 2223 (noting the "depth, breadth, and comprehensive reach, and the inescapable and automatic nature of" the collection of the voluminous historical CSLI at issue), with United States v. Hammond, 996 F.3d 374, 389 (7th Cir. 2021) (distinguishing Carpenter from CSLI collection that consisted of real-time "pings" of the location of the suspect's phone for six hours, where law enforcement "only collected location data that [the defendant] had already exposed to public view while he travelled on public, interstate highways and into parking lots within the public's view," and distinguishing the use of real-time CSLI "to examine the defendants' movements inside of a home or other highly protected area"). In a practical sense, though, a canvassing cell-site simulator may be more akin to collection of historical CSLI than real-time CSLI: although device identifiers are gathered in real-time when law enforcement uses a CCSS, law enforcement does not know which device is the target device when they are using a CCSS. By the time law enforcement has gathered enough information to distinguish and identify the target device (and subpoena the service provider for corresponding phone number and subscriber information), the CSLI law enforcement has received is effectively historical rather than real-time.
The Court thus, for several reasons, finds that authority addressing geofences and tower dumps is instructive in assessing the use of a canvassing cell-site simulator. First, as noted above, as a practical matter, a CCSS leads to collection of the same kind of historical CSLI as tower dumps and geofences. Second, all of these technologies -- geofences, tower dumps, and canvassing cell-site simulators -- seek blanket information about cellular device activity occurring in or near a specified area for the purpose of identifying a particular suspect or device. And by their operation, each of these surveillance tools is likely to capture information about individuals that are uninvolved in any criminal activity, giving rise to concerns about the particularity and overbreadth of any warrant permitting their use. See Narcotics Trafficking, 623 F.Supp.3d at 890-91 (noting that a CCSS warrant application "implicates the same concerns" about capturing "location data of those uninvolved in any criminal activity" that geofence applications do). The same question thus arises with respect to geofences, tower dumps, and canvassing cell-site simulators: how narrowly (or not) must a warrant be drawn to ensure that the probable cause, particularity, and breadth requirements of the Fourth Amendment are satisfied?
The government suggests that geofence cases are unhelpful because a geofence can identify the location of an individual more precisely than a CCSS can. Gov. Reply Br. at 5 n.4. But the government identifies no reason why that distinction as to precision—which is possibly disputed as noted above—renders geofence cases inapposite. There is no reason to believe that application of the probable cause, particularity, and overbreadth requirements of the Fourth Amendment would be materially different between a surveillance mechanism that can locate devices within 20 meters (the geofence margin of error mentioned in Arson Investigation, 497 F. Supp. 3d at 360), and one that can locate devices within a larger margin of error but still precisely enough to be useful to investigators, as CCSS data necessarily is given investigators' continued use of the technique.
With these general considerations in mind, the Court addresses the government's revised warrant application in this matter.
II. For what is probable cause needed for a canvassing cell-site simulator warrant to issue?
The Fourth Amendment enshrines the "right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures." U.S. Const. amend. IV. As such, "no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized." Id. Accordingly, two foundational issues that must be addressed in assessing any warrant are probable cause and particularity. See Kentucky v. King, 563 U.S. 452, 459, 131 S.Ct. 1849, 179 L.Ed.2d 865 (2011).
With this in mind, the Court asked the government and amicus to address the standard for probable cause the government must show for a CCSS search warrant to issue, assuming already that there was probable cause that the alleged offense(s) had occurred. Dkt. 5. Specifically, the Court asked whether the government must demonstrate (1) probable cause for all of the data that will be collected by the cell-site simulator; (2) probable cause only that evidence of a crime(s) will be found within that data; (3) probable cause only that evidence of a crime(s) will be found at the 3 specified locations; or (4) some other formulation of probable cause. Id. The government answered that "a CCSS warrant must be supported by probable cause to believe that use of the CCSS will lead to evidence of a particular criminal offense." Gov. Br. at 20. Amicus answered that the government "must establish individualized probable cause for each cell phone that it seeks to search." Amicus Br. at 13. The Court finds neither approach wholly compelling, however.
Amicus's preferred test—that the government must establish probable cause for each individual cellular device whose data would be collected by the CCSS—is derived (in part) from Ybarra v. Illinois, 444 U.S. 85, 100 S.Ct. 338, 62 L.Ed.2d 238 (1979), and its progeny. Amicus Br., Dkt. 10 at 11-21; see, e.g., United States v. Chatrie, 590 F. Supp. 3d 901, 928-34 (E.D. Va. 2022) (finding that a geofence warrant improperly issued because the government did not establish probable cause as to each individual within the geofence, but ultimately declining to suppress geofence evidence based on the good faith exception). In Ybarra, the Supreme Court ruled that probable cause to search a location does not equate to probable cause to search each individual at that location. 444 U.S. at 91, 100 S.Ct. 338. This is so because "a person's mere propinquity to others independently suspected of criminal activity does not, without more, give rise to probable cause to search that person." Id. The District Court in Chatrie applied this rule in calling into question a geofence warrant that the government had previously obtained. Because the geofence warrant enabled the government to obtain subscriber information for any Google user who entered the geofenced area during the identified periods, irrespective of whether the government had probable cause to believe the user was involved in criminal activity, the court theorized that the warrant had not been supported by probable cause. Chatrie, 590 F. Supp. 3d at 928-34. So too, according to amicus, would a CCSS warrant impermissibly permit law enforcement to obtain subscriber information for cellular device users for whom the government has no probable cause to believe that they committed the alleged offense(s).
This argument, however, seems to rely on the idea that the use of a CCSS is akin to a search of the body of a person. The typical standard for a search warrant is that there must be probable cause that evidence of a crime will be found in the place to be searched. See, e.g., Taylor v. Hughes, 26 F.4th 419, 429 (7th Cir. 2022) ("Probable cause exists, we have explained, when a reasonably prudent person would believe that contraband or evidence of a crime will be found in the place to be searched.") (cleaned up). Once the government has established probable cause with respect to a specific location, and a warrant issues, law enforcement may search the entirety of the identified location for the identified contraband or evidence. See Arson Investigation, 497 F. Supp. 3d at 361. Consider for example the quintessential search warrant for an apartment or home where more than one person resides and thus keeps their belongings (and only one of whom is a suspect supported by probable cause). See id. ("[W]hen a court authorizes the search of a house, the entire house is subject to the search, and this includes the most private areas of a house, such as bedrooms and bathrooms, of individuals who may not be involved in the crime but who nonetheless live in the premises, such as spouses and children.").
