[House Hearing, 114 Congress]
[From the U.S. Government Publishing Office]











                   GEOLOCATION TECHNOLOGY AND PRIVACY

=======================================================================

                                HEARING

                               BEFORE THE

                         COMMITTEE ON OVERSIGHT
                         AND GOVERNMENT REFORM
                        HOUSE OF REPRESENTATIVES

                    ONE HUNDRED FOURTEENTH CONGRESS

                             SECOND SESSION

                               __________

                             MARCH 2, 2016

                               __________

                           Serial No. 114-107

                               __________

Printed for the use of the Committee on Oversight and Government Reform





[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]










         Available via the World Wide Web: http://www.fdsys.gov
                      http://www.house.gov/reform
                                  ______

                         U.S. GOVERNMENT PUBLISHING OFFICE 

23-406 PDF                     WASHINGTON : 2017 
-----------------------------------------------------------------------
  For sale by the Superintendent of Documents, U.S. Government Publishing 
  Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; 
         DC area (202) 512-1800 Fax: (202) 512-2104 Mail: Stop IDCC, 
                          Washington, DC 20402-0001                      
                      
                      
                      
                      
                      
                      
                      
                      
                      
                      
                      
                      
                      
                      
                      
                      
                      
                      
                      
              COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM

                     JASON CHAFFETZ, Utah, Chairman
JOHN L. MICA, Florida                ELIJAH E. CUMMINGS, Maryland, 
MICHAEL R. TURNER, Ohio                  Ranking Minority Member
JOHN J. DUNCAN, Jr., Tennessee       CAROLYN B. MALONEY, New York
JIM JORDAN, Ohio                     ELEANOR HOLMES NORTON, District of 
TIM WALBERG, Michigan                    Columbia
JUSTIN AMASH, Michigan               WM. LACY CLAY, Missouri
PAUL A. GOSAR, Arizona               STEPHEN F. LYNCH, Massachusetts
SCOTT DesJARLAIS, Tennessee          JIM COOPER, Tennessee
TREY GOWDY, South Carolina           GERALD E. CONNOLLY, Virginia
BLAKE FARENTHOLD, Texas              MATT CARTWRIGHT, Pennsylvania
CYNTHIA M. LUMMIS, Wyoming           TAMMY DUCKWORTH, Illinois
THOMAS MASSIE, Kentucky              ROBIN L. KELLY, Illinois
MARK MEADOWS, North Carolina         BRENDA L. LAWRENCE, Michigan
RON DeSANTIS, Florida                TED LIEU, California
MICK MULVANEY, South Carolina        BONNIE WATSON COLEMAN, New Jersey
KEN BUCK, Colorado                   STACEY E. PLASKETT, Virgin Islands
MARK WALKER, North Carolina          MARK DeSAULNIER, California
ROD BLUM, Iowa                       BRENDAN F. BOYLE, Pennsylvania
JODY B. HICE, Georgia                PETER WELCH, Vermont
STEVE RUSSELL, Oklahoma              MICHELLE LUJAN GRISHAM, New Mexico
EARL L. ``BUDDY'' CARTER, Georgia
GLENN GROTHMAN, Wisconsin
WILL HURD, Texas
GARY J. PALMER, Alabama
                                 ------                                

                   Jennifer Hemingway, Staff Director
                 David Rapallo, Minority Staff Director
  Troy Stock, Subcommittee on Transportation and Public Assets Staff 
                                Director
                         Sean Brebbia, Counsel
                           Willie Marx, Clerk
                           
                           
                           
                           
                           
                           
                           
                           
                           
                           
                           
                           
                           
                           
                           
                           
                           
                           
                           
                           
                           
                            C O N T E N T S

                              ----------                              
                                                                   Page
Hearing held on March 2, 2016....................................     1

                               WITNESSES

Mr. Richard Downing, Deputy Chief, Computer Crime and 
  Intellectual Property Section, U.S. Department of Justice
    Oral Statement...............................................     4
    Written Statement............................................     7
Mr. Michael R. Doucette, Commonwealth's Attorney, City of 
  Lynchburg, Virginia
    Oral Statement...............................................    13
    Written Statement............................................    15
Mr. Paul J. Larkin, Jr., Senior Legal Research Fellow, Edwin 
  Meese III Center for Legal and Judicial Studies, The Heritage 
  Foundation
    Oral Statement...............................................    25
    Written Statement............................................    26
Ms. Neema Singh Guliani, Legislative Counsel, American Civil 
  Liberties Union
    Oral Statement...............................................    50
    Written Statement............................................    52
 
                   GEOLOCATION TECHNOLOGY AND PRIVACY

                              ----------                              


                        Wednesday, March 2, 2016

                  House of Representatives,
      Committee on Oversight and Government Reform,
                                           Washington, D.C.
    The committee met, pursuant to call, at 10:03 a.m., in Room 
2154, Rayburn House Office Building, Hon. Jason Chaffetz 
[chairman of the committee] presiding.
    Present: Representatives Chaffetz, Mica, Jordan, Walberg, 
Amash, DesJarlais, Massie, Meadows, DeSantis, Buck, Walker, 
Blum, Hice, Carter, Grothman, Hurd, Cummings, Lynch, Connolly, 
Cartwright, Duckworth, Kelly, Lieu, Plaskett, and Welch.
    Chairman Chaffetz. The Committee on Oversight and 
Government Reform will come to order.
    Without objection, the chair is authorized to declare a 
recess at any time.
    Thank you all for being here. In today's modern age, this 
is a new phenomenon, new waters, new areas that we are 
chartering here. And these technological advances, particularly 
with smartphones, have made it easier to solve crimes and to 
take criminals off the streets, but it also makes it easier and 
less expensive for law enforcement to track people's movements 
over long periods of time. And keep in mind, as we address 
these issues with law enforcement, there are also issues that 
bleed over in how organized crime, how individuals can use 
these types of technologies in a very nefarious way as well.
    But these advances make it possible to conduct either 
historical or real-time prolonged surveillance previously 
unachievable with traditional surveillance techniques. And 
prolonged surveillance of geolocation reveals intimate personal 
details far exceeding mere location.
    As the D.C. Circuit noted, ``A person who knows all of 
another's travels can deduce whether he is a weekly churchgoer, 
a heavy drinker, a regular at the gym, an unfaithful husband, 
an outpatient receiving medical treatment, an associate of 
particular individuals or political groups, and not just one 
such fact about a person but all such facts.''
    Geolocation is more than just a record of where we are or 
were; it is a window into who we are. Do you want your Uber 
trip records to have Fourth Amendment protection? What about 
your Fitbit data? What about your smartphone information?
    The Department of Justice takes an interesting position on 
this. The Director of National Intelligence recently 
acknowledged that, ``In the future, intelligence services might 
use the Internet of Things for identification, surveillance, 
monitoring, location tracking, and targeting for recruitment or 
to gain access to networks or use credentials.''
    In plain English, he is saying that the government intends 
to appropriate the technology you buy and can strip the 
companies you entrust with your data to be the arms of the 
State to spy on you. It doesn't seem like too much to ask the 
executive branch that before prying into your life it at least 
convince a neutral judge they have probable cause for doing so.
    Protection against unreasonable government searches is a 
cornerstone of our democracy. It is an expectation in our life. 
I do believe that each American has an expectation and a right 
to privacy. The Fourth Amendment provides ``the right of people 
to be secure in their persons, houses, papers, and effects 
against unreasonable searches and seizures shall not be 
violated.''
    Think about what you keep on your smartphone, everything 
from banking information and personal health data, sensitive 
communications, family photos, and who knows what in the 
future. It sounds a lot like persons, houses, papers, and 
effects to me.
    In April of 2014, the committee began an investigation into 
law enforcement's use of cell-site simulators after press 
reports allege widespread use of devices also known as 
stingrays to locate people, that using the word stingray in a 
generic term. There are lots of other brand names that are out 
there.
    The committee discovered multiple executive branch agencies 
possessing these devices with the Department of Justice alone 
possessing hundreds of these devices. Even the IRS has a 
stingray, the IRS. What in the world are they doing with that 
machine? I do not trust Commissioner Koskinen and the IRS with 
this technology, especially after the agency targeted 
individuals for their political beliefs.
    The committee's investigation confirmed, as many suspected, 
that law enforcement was using these devices without first 
obtaining a warrant. And the Supreme Court agrees. In Jones v. 
United States, the Supreme Court unanimously, unanimously 
rejected the government's warrantless use of a GPS device. In 
that case, Justice Alito remarked that Congress should solve 
these issues legislatively, and I happen to agree with that.
    One of our witnesses here today worked with law enforcement 
and privacy advocates in the State of Virginia to update 
Virginia's laws post-Jones to ensure they adhere to the Fourth 
Amendment and gave law enforcement the legal tools necessary to 
catch and prosecute bad guys and women in this digital age. And 
my home State of Utah has done the same, as has California.
    It is time for Congress to follow the lead. I happen to 
have introduced H.R. 491, the Geolocation Privacy and 
Surveillance Act, in a bipartisan way, in a bicameral way with 
good leadership there in the Senate in a bipartisan way as 
well. It provides law enforcement clear legal guidelines, when 
and how to use geolocation information, how it can be 
collected, addressed, and used. I intend to pursue all 
opportunities I can to make our fellow Members and the public 
aware of this type of technology and what it can mean in your 
life.
    We are going to hear a lot today about government rules and 
protocols, but as Chief Justice John Roberts wrote in a case 
holding that police need a warrant to search a smartphone after 
arrest, the Founders did not fight a revolution to gain access 
to government rules and protocols. Just because it is easier in 
2016 for law enforcement to track our location and learn 
intimate details about our lives, it doesn't mean those details 
are somehow less worthy of constitutional protection. I stand 
with the Founders; get a warrant.
    We have a lot to talk about here. In this day and age, not 
only are we looking, as the Oversight Committee, into the past, 
but I think we also need to look into the future. And a lot of 
these tools can be used in a good way to make people's lives 
better, but we also have to make sure on what sort of privacy 
we are giving up in the name of security. We had a good hearing 
yesterday in Judiciary talking about it with the Director of 
the FBI, talking about a similar type of technologies and what 
we are going to do or not do with encryption. But dealing with 
geolocation is something that we want to explore here today and 
we have a good healthy panel for that.
    Chairman Chaffetz. So I would now like to recognize our 
ranking member, Mr. Cummings of Maryland.
    Mr. Cummings. Thank you very much, Mr. Chairman. And I 
welcome all of our witnesses today.
    Today's hearing provides an opportunity to discuss both the 
privacy concerns and law enforcement interests in obtaining 
geolocation information about our constituents. Geolocation 
information provides tracking capabilities with great accuracy 
making it a valuable law enforcement tool. This information can 
reveal intimate details of a person's life, which raises 
significant concern about whether the American people have a 
right to expect their private information be treated as such.
    It is important that our law enforcement authorities have 
the ability to carry out their public safety duties, and it is 
also important that we protect the privacy rights of American 
citizens. Currently, Federal law enforcement officials use 
authority under the Stored Communications Act to obtain 
location records from wireless service providers. This law 
requires law enforcement authorities to provide ``specific and 
articulable facts'' demonstrating ``reasonable grounds'' to 
believe that the information they seek is ``relevant and 
material to an ongoing criminal investigation.''
    Right now, there is a split among Federal courts. Some have 
held that the Americans have a reasonable expectation of 
privacy over this type of information. They require law 
enforcement to obtain a search warrant based on probable cause. 
Others have held that Americans do not have a reasonable 
expectation of privacy because they voluntarily use their cell 
phones in this manner. These courts require law enforcement to 
obtain a court order under the lower standard of reasonable 
suspicion.
    This is a legitimate and challenging issue with reasonable 
voices on both sides. For example, on the one hand, the 
chairman has a bill that would create a uniform standard that 
recognize privacy interests and would require law enforcement 
to obtain warrants based upon probable cause. There are strong 
benefits to this approach, and it is supported by Senator 
Wyden, Ranking Member Conyers, and our own Congressman Welch.
    There are also voices on the other side. For example, 
Congressman Gowdy has expressed concern that this approach 
could impair the efforts of law enforcement authorities to 
investigate and solve crimes.
    Today, I welcome this debate because I want to make sure 
that we are striking the right balance. I look forward to 
hearing from all of our witnesses to help us continue to inform 
this debate and to ensure that we help our law enforcement 
authorities while protecting the privacy rights of our 
constituents.
    And with that, I yield back.
    Chairman Chaffetz. I thank the gentleman. I will hold the 
record open for 5 legislative days for any members who would 
like to submit a written statement.
    And I will now recognize our panel of witnesses. We are 
pleased to welcome Mr. Richard Downing, Acting Assistant 
Attorney General in the Criminal Division at the United States 
Department of Justice. Mr. Michael Doucette is the 
Commonwealth's attorney in Lynchburg, Virginia. I appreciate 
your being here today. Mr. Paul Larkin, Jr., Senior Legal 
Research Fellow for the Edwin Meese III Center for Legal and 
Judicial Studies at the Heritage Foundation; and Ms. Neema 
Singh Guliani. Did I pronounce it right?
    [Nonverbal response.]
    Chairman Chaffetz. Guliani, Legislative Counsel for the 
American Civil Liberties Union. We do appreciate you all being 
here and your participation today.
    So if you would please rise and raise your right hand. 
Pursuant to committee rules, all witnesses are to be sworn 
before they testify.
    [Witnesses sworn.]
    Chairman Chaffetz. Thank you. Let the record reflect that 
all witnesses answered in the affirmative.
    In order to allow time for members to ask questions, we 
would appreciate your limiting any oral testimony to 5 minutes. 
Your entire written statement will be made part of the record.
    Mr. Downing, you are now recognized for 5 minutes.

