OAKLAND, Calif.—"He's got a trapper."

Officer Eric Karsseboom merely wanted to find a four-door, white Dodge car on the evening of January 21, 2013. Instead, someone else found him. The Oakland Police Department veteran was suddenly facing down the barrels of a trio of guns as three men—Denate Kincaid, Joseph Pennymon, and Damien McDaniel—surrounded his vehicle, an unmarked Chevy Tahoe, in the parking lot of a gated apartment complex at 1759 Seminary Avenue. Located in East Oakland, this was and remains the heart of one of the city's toughest neighborhoods.

Kincaid spotted the trapper, a slang term for a gun, after he and his associates stopped Karsseboom's car for an informal interrogation. Undercover and alone, Karsseboom had crept into the apartment complex behind another vehicle, hoping to find the Dodge that OPD connected to a suspect from a shooting the previous day. Now more gunfire loomed.

As all three men kept their firearms aimed at the undercover officer, McDaniel came in through the unlocked passenger-side door to take Karsseboom's Glock 27. Kincaid then ordered Karsseboom out of the car, requesting that McDaniel search him. The trio next found Karsseboom's service weapon: a Glock 22, holstered.

"Trapper," McDaniel announced.

The policeman refused to hand over the gun, so McDaniel shoved the muzzle of his own firearm directly into the officer's torso hoping to convince Karsseboom otherwise. McDaniel repeatedly tried to take the service weapon from Karsseboom, but the officer continued to resist. Kincaid soon grew tired of the charade. He smacked Karsseboom hard on the head with the muzzle of the gun. Within a few moments, blood began dripping down the side of his head. And during the ensuing struggle, McDaniel shot Karsseboom in the left forearm. When the officer still didn't give up the gun, the muzzle of Kincaid's gun met the bridge of the officer's nose.

At first, Karsseboom attempted to get his gun out of the holster. But with a bloody left hand, he lost his grip, and McDaniel finally took the gun to hand it to Kincaid. The officer was left with only one final option—he decided to show his hand.

"I'm the police. 5-0. I'm a cop."

Kincaid again put his own gun against the bridge of Karsseboom's nose. "I don't care if you're the police… Where's your badge at then?"

Karsseboom told him it was in the trunk. Pennyman finally spoke.

"I see you when you made that U-turn in front of the complex," he said. Pennymon struck the officer, and he and Kincaid ran away. But McDaniel hesitated. Because of this, Karsseboom was able to grab the man by the shoulder and toss him to the rear of the vehicle, an attempt to take him into custody. Karsseboom shoved McDaniel into the driver's seat and managed to take the attacker's gun away, all the while keeping a lookout to see if the other two men returned. However, the officer couldn't secure the situation, and McDaniel spun away, sliding out of his coat to flee.

At this point, the first OPD car arrived. Throughout the entire incident, Karsseboom had kept phone communication with a nearby officer open. Bloodied, Karsseboom briefed the arriving policemen and attempted to move his car onto the street. He felt numb though, and he was quickly transported to Highland Hospital for treatment. The cuts on his head required "13 or 14 stitches."

The OPD soon set up an incident command post about two blocks north of the perimeter, and there were dozens of responders. Officers from other law enforcement agencies included the Oakland Housing Authority Police, California Highway Patrol (which flew in a helicopter from three counties north), BART Police, and others. Even a BearCat armored personnel carrier arrived. OPD launched an immediate investigation and manhunt to track down the three men who badly wounded their colleague.

Within a few days, all three—plus a fourth man allegedly involved—were eventually located. A criminal case, United States vs. Ellis et al, now hangs in the balance. The men are charged with both the attempted murder of a local police officer and for running an alleged East Oakland gang centered around Seminary Avenue (known as "SemCity"). But in the process of locating one of the alleged assailants on that night nearly three years ago, the department may have unintentionally opened up a way for the defendants to challenge evidence in the case. And perhaps worse for the authorities at large, the OPD's actions in the wake of Karsseboom's beating are shedding new light on one of the government's most prized and secretive surveillance tools: the cell phone hunting and intercepting device known as a stingray.