Ybarra and its progeny delineate an exception to that rule for the physical bodies of persons who are present during the search of a location for which the government has obtained a warrant. See Ybarra, 444 U.S. at 91, 100 S.Ct. 338 ("[A] person's mere propinquity to others independently suspected of criminal activity does not, without more, give rise to probable cause to search that person.") (emphasis added). But capturing a signal given off by a cellular device that provides only limited albeit important information—an IMSI, certain locational information, and eventually via subpoena a phone number and any other subscriber information—is not the same as the search of a body of a person, such that Ybarra would be implicated. There is no physical intrusion on a person's body involved in use of a CCSS; it is more akin to a search for specific information within a place for which the government has obtained a search warrant. Accordingly, the Court finds the Ybarra analogy—and thus amicus's formulation of the probable cause showing necessary for a CCSS warrant to issue—inapplicable in this particular case. See Google III, 579 F. Supp. 3d at 83 ("[W]here the State does not seek to seize 'persons' but only those 'things' which there is probable cause to believe are located in the place to be searched, there is no apparent basis in the language of the Fourth Amendment to require probable cause to believe that the third party is implicated in the crime.") (cleaned up).
See also Orin Kerr, The Fourth Amendment and Geofence Warrants: A Critical Look at United States v. Chatrie, Lawfare (March 12, 2022), available at https://www.lawfareblog .com/fourth-amendment-and-geofence-warrants-critical-look-united-states-v-chatrie.
The analogy to Ybarra possibly could be more apt if the government sought to search the actual contents of devices using a CCSS, as "[w]ith all they contain and all they may reveal, [modern cell phones] hold for many Americans 'the privacies of life,' " Riley v. California, 574 U.S. 373, 403, 135 S.Ct. 891, 190 L.Ed.2d 763 (2014). But the information the government seeks via the requested CCSS search is more limited and does not include the actual contents of any of the devices.
The Court does not find the government's proposed probable cause formulation on point either, however. The government proposes that it only need establish probable cause that "use of the CCSS will lead to evidence of a particular criminal offense," Gov. Br. at 20. But this standard would be too broad, as it could be read to allow law enforcement to search wherever within the Northern District of Illinois—covering millions of cellular devices—so long as it is probable that the suspect's device's IMSI could be located somewhere in the District. If this were the correct standard—and the government's probable cause showing could be untethered from any geographically-bound location—there would by analogy be no constitutional problem with a warrant that permitted the search of an entire apartment building (or an entire neighborhood) based on a showing of probable cause as to one unit in that building or neighborhood. That situation, however, poses the canonical constitutional problem with general warrants. See, e.g., Jacobs v. City of Chicago, 215 F.3d 758, 767 (7th Cir. 2000) ("A warrant authorizing the search of an entire multi-unit building is fatally defective when the warrant authorizes the search of an entire structure and the officers do not know which unit contains the evidence of illegal conduct.") (cleaned up). As articulated, the government's proposed formulation would permit the government to use a CCSS to "rummage where they please in order to see what turns up"—which is what the Seventh Circuit has suggested would be a bridge too far. Sanchez-Jara, 889 F.3d at 421.
The correct formulation in this Court's view is that the government must show probable cause that evidence of the crime(s) alleged will be found in the particular place to be searched. See Illinois v. Gates, 462 U.S. 213, 238, 103 S.Ct. 2317, 76 L.Ed.2d 527 (1983). "The task of the issuing magistrate is simply to make a practical, common-sense decision whether, given all the circumstances set forth in the affidavit before him, there is a fair probability that contraband or evidence of a crime will be found in a particular place." Id. This standard does not require that the government have probable cause specific to each phone within a CCSS's ambit. "[T]he fact that one uninvolved individual's privacy rights are indirectly impacted by a search is present in numerous other situations and is not unusual." Arson Investigation, 497 F. Supp. 3d at 361. Indeed, "[t]he Supreme Court has long recognized and accepted that third party privacy interests could be impacted by lawful searches." Google III, 579 F. Supp. 3d at 82. For instance, "when a court authorizes the search of a house, the entire house is subject to the search, and this includes the most private areas of a house, such as bedrooms and bathrooms, of individuals who may not be involved in the crime but who nonetheless live in the premises, such as spouses and children." Arson Investigation, 497 F. Supp. 3d at 361.
Applying that formulation in this case, a CCSS warrant may issue when the government has established probable cause that evidence of the crime(s) alleged will be found in a particular place(s) to be searched as identified in the warrant, even if the CCSS will capture some data from uninvolved phones. "The proper line of inquiry is not whether a search of location data could impact even one uninvolved person's privacy interest, but rather the reasonableness of the search, the probability of finding evidence at the location, and the particularity of the search request." Id. at 362. Thus, an additional but important caveat to this standard is that the warrant must also meet the Fourth Amendment's particularity requirements. More on that later.
The government argues that its probable cause showing need not be tied to a particular location because use of a CCSS constitutes a search for an item, rather than the search of a place. The government relies on United States v. Karo, 468 U.S. 705, 104 S.Ct. 3296, 82 L.Ed.2d 530 (1984), in which the Supreme Court held that a warrant to use a beeper to track a particular object as it moves may issue notwithstanding the fact that the object may move to different locations. Id. at 718, 104 S.Ct. 3296. In Karo, the Court explained that it sufficed for the government "to describe the object into which the beeper is to be placed, the circumstances that led agents to wish to install the beeper, and the length of time for which beeper surveillance is requested." Id. But importantly, however, the Court ruled in Karo that a warrant may issue to enable the government to track the movement of a specific, identified object even if the government does not know where the object will be moved to, much like the approved use of a CSS in Sanchez-Jara to track a known cellular device. If the instant application were for a location cell-site simulator to be used to track a specific, known cellular device, then this logic would apply. But what the government proposes to do here is to search for the identifiers of every cellular device within certain identified locations—the areas surrounding the suspect's residence and locations where the suspect is or has been seen by law enforcement—in order to identify and distinguish a device with currently unknown identifiers. The government thus has proposed the search of a place or area, albeit one with virtual and sometimes variable borders, rather than the tracking of a specifically known and identified object. Thus, this Court concludes that the government must make a probable cause showing specific to the place(s) where it proposes to search.