                       WITNESS STATEMENTS

                  STATEMENT OF RICHARD DOWNING

    Mr. Downing. Thank you very much. Good morning, Chairman 
Chaffetz, Ranking Member Cummings, and members of the 
committee. Thank you for the opportunity to appear before you 
today.
    I'd like to begin with the facts of a case based on public 
filings. The United States District Court judge in 
Jacksonville, Florida, was sitting in his living room one 
night, a shot from a high-powered rifle shattered his window. 
He was injured, but thankfully, the bullet did not hit him. The 
police had no eyewitnesses and a very large pool of suspects, 
including many litigants and defendants who had appeared before 
the judge.
    So what did the investigators do? Among other things, they 
applied for court orders to obtain the cell tower records of 
the phones of some of the possible suspects. Those records 
provided a general idea of the location of the phones. This 
information advanced the investigation and allowed agents to 
exclude certain innocent people and pursue leads that 
eventually led to the arrest of the alleged shooter. This case 
is just one example of the importance of location information 
to a wide variety of criminal investigations.
    I should emphasize, however, that there is no single kind 
of geolocation information. Location information can differ in 
precision, everything from what country the phone is in to 
precise GPS measurements of latitude and longitude. Sometimes 
companies generate location information for their own business 
purposes, and other times, law enforcement may gather the 
information directly. Sometimes, it is generated continuously 
as the phone moves around. Other times, only when certain 
events happen like when a user places a call.
    The Department recognizes the importance of considering 
individual privacy interests when obtaining different kinds of 
location information. At the same time, location information 
plays an important and sometimes pivotal role in our efforts to 
protect public safety and to seek justice. And it is important 
to recognize that different kinds of location information 
implicate different privacy concerns.
    In the time that I have, it would be impossible to discuss 
in detail all of the various types of location information. And 
I would like to mention just two types: first, cell-site 
information; and second, information collected by cell-site 
simulators.
    I recognize that these two types of information have 
confusingly similar names. Cell-site information is generated 
by cellular phone companies. A cell-site simulator is equipment 
operated directly by law enforcement officers. Cell-site 
information consists of business records that wireless carriers 
routinely collect and maintain as part of providing cellular 
service. These records identify the towers and sometimes the 
face of those towers handling communications with a particular 
device. While not providing pinpoint accuracy, the fact that a 
tower handled communications with a phone can give an idea of 
the location of the phone at the time that the communication 
occurred.
    Providers collect and maintain cell-site records for their 
own business purposes such as to repair and improve their 
networks. This data is collected only periodically when calls 
and other communications occur, not continually, and courts 
have found that historical cell-site information may be 
obtained based on a court order under the Electronic 
Communications Privacy Act, as Congressman Cummings mentioned 
in his opening.
    This provision requires the court to find that the 
government has provided specific and articulable facts showing 
that a substantial but not quite at the level of probable 
cause. Historical cell-site information can play a critical 
role at the outset of an investigation when there is not 
sufficient evidence yet to satisfy a probable cause standard 
such as in the shooting that I mentioned earlier.
    I'd like to turn now to cell-site simulators, the equipment 
owned and operated by police officers. A cell-site simulator 
collects a limited set of signaling information, not the 
content of communications, from cellular devices in the 
vicinity of the simulator. It can be used to figure out the 
location of a suspect's phone.
    The Department recognizes that the collection of precise 
location information in real time implicates different privacy 
interests than less precise information generated by a provider 
for its business purposes. That is why last September the 
Department issued a new policy governing the use of cell-site 
simulators in domestic criminal investigations. Under the 
policy, law enforcement agents now are generally required to 
obtain a search warrant supported by probable cause before 
using such a device.
    In conclusion, I'd like to emphasize that the Department is 
dedicated to ensuring that its policies and practices comply 
with the law and promote the privacy and civil liberties of 
individuals while we fulfill our mission to protect the public 
and to seek justice.
    Thank you, and I look forward to answering your questions.
    [Prepared statement of Mr. Downing follows:]
    
    
  [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
  
    
    
    
    Chairman Chaffetz. Thank you, Mr. Downing. I appreciate it.
    Mr. Doucette, you are now recognized for 5 minutes.

                STATEMENT OF MICHAEL R. DOUCETTE

    Mr. Doucette. Chairman Chaffetz, Ranking Member Cummings, 
members of the committee, my name is Mike Doucette. I'm the 
elected Commonwealth's attorney for the city of Lynchburg, 
Virginia. I'm also currently a board member of the National 
District Attorneys Association, the largest association 
representing the voice of prosecutors around the country. And I 
appreciate the opportunity to address you today, Virginia's 
perspective on the use of geolocation information and changes 
made after the decision in United States v. Jones.
    In response to that decision, Governor Bob McDonnell back 
in 2012 convened a small group consisting of prosecutors, 
defense attorneys, and law enforcement to draft a bill to allow 
for a search warrant specifically for the use of a GPS device. 
One of the problems with which we had to deal with the use of a 
GPS device was how to satisfy the particularity requirement for 
a search warrant when the product of that proposed search is 
neither in a particular location, nor is a particular item.
    And another problem we had to deal with was providing 
service of the warrant on the target of that warrant--GPS 
warrant without tipping him off that he is under surveillance. 
It would do no good to serve a warrant--a copy of a search 
warrant with its attached affidavit to the person who is to be 
surveilled and then tell that person to go about his usual 
suspected criminal activity.
    Our key concern in drafting this bill was how to issue a 
search warrant in one particular jurisdiction but allow it to 
be valid in any other jurisdiction to which the object, usually 
an automobile, would travel in the future. For standard search 
warrants, a search warrant is issued in the jurisdiction in 
which there is probable cause to believe that the evidence or 
contraband sought will be located at that static point in time 
when the warrant is executed.
    And so to address this issue, we defined ``use of a 
tracking device'' to include the installation, the maintenance, 
and the monitoring of that particular device. The search 
warrant is valid for 30 days from issuance. Additional 30-day 
extensions may only be issued by a circuit court. The 
installation of the tracking device must be completed within 15 
days of the issuance of the warrant, and the device must be 
removed or disabled within 10 days after the use of the device 
has ended.
    Upon issuance of the warrant, the warrant and the affidavit 
are automatically sealed by the circuit court. There is a 
process for unsealing at the end of the use of that particular 
GPS search warrant. Both the warrant and the affidavit must be 
served on the owner or possessor within 10 days after the end 
of that use of that tracking device. And again, 30-day 
extensions may be granted by the circuit court.
    In 2014, we anticipated through legislation what we 
believed United States v. Jones might ultimately lead, and so 
we amended our State counterpart to 18 U.S.C. 2703 to require a 
search warrant for the disclosure for up to 30 days of the 
real-time location data of any electronic device. Exceptions 
were added to the statute in situations where there is 
administrative subpoena in child pornography cases and when 
there is an emergency circumstance or consent.
    This specific bill was geared towards the real-time 
location data of mobile phones whether through pinging the 
phone by an electronic communication service or through the use 
of the phone's internal GPS. While the location of the phone 
does not necessarily identify the present location of the 
phone's owner, practical experience tells us that most of the 
time it does.
    However, in this bill, we specifically did not include 
historic cell tower information. We subscribe to the United 
States Supreme Court's opinions which stated that ``an 
individual enjoys no legitimate expectation of privacy'' in the 
information he ``voluntarily turns over to a third party.'' But 
we were also influenced by both the absence of the simultaneous 
monitoring of a person's present location and the lack of 
specificity in that location provided by the cell tower 
information. While GPS can pinpoint location within a few feet, 
historic cell tower information is far less accurate with the 
distances measured within thousands of feet more or less. The 
lack of specificity in this technology is based on several 
factors relating to signal strength, including distance to 
tower, intervening objects between the towers and the phone, 
the number of towers in the area, and the number of calls that 
a particular tower is handling.
    In 2015, we amended that statute even further to include a 
requirement for a search warrant before law enforcement could 
use what is commonly referred to as a stingray because we had 
inadvertently left that out of the 2014 legislation.
    In 2015, we--there were some bills introduced in the 
Virginia General Assembly to limit the time period for passive 
use of automated license plate readers. The bills were 
ultimately vetoed by the Governor and have not been 
reintroduced, although the patrons have promised to reintroduce 
those bills in next year's session.
    And that in a nutshell, Mr. Chairman, highlights the 
Virginia legislative efforts in geolocation data and technology 
and its relationship with the Fourth Amendment for the past 4 
years in Virginia. And I look forward to the opportunity to 
answer any questions.
    [Prepared statement of Mr. Doucette follows:]
    
    
   [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
 
    
    
    
    Chairman Chaffetz. Thank you. I appreciate it.
    Mr. Larkin, you are now recognized for 5 minutes.

                STATEMENT OF PAUL J. LARKIN, JR.

    Mr. Larkin. Mr. Chairman, Mr. Ranking Member, and members 
of the committee, I want to thank you for the opportunity to 
try to help you puzzle through this difficult issue. I'm going 
to make only three points.
    First, current settled Supreme Court case law allows the 
government to obtain historical cell-site or cell-location 
information without a warrant and without any showing of 
justification or need. It may be that the Supreme Court will 
change that law, but they've not yet done so, so that's the 
baseline from which we operate with respect to the Fourth 
Amendment. You of course could go further by statute, but the 
Fourth Amendment doesn't require you to go further at this 
point.
    Second, the technology that the chairman mentioned--
stingrays--are a new development that allow law enforcement to 
obtain this information without going through a carrier. The 
problem, however, is the way the device works. As I understand 
it, the device works by capturing all the cell phone signals 
within a radius of the operating device. The effect, therefore, 
is to shut off those other cell phones of everyone else who is 
within that radius. One of the problems in this regard is we 
don't know exactly how these devices work, and I think before 
deciding whether or not to regulate, that is an important 
factor that I think the committee has to take up the 
responsibility for learning.
    Third, any legislation will require this committee or any 
other to draw arbitrary lines, but some arbitrary lines are 
better or worse than others. In my written statement, I've 
recommended several arbitrary lines that the committee, I 
think, should consider avoiding and several others that I think 
the committee should consider endorsing.
    At the end of the day, however, in deciding whether to 
regulate any law enforcement practice, you have to ask yourself 
several questions. What are the benefits and harms of this 
practice? What is the likelihood of those benefits and harms 
coming to fruition? Who are the people that you're going to 
regulate? That is, do the police officers you're thinking about 
more closely resemble Joe Friday or Judge Dredd? Finally, what 
is the risk the public has to accept that you may be wrong in 
answering all of these questions?
    Thank you for the opportunity to make a statement and 
prepare a written one. I'm glad to answer any questions you may 
have.
    [Prepared statement of Mr. Larkin follows:]
   
 [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
  
   
    Chairman Chaffetz. Thank you.
    Ms. Guliani, you are now recognized for 5 minutes.