"PING SUSP PHONE"

Karsseboom recalled the events above during a preliminary examination, but in retrospect, court documents show that details start becoming murky at this point. OPD declared the scene as "secure" by 6:29pm. But a few hours after the incident, OPD Officer Steve Valle received a call from a confidential informant who is labeled in court documents only as "X." X told Valle that she or he received a call where X learned the names of two people involved in the original, January 20 shooting: Kincaid and McDaniel. X said two others were present: Purvis Ellis and someone named Lil' Joe, later identified as Joseph Pennymon.

X also told Valle that he or she believed that the guns taken from Karsseboom were now at Ellis' apartment inside the 1759 Seminary Avenue complex. At 1:05am on January 22, roughly six hours after Karsseboom was shot, the OPD got a search warrant for three apartments: #108, #110, and #212. At 2:45am, the OPD faxed Metro PCS, asking the company to activate a pen register on two target phone numbers (a 510 number and a 661 number) citing exigent circumstances. And not 11 minutes later, Officer Omega Crum is mentioned in the OPD Computer Aided Dispatch (CAD) log: "CRUM TO PORTER—ACTIVITY ON PHONE RELATED TO 108."

"Exigent circumstances" is the idea in American criminal procedure that law enforcement can search or seize persons or things if there are imminent circumstances where bodily harm or injury is in process, evidence is being destroyed, or a suspect is in flight. In such situations, a warrant is not required. The question of whether this entire standoff qualified as an exigent circumstance is key. Today, it's not clear whether Metro PCS responded with any information at all. This may have just been a pro forma attempt by the OPD to document that they had made some effort to obtain the information via the carrier, when in fact, they just plucked the information out of the air.

Further Reading

Over the next few hours on that night, an OPD SWAT Team prepared to search those apartments. McDaniel returned to the scene and was apprehended early on the morning of January 22, just before 5am. A police report noted that it was strange that he was not wearing a shirt as it was 36 degrees overnight that night, unusually cold for the East Bay.

The raid on the three apartments began exactly on the hour. Officers found suspected marijuana, cell phones, a cut ankle monitor (turned out to belong to Kincaid), a loaded .22 caliber pistol, an iPad, an Android tablet, and a computer. An Uzi, Glock, and phone turned up on the roof of the building. Notably, apartment #212 yielded the guns taken from Karsseboom.

According to an OPD log that was later redacted, a notice soon went out at 5:24am: "PING SUSP PHONE IN BLDG TWDS REAR STILL." In addition to a CAD log notation from 3am, this seemed to be the second indication in all of the publicly available records that some sort of cell phone surveillance was taking place.

The standoff didn't end until hours later. Officers got a warrant to search apartment #112, where they found Ellis. He was arrested and later questioned, refusing to answer anything and requesting a lawyer. With Ellis in custody, the incident at 1759 Seminary Avenue finally came to a close. A new standoff was just beginning.

Pesky warrants

Over the next few months, county prosecutors began their case against the three men. For some reason, Ellis was not initially prosecuted. By late July 2013, a number of OPD officers were questioned under oath during preliminary hearings, Karsseboom included. But mysteriously, the state charges were dropped that summer and the men were released. (Ellis was charged on an illegal firearm possession, a charge that was also dropped.) Federal prosecutors picked up the case again in December 2013, when new federal charges were unsealed. This time, they included Ellis.

As the process of federal criminal discovery began to unfold, defense attorneys seized onto the two CAD lines that appeared to show cell phone monitoring. "We suspected that they had a stingray or equivalent on some phone and they did not disclose that to us," former federal prosecutor and Ellis' lawyer, Martha Boersch, told Ars. "So Chris [Cannon, Kincaid's lawyer] and I jointly filed a motion for disclosure of electronic surveillance."

As Ars has reported previously, stingrays, IMSI catchers, or cell-site simulators can be used to determine location by spoofing a cell tower, but they can also intercept calls and text messages. Once deployed, the devices snatch data from a target phone as well as information from other phones within the vicinity. For years, federal and local law enforcement have tried to keep their existence a secret while simultaneously upgrading their capabilities. But over the last year, as the devices have become scrutinized, more information about the authorities' little surveillance secret has been revealed.