To summarize: this Court finds that there is no requirement that the government establish probable cause specific to each cellular device within a CCSS's reach, consistent with the understanding that permissible searches of places often intrude upon the privacy of uninvolved third parties. But the government's suggestion that its probable cause showing need not be tethered to a particularly defined location (or locations)—and, without citation to any authority, that there is "no upper limit" on the areas or data law enforcement may search, Gov. Reply Br., at 5 n.3—is also inconsistent with well-settled Fourth Amendment standards that warrants must be "reasonable." See Google III, 579 F. Supp. 3d at 62 ("[T]he touchstone of the Fourth Amendment is reasonableness, and the reasonableness of a search is determined 'by assessing, on the one hand, the degree to which it intrudes upon an individual's privacy and, on the other, the degree to which it is needed to promote legitimate governmental interests.' ") (quoting United States v. Knights, 534 U.S. 112, 118-19, 122 S.Ct. 587, 151 L.Ed.2d 497 (2001)).
III. Particularity and Overbreadth
The Court's assessment of the requested warrant in this matter is also bound up with other key issues, however: whether the warrant describes with sufficient particularity the place to be searched and things to be seized, and whether it runs afoul of the Fourth Amendment's prohibition on overbroad warrants. With respect to a CCSS, the concern is that if the place to be searched or the data to be seized is not particularly defined, or if the warrant is overbroad, the government will be able to over-collect data of uninvolved third parties.
A. Background Principles Requiring Particularity and Avoiding Overbreadth
The Fourth Amendment has a particularity requirement that "ensures that the scope of a search will be confined to evidence relating to a specific crime that is supported by probable cause." United States v. Vizcarra-Millan, 15 F.4th 473, 502 (7th Cir. 2021); see also King, 563 U.S. at 459, 131 S.Ct. 1849 ("the scope of the authorized search [must be] set out with particularity.") "The manifest purpose of the particularity requirement was to prevent general searches." Maryland v. Garrison, 480 U.S. 79, 84, 107 S.Ct. 1013, 94 L.Ed.2d 72 (1987). General warrants, widely reviled in colonial America, allowed British officers to rummage through homes in an unrestrained search for evidence of criminal activity," Riley, 573 U.S. at 403, 134 S.Ct. 2473, and left to "the discretion of the executing officials the decision as to which persons should be arrested and which places should be searched." Steagald v. United States, 451 U.S. 204, 220, 101 S.Ct. 1642, 68 L.Ed.2d 38 (1981). General warrants "provide[ ] no judicial check on the determination of the executing officials that the evidence available justified an intrusion into any particular [place]." Id. "By limiting the authorization to search to the specific areas and things for which there is probable cause to search," the Supreme Court has said, "the [particularity] requirement ensures that the search will be carefully tailored to its justifications, and will not take on the character of the wide-ranging exploratory searches the Framers intended to prohibit." Garrison, 480 U.S. at 84, 107 S.Ct. 1013; see also Sanchez-Jara, 889 F. 3d at 421 (holding that warrant was sufficiently particular because it was "not an open-ended authorization for public officials to rummage where they please in order to see what turns up"). The particularity requirement's bar on general warrants protects not only the sanctity of a person's home but also "the privacies of life." Berger v. New York, 388 U.S. 41, 58, 87 S.Ct. 1873, 18 L.Ed.2d 1040 (1967).
Thus, the Fourth Amendment imposes that both the place to be searched and the items to be searched for must be particularly described in a warrant. See Matter of Search of Info. Stored at Premises Controlled by Google, No. 20 M 297, 2020 WL 5491763, at *2 (N.D. Ill. July 8, 2020) ("Google I"). In a typical case, the particularity requirement with respect to the place to be searched is satisfied "if the warrant's description 'is such that the officer with a search warrant can, with reasonable effort ascertain and identify the place intended.' " United States v. Kelly, 772 F.3d 1072, 1081 (7th Cir. 2014). This is most commonly done by including in the warrant an address, photograph, and/or description of a physical location (such as a house or apartment) or item (such as a seized phone) to be searched. "[M]inor technical errors or omissions do not automatically invalidate a warrant so long as there is no danger that the officers might inadvertently search the wrong place." Id.
By contrast, a warrant that describes the place to be searched as the entire District over which the authorizing federal court has jurisdiction does not satisfy the Fourth Amendment's particularity requirements. See United States v. Nafzger, 965 F.2d 213, 216 (7th Cir. 1992) (per curiam) ("By accepting 'the Western District of Wisconsin' as a particular description of the place the truck was to be found we would be giving the government carte blanche to search anywhere in that district that the truck might conceivably be found, condoning the use of the pernicious general warrant, and redacting the particularity requirement from the Fourth Amendment."). The particularity requirement with respect to the items to be searched for or seized is satisfied if the warrant describes the items with "reasonable specificity." United States v. Jones, 54 F.3d 1285, 1290 (7th Cir. 1995).
Finally, a warrant must not be overbroad. Vizcarra-Millan, 15 F.4th at 502. Warrants are overbroad when they "allow officers to search for items that are unlikely to yield evidence of the crime." Id. A warrant, for instance, "is fatally overbroad when it authorizes the search of an entire multi-unit building where the officers do not have probable cause to believe either that there is illegal activity occurring in each separate unit of the building or that the entire building is under the 'dominion and control' of the person targeted for the search." Jacobs, 215 F.3d at 771. The "manifest purpose" of these requirements is "to prevent 'the wide-ranging exploratory searches' that the Framers faced and to limit each search 'to the specific areas and things for which there is probable cause.' " Kelly, 772 F.3d at 1081 (quoting Garrison, 480 U.S. at 84, 107 S.Ct. 1013).