                STATEMENT OF NEEMA SINGH GULIANI

    Ms. Guliani. Chairman Chaffetz, Ranking Member Cummings, 
and members of the committee, thank you for the opportunity to 
testify today on behalf of the American Civil Liberties Union.
    In today's world, law enforcement can easily and 
inexpensively track virtually any American who owns a cell 
phone. GPS chips embedded into our phones provide real-time 
precise information about our every movement. Meanwhile, phone 
companies keep historical records that log information about 
our phone's location every time we make or receive a call, make 
or receive a text, or even receive a weather alert.
    These advances have provided law enforcement with a 
powerful new surveillance tool that they routinely use. For 
example, in 2015, AT&T received over 76,000 requests for cell 
phone location information. Over 58,000 of these requests were 
for historical information which the company keeps for a period 
of 5 years.
    Unfortunately, our Federal law has not kept pace with these 
technological realities. As a result, law enforcement officials 
and the public have been left to interpret a patchwork of State 
laws, conflicting legal precedent, and nonbinding policies to 
determine what policies apply.
    This mosaic of standards has resulted in law enforcement 
officials routinely accessing location information without a 
warrant. For example, in one case in Baltimore, police 
collected over 7 months of historical location information 
without a warrant. This information allowed police to infer 
that an individual was likely at his pregnant wife's OB/GYN at 
some point during this period. In another case in Michigan, 
police collected over 6 months of location information without 
a warrant.
    The Department of Justice has taken the position that a 
probable cause for warrant is not required for these types of 
collection. The ACLU disagrees with the government's position 
in this case. The Supreme Court's decision in Jones makes clear 
that the Fourth Amendment requires a probable cause warrant to 
collect historical or real-time location information.
    In her concurrence in the Jones opinion, Justice Sotomayor 
emphasized the intimate nature of information that might be 
collected by GPS surveillance, including trips to a 
psychiatrist, trips to an AIDS treatment center, church, or 
even trips to a strip club.
    In that same case, Justice Alito noted that society's 
expectation has been that law enforcement agents and others 
would not and could not ``secretly monitor and catalog every 
single movement of an individual's car for a very long period 
of time.'' Due in part to these concerns, a majority of 
Justices in the Jones case found that long-term GPS tracking 
impinged on expectations of privacy.
    More recently, the Supreme Court has expressed concern that 
cell phone location data can ``reconstruct someone's specific 
movements down to the minute not only about town but also 
within a particular building.'' That's--what we're seeing is 
often a gap between law enforcement practices on one hand and 
on the other hand the sensitivity with which Americans and the 
Supreme Court view our location information.
    The ACLU urges Congress and the Department of Justice to 
take three steps to address this gap. Number one, the ACLU 
urges Congress to pass legislation such as the Geolocation 
Surveillance and Privacy Act introduced by Chairman Chaffetz 
that would require police to get a warrant before accessing 
location information. This bill takes a sensible approach. It 
would require police to follow the same procedures they follow 
when collecting a variety of sensitive information. At the same 
time, it preserves the ability of law enforcement to act 
without a warrant in truly exigent circumstances. This bill 
also reflects the approach that States like Utah, New 
Hampshire, and Montana have already taken.
    Number two, until such legislation is passed, the ACLU 
urges the committee to continue to protest the Department of 
Justice to fully disclose its interpretation of the Supreme 
Court's Jones decision and any associated guidance. The public 
and Members of Congress should not be left in the dark about 
these important issues. By withholding this information, the 
DOJ has cut off the robust public debate and oversight that 
this issue demands.
    Number three, we urge the committee to press the Department 
of Justice to adopt and publicly release a policy that requires 
a probable cause warrant to obtain real-time or historical 
information. Last year, the Department of Justice released 
guidance on stingrays demonstrating that it can operate under a 
warrant standard and release information about its policies 
without compromising investigations. These actions are 
obviously not a substitute for legislation, but they are 
necessary to protect the rights of Americans.
    Thank you again for the opportunity to testify today, and I 
look forward to answering any questions that you may have on 
these important issues.
    [Prepared statement of Ms. Guliani follows:]
    
    
 [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
   
   
    