At times, cops have gone as far as to falsely claim the existence of a confidential informant while in fact deploying this particularly sweeping and invasive surveillance tool. As such scenarios continued to become public, the Department of Justice announced in May 2015 that it would be reviewing its stingray policies, just four months after claiming that it did not need a warrant to use the device in public. (Private residences are considered different, as that is a location where a person has a "reasonable expectation of privacy.")

Cannon and Boersch filed their disclosure motion in February 2015. It asked the court to require the government to disclose whether electronic surveillance was used. The government's response came in April 2015. It confirmed the defense attorneys' suspicion.

As Joseph Alioto, an Assistant United States Attorney, wrote:

Nevertheless, the United States confirms that a cell-site simulator was used in this case to obtain the general location of an armed suspect at large. Since the United States voluntarily confirms the use of the cell-site simulator, Defendants' motion may also be denied as moot. Even if the use of a cell-site simulator now requires a warrant, its use in this case was under exigent circumstances. The Defendant was thought to be armed and involved in the shooting of an Oakland police officer several hours earlier. The cell records thus were obtained under exigent circumstances and no warrant was required.

Cannon countered the claimed exigency. He filed a reply brief about a month before a July 1 hearing on behalf of all the defendants. In his 42-page filing, the defense lawyer argues:

Stingrays conduct Fourth Amendment searches and seizures when they extract information from cell phones. Here, the government has conceded warrantless use of a cell site simulator to obtain location information in violation of the Fourth Amendment. Moreover, the use of the Stingray violated the Wiretap Act. The scene was secure, and no exigency excused the failure to obtain a warrant. The Oakland police demonstrated they had time to seek a warrant, however they chose not to obtain one. All of the information illegally obtained through the use of the Stingray, and the fruits of that information, must be suppressed.

Cannon presents a number of supporting legal theories for his argument, including citing a warrantless physical trespass of the suspects' phones as found in the unanimous Supreme Court decision, United States v. Jones. In that case, the court found the placement of a physical GPS tracker on a suspected drug dealer's car was illegal.

Cannon continued, saying that the stingray use in this situation falls under a 2001 Supreme Court decision known as Kyllo v. United States. In a 5-4 decision, the court found that law enforcement does require the use of a warrant before using an infrared sensor device to peer through the walls of a home. He finally presented compelling arguments that the government's claim of exigency should fall flat given that the scene was deemed secure by OPD earlier in the evening. By definition, that meant the authorities believed there was no imminent threat to Karsseboom nor any other law enforcement.

"According to the information available to the defense, Stingray surveillance began well after the scene was secured," Cannon added. "There was simply no exigency."

Y'know, generally...

Alioto's filing revealing the stingray's use on January 21, 2013 has some fairly oblique references—it doesn't say, for instance, who the stingray was used against, nor by what agency, nor under what circumstances. The document also contains this strange line: "While a cell-site simulator is used to detect the location of a cell-phone, it does not generally intercept the contents of cell phone conversations."

Further Reading

It seems reasonable to conclude based on that phrasing that cell-site simulators sometimes do have that capability.

When Ars contacted the OPD to find out more information about how the stingray has been used in this and other cases, Officer Johnna Watson told Ars that the agency has no formal policy for how its stingray should be used.

"Although we may not have a policy, it is important to know that the Oakland Police Department utilizes available technology and investigative tools in accordance with the law," she wrote in an e-mail. She did not respond to further questions. A spokesman for the prosecutor, Abraham Simmons, did not respond to Ars' repeated requests for comment either.

Ars presented the details of this case to Brian Owsley, a law professor at the University of North Texas and a former United States magistrate judge who has worked on a number of stingray-related cases. Given that the stingray's use was no longer in dispute, the next logical question fell to whether the police's exigency claims felt valid, therefore negating the need for a warrant.

"I'm not sure I would say there's exigent circumstances in the middle of all that," Owsley told Ars. "I'm not sure how you could say we couldn't get a warrant but we could get a pen register. [In the OPD's thinking], that is the authorization to use the stingray, there's no doubt in my mind."

In ideal circumstances, detectives typically go to a local judge before they want to deploy a stingray. Instead of a warrant, most file an application for a "pen register and trap and trace order." Unlike the threshold for a warrant—probable cause of an actual crime—the pen register and trap and trace order only requires authorities to show "relevancy to a criminal investigation."