In our context, these concerns center around data from devices that are unlikely to yield evidence of the alleged crime(s) because their users have nothing to do with the suspect or the alleged criminal activity. Again, the Court does not address these issues on a blank slate: in Sanchez-Jara, the Seventh Circuit briefly addressed particularity with respect to a warrant for use of a location cell-site simulator, noting that "a warrant authorizing police to follow an identified phone, to see where it goes and what numbers it calls, particularly describes the evidence to be acquired." Sanchez-Jara, 889 F.3d at 421. The use of a canvassing cell-site simulator is inherently different than the use of a location cell-site simulator, however, as described above. A location cell-site simulator warrant permits the government only to locate and track a specifically identified device. By contrast, a canvassing cell-site simulator searches for every device within the machine's operational radius and provides identifiers to law enforcement about every such device until investigators, in their discretion, "ascertain the identity of the Target Cellular Device." Redacted Warrant App., Dkt. 7 at 23. Thus, unlike a location cell-site simulator (which enables the government only to track a single device, ala the beeper in Karo or the identified device in Sanchez-Jara), use of a canvassing cell-site simulator is more properly characterized as the search of an entire place—specifically, the area covered by the machine. So before approving a CCSS warrant, the Court must assess whether the place identified in the warrant (in addition to the data that the government may seize) is particularly described and not so broad as to run afoul of the Fourth Amendment.
That assessment requires an understanding and analysis of a CCSS's capabilities, because "the device itself is what is at issue." Patrick, 842 F.3d at 548 (Wood, C.J., dissenting). As described above, the device's capabilities as well as other operational variables determine in part the boundaries of the place to be searched and the data that will be seized. As explained in the dissent in Patrick, "[b]ecause of its capabilities, the way [the machine is] used could affect the scope and location of the search itself." Id. Conducting an analysis of a CCSS's capabilities in the context of a warrant application—which is functionally required to determine whether the requested CCSS warrant is sufficiently particular and not overbroad—thus does not run afoul of the prohibition on ex ante limiting of the manner of a warrant's execution identified in Dalia v. United States, 441 U.S. 238, 257, 99 S.Ct. 1682, 60 L.Ed.2d 177 (1979). Dalia provides that "the specificity required by the Fourth Amendment does not generally extend to the means by which warrants are executed." 441 U.S. at 257, 99 S.Ct. 1682. But in its analysis below of the warrant, the Court is not "dictat[ing] the settings on the simulator, which government agency will operate the simulator, the number of agents at the scene of the search, the amount of time the simulator will be active, or whether the simulator is hidden or in plain view." Narcotics Trafficking, 623 F.Supp.3d at 896. Instead, the Court is assessing, in the context of the machine's capabilities, "the locations of the search and the scope of the items to be seized—in plain English, where the government can look and what the government can keep." Id. These are "typical Fourth Amendment considerations with search warrants," and are "no different than the Court authorizing the search of a house and ensuring that the boundaries of the house are properly identified and described and items to be seized at the house . . . are ones for which there is probable cause, are particularly described, and are not so overbroad such that they turn into the prohibited general search." Id.
The government relies on the majority opinion in Patrick to support its particularity and manner of execution arguments. In addition to the important fact that Patrick addresses a location cell-site simulator and not a canvassing cell-site simulator, 842 F.3d at 542-44, Patrick's applicability to this analysis is limited by at least two other factors, however. First, Patrick was decided before the Supreme Court's decision in Carpenter, — U.S. —, 138 S. Ct. 2206, which at least to some extent altered the landscape with respect to collection of CSLI. Second, the defendant in Patrick was located and arrested in public (and the probable cause for that arrest was not generated by use of the CSS), obviating the need for the court to definitively address the numerous constitutional questions posed by the government's CSS use. Id. at 542 ("we need not resolve some difficult issues . . ."). Indeed, the Court expressly deferred a more definitive discussion of cell-site simulator warrants, noting: "Questions about whether use of a simulator is a search, if so whether a warrant authorizing this method is essential, and whether in a particular situation a simulator is a reasonable means of executing a warrant, have yet to be addressed by any United States [C]ourt of [A]ppeals. We think it best to withhold full analysis until these issues control the outcome of a concrete case." Id. at 545. In other words, Patrick represented the beginning—not the end—of the Seventh Circuit's analysis of cell-site simulator warrants.
The government also cites to United States v. Carrazco-Martinez, No. 19-CR-00351-2, 2022 WL 425729, at *3 (N.D. Ill. Feb. 11, 2022), for the proposition that use of a CCSS constitutes only a "means of execution." But that case was resolved on good faith grounds and thus avoided what that court referred to as the "thorny Fourth Amendment issues" implicated by "the use of Stingray devices." Id.
B. Whether This CCSS Warrant Is Sufficiently Particular
Given this background, is this requested CCSS warrant sufficiently particular and not overbroad? At one level, the government argues that it need not tailor a CCSS warrant at all (i.e., that it did not even need to include the limitations identified and approved in Narcotics Trafficking, 623 F.Supp.3d at 893-96), that the warrant "need not set forth the place to be searched" because it is attempting to "find an item," and that there is "no upper limit" to the areas the government may search. Gov. Br. at 14-15; Gov. Reply Br. at 5 n. 3. Nevertheless, the government has proposed in its revised warrant application limitations that this Court must analyze vis a vis the Constitution's demands.
1. Tailoring as to Geographic Area and Time Coverage
As explained above, the Court finds geofence cases to be instructive in this analysis. In Google I, the court confronted an application for a geofence warrant for an area with a 100-meter radius in a densely populated city for three forty-five minute periods of time on three different dates. 2020 WL 5491763, at *1. The proposed geofence included "restaurants, various commercial establishments, and at least one large residential complex." Id. Yet "despite the geographic and practical reach of the geofences, the government's evidence of probable cause [wa]s solely focused on one user of a cellular telephone." Id. The Court ruled that the geofence location described by the warrant was overbroad because it was "in a congested urban area encompassing individuals' residences, businesses, and healthcare providers" where "the vast majority of cellular telephones likely to be identified in th[e] geofence will have nothing whatsoever to do with the offenses under investigation." Id. at 5; see also Chatrie, 590 F. Supp. 3d at 928-34 (finding the geofence warrant at issue was too broad, with a 387 meters radius, for a two-hour time-period).