    Chairman Chaffetz. Thank you all for your testimony.
    I would like to enter into a colloquy with Mr. Cummings 
here prior to our questioning.
    We had good word from the Department of Justice just within 
the last 24 hours that they would allow myself and Mr. 
Cummings, plus we would each allow one staff person to review 
the post-Jones guidance. Now, while I appreciate that gesture, 
I need to say that it is frustrating that it has literally 
taken years to get to this point. I serve on the Crimes 
Subcommittee within the Judiciary Committee, and I am the 
chairman of the Oversight Committee, and thus far, the 
Department of Justice has refused to allow those of us who 
serve in Congress to even understand how they are using these 
types of materials.
    This is a positive step forward. I appreciate it. But as 
Ms. Guliani just pointed out, the public doesn't know what is 
happening, and we don't know what is happening. I look forward 
to seeing that information and working with Mr. Cummings on 
this.
    Let me yield to Mr. Cummings.
    Mr. Cummings. Mr. Chairman, first of all, I agree with you. 
These issues are very, very important to our committee and the 
Congress and the American people, and so I am happy that we 
could work together with the Department of Justice over its 
production of Jones memoranda.
    The Department has agreed to provide us with full access to 
all of the information we requested with no redactions, and we 
have agreed to consult closely with the Department going 
forward. We were able to reach an appropriate balance between 
legitimate congressional oversight and protecting law 
enforcement sensitivities. I commend the Department for 
responding to our concerns, and I commend the chairman for 
working through this issue in a very thoughtful way. We did 
this in a bipartisan manner, and I hope that we can continue 
this approach on other information requests important to this 
committee. Congressional oversight is a critical function, and 
we have to have the cooperation of entities subject to our 
oversight, whether that is in the public of the private sector.
    And with that, I will yield back.
    Chairman Chaffetz. I thank the gentleman.
    I would also want everybody to know that it is not just the 
Department of Justice that owns, maintains, and operates the 
cell phone simulators, stingrays, whatever you want to call 
them. There are different brand names, different versions of 
the technology. For instance, the Internal Revenue Service has 
these machines. They have deployed these machines. How in the 
world is the Internal Revenue Service using this information? 
We don't know. So today, we are going to be focused much on the 
Department of Justice, but there are also other parts of 
government.
    I will also credit the ACLU for the good work that they did 
in surveying law enforcement across the country at various 
levels. Whether it be State, county, or municipal, there are 
lots of machines that are out there and available in other law 
enforcement situations that are not focused at the Federal 
level at the Department of Justice. And so the use of that type 
of information is more pervasive than just at the Federal 
level.
    And finally, I would remind members that you can go on the 
Web and buy these machines, so don't think that this is just 
limited to the good guys in law enforcement. I do think we are 
living in a world and an age where the price point will 
dramatically decrease where organized crime, somebody with 
nefarious intent, some punk, whatever, is going to go out there 
and want to be able to use this type of information to gather 
information about somebody's geolocation and then be able to 
track that person back and then go find them with such 
specificity that if you were in New York City, as was 
mentioned, you could tell not only that they are on a certain 
block, you could tell which floor they are on and which 
apartment they are in or which office they are in. That is some 
pretty scary stuff, and that is something that I think we have 
to also consider.
    So with that as the backdrop, and I appreciate the 
colloquy, let's go to the questions. I am going to recognize 
myself first, and we will start here with Mr. Downing. And I do 
appreciate you being here. I really do. These are tough, 
difficult questions.
    I still struggle with how the Department of Justice 
considers geolocation. Is it metadata or is it content? Because 
the district court ruled that it is content. How does the 
Department of Justice view this information?
    Mr. Downing. Thanks very much for the question. That's, I 
think, the interesting and tricky thing about this label that 
we've placed on it as geolocation data because it can come in 
very many different forms. At times, I would say that it is 
metadata. That is, it is not the content of a communication but 
simply information about the location of where a phone is.
    But if you think broadly about the way that location 
information can be stored, if I send an email to my mom and say 
I'm at the office, well, that's actually location information 
and it's in that form the content. That might also be true, for 
example, if I were to post a photograph on Facebook that 
contained information that might be part of that photograph and 
therefore content.
    Chairman Chaffetz. But does the Department of Justice 
believe that if it knew I was at the hospital at the oncology 
department, isn't that the content of my life? And then I move 
from there to somewhere else, why is that not content? You 
think that is simply metadata?
    Mr. Downing. So, the general construct is the content of 
the communication versus information about a communication. 
That's the general way that we look at these kinds of 
questions. If I were to place a call using my landline phone, 
the number that I dialed would widely be considered metadata, 
but the fact that I'm calling Home Depot is--gives an idea 
about what I might be talking about, but it's still metadata 
even though it can be used to infer certain things.
    Chairman Chaffetz. And this is where I think I beg to 
differ. I think geolocation certainly used for more than just a 
split second snapshot in time, even if it was, you can tell a 
lot about what they are doing. If I called from the local jail, 
that is going to provide a lot more information than just the 
fact that I called Bob.
    Is there anything that Ms. Guliani or Mr. Larkin or Mr. 
Doucette said, Mr. Downing, that you disagree with or you found 
in their testimonies?
    Mr. Downing. One thing that I think is important to 
understand is that we often hear discussion about whether 
something was obtained without a warrant. And of course that is 
true. That is the Department's position. But it brushes over 
the idea that when we use a court order under section 2703 of 
ECPA that there are substantial privacy protections built into 
that, that it's not that law enforcement is waltzing in and 
just obtaining it at a whim but in fact a series of process 
which require specific facts presented to the judge before we 
can obtain that information. That's one response I would have 
that I would offer.
    Chairman Chaffetz. Is the IRS doing that?
    Mr. Downing. I don't oversee the IRS, but I do believe that 
they would be, yes, because ----
    Chairman Chaffetz. Why do you believe that?
    Mr. Downing. Because the carriers know what sort of process 
to expect ----
    Chairman Chaffetz. So it is up to AT&T to police the IRS? I 
mean, you have jumped to a conclusion and an assumption that 
the IRS is living up to the standard of the Department of 
Justice. I want to know why you think that is.
    Mr. Downing. Well, I think all law enforcement agents and 
prosecutors ----
    Chairman Chaffetz. But is the IRS ----
    Mr. Downing.--we follow the law, and the law is that, at a 
minimum, you need to obtain a--this kind of court order to 
obtain records or other information pertaining to a customer or 
subscriber. That's the law.
    Chairman Chaffetz. Ms. Guliani, is that the way you see 
that?
    Ms. Guliani. No, we disagree with the Department of 
Justice. The standard that is under 2703(d) is not a probable 
cause standard, and we believe that doesn't reflect the 
intimate nature of location information. It doesn't reflect how 
Americans view this information. Under polling, 80 percent of 
Americans view their location information over time as 
sensitive. That's a greater percentage than view their 
relationship history or their religion as sensitive.
    And the Department of Justice's position also doesn't 
comport with what courts have said about the sensitivity of 
this information. Courts have recognized that location 
information over time can tell you whether someone is a regular 
churchgoer, is an unfaithful husband, is a heavy drinker. And 
given the intimate nature of this information, we believe that 
a probable cause standard is the correct standard, as many 
courts have found.
    Chairman Chaffetz. So the FBI Director testified that they 
do use probable cause, but what about all the rest of the 
Department of Justice? Do they or do they not under the 
description Ms. Guliani cited there?
    Mr. Downing. I think I would go back to the general 
overarching point here, which is there are many kinds of 
location information. We certainly do use warrants for cell-
site information when it is collected by the cell-site 
simulator. We also use warrants when we are collecting precise 
GPS location from the providers.
    The difference is, and the courts have supported us in 
this, when we are obtaining less precise information that is a 
business record of a carrier, cell-site information, then that 
does not require a warrant, although there are many standards 
that have to be met that are built in for the protection of the 
privacy of the individual.
    Chairman Chaffetz. My time is expired, but I do wish you 
would provide that standard to the public and to the Congress. 
We are different than most every other country on the planet, I 
get it, but we do value our privacy, too.
    Ms. Guliani, I will let you speak and then we will go to 
the ranking member.
    Ms. Guliani. Yes, I just wanted to address the point of 
this idea that some--historical cell-site information is not as 
precise as GPS information, and that doesn't reflect the way 
technology is moving. We're increasingly seeing this 
information be very precise because it's not just the tower you 
connect to, it's the direction, it's the distance. Even in 
cases people have microcells, so a tower that only serves their 
home. And given this, the precision of cell site information, 
historical cell-site information is quite accurate and I think 
doesn't--I think our--the standards that we've used have--does 
not reflect that accuracy.
    Chairman Chaffetz. Thank you. I will recognize the ranking 
member, Mr. Cummings.
    Mr. Cummings. Ms. Guliani, geolocation information is a 
critical law enforcement tool, I think you will agree, but it 
has significant implications for an individual's privacy 
rights. We have to balance the need of our law enforcement 
authorities to access this information with the importance of 
protecting the privacy rights of American citizens.
    Cell phones and other wireless communication devices 
provide location information to service providers each and 
every time a phone call is placed. Is that correct?
    Ms. Guliani. That's correct.
    Mr. Cummings. You mentioned the Baltimore case a little bit 
earlier.
    Ms. Guliani. Right.
    Mr. Cummings. And you said that apparently they had 
surveillance for 7 months. Is that what you said?
    Ms. Guliani. They had obtained historical cell-site 
information for a period of over 7 months, that's correct.
    Mr. Cummings. And what happened in that case?
    Ms. Guliani. In that case, police did not obtain a probable 
cause warrant. They operated under a lower standard, and that 
case is being challenged.
    Mr. Cummings. Now, should individuals have a reasonable 
expectation of privacy with respect to their location 
information?
    Ms. Guliani. We believe that individuals do have a 
reasonable expectation of privacy and that that has been 
reflected in statements from the Supreme Court that have 
recognized that the Fourth Amendment has always acknowledged 
that there are facets of American life that should be free from 
improper government intrusion. And your location, whether 
you're in your home, whether you're in a church, that those are 
aspects that should be protected.
    Mr. Cummings. Mr. Doucette, geolocation information can be 
used to provide critical assistance in complicated criminal 
investigations to apprehend dangerous and violent fugitives or 
help locate kidnapped children. Can you describe how 
geolocation information can be useful in these types of complex 
criminal cases?
    Mr. Doucette. Mr. Chairman, Mr. Cummings, the--we've had a 
number of cases, especially dealing with historical cell tower 
information, where we've been able to obtain this particular 
information through a court order, a 2703 court order, and 
were--and specifically in one case in Lynchburg we were able to 
solve a rather serious homicide where we had no suspects at 
all, and basically through the course of doing this particular 
investigation developed the estranged son-in-law.
    But we had no information whatsoever to beat his alibi that 
he was in Richmond 2 hours away until we were able to get his 
historical cell tower information through a court order and 
show that, no, at the time that the murder occurred he was 
actually in city of Lynchburg. But that was not enough to get 
any sort of a conviction. We had to go forward and do a lot of 
police work afterwards, but again, that led us down the right 
path and led us through to be able to ultimately bring this 
person to justice.
    Mr. Cummings. You know, when you watch 20/20, you find the 
use of this cell phone information to be extremely helpful in a 
lot of very, very serious cases showing where the location of a 
person was at a certain time and to kill an alibi easily. Mr. 
Downing, how precise is historical cell-site information?
    Mr. Downing. Historical cell-site information varies 
considerably depending on the size of the coverage area of the 
particular antenna. In rural areas, it tends to be extremely 
large, a matter of miles perhaps. In urban areas, it tends to 
be smaller, and in certain cases, may be quite small, down to 
the level of a much smaller area.
    Mr. Cummings. So when you say rural, I mean, can you give 
me a max, just general, what, 5 miles, 10 miles, 20 miles?
    Mr. Downing. I don't know the specifics, but it's on the 
order of, yes, 5 to 10 miles, something like that.
    Mr. Cummings. What impact would a search warrant 
requirement for historical cell-aside information have on a 
criminal investigation?
    Mr. Downing. We are troubled by the idea of requiring a 
probable cause warrant because there are situations like the 
one I mentioned involving the person shooting at the judge 
where we are at an early stage of we do not yet have probable 
cause, but the ability to gather that sort of information can 
be very important to follow up on leads such as Mr. Doucette 
mentioned and to exclude people, frankly, that are not involved 
or that weren't involved in the crime. So that's an important 
and useful tool, and it should be considered as we debate this 
question.
    Mr. Cummings. Mr. Doucette, do you agree?
    Mr. Doucette. Absolutely, sir.
    Mr. Cummings. And what impact do you think a search warrant 
requirement would have on a criminal investigation?
    Mr. Doucette. Again, as pointed out by Mr. Downing, a lot 
of times we're strictly in the investigative stage. It would 
shut down the investigation completely because we would not 
have that level of probable cause. We're using this particular 