Further Reading

Many such orders remain sealed after the fact, even well after any related case has concluded. There is usually little public scrutiny. And if the lower threshold for surveillance isn't confounding enough, such applications to the court do not need to be very explicit about what law enforcement wants to do, nor how exactly it will be carried out in most jurisdictions nationwide.

In this situation, according to court documents, OPD didn't even go through the normal procedure of trying to get a pen/trap order from a court. Instead, all they needed to do was fax off an exigent request to Metro PCS. It appears a stingray was then deployed within minutes.

Former federal prosecutor Stephanie Pell told Ars that in her 14 years of service, she never heard of the stingray until after she left the government. And like this situation in Oakland, most stingray cases she's analyzed involve a level of faith in authority many would not be comfortable with.

"This kind of surveillance is something that we truly have to trust the government to do what they say they're doing," she told Ars. "I'm not terribly comfortable with that, not because I think prosecutors and cops are bad people, but you have to have some kind of oversight structure built in."

From Oakland to Washington

Should the four men in Ellis be found guilty, they face substantial prison time. Being found guilty of racketeering conspiracy alone carries a maximum sentence of life in prison. But if much of the evidence in Ellis gathered as a result of the stingray ends up getting tossed, it would throw a major wrench into the prosecution's case.

At the latest hearing on August 5, United States District Judge Phyllis Jean Hamilton continued to listen to the defense's attempt to suss out specifics of how exactly the electronic surveillance was conducted. The four defendants, in prison garb and in shackles, listened silently, only flashing a few smiles at some assembled family members and friends seated in court.

In the latest development, Cannon told the court that he and his colleagues received a letter the previous day from federal prosecutors. It revealed even more new information on the surveillance, yet the document "raises more questions than it answers," according to the lawyer.

"[The letter] indicates the FBI uses a cell-site simulator, and we have a series of CAD transmissions," Cannon told the court. "Apparently, there were multiple cell site simulators used."

Alioto, the Assistant United States Attorney on the case, flatly denied this.

"The defense requested material, we gave them what they requested," he said in court. "They want to request more, and I can say right now that there were not two cell-site simulators used. All of the conjecture you heard is just conjecture."

FBI Special Agent Douglas Jacobs, a former OPD officer, who sat with the prosecution during the August 5 hearing, also did not respond to Ars' request for comment. In a 2013 affidavit in an unrelated criminal case, Jacobs wrote that he was assigned to Criminal Squad 8, "which investigates violent street gangs."

Judge Hamilton evidently believed this focus on surveillance was taking away from the case at hand. On Wednesday, she requested that the government and the defense team confer in person to see if they could work out their differences, providing each other with any further data or information that was needed. If those meetings proved to be unfruitful, the defendants will likely file a motion that seeks to compel further disclosure.

For now, the case pushes forward with an outcome that's still a long ways off. But regardless of the fates of the four men, United States vs. Ellis et al has already become a small landmark. The case is increasingly shedding light on the intimate world of stingray use, and possible concealment, through a real-world example. If Cannon and Boersch continue to succeed in making more information public, their case could prompt at-large reform for the general lack of stingray oversight in California and beyond. It could be the work that finally alerts even more of the general public and, perhaps more importantly, their legislators.

"[Authorities] have got rules that they're supposed to play by, and they know they're supposed to be getting warrants, and they're not doing it," Matthew Laws, another one of the lawyers representing Kincaid, told Ars.

This process has already started. Recently, California congressman Darrell Issa (R-San Diego) acted upon stingray outrage from his constituents and managed to get a related amendment attached to a House of Representatives bill: HR 2578. Issa's addition simply states: "None of the funds made available by this Act may be used to operate or disseminate a cell-site simulator or IMSI catcher (stingray) in the United States except pursuant to a court order that identifies an individual, account, address, or personal device."

The bill has passed the House. But for now, it hasn't been taken up by the Senate.

"As you know, law enforcement does not get a pass inherently on constitutional limitations," Issa told Ars. "And yet if you and I put one on a small drone, we would have the FCC and the FBI arresting us."