By contrast, in Arson Investigation, the court approved a warrant for six geofences focused on specific commercial properties and narrow stretches of road during discrete periods in the middle of two nights, when it was not likely that many individuals other than suspects and witnesses would be present. 497 F. Supp. 3d at 357-59. The court explained that "the warrant does not seek location data for days or even hours to track the whereabouts of the perpetrators, but rather location data that is tailored and specific to the time of the arson incidents only." Id. In addressing the concern that geofence warrants have the "potential to capture vast swaths of location data of individuals not connected to the crime," the court noted that the proposed geofences excluded nearby residences and commercial buildings, that the time limitations of the geofence served to make it unlikely that many uninvolved devices would be captured, and that there was evidence specific to each proposed geofence suggesting that the zones were sparsely populated. Id. at 358-59. The court concluded that the government "satisfied overbreadth considerations by ensuring that there is probable cause that location data of perpetrators, co-conspirators and witnesses will be collected from Google, and that the scope of the warrant would not result in the collection of a broad sweep of data from uninvolved individuals for which there is no probable cause." Id. Put differently, the warrant was "particular in time, location, and scope" because it "minimize[d] the potential for capturing location data for uninvolved individuals and maximize[d] the potential for capturing location data for suspects and witnesses." Id. at 353; see also Google III, 579 F. Supp. 3d at 85 ("[T]he potential infringement of third-party privacy interests is modest in this case. The government represents that, in the [limited] time periods for which it is seeking information from Google, the suspects are either in the [target location] alone, or accompanied by (on average) two or three other customers. . . . Further, as explained, the geofence, as drawn by the government, falls within an industrial area and does not encompass residences or other particularly sensitive locations.").
The proposed CCSS use in this case appears to go well past the impermissibly broad sweep of Google I and is in contrast with the narrow tailoring of Arson Investigation and Google III. Here, the amended warrant application proposes that a CCSS would be used for up to 30 days "when the officers to whom it is directed have reason to believe that [the suspect] is present" in three locations: (1) within a quarter-mile radius of the suspect's residence; (2) within a quarter-mile radius of any location where law enforcement physically sees the suspect; and (3) within a quarter-mile radius of any location where law enforcement has physically seen the suspect within the last 30 days. Gov. Br. at 2. But as the government describes, the three identified quarter-mile radiuses do not and cannot reflect the geographic area that a CCSS would actually search; they simply reflect how close the machine would be to the suspect's residence or locations where the suspect has been seen. The government indicated that it could not provide the precise coverage area of a CCSS or even a rough estimate of the number of subscribers whose identifier and location data the CCSS would capture, but neither did it push back upon the concept that its proposed use of the CCSS could capture the data of a relatively large number of users. Gov. Br. at 10; Gov. Reply Br. at 5 n.3.
Given this practical backdrop, the request here is akin to a warrant application to search an entire apartment building—or an entire city block—where the government has probable cause only that evidence of a crime will be found in one specific apartment unit, for up to 30 days. The government's requested warrant is overbroad because "the vast majority of cellular telephones likely to be identified [by the CCSS] will have nothing whatsoever to do with the offenses under investigation." Google I, 2020 WL 5491763, at *5; see also Matter of Search of Info. that is Stored at Premises Controlled by Google, LLC, 542 F. Supp. 3d 1153, 1157 (D. Kan. 2021) (denying geofence warrant where "[t]he application . . . [did] not address the anticipated number of individuals likely to be encompassed within the targeted Google location data"). The requested warrant does not reflect the kind of narrowly tailored geographic and temporal constraints that sufficed in Arson Investigation or Google III.
The Court is also concerned that the requested warrant does not define the place of the search with sufficient particularity because the government does not attempt to and apparently cannot specify the boundaries of the place, or location radius, of the CCSS search it proposes to conduct. The warrant application does not identify the operative range or coverage area of the CCSS (which as we've explained above is likely different than just using the machine within a quarter mile of a particular location), or the limits of a CCSS's range when operating in ideal conditions. Instead, the government explains that it "cannot provide this Court with a precise answer regarding . . . the size of the area containing phones that would connect to the CCSS," and that the "number of IMSI captured . . . will turn on other variables outside of law enforcement's control." Gov. Br. at 8. Accordingly, if the Court authorizes a CCSS search to take place with the machine located within a quarter-mile of the three approved locations, the Court has no idea if it is actually authorizing a search of a cell coverage area within a quarter-mile radius around the site where the CCSS is located, or instead within a half-mile or one-mile or even greater radius of the machine. It is difficult to square such an authorization with Seventh Circuit law prohibiting warrants that authorize a search of a place with no appreciable limit on the place to be searched, which "redact[s] the particularity requirement from the" Fourth Amendment. Nafzger, 965 F.2d at 216. In the most basic terms, how can this Court authorize a search of a place if it's not told exactly what that place is? Nonetheless, the Court need not definitively confront this thorny question, because the government's requested warrant is overbroad even if the Court assumes that a CCSS can capture IMSIs within only a finite quarter-mile radius, as discussed above.
For all of these reasons, the geographic and temporal limitations identified in the revised warrant are not sufficient, on their own, to satisfy the Fourth Amendment's particularity and overbreadth requirements. The Court will thus move on to assess whether the other limitations in the revised warrant sufficiently narrow its scope such that it passes constitutional muster.
2. Limiting collection of de-anonymized data to only multiple or cross-referenced hits
The government has included in its revised warrant application another relevant limitation: pursuant to the warrant, law enforcement would "take no further investigative steps with regards to identifiers collected pursuant to the use of the investigative device . . . until after the Target Cellular Device's identifiers have been captured by the investigative device at multiple locations and/or multiple times at a common location." Gov. Br. at 2 (emphasis added). The warrant application and affidavit explain that this will assist with identifying the target device, "as only the Target Cellular Device's unique identifiers will be present in all or nearly all locations." Redacted Warrant App., Dkt. 7 at 19.
Limitations similar to this have been considered by courts in discussing appropriate constraints on geofence warrants. See, e.g., Arson Investigation, 497 F. Supp. 3d at 363 ("Overlapping data on all six geofence target locations here would certainly make it even more likely that the perpetrators' data will be collected, as it could pinpoint the specific individuals who committed the four arsons at separate times."); Google II, 481 F. Supp. 3d at 756 (describing with approval a scenario "in which a geofence warrant generates identifying and location information only of persons as to whom probable cause can be established because the warrant yields disclosure only as to devices present in multiple geofence times and locations"); Google I, 2020 WL 5491763, at *7 ("[I]f the government had constrained the geographic size of the geofence and limited the cellular telephone numbers for which agents could seek additional information to those numbers that appear in all three defined geofences, the government would have solved the issues of overbreadth and lack of particularity). In this case, however, the government's proposed "multiple hits" are not a meaningful limitation on the government's ability to obtain identifying information about those within the CCSS's ambit, given the nature of the "multiple hits" required by the warrant.