information to establish probable cause, not that we already 
have it.
    Ms. Guliani, a search warrant is not required for physical 
surveillance of a suspect. Why should a search warrant be 
required for geolocation information?
    Ms. Guliani. The nature of the information we're talking 
about is quite different from a police officer, for example, 
following someone. You know, with phone information, the law 
enforcement can inexpensively and easily track virtually 
anybody, and it's not constrained by resources as you would 
normally have in a situation where police are following 
somebody.
    But I also want to follow up on this question of, you know, 
whether a probable cause warrant will interfere with the 
ability of law enforcement in certain cases. The idea of a 
warrant for this information is not a novel idea. There have 
been many States to have passed laws that require a warrant for 
real-time or historical information, and there's no evidence 
that, for example, in Utah or in Montana where such a standard 
exists that law enforcement has been stopped from doing their 
job.
    Mr. Cummings. And last but not least, I want to go back to 
something that the chairman was talking about. And I guess he 
was talking about the stingrays. You know, one of the things 
that I have always been concerned about, the domestic violence 
cases where you have usually a woman who is trying to get away 
from a dangerous situation. She relocates trying to hide really 
from danger. And I guess, as she was talking, I was thinking 
that is a lot of power for someone who wants to get to her. Is 
that right, Mr. Doucette? Would you agree?
    Mr. Doucette. Absolutely, sir. And we did include--because 
the--when we are dealing with real-time location data such as 
whether it comes from a cell phone or provider or through a 
stingray, we do in Virginia require a search warrant because we 
do have probable cause. And again, you know, if a perpetrator 
wants to use this, the Fourth Amendment does not deal with him. 
We're going to have to pass laws, but outside of the realm of 
the Fourth Amendment.
    Mr. Cummings. Thank you very much, Mr. Chairman.
    Chairman Chaffetz. Thank you. I now recognize the gentleman 
from Ohio, Mr. Jordan ----
    Mr. Jordan. Thank you ----
    Chairman Chaffetz.--for 5 minutes.
    Mr. Jordan. Thank you, Mr. Chairman.
    Ms. Guliani, you are familiar with the stingray technology 
that the chairman referenced a little bit ago?
    Ms. Guliani. Yes.
    Mr. Jordan. Yes. And the fact that it mimics a cell site, 
tricks phones into going to that so that the person using the 
stingray can get access to the numbers and therefore where this 
person in fact is located?
    Ms. Guliani. That's correct, all phones in range.
    Mr. Jordan. And the fact that every major law enforcement 
agency in the Federal Government is using that, I assume that 
troubles you a little bit like it does me?
    Ms. Guliani. We are very troubled specifically by the 
notion that these devices have been shrouded in secrecy. The 
public didn't know about them, judges in many cases, defense 
attorneys.
    Mr. Jordan. And did you also know that it wasn't just 
limited to law enforcement, that it included the Department of 
Energy and more importantly, as the chairman pointed out, the 
Internal Revenue Service?
    Ms. Guliani. Yes ----
    Mr. Jordan. Did you know that?
    Ms. Guliani. There have been recent reports that the IRS 
and other agencies are also using these devices.
    Mr. Jordan. Mr. Downing, did you know the IRS was using the 
stingray technology?
    Mr. Downing. I believe that--I do understand that. It's the 
criminal part of the IRS, the criminal investigators.
    Mr. Jordan. But did you know they were using it or did you 
learn it in the press like the rest of us did?
    Mr. Downing. I personally didn't have specific knowledge of 
it, no.
    Mr. Jordan. I know you have got this Jones memo that you 
have given to all law enforcement in the Federal Government but 
won't show Congress and therefore the American people. Has the 
Jones memo gone to the Internal Revenue Service to tell them 
how you think they should use this stingray technology that you 
didn't know they were using?
    Mr. Downing. No, it did not to my knowledge.
    Mr. Jordan. So you haven't sent it to them, but this is the 
guideline on how we are supposed to deal with this important 
privacy issue that you thought was so important that you gave 
it to everyone in the Justice Department? You won't let 
Congress see it, but you know an agency has used the technology 
and you didn't give them the memo, the guidelines on how they 
should appropriately use it?
    Mr. Downing. We have given them the cell-site policy of --
--
    Mr. Jordan. No, no, I am asking about the Jones memo, this 
secret document that you won't let us see. Has it been given to 
the Internal Revenue Service? After all, they have used this 
technology on American people.
    Mr. Downing. The Jones memo is a memo that advises ----
    Mr. Jordan. Has it gone to the Internal Revenue Service?
    Mr. Downing. I don't know the answer to that. I don't 
believe so.
    Mr. Jordan. Well, that is scary because let me just remind 
you all of something here. The Internal Revenue Service, for a 
sustained period of time, systematically targeted Americans who 
were exercising their First Amendment liberties, and they sent 
questionnaires and information to these--told these groups to 
answer questions like this: ``Please provide board members or 
officers who have run or will run for public office who are in 
your group.'' ``Please provide handouts you provided to the 
audience participants and to the public.'' ``Please provide 
detailed contents of any speeches given at your meetings,'' 
copies of current Web pages. They ask them, ``Will you attempt 
to influence the outcome of specific legislation?'' That is a 
fancy way of asking will you exercise your First Amendment 
rights. Are you kidding me?
    And now this same agency has stingray technology, has used 
stingray technology, and you haven't even given them the memo 
to tell them how they should appropriately use it? This is 
unbelievable. ``Give copies of all communications, pamphlets, 
advertising, copies of any radio, television, Internet 
advertising you have done,'' another 33 questions sent to 
another Tea Party group. ``Have you conducted or will you 
conduct voter education activities?'' This is amazing. 
``Provide details regarding your relationship with''--they list 
a person's name, Justin Thomas.
    Now, think about this. All these questions that I think go 
right to the First Amendment liberties, and now this agency has 
a technology that they can go into an area where let's say 
there is a political rally going on. They go into an area, say 
we are going to trick every cell phone to come into this device 
so we can get people's phone numbers, know who they are, who 
they have been talking to, who they associate with in this 
context, and you didn't even know about it and you haven't even 
advised them on how to use it?
    Mr. Larkin, is that a little concerning to you?
    Mr. Larkin. The predicate facts are very disconcerting, 
very troubling. One of the lines that I think the committee 
should consider not drawing is trying to limit the use of these 
sort of devices by agency because, over time, it will bleed 
over into every other agency. And that doesn't even begin to 
count the number of State and local agencies that can use these 
devices. So there's a very troubling aspect of this problem.
    Mr. Jordan. Yes, it seems to me at a minimum you need a 
probable cause warrant before you can do this. I mean, again, I 
think you have to view everything in context. You have to view 
it within the framework of what we have seen from this 
administration going after people's First Amendment liberties, 
people's Fourth Amendment liberties, and now they have this 
technology that the Internal Revenue Service is using with no 
guidance from our own Justice Department? I mean, that boggles 
the mind, boggles the mind.
    Ms. Guliani, I will give you the last word.
    Ms. Guliani. Sure. I mean, I would echo the same concerns. 
We're concerned that the guidance that exists doesn't apply to 
States and localities or other Federal agencies, but I will 
note even that guidance has loopholes and deficiencies. There's 
a warrant requirement by default except for exceptional 
circumstances. Exceptional circumstances aren't defined, and 
we've had no additional information as to what that even means. 
So given this and some of the other deficiencies, how are 
judges informed of this, how are defense attorneys informed of 
information from these devices being used? There's just no 
clarity right now.
    Mr. Jordan. This Jones memo, the guidelines, this secret 
memo that we can't see but the night before the hearing they 
tell the chairman and the ranking member, oh, we will let you 
view it in private with your secret 3-D glasses or whatever it 
is and they won't let the IRS know how they should do this, 
unbelievable. Well, I mean, it is truly unbelievable what we're 
seeing in America today from this Justice Department.
    I yield back, Mr. Chairman.
    Chairman Chaffetz. I thank the gentleman.
    I would now recognize the gentleman from California, Mr. 
Lieu, for 5 minutes.
    Mr. Lieu. Thank you, Mr. Chairman.
    Mr. Downing, you had testified in your earlier testimony 
that these stingray devices track geolocation but they don't 
track content. It is true, however, that these stingrays can in 
fact be configured to track the content of conversations, 
correct?
    Mr. Downing. The devices that we use are not configured, 
nor do they have the necessary software to do that. And if they 
did, it would be in violation of our policy. But as a general 
matter, this type of technology could be used in that manner 
that you suggest.
    Mr. Lieu. Could this technology also be configured to track 
text messages and emails, the contents of those communications 
as well?
    Mr. Downing. If you have the right software and you 
configured it and you violated the policy, then yes, you could 
do that as ----
    Mr. Lieu. Is there anything stopping the Department of 
Justice from changing the policy next month or next year?
    Mr. Downing. No, we have the ability to change the policy.
    Mr. Lieu. The IRS has these stingrays. Does your policy 
apply to them?
    Mr. Downing. It doesn't apply to them directly, but if they 
were to be used in compliance with the pen register statute, 
then they would need to have a prosecutor--a department 
employee involved in that.
    Mr. Lieu. Does your policy apply to local law enforcement 
agencies?
    Mr. Downing. It does not apply to ----
    Mr. Lieu. Okay.
    Mr. Downing.--local law enforcement agencies.
    Mr. Lieu. So these stingrays could in fact be used by the 
IRS or local law enforcement agencies to not just track 
geolocation information but also the content of communications, 
including text messages and emails, correct?
    Mr. Downing. If they did it without a wiretap order, then 
it would likely be a Federal criminal offense, but I suppose, 
yes, anything is possible.
    Mr. Lieu. Let's talk about historical data versus real-time 
tracking. My understanding is the Department of Justice 
believes that you don't need a warrant to access historical 
geolocation data, but you do need one for real-time tracking. 
Am I understanding your position correctly?
    Mr. Downing. We have taken the position publicly that we do 
not need--you do not need a warrant for historic cell location 
information. If we were to use real-time tracking, if what you 
mean is specific precision GPS location on a prospective basis 
going forward, we, yes, agree a warrant is required in that 
circumstance.
    Mr. Lieu. So let's say someone has cancer and doesn't want 
people to know about it, they go to a clinic that just treats 
cancer, why would it matter from a privacy perspective whether 
that person went to that cancer clinic last week or they are 
there right now or they are about to go to it tomorrow? Isn't 
the privacy interest exactly the same?
    Mr. Downing. The data that would be the basis for 
historical and perspective that we were just talking about is 
not identical in its precision, nor is it identical in the way 
that it's collected, so I'm not sure we're comparing apples and 
oranges. But of course whether somebody is being tracked in 
real time going forward has historically been recognized as 
something that is more intrusive than looking at a historical 
view of somebody's activities.
    Mr. Lieu. I completely don't understand that distinction. I 
think it is stupid and meaningless. So, Ms. Guliani, can you 
elaborate on that distinction?
    Ms. Guliani. We also don't believe that there should be 
that distinction between historical and real-time data. You 
know, as one judge put it, the idea that something is less 
intimate because you're looking at a picture that's already 
been painted just simply isn't accurate.
    It's also important to note that courts recognize that 
there are areas where you're entitled to enhanced protection, 
for example, in your own home, and historical data captures 
whether you're in your home, how often you're in your home, 
when you leave your home. And given the accuracy of historical 
data, and we anticipate that it's only going to become more 
accurate, we believe that it should be treated with the 
sensitivity it deserves and a probable cause warrant should 
apply.
    Mr. Lieu. Thank you. Mr. Larkin, what do you think about 
that distinction?
    Mr. Larkin. It depends whether you're talking about it as a 
matter of law or policy. As a matter of Fourth Amendment law, 
there's probably no distinction between past data about a 
person and present data. The Fourth Amendment would not require 
a search warrant or probable cause in either case. But if 
you're talking about the effect of privacy, then, yes, it can 
be the same in both cases.
    See, the Fourth Amendment treats not past and present as 
the distinction. It treats--it makes the distinction in other 
ways, between protected areas and non-protected areas. If you 
are on a city street, the Fourth Amendment would allow the 
police to see what you're doing and follow you, whether they've 
done it 100 times in the past or are doing it now. If you're in 
your home, that's a protected area and that's different.
    Mr. Lieu. Thank you. Mr. Downing, can I see this super-
secret memo or only the chairman and the ranking member?
    Mr. Downing. Let me say that the Department has great 
respect for the needs of this committee and wants to work 
towards developing--giving the information that's required. Of 
course, at times there are going to be situations where the 
content of documents has the effect of inhibiting the kinds of 
things that we do such as by giving criminals warning about the 
types of activities that we might use to investigate them and 
also to reveal the litigating positions of the Department, 
which is an important internal deliberation.
    All that being said, as the chairman and ranking member 
announced, we seek to seek an accommodation with the committee 
to get the committee the information that it needs, and so I 
understand that our Office of Legislative Affairs has worked 
out a compromise that we're going to try to pursue at this 
point.
    Mr. Lieu. Mr. Chairman, could I have 15 seconds to respond?
    Chairman Chaffetz. Sure.
    Mr. Lieu. I fully trust Chairman Chaffetz and Ranking 
Member Cummings. I just want to note that the message you're 
sending to me and other members of this committee is you don't 
trust us. I find that offensive, disrespectful, and it will 
affect my dealings with the Department, maybe other members 
here in their dealings with your department on an ongoing 
basis.
    And I yield back.