First, the government proposes that it may take "further investigative steps" with regards to the device identifiers it collects—which as a practical matter includes obtaining via subpoena subscriber information associated with the collected IMSI(s)—if identifiers are present "multiple times at a common location." If the "common location" is the suspect's residence, then one would expect the CCSS to capture the IMSIs of both the suspect and many of the suspect's neighbors and other people who live within the CCSS's reach, who would be in that common area "multiple times," because they live there. The device data of those uninvolved neighbors and individuals are just as likely to be collected by the CCSS "multiple times" as the suspect is. The government has not explained how it can distinguish between the suspect and others who live in the surrounding residences, so the proposed "multiple times at a common location" limitation on further investigation does not seem to be a real limitation at all.
Keep in mind that because this is a warrant for an unknown phone number, investigating agents will not be able to narrow down on the targeted location (such as the suspect's residence) by combining the CCSS data with prospective CSLI for a certain phone number from a wireless service provider.
The second alternative—that the government could take further investigative steps with respect to IMSIs that are found at "multiple locations" covered by the warrant—is more meaningful, but still misses the mark given the particulars here. On its face, this limitation is similar to the "multiple geofence times and locations" limitation the Google II court, for example, suggested could suffice to obtain a geofence warrant. 481 F. Supp. 3d at 756. In Google II, the court identified with approval a hypothetical "geofence warrant [that] generates identifying and location information only of persons as to whom probable cause can be established because the warrant yields disclosure only as to devices present in multiple geofence times and locations." Id. Such a limitation is intuitively appealing, and for good reason. If a particular IMSI appears in two separate CCSS searches at two different locations where the suspect is known or reasonably believed to be, it is more likely that that IMSI belongs to the suspect.
The problem here, however, is that the proposed limitation does not engage with the potential range of a CCSS or how far apart the "multiple locations" would need to be. If a device appears in two separate geofences—for instance, two separate banks at the time of two separate robberies—it is probable that the device belongs to the perpetrator. But from the parties' briefs in this case, it does not appear that a CCSS coverage area can be drawn as narrowly as a geofence. Because the range of a CCSS necessarily covers some relatively large swath of land—at a minimum in this case a quarter-mile radius, and likely more—limiting the government's usage of obtained IMSIs to only those captured at "multiple locations" could still result in mass identification of uninvolved third parties if the "multiple locations" are in the same neighborhood and there is thus overlap of the area covered by each CCSS search. For example, if a CCSS was used at the suspect's residence and then again at a nearby park or store where the suspect is seen, and they're sufficiently close that the coverage area of each CCSS use has some overlap, then the CCSS could capture perhaps hundreds or more IMSIs at these "multiple locations," simply because of residents who live in the CCSS's coverage area of both searches.
Consider for example, by way of contrast: if a device is captured by three separate CCSS searches in sufficiently different areas where the suspect is seen or reasonably believed to be, that are sufficiently far apart such that the CCSS coverage areas are unlikely to overlap, then it is probable that the identified device belongs to the suspect. True, it is not impossible that other, uninvolved individuals will happen to be within the CCSS's coverage area during each of the searches, but the Fourth Amendment deals in probabilities, not certainties. See Arson Investigation, 497 F. Supp. 3d at 353. But such a potentially workable limitation has not been included in this revised warrant application, and the "multiple hits" limitation is substantially less meaningful without it.
3. Cessation and deletion protocols
The government also proposes that it may not need to use the CCSS for the full 30 days; once investigators "ascertain the identity of the Target Cellular Device, they will end collection, and any information collected concerning devices other than the Target Cellular Device will be deleted." Redacted Warrant App., Dkt. 7 at 23. Other courts have found that a requirement that the government delete any data associated with uninvolved devices is a crucial minimum standard in an appropriately tailored CCSS warrant. See Narcotics Trafficking, 623 F.Supp.3d at 896 ("By identifying the end of the search as the acquisition of the suspect's cell phone number, and subsequently deleting all other data collected, this third limitation helps ameliorate overbreadth concerns inherent with the use of a cell-site simulator, protects third-party privacy interests, and thus, makes this particular search reasonable."); Telephones Used by Suppressed, 2015 WL 6871289, at *4 ("[L]aw enforcement officers must immediately destroy all data other than the data identifying the cell phone used by the target. The destruction must occur within forty-eight hours after the data is captured."). Given that almost any use of a CCSS may capture data associated with devices beyond those of the suspect, any sufficiently particular CCSS warrant should require at a minimum that the government timely dispose of or at least not make any use of the extraneous data it obtains.
One potentially complicated issue in disposing of data arises if the government collects data that may be exculpatory, which could give rise to preservation obligations under Brady v. Maryland, 373 U.S. 83, 83 S.Ct. 1194, 10 L.Ed.2d 215 (1963), and its progeny. This seemingly difficult topic, however, is beyond the scope of this opinion and was not meaningfully briefed by the government or amicus (understandably so given that the Court did not ask in its briefing order for this issue to be addressed), so the Court will not address that issue in this opinion.
One problem with the government's deletion proposal as articulated in the requested warrant, however, is that it involves no objective standards for how to identify the target cellular device(s) and thus permits law enforcement nearly limitless discretion to retain data associated with uninvolved devices. It sets up an investigative tautology: law enforcement does not know at the outset which device is the target device(s); the point of using a CCSS is to try to make that determination. Nor does use of a CCSS necessarily or automatically identify the target device's IMSI, because it is likely to capture the device identifiers of perhaps thousands of devices in this case, only one (or perhaps a handful) of which belong to the suspect. The government commits to deleting data associated with every device except the target device, but proposes no objective criteria by which it can determine which device is the target device, at which point it would "end the collection and delete any information collected concerning cellular devices other than the Target Cellular Device." Redacted Warrant App., Dkt. 7 at 23. The "multiple hits" criteria that the government has proposed is not a meaningful limitation on the government's ability to retain and investigate collected data, for the reasons discussed above. Under the revised warrant, then, the government would have insufficiently cabined discretion to keep and obtain (via subpoena) identifying information associated with an indeterminate number of IMSIs.