    Chairman Chaffetz. I thank the gentleman. I now recognize 
the gentleman, Mr. DesJarlais from Tennessee, for 5 minutes.
    Mr. DesJarlais. Thank you, Mr. Chairman, and thank you, 
panel.
    As you all know, the Fourth Amendment provides the right of 
the people to be secure in their persons, houses, papers, and 
effects against unreasonable searches and seizures, in other 
words, protection against unreasonable government search is a 
fundamental right.
    Mr. Downing, as the courts have made clear in their 
rulings, all evidence that is obtained through an 
unconstitutional search is inadmissible in court. Would this 
exclude all the tracking information, even the information 
obtained where the suspect had no reasonable expectation of 
privacy like driving on public roads?
    Mr. Downing. So the constitutional suppression would only 
apply to that information that is indeed protected by the 
Constitution. So if a court found that the information was not 
implicating the Fourth Amendment, then constitutional 
suppression would not apply in that situation.
    Mr. DesJarlais. Okay. So then what are some examples of 
situations where a warrant would not be necessary when placing 
a GPS on a vehicle?
    Mr. Downing. There might be situations that come up where 
there is a life-and-limb emergency, for example, where the 
courts have long recognized that the warrant requirement 
doesn't apply. So, for example, in that situation law 
enforcement officers could search a house without a warrant 
because of the immediate need. Those kinds of exceptions would 
apply also in the case of tracking devices on vehicles.
    Mr. DesJarlais. Mr. Lieu touched on this a bit. What should 
be the legal standard for historical geolocation information?
    Mr. Downing. I'm sorry, was that question to me or Mr. 
Doucette?
    Mr. DesJarlais. Yes. Yes, sir.
    Mr. Downing. I apologize. Historical location information?
    Mr. DesJarlais. Yes, what should be the legal standard for 
historical geolocation information? In other words, why would 
you have less privacy interest in where you were last Saturday 
than where you will be next Saturday?
    Mr. Downing. So the Department's position is that 
historical cell-site information does not require a warrant, 
and three circuit courts have agreed that that's the case. The 
reason that it is different is that it is less precise in 
general, that it is a business record collected by the company, 
that it is not continuous but only recorded when communications 
occur. And so for all of those reasons, it's a different 
category of information than, say, real-time GPS information 
that's collected prospectively. For that reason, the courts 
have recognized that that does not have constitutional 
protection.
    Mr. DesJarlais. How far can law enforcement go back, a 
year, 3 years, 5 years?
    Mr. Downing. The amount of time that you could go back 
would depend entirely on the record collection and retention 
practices of the company because these are company records that 
are not mandated to be stored. It's a choice that the companies 
make. And so it's variable. Some go back for a short period of 
time, others for longer.
    Mr. DesJarlais. Ms. Guliani, would you like to comment or 
share your opinion on those issues?
    Ms. Guliani. Sure. You know, as I mentioned before, we 
believe this distinction between real-time and historical 
information is artificial and not just because of the 
increasing accuracy of cell-site information but also because 
of the very real privacy interests that Americans have in 
protecting the fact that they've been to an AA meeting six 
times in the last week or the fact that they only sleep at home 
5 out of 7 days a week.
    With regards to historical cell-site information and the 
time period that providers keep that information, in some cases 
that can be close to 5 years, for example, in AT&T's case; with 
Sprint, 18 to 24 months, and that's incredibly intimate 
information about someone's life. And given this, we believe 
that a probable cause warrant, the same standard that would 
apply if law enforcement wanted to read a letter of yours, is 
the correct standard.
    Mr. DesJarlais. Mr. Downing, do you agree with that?
    Mr. Downing. With all due respect, I do not agree. The 
reason that the--this information is different--first of all, 
let me say we respect that it is private information, and we 
believe that it should be protected. We believe it is 
protected. The Electronic Communications Privacy Act already 
creates rules. It's not at a probable cause standard, but 
nevertheless, it is quite protected and not instantly available 
to law enforcement whenever it chooses.
    We have analyzed, though, the constitutional rules here and 
have taken the position that the Constitution does not require 
a probable cause standard for the reasons that I explained 
before.
    Mr. DesJarlais. Ms. Guliani, do you agree with that?
    Ms. Guliani. Respectfully, we disagree, and there are many 
courts that have recognized that historical information is 
extremely sensitive. For example, a Fourth Circuit opinion that 
is waiting en banc review where the court found that historical 
cell-site information was sensitive and should be provided a 
higher standard.
    I think it is important to note that States across the 
country have recognized this, have recognized the sensitivity 
with which Americans view this information and have on their 
own adopted, you know, in many cases by nearly unanimous votes 
in their State Legislatures, legislation that protects 
historical and real-time cell-site information.
    And given this trend, both at a State level and both in 
terms of the American view of this information, we feel that 
this is a case where it's ripe for Congress to make clear that 
this information should be afforded a higher level of 
protection through legislation and by pressing the Department 
to change its policies and its position.
    Mr. DesJarlais. Thank you both for your time. I yield back.
    Chairman Chaffetz. I thank the gentleman.
    I will now recognize the gentleman from Pennsylvania, Mr. 
Cartwright, for 5 minutes.
    Mr. Cartwright. Thank you, Chairman Chaffetz.
    The first thing I want to do is I want to clarify 
something. It was heard in this room not 10 minutes ago that it 
was a great revelation about stingrays being used by the IRS. 
Please do not be misled by that. It was not a revelation this 
month. This committee was briefed on stingrays back in 
November, November 12, 2015, by Richard Weber, the chief of the 
Office of Criminal Investigation, and also has received at 
least two briefings, one in January of this year and one in 
November from the Department of the Treasury from TIGTA on the 
use of stingrays. So anybody claiming this is a revelation 
wasn't showing up for the meetings.
    I want to talk about geolocation, the legal standard. Ms. 
Guliani, law enforcement currently has the ability to obtain 
geolocation data through the use of a valid court order. Law 
enforcement relies on legal authority provided in the Stored 
Communications Act to obtain an order compelling a service 
provider to disclose cell-site location information. These 
orders call for specific and articulable facts showing that 
there are reasonable grounds to believe that the cell-site 
information is relevant and material to an ongoing criminal 
investigation.
    There has been disagreement in the Federal courts over 
whether this is the proper standard, and some Federal courts 
have decided that there is an expectation of privacy in cell-
site location information, and they have imposed stricter 
requirements for law enforcement to obtain the information.
    I wanted to ask you, what is the impact of a lack of a 
uniform standard governing access to geolocation information?
    Ms. Guliani. There are very practical impacts. I mean, I 
think the first and foremost is the reality that many 
Americans' information may not be adequately protected. So if 
you happen to live in a State that has not passed a law 
protecting information, law enforcement may be able to access 
your information under a lower showing.
    And I think that, you know, the Supreme Court has 
recognized, courts have recognized that the Fourth Amendment is 
important not just to protect people's privacy but also for 
freedom of expression, freedom of association. You know, the 
idea that law enforcement may be able to track your every 
movement could chill, you know, the desire of someone to go to 
a protest, to visit their psychiatrist. And these are very real 
effects and the reason why we believe that it's so important 
that a high standard apply when law enforcement collect this 
information.
    Mr. Cartwright. Thank you for that. And I want to shift 
over to you, Mr. Downing. Do you agree with that?
    Mr. Downing. We do not agree. We think and have taken the 
position in litigation that it is appropriate to have that 
lower standard and that the--although it is lower than probable 
cause, it is not a no-standard. There is in fact a lot of 
protection that is built into that. The reason that it's 
particularly important, however, is that, as mentioned in--
before, the early stages of investigation can certainly benefit 
from the ability to get this sort of information at a time when 
we don't have probable cause, and so there is a real cost to 
the public and to the solving of crimes and seeking justice if 
the standard were to be raised.
    Mr. Cartwright. Not to interrupt you, but I'm not asking 
about the level of the standard. I'm talking about the 
uniformity of the standard. What do you believe the impact of 
the lack of a uniform standard has been?
    Mr. Downing. I don't see an enormous impact as a result of 
the lack of uniformity. In the law, we often see circuit splits 
and differences from one part of the country to another. We 
have to deal with that as law enforcement officers and as 
prosecutors, and so we need to follow the law in our local 
area. Usually, those differences of opinion get worked out and 
we come up with a consistent standard in due course.
    Mr. Cartwright. Well, Mr. Downing, are you aware of any 
instances in those States that the warrant requirement impeded 
their efforts?
    Mr. Downing. I'm not aware of which States have them and 
which don't, nor do I have any information for you on that.
    Mr. Cartwright. Mr. Doucette, the State of Virginia 
currently requires a warrant for real-time tracking. Am I 
correct in that?
    Mr. Doucette. That is correct.
    Mr. Cartwright. And what has been the experience in 
Virginia?
    Mr. Doucette. It's been our experience for real-time 
tracking that we do generally have--we have the probable cause. 
We had the probable cause before, and that's why--if we are 
looking where somebody is right now, we have reason to believe, 
we have probable cause to believe that they are involved in a 
particular criminal activity. It's ----
    Mr. Cartwright. How would law enforcement practices change 
if a higher legal standard were uniformly to be adopted?
    Mr. Doucette. And I think we've mentioned this, both Mr. 
Downing and I, is that it would have a severe impact as far as 
the criminal justice and the criminal prosecution provisions 
where we're using this particular information to aid us in this 
particular investigation.
    And I realize this is not directly an answer to the 
question, but Ms. Giuliani--Guliani has raised an issue about a 
particular case in the Fourth Circuit, United States v. Graham, 
which is coming up for an en banc hearing. As I understand the 
majority opinion in that particular case, it wasn't that they 
were using historical cell tower information without a probable 
cause determination. It was the amount of time that went on. It 
was 221 days that they were using this court-ordered 
information. And so it wasn't 1 day or 2 days. That would have 
been fine under the ECPA standard. It was the 221 days, and 
that's what's ----
    Mr. Cartwright. Thank you for that. And I just want to give 
Ms. Guliani just a few moments to respond to that.
    Ms. Guliani. Mr. Doucette is right. In that case there was 
a long amount of time, but I think it's important to note that 
the Department of Justice's position is that even for a lengthy 
period of time, even for 5 months or 6 months, a warrant would 
not be required for historical information, and that is not 
consistent with what some courts have--the way some courts have 
assessed this issue.
    But like I said, this issue is still pending in many 
courts. There's not uniformity among States and among courts. I 
mean, it's for that very reason that it's so important that we 
develop a uniform policy and legislation that addresses this 
important issue and ensures that what law enforcement is doing 
comports with the Fourth Amendment. And our view is that the 
Fourth Amendment protects Americans against law enforcement 
getting their information unless there is appropriate cause, 
and in this case, that cause is probable cause, which is a 
standard, but it's not a standard that is different from what 
law enforcement applies in a variety of circumstances when 
investigating many serious crimes.
    Mr. Cartwright. Understood. And I yield back, Mr. Chairman.
    Chairman Chaffetz. I thank the gentleman.
    I now recognize the gentleman from Kentucky, Mr. Massie, 
for 5 minutes.
    Mr. Massie. Thank you, Mr. Chairman.
    Ms. Guliani, in your opinion, should Congress act now or 
wait for the Supreme Court to decide this issue?
    Ms. Guliani. I think that Congress should act now. We don't 
know when or if the Supreme Court will take this case. It could 
be 5 years or 10 years. And candidly, in many cases are--legal 
cases have lagged behind technology.
    And we're at a point where location information is becoming 
increasingly more accurate and is being collected by a wide 
variety of parties. Smart cars, smart medical devices, we're 
fairly close to having information about our location collected 
by these third parties. And given this, it's--we believe that 
Congress can protect the rights of Americans ensuring that 
location information is afforded the high level of protection 
and do so in a way that is reflective of our current 
technological realities.
    Mr. Cartwright. Same question, Mr. Larkin. Should we wait 
for the Supreme Court to decide this issue or should we pass 
legislation?
    Mr. Larkin. You should not wait. You should look into the 
facts and then address the issue. In the Jones case, for 
example, the beeper was placed on the vehicle in 2005. The 
Supreme Court didn't decide the case until 2012. You can decide 
things a lot faster than it took the Supreme Court to resolve 
that issue.
    Secondly, whatever you decide I think would be well 
received by the Supreme Court. Justice Alito, for example, in 
his concurring opinion almost pleaded with Congress to address 
this issue and let it pass from the Supreme Court. The same 
thing has happened in all the other cases where Congress has 
addressed electronic acquisition of information. The Supreme 
Court has been very deferential realizing that Congress can 
balance considerations and has access to data it does not have.
    Mr. Massie. This is a larger question but I know that 
Heritage speaks to this question. Doesn't Congress lose power 
to the other branches when it abdicates its responsibility to 
legislate on these issues?
    Mr. Larkin. It depends on what the particular issue areas, 
but the general answer is yes. Power not used tends to wither, 
and then when you try to use it later, you have a long line of 
precedence that people tend to point to to say that you no 
longer have this power; you've passed it on to somebody else.
    Mr. Massie. Right. That is what the late Justice Scalia 
told me, in fact.
    Mr. Downing, when we vote on this issue and legislate and 
amend this legislation, how many of us in the House of 
Representatives are going to be voting on this?
    Mr. Downing. I'm sorry, I don't understand your question.
    Mr. Massie. How many Members of the House of 
Representatives are eligible to vote on this issue?
    Mr. Downing. I believe it's 435. Is that ----
    Mr. Massie. That is correct, 435. So why would you share 
the post-Jones memorandum with only two? I mean, ostensibly, 
whatever we legislate is going to have a profound effect on how 
you are allowed to interpret these issues. So why wouldn't you 
want Congress to be informed?
    Mr. Downing. Congressman, we very much do want to have 
Congress be informed and want to respect the need of this 
committee to have the information that it legitimately needs to 
make its decisions. However, there are certain circumstances 
where particular memos contain information that if it were 
released publicly or--it would be detrimental to the ability of 
us to do our jobs. And so we seek to try to find some 
accommodations to allow for ----
    Mr. Massie. Let me just echo ----
    Mr. Downing.--that ----
    Mr. Massie.--what Mr. Lieu said. This breeds mistrust when 
you don't trust Congress, and we are trusted with many other 
secrets of national importance, and I think the people's 
representatives, if not the people, at least the people's 
representatives deserve to know how the laws are being 
interpreted and how they are going to affect them.
    And I would remind you that there are also 435 of us vote 
on your budget as well.
    Mr. Downing. Thank you. We have actually done a lot to try 
to provide and answer any questions that the committee may have 
as a result of that. We've provided our public positions, which 
really go through all sorts of the positions that are relevant 
to these decisions. I've also briefed staff and answered all of 
their questions. We're really trying very hard to give the 
information to the committee that it ----
    Mr. Massie. I would like you to try a little bit harder and 
give me that post-Jones memorandum.
    Should it be legal to turn off precise geolocation on a 
phone, Ms. Guliani?
    Ms. Guliani. You in fact cannot turn off precise 
geolocation on your phone. Under FCC rules, all cell phones 
must have the ability to have GPS information. The idea of this 
was to provide the ability for emergency personnel ----
    Mr. Massie. 911, yes.
    Ms. Guliani.--to access you. But this information is 
routinely provided to law enforcement, and based on new 
regulations that the FCC has put out, they've asked carriers to 
increase the accuracy of this information so they can be able 
to assess, you know, what floor of a building you're on.
    Mr. Massie. You know, I remember in the early 2000s I was 
in the tech industry and went to a factory to get something 
manufactured, and they were too busy. They were retooling all 
the cell towers so that all of your phones could be tracked. 
And it was under a mandate that presumably Congress issued. And 
it strikes me if this data didn't exist, we wouldn't be having 
this issue, or if a person had the right to turn that off. And 
you could see how it could easily work with a microcell where, 
you know, you plug this element into the Internet and then your 
cell phone works magically wherever the internet is, but I know 
that it won't come on until the GPS finds a signal.
    Because of what we have done here in Congress, you are not 
allowed as a consumer to make a phone call unless the 
government is able to find out where you are. And we did all 
that under the pretext of safety.
    So, you know, one of the suggestions I would have, Mr. 
Chairman, is giving some exemption to that law, allowing people 
to have privacy because we are saying, well, it is not private 
when you share it with a third-party, yet we are not even 
allowing you to make the phone call without sharing it with the 
third party. So with that ----
    Chairman Chaffetz. I thank the gentleman.
    Mr. Massie.--I thank you. I yield back.
    Chairman Chaffetz. I now recognize the gentleman from 
Massachusetts, Mr. Lynch, for 5 minutes.
    Mr. Lynch. Thank you, Mr. Chairman.
    Let me say at the outset that, absent any compelling 
reason, I would side with the chairman, Mr. Chaffetz, and 
Senator Wyden in requiring your reasonable cause a standard for 
this type of intrusion. And it would help your case, as Mr. 
Massie has laid out, if more members of this committee and if 
Congress had access to those memoranda that state your case. 
You are going to need it, I think.
    One of the differentials we have here is that Congress 
continues to move at a very slow pace, whereas the velocity of 
change in the areas of technology is breathtaking. Anybody with 
a 16-year-old daughter understands that, you know, cell phones 
are part of our personal effects now intimately and that the 
network of cell towers, it really does, as one of the courts 
described, provide a mosaic of a person's personal and private 
life.
    And I think it was not a recent case, Katz v. United 
States, that says the Fourth Amendment doesn't just protect 
places, it protects people. And with the advent of wearable 
technology, you know, the iPhone is connected to your cell 
phone. It is paired, so it really is--you know, technology has 
really permeated our private life.
    One of the things I can't get beyond is in other areas of 
surveillance for the Department of Justice, let's take the 
Foreign Intelligence Surveillance Act, we require in the FISA 
Court that the Department of Justice provide probable cause 
that a person is an agent of a foreign power or acting on 
behalf of a foreign power. So we require you to prove--to make 
probable cause in that case. Why would we provide a lesser 
standard for good old American citizens when the consequences, 
you know, are not regarding terrorism or, you know, imminent 
threats?
    Mr. Downing. I can't speak to the FISA side of the House. 
That's not ----
    Mr. Lynch. We can though. We oversee FISA.
    Mr. Downing. Of course.
    Mr. Lynch. Yes.
    Mr. Downing. But I want to emphasize the way that this 
works is that there are many different kinds of location 
information. Certainly, if the access were to really precise 
information like the GPS information that's on the chip that 
was just being discussed were accessed by the Department of 
Justice in order to track someone and follow them around, we 
would indeed use a warrant for that.
    Mr. Lynch. Let me just reclaim my time because I think you 
are going to use it all up. But you have access to all of that 
and without proving probable cause right now. And so while you 
sort that all out, let me give you another example. In the FISA 
instance, Foreign Intelligence Surveillance, if there is a 
critical, urgent need, we allow the Department of Justice, the 
FBI to go out in the first instance and actually conduct that 
surveillance if the judge is going to be shot or, you know, 
there is an emergency situation. In the short term we allow 
them to go forward with that surveillance, but immediately, 
immediately, they have to go back to the FISA Court and ask to 
verify that surveillance and to legalize that surveillance 
under a standard of probable cause.
    So they are allowed to make the surveillance, but they have 
got to be in front of that FISA Court as soon as practicable, 
and they will be judged on their action by probable cause. Why 
would we not have that for instances that you engage in with 
respect to American citizens?
    Mr. Downing. The answer to your question, I think, is that 
there are different kinds of information. Some of it is more 
protected and more sensitive and more ----
    Mr. Lynch. Yes, I know that. You are going back to the same 
point again, but we have an opportunity here for probable cause 
for you to make your case in each and every instance. I just 
don't buy it.
    We have had plenty of investigations here of the FBI acting 
illegally with respect to the Boston ops of the FBI. We have 
had other situations where the FBI has overreached with, you 
know, confidential informants. So the trust--and, look, you 
know, I know they are cleaning up their act, they are doing a 
good job, but we have had too many instances where government 
agencies have overstepped their bounds, and I think that Mr. 
Jordan's point about the IRS, you know, is probably a very 
strong example of why we should require reasonable cause.
    Mr. Downing. Well, the answer, I think, though ----
    Mr. Lynch. Probable cause, excuse me.
    Mr. Downing. If I may be allowed to respond is there are 
situations like the judge shooting case where we don't have 
probable cause. That is, we have suspects that are in the case. 
We'd like to be able to include them or exclude them so as to 
guide the investigation, but we just don't have probable cause 
at that stage. It's an early stage of the investigation, and 
having the necessary building blocks to build to probable cause 
is necessary. That's why we think having ability to gather 
information about the lesser standard, the lesser protected 
stuff is actually very important.
    Mr. Lynch. All right. I clearly disagree, but thank you.
    I yield back.
    Chairman Chaffetz. I thank the gentleman.
    I would now recognize the gentleman from North Carolina, 
Mr. Walker, for 5 minutes.
    Mr. Walker. Thank you, Mr. Chairman. Thank you, panel, for 
being here today.
    My colleague from Kentucky just a few minutes ago in the 
discussion, I believe you said that part of the problem is that 
you can't release this information publicly, to use your words. 
Congress isn't public.
    You also said that you and your staff have answered 
questions from the committee, but I would like to go back to 
last October on a question that we are still waiting for. In 
fact, it was asked by me in asking the representative from DOJ 
on whether cell-site simulators to collect the content of 
information or communications. Are you doing that before 
implementing its internal policy requirement warrants for the 
technology that you implemented in September, a month earlier?
    Mr. Downing. I'm sorry, if I understand correctly, are we 
requiring warrants to be used in following of the policy, is 
that correct?
    Mr. Walker. That is correct, yes. The witness said she was 
not aware of this but would get back to us.
    Mr. Downing. We do require warrants except under those rare 
situations where there's an exception like life-and-limb 
emergency.
    Mr. Walker. Okay. So how many cases did you guys obtain a 
warrant before collecting this content?
    Mr. Downing. I don't have exact numbers for--well, first of 
all, I would disagree whether it's content or not, but I don't 
have exact numbers. But the policy does require the collection 
of that information, and so we should be figuring that out as 
we go forward.
    Mr. Walker. All right. So from your perspective as far as 
you know, when you implemented this new policy, you guys, you 
are telling me, on all the components that you captured, 
collected or the communications that you retained, there were 
warrants issued in that process?
    Mr. Downing. If I'm understanding you correctly, after the 
policy went into effect, are we using warrants? Is that the 
question?
    Mr. Walker. That's correct, yes.
    Mr. Downing. Yes, except under those rare circumstances 
where the policy has an exception.
    Mr. Walker. Okay. All right. Fair enough. Thank you for 
answering that.
    Mr. Larkin, I have a question for you. In your testimony 
you referenced three reasonable arbitrary lines that Congress 
can draw to better protect Americans. Your second suggestion 
was to impose a warrant requirement if, after a reasonable 
period of time has elapsed, the government still has a 
legitimate need for this geolocation information. Other than 
the two areas you mentioned, intelligence and non-law-
enforcement interests, my question is this: Why should law-
enforcement not be required to obtain a warrant from the onset 
for the geolocation information?
    Mr. Larkin. There may be instances, as my panel member 
colleague said, where you can't satisfy probable cause but you 
can satisfy reasonable suspicion. I think one thing that hasn't 
been adequately explained is that there is a material 
difference between the two. It's very difficult to try to put 
percentages on how right you are when you're deciding whether 
it is probable cause or reasonable suspicion, but it's clear 
that reasonable suspicion is far lower.
    Mr. Walker. And you would build me a case of when you would 
say a warrant is not needed here but there is reasonable 
suspicion. Give me a sample situation, Mr. Downing or Mr. 
Larkin. What would that look like?
    Mr. Larkin. Well, I think his example of someone who is 
shot and you want to see, for example, based on the people who 
have a motive to do it, who had cell phones in that area. You 
don't have probable cause to believe that any one of the 
perhaps dozen people actually committed the crime, but you know 
that there are 50 people that hated someone and you want to 
find out how many of those 50 were in a particular area. So you 
find out that information. Now, you have something that you can 
work on that you never would have gotten if you didn't--if you 
had a probable cause requirement. And then you can go from 
there.
    I mean, one of the--I mean, one way to try to balance this 
out is to have only reasonable suspicion requirement for a 
limited number of days at the front, and then after a certain 
period of time, if you thought that privacy interests demanded 
a probable cause showing, the probable cause showing would come 
into play only after a certain number of days. That would allow 
somebody to try to accommodate the privacy and law enforcement.
    Mr. Walker. Mr. Downing, do you want to follow up on that 
same idea as far as what situations, what conditions, sample-
wise? Would you say you wouldn't need a warrant because there 
is probable cause?
    Mr. Downing. Actually, Mr. Larkin's explanation is far 
better than mine. That's exactly the kind of situation. We also 
have certain cases where, as another one was mentioned in my 
testimony, written testimony, where we just don't have probable 
cause yet. We have scattered pieces of information, and if we 
could get that extra bit of information, it might put us over 
the line and be able to figure out who the person is that was 
responsible. So it does come up, and that's going to be the 
burden if that source of information is offered.
    Mr. Walker. Thank you, Mr. Chairman. I yield back.
    Chairman Chaffetz. I thank the gentleman.
    I now recognize the gentlewoman from Illinois, Ms. 
Duckworth, for 5 minutes.
    Ms. Duckworth. Thank you, Mr. Chairman.
    Appropriately balancing the privacy interests of Americans 
against need of law enforcement is of great concern to me. I 
really feel that it is a responsibility for Members of Congress 
to provide the oversight for government interactions in the 
daily lives of the American citizens. While I agree that a 
person's interests and privacy is compelling and that it should 
be respected, I also cannot ignore the compelling interests of 
law enforcement to obtain information necessary to conduct 
criminal investigation.
    Mr. Downing, the collection of cell-site location data 
implicates both, and we have talked about this. Can you talk a 
little bit--you know, if there is no uniform standard for how 
we collect this information, does the Department have a 
different standard for whether the geolocation information can 
be obtained depending on where the target is located?
    Mr. Downing. I'm sorry, I'm not sure I understand ``where 
the target is located.'' You mean in what part of the country?
    Ms. Duckworth. Or situation that they may be located in. 
And do you have--because there is no uniform standard, it makes 
it very hard to sort of pin down what we are trying to do here.