While executing agents' discretion cannot and need not be entirely eliminated, Google III, 579 F. Supp. 3d at 76, a warrant is overbroad where it contains "no objective measure that limits [government] agents' discretion in obtaining information as to each cellular" device in a broad area containing mostly devices for which the government has identified no probable cause. Google I, 2020 WL 5491763, at *6 (emphasis added). This is so because "a warrant that meets the particularity requirement leaves the executing officer with no discretion as to what to seize." Google II, 481 F. Supp. 3d at 754; see also Stanford v. Texas, 379 U.S. 476, 485, 85 S.Ct. 506, 13 L.Ed.2d 431 (1965) ("As to what is to be taken, nothing is left to the discretion of the officer executing the warrant."). Put another way, a "warrant satisfies this requirement if it leaves nothing about its scope to the discretion of the officer" executing it. United States v. Clark, 754 F.3d 401, 410 (7th Cir. 2014).
For example, a failure to identify objective standards governing law enforcement's ability to use anonymized data received from Google to obtain further identifying subscriber information has doomed several geofence warrant applications. See Google I, 2020 WL 5491763, at *6; Google II, 481 F. Supp. 3d at 754; Chatrie, 590 F. Supp. 3d at 934 (holding that geofence warrant was overbroad because it "contain[ed] no language objectively identifying which accounts for which officers would obtain further identifying information" and did not "provide objective guardrails by which officers could determine which accounts would be subject to further scrutiny"); Google III, 579 F. Supp. 3d at 88 (explaining that the court previously rejected a geofence warrant because it "proposed no rule or condition that would adequately cabin that exercise of discretion by law enforcement" to obtain subscriber information for every device within the geofence).
So too here. Under the requested warrant, the government, without sufficient objective criteria cabining its discretion, would have license to seize and investigate data associated with an indeterminate number of cellular devices for which they overwhelmingly have no probable cause. Indeed, agents will never be able to conclusively eliminate the possibility that the suspect has yet another burner phone that has not yet been identified by law enforcement. Given that law enforcement would have discretion to determine when in its view the identity of the target device(s) have been ascertained, the requirement that the searches stop and unrelated data gets deleted once the device(s) are identified is not a meaningful constraint. The cessation and deletion requirement therefore does not cure this warrant's overbreadth.
The government did indicate in its reply that it would be willing to replace the requested warrant's three location-based restrictions with a general requirement that the CCSS only be used "within a quarter-mile of the area where the agents reasonably believe the target cell to be." Gov. Reply Br. at 9-10. This limitation, however, suffers from the same infirmities as the warrant as currently requested. It does not obviate any of the problems created by the fact that a CCSS in this scenario likely has a relatively large coverage area that would capture information associated with perhaps thousands of uninvolved devices, as calculated above. Nor does this limitation mitigate the essentially unbridled discretion the warrant affords to law enforcement in determining which data it may keep and use and when it must end collection. Nor does it mitigate that the government likely will still identify hundreds or thousands of uninvolved devices multiple times if it runs two CCSS searches at the same location, or at sufficiently close locations, even if they have information indicating the suspect is nearby. The government's proposed formulation on reply thus does not obviate the concerns outlined in this opinion.
C. Other procedures, such as "two-step" warrant applications
As suggested by the amicus, it is worth noting that some courts have found that other limitations, although not included in the revised warrant application here, may satisfy the probable cause, particularity, and overbreadth tests. One potential approach is to permit the government to conduct a CCSS search near a suspect, but require the government to make a separate probable cause showing to the authorizing court if it sought to retain (and use) data associated with any particular device. For example, in Google III, the court initially rejected a geofence warrant application that would have permitted the government to, in its discretion, obtain identifying information from Google for any device found within the geofence. See Google III, 579 F. Supp. 3d at 88. "The warrant application which the [c]ourt granted, on the other hand, eliminated law enforcement's discretion at step two by requiring it to return to the [c]ourt and justify any device deanonymization based on its review of the anonymized information provided by Google and other evidence in the case." Id. This requirement ensured "that the government's search [was] particularized; that is, before any identifying information is disclosed to the government, it must justify the specific devices for which it seeks that information, consistent with its showing of probable cause." Id. It also "ameliorate[d] possible overbreadth concerns" by ensuring that location data associated with devices likely belonging to innocent third parties would remain anonymized. Id.; see also Chatrie, 590 F. Supp. 3d at 933 ("[O]fficers likely could use that narrow, anonymous information to develop probable cause particularized to specific users. Importantly, officers likely could then present that particularized information to a magistrate or magistrate judge to acquire successively broader and more invasive information.")
The Court can envision a CCSS warrant involving a similar process possibly satisfying the Fourth Amendment's particularity and overbreadth requirements. The government could propose a multistep procedure wherein law enforcement (1) is permitted to use a CCSS in proximity to a location(s) where they have reason to believe the suspect is present, and (2) may then make a separate probable cause showing to the Court with respect to any captured data (including IMSIs and location data) that the government wishes to retain and use for further investigative measures. This process could ensure that the data the government is permitted to seize is not overbroad because the government would have to establish probable cause to retain and seek additional, deanonymized information (for instance, subscriber information via subpoena) related to any captured IMSI. Data associated with devices that likely belong to uninvolved third parties would remain anonymized, preventing an unwarranted intrusion on the privacy of the vast majority of people who happen to be within the CCSS's ambit.
CONCLUSION
The Court understands that law enforcement arguably does not have an incentive to use a CCSS in a freewheeling manner. Telephones Used by Suppressed, 2015 WL 6871289, at *3 (noting that law enforcement's "own self-interest is served in minimizing the amount of innocent third parties' cell phone information that is collected. The additional information only complicates the process of identifying the target's cell phone ESN or ISMI."). After all, if law enforcement is attempting to identify a suspect's unknown cellular device(s), law enforcement should want to use the CCSS in the most narrow and targeted way that is still feasible. But the question is not what law enforcement is incentivized to do; the question is whether what the four corners of the proposed warrant authorize the government to search and seize is particularly defined or, instead, overbroad. See, e.g., United States v. Baboolal, No. 05-CR-215, 2006 WL 1674480, at *1 (E.D. Wis. June 16, 2006), report and recommendation adopted, No. 05-CR-215, 2006 WL 1942357 (E.D. Wis. July 11, 2006) ("[T]he issues of probable cause and that the warrant lacked particularity were legal matters to be analyzed within the four corners of the warrant and supporting application.").
The Court also notes that the sheer fact that a technology exists does not mean that there must be circumstances in which a warrant authorizes broad use of that technology. It is the function of this Court to apply precedential Fourth Amendment standards to all warrant requests, including those involving emerging technologies, even if those standards may sharply limit the circumstances under which use of those technologies may be authorized. Nevertheless, the Court is not seeking here to make a categorial rejection of all CCSS warrants. Indeed, at a minimum, use of a CCSS in a rural or commercially isolated area may pass constitutional muster, as the risk of overcollection of third parties' data would be limited compared to CCSS use in a dense urban environment. And even in a dense urban environment, there may be sufficient limitations on the places a CCSS can be used, and the breadth of data law enforcement may seize and retain, that can make a CCSS warrant constitutionally palatable. But the warrant before the Court now would enable the government to obtain and use data associated with possibly thousands (or at least an indeterminate number) of uninvolved cellular users. It is true that one (or a few) of the devices within the government's proposed mass collection likely belong to the suspect, but the Fourth Amendment's particularity and overbreadth requirements constrain the government from obtaining a warrant to search an entire neighborhood's hundreds of haystacks in search of a single needle. See Sanchez-Jara, 889 F.3d at 421 (court may not issue an "open-ended authorization for public officials to rummage where they please in order to see what turns up").
The Court acknowledges that—in the suppression context, when criminal defendants may not press the rights of third parties, see, e.g., United States v. Carlisle, 614 F.3d 750, 756 (7th Cir. 2010) ("Fourth Amendment rights are personal rights which, like some other constitutional rights, may not be vicariously asserted.")—a handful of District Courts have held that CCSS warrants are sufficiently particular even though they did not include restrictions of the kind discussed herein. See United States v. Johnson, No. S1418CR5651CDPJMB, 2020 WL 6049562, at *16 (E.D. Mo. Apr. 14, 2020), report and recommendation adopted, No. 4:18 CR 565 CDP, 2020 WL 3989590 (E.D. Mo. July 15, 2020); United States v. Tutis, 216 F. Supp. 3d 467, 481 (D.N.J. 2016). But it is not the case, as the government suggests, that courts have to this point uniformly addressed and approved CCSS warrant applications. See Gov. Reply Br. at 8. Courts in this District have, for example, required additional limitations in the government's proposed CCSS warrants prior to authorization. See Narcotics Trafficking, 623 F.Supp.3d at 896; Telephones Used by Suppressed, 2015 WL 6871289. Although the Court today respectfully disagrees with her colleague and rejects that the limitations identified in Narcotics Trafficking are ultimately sufficient to enable a CCSS warrant to withstand Fourth Amendment scrutiny, the Court notes that the government modified its warrant application in that case to include those limitations at that court's request. See 623 F.Supp.3d at 894 n.6 ; see also Telephones Used by Suppressed, 2015 WL 6871289, at *3 (imposing requirements devised by the court on any CCSS warrant application). While the Court acknowledges that the restrictions described in this opinion may render it difficult for the government to obtain a warrant for use of a CCSS in a city like Chicago, the Fourth Amendment must be faithfully applied no matter what "new methods of investigation may be devised." United States v. Jones, 565 U.S. 400, 406 n.3, 132 S.Ct. 945, 181 L.Ed.2d 911 (2012) ("Whatever new methods of investigation may be devised, our task, at a minimum, is to decide whether the action in question would have constituted a 'search' within the original meaning of the Fourth Amendment."). And application of familiar principles in this matter leads the Court to conclude that the government's requested warrant runs afoul of the Fourth Amendment.
This is not to say that the Court disagrees entirely with the opinion in Narcotics Trafficking. To the contrary, this Court agrees with much of the opinion—for instance, this Court agrees that the correct probable cause inquiry is "whether probable cause exists that a crime has been committed and that evidence of the crime will be located at the place to be searched." Narcotics Trafficking, 623 F.Supp.3d at 893. This Court agrees that the requested search warrant must be analyzed in light of the 4th Amendment's requirement's regarding particularity and overbreadth. Id. This Court also agrees that the limitations identified in Narcotics Trafficking and assessed in this opinion do not run afoul of Dalia's prohibition on ex ante limiting the manner of a warrant's execution. Id. at 895-96. This Court simply disagrees that the limitations identified in Narcotics Trafficking suffice to bring the revised warrant application in this case within the bounds of the Fourth Amendment's particularity and overbreadth requirements.
In the end, recognizing that Fourth Amendment doctrines rooted in Colonial Era grievances do not always map neatly onto 21st century surveillance technologies, and that overbreadth is a "highly fact- and context-specific" inquiry, see Vizcarra-Millan, 15 F. 4th at 502, this sort of analysis will need to be done on a case-by-case basis. Including meaningful limitations like those discussed above may make an otherwise overbroad warrant for use of a CCSS in an urban area sufficiently particular and tailored. The cornerstone of such limitations is that they should "minimize the potential for capturing" identifying and location data for uninvolved individuals and "maximize the potential for capturing" such data for the suspect's device(s). See Arson Investigation, 497 F. Supp. 3d at 353.
Furthermore, the government's use of canvassing cell-site simulators—a relatively powerful surveillance tool—is ripe for further factual and legal development. As the dissent observed in Patrick, "[i]t is time for the Stingray to come out of the shadows, so that its use can be subject to the same kind of scrutiny as other mechanisms, such as thermal imaging devices, GPS trackers, pen registers, beepers, and the like." 842 F.3d at 552 (Wood, C.J., dissenting). Perhaps additional information about how a CCSS works or can be used, or technological developments that enable law enforcement to more deliberately gerrymander a CCSS's range, will make use of the device more amenable to the Constitution's demands. Perhaps even within existing technological limitations, a CCSS warrant could be drafted that is sufficiently narrow to withstand court scrutiny. But for the reasons explained in this opinion, the government's requested warrant in this case—as written and as amended—does not pass the Fourth Amendment's tests. The government's revised warrant application is therefore denied.
The questions the Court has addressed herein are undeniably difficult, as they involve application of sometimes dated constitutional doctrines to a powerful modern technology. Carpenter instructs that the government must obtain a search warrant to seize cell-site location information at least in some circumstances, but did not decide what such a warrant must look like. 138 S. Ct. at 2223. In the absence of a more authoritative statement on what a constitutionally sound warrant for the use of geofences, tower dumps, canvassing cell-site simulators and the like requires, lower courts will continue to struggle with line-drawing exercises. The Court commends the numerous thoughtful opinions of its colleagues analyzing these issues. Courts and litigants nationwide will benefit from ongoing dialogue, ideas, and analysis concerning the intersection between Fourth Amendment law and new and emerging surveillance technologies.