    Mr. Downing. Well, of course, before the cell phone company 
were to disclose that information to the investigative officer, 
we're not going to know necessarily where that person is. In 
fact, that's kind of the goal of what's going on. So it 
wouldn't be possible to in advance say, well, we only want 
information about the location if it's in a certain context or 
otherwise. Does that answer your question?
    Ms. Duckworth. It does, but is there any effort or any 
usefulness to some sort of a minimum uniform standard as you 
are trying to move forward with this?
    Mr. Downing. Well, I think the law already provides for a 
minimum standard. Under the Electronic Communications Privacy 
Act, for example, we would have to obtain a court order with a 
specific-and-articulable-facts standard. So when we're speaking 
of historical cell-site location information in particular, it 
is very much the case that it is not unprotected; it's simply 
not quite as protected as other types of information which 
require a probable cause standard.
    Ms. Duckworth. Okay. So then let's talk about once you get 
the information. Does the Department have a consistent practice 
for how geolocation information is treated once it is 
collected? And, you know, specifically describe how that 
information is handled once it has been collected. If there is 
not a standard for what you can get, at least is there a 
standard for what you do with it once you get it?
    Mr. Downing. So the Department investigators, of course, 
encounter all sorts of very sensitive and private information 
from--personally identifiable information about people, their 
financial information, perhaps their medical information. So we 
very much respect the need to protect that information, to keep 
it safe and protected from disclosures--improper disclosures 
and so that it's used only for the official purpose for which 
it's collected. So site location information and other location 
information is treated similarly with due care to make sure 
that it is not inadvertently disclosed.
    Ms. Duckworth. Mr. Doucette, does your jurisdiction have 
similar safeguards in place when these kinds of data are being 
collected?
    Mr. Doucette. Mr. Chairman, Ms. Duckworth, the--in 
Virginia, in order for us to have real-time location data, we 
do have--we do require probable cause there, and we do require 
a search warrant. At this point in time, given historical cell 
tower information, our standard is that of what is required by 
ECPA, that there be a reasonable standard--reasonable and 
articulable standard before we can obtain that information 
through a court order. And it's not that we just go and say, 
okay, we've made the determination that we have reasonable--
probable--an articulable suspicion and therefore, phone 
company, give us this particular information. We have to take 
that information before a court and the court has to say, yes, 
you do or no, you don't. And we've had these particular orders 
refused by courts when they say you haven't even risen to the 
level of reasonable articulable suspicion. So those are our 
standards in Virginia.
    Ms. Duckworth. What I am concerned with is we have clear 
standards for how we treat physical evidence, but when you are 
talking about data that is gathered electronically, are there 
clear standards for how we handle that data, how it is tracked, 
how it is recorded, how it is shared, how it is preserved, when 
is it destroyed, all of that? Are there standards for the 
electronic data not necessarily in the same manner as physical 
evidence but are there standards? And either one of you can 
address this.
    Mr. Doucette. Are there standards? If I understand your 
question correctly, are there standards as--once we receive 
that information, how ----
    Ms. Duckworth. Yes, once you have the data, how do you--do 
you safeguard it in the same way you safeguard physical 
evidence of a crime?
    Mr. Doucette. Obviously, we have discovery obligations, we 
have exculpatory evidence obligations that we do have to 
provide to defense counsel, and we take those quite seriously. 
And so we do disclose that particular information. How it gets 
disclosed from defense counsel from then on, I have no way of 
controlling that. I do not release it out into the general 
public.
    Ms. Duckworth. Is it available to be mined by other people 
on other cases that may be unrelated? Do you see what I am 
trying to get to?
    Mr. Doucette. I may or may not. I mean, any information 
that I release in open court, obviously, anybody is allowed to 
be in court and say, okay, this particular person's phone was 
in this particular location at that particular point in time.
    Ms. Duckworth. I guess what I am saying is, for example--
and I am sorry, Mr. Chairman, I am over time. May I just follow 
a little bit ----
    Chairman Chaffetz. Go ahead. Finish the question.
    Ms. Duckworth. So the question is if you get the data that 
you want that Mr. Larkin was mentioning, we want to know how 
many guys were in the vicinity of a crime that happened, and 
you get the data for this particular investigation and it takes 
place, what happens to that information? Is it just sitting 
there for other people to come back and see who all else was 
there at that point in time later on, or is that evidence only 
used for that particular instance? I am worried that there are 
not ----
    Mr. Doucette. Yes.
    Ms. Duckworth.--safeguards and standards in place for how 
that information, now that you have it, is safeguarded and used 
in the future.
    Mr. Doucette. Mr. Chairman, ma'am, the answer under 
Virginia law is none of my files are subject to FOIA. 
Everything is considered a criminal investigative file under 
our State Freedom of Information Act, and so no one can have 
access and say--hit me with a FOIA request and say what-do-you-
have sort of thing. I do have an obligation, however, for 
discovery purposes and exculpatory evidence purposes to turn 
over to defense counsel. I do have a--obviously, whenever I 
present in open court as far as evidence is concerned, anyone 
is allowed to be in that open court and hear what evidence we 
present. But that is the only way they would have access to the 
information that we're gathering.
    Chairman Chaffetz. I thank the gentlewoman.
    And to the gentlewoman's point, part of the issue is 
Virginia, Utah, there are very few States that actually have 
these things in place, and then you have agencies outside of 
the Department of Justice that have this tool such as the IRS. 
And nobody knows what they are doing with it, and that is the 
point.
    I will now recognize the gentlemen from Georgia, Mr. Hice, 
for 5 minutes.
    Mr. Hice. Thank you, Mr. Chairman.
    And I really appreciate this hearing and what we are 
discussing today. And I share with my colleagues a great deal 
of concern with what we have seen in the past of abuse of 
government and the Fourth Amendment and the concerns that have 
been brought up today, I think, are extremely valid and need 
answers.
    I would like to go a little bit more on a bit more of a 
practical direction at this point and, Mr. Larkin, ask you a 
couple of questions. Could you expand on the differences 
between the step-by-step traditional Fourth Amendment analysis 
and mosaic theory?
    Mr. Larkin. Sure. Mosaic theory is like a Rorschach test. 
You look at the entire picture and see if the entire picture is 
reasonable. And in deciding whether it's reasonable, one of the 
things you take into account is the amount of information that 
you acquire. If all you're doing is looking at someone over the 
course of one day, you may get a very different answer than if 
you look at it over the course of 30 days. Twenty-eight days 
was the number of days that was at issue in Jones, and the 
concern was you got a lot more information following somebody 
for 28 days than one, which is absolutely true.
    If you look at it, however, the way matters normally have 
been looked at, you look at each step in what the government 
does, analyze each one separately, and if each one separately 
is lawful or justified, then you don't worry about what 
happened at steps 1 and 2 when you're looking at step 3, and 
you don't worry about what happened at step 3 when you're 
looking at step 10. You don't ever step back and do the sort of 
Rorschach analysis.
    The problem for a court is in drawing the line. You have to 
draw an arbitrary line. You have to say 2 days is enough, is 
okay, 20 days is too much. And you have to then figure out 
where between those two. Congress can do that. Congress can 
draw arbitrary lines by deciding that at a certain point you 
cannot--you can go up to a certain point based on, say, 
reasonable suspicion or based even on no justification at all. 
But we're concerned after that so we're going to cut it off at 
whatever day you choose, 3, 7, or 10.
    Mr. Hice. Is it a fair assumption to believe that you 
believe Congress should make that determination?
    Mr. Larkin. Yes.
    Mr. Hice. Okay.
    Mr. Larkin. Now, you could leave it just at reasonable 
suspicion throughout. That's what the Department is doing now, 
I think, with the exception of the policy.
    Mr. Hice. But it is fairly vague at that ----
    Mr. Larkin. But there is a material difference between 
reasonable suspicion and probable cause. The latter is much 
more serious. So one way you could balance this law enforcement 
and privacy interest is to have a cutoff period.
    Mr. Hice. Okay. Well, let's go with reasonable cause. From 
my understanding of this whole third-party doctrine issue, I 
believe you mentioned earlier, has been affirmed by the courts 
for decades now. But as we all know, since then, technology has 
changed drastically. People use email now more than they do the 
Postal Service, for example. So in a time like this where 
technology has evolved so much, do you believe that the bar for 
reasonable cause for privacy has it changed or should it have 
changed?
    Mr. Larkin. I wouldn't say that the way you define 
reasonable suspicion should change. What I would say is that at 
a certain point you may want to say that's insufficient and 
that you need probable cause because I don't think you want to 
change the standards themselves, but you may decide that at a 
certain point a reasonable suspicion standard allows you to 
accumulate so much information, you're violating the privacy of 
people involved.
    Mr. Hice. Okay. But from a technological perspective, how 
do you see the changes in technology where we are all walking 
around with our smartphones, our emails, as opposed to 30, 40, 
50 years ago? It was through the mail or other means. How has 
the changing of technology, do you believe, has it altered or 
should it have altered the bar as it relates to reasonable 
expectation?
    Mr. Larkin. There's no doubt that it has, and the reason it 
has is, as was pointed out in, I think, Justice Alito's 
opinion, practicality was a basic limitation on the ability to 
acquire evidence in the past. Now, if you had 10 people in your 
police department, you couldn't do the same sort of intensive 
surveillance that you could if you had 10,000 people in your 
police department. The NYPD can do a lot more than a very small 
police department can, and those sorts of practicalities were 
to some extent, I think, factors that courts considered in 
deciding how far the Fourth Amendment should go. You could say 
that they balanced the two to some extent.
    Unfortunately, the historic limitation that practicality 
imposed no longer is with us because the ability to collect and 
analyze information has so superseded the ability of any 
individual to do either of those that it may be necessary to 
reexamine the entire area.
    Mr. Hice. Okay. Well, thank you very much, and I yield 
back. Thank you.
    Chairman Chaffetz. I thank the gentleman.
    I will now recognize the gentleman from North Carolina, Mr. 
Meadows, for 5 minutes.
    Mr. Meadows. Thank you, Mr. Chairman, and thank each of you 
for your testimony.
    I find myself in a very difficult spot. I don't know that I 
have on many occasions ever agreed with the ACLU, and I don't 
know on many occasions that I have ever gone against law 
enforcement, and yet this fundamental question that we are here 
today addressing is, Mr. Downing, very troubling because of the 
expectation of privacy and what foundationally is what all 
Americans presume that they should enjoy.
    And so I guess under what scenario can you justify not 
sharing with Members of Congress the Jones guidance? And let me 
caution you because I go into a skiff here and I see all kinds 
of national security secrets that I am not allowed to divulge, 
and yet somehow your Jones guidance would supersede our nuclear 
capability in terms of my ability to see a memo.
    Mr. Downing. As I said before ----
    Mr. Meadows. Is it more important than our nuclear 
capability?
    Mr. Downing. The Department is very much interested in 
providing whatever information the ----
    Mr. Meadows. So you are going to provide to all the 
Members?
    Mr. Downing. At this point there are, however ----
    Mr. Meadows. Because having an interest and doing something 
are two different things, Mr. Downing. So are you going to 
provide to the Members of Congress? I can see all kinds of 
national security secrets, some that you may not even get to 
see.
    Mr. Downing. We are seeking to do an appropriate 
accommodation with the committee ----
    Mr. Meadows. Appropriate according to who?
    Mr. Downing. Mutually appropriate accommodation to the 
committee ----
    Mr. Meadows. Well, we think is appropriate that the entire 
committee should be able to see it, so ----
    Chairman Chaffetz. If the gentleman will yield?
    Mr. Meadows. Yes.
    Chairman Chaffetz. I don't think we should be treated any 
different than every other Member of Congress. I have been 
fighting this for years. And even though we are grateful, it is 
amazing to me that I have to negotiate as a Member of Congress, 
as a chairman of the committee, as someone that serves on the 
Judiciary Committee to an accommodation--I mean, part of this 
deal is we are not supposed to take notes, we are not supposed 
to do certain things. What? What? Seriously?
    The reason I have resisted every other gesture thus far is 
because of all these conditions. I shouldn't have to have a 
condition. I represent 800,000 people. They trust me to go in 
in this republic, and look at this information and keep it 
confidential, that we sign oaths, we abide by the law. If we 
don't do that, then you should prosecute us. But we see, as Mr. 
Meadows said, some of the most sensitive information that you 
can possibly have, but the guidance on post-Jones is somehow so 
sacred that thus far you are only granting two out of 535 
people to go see this? It seems very inconsistent.
    I am sorry. I yield back to the gentleman.
    Mr. Meadows. You go ahead. You can comment.
    Mr. Downing. It's not really a matter of trust. I think 
that's not the right way to think about this. The Department 
has confidentiality needs in things like the way--the positions 
that we're going to take. We're also worried that disclosures 
of one sort will be regarded later by a court as a waiver of a 
privilege as well. So there's a number of factors that go into 
this consideration.
    Mr. Meadows. But it is a matter of trust because if you are 
saying that you can't--I mean, because we are protected in 
that. If Members of Congress--maybe not our staff, but Members 
of Congress would be protected.
    But let me go a little bit further because what you are 
saying is reasonable suspicion is enough to be able to use 
this, is that correct, in some cases?
    Mr. Downing. For the historical cell-site information, yes 
----
    Mr. Meadows. All right. So is it ----
    Mr. Downing.--we've been very public about that.
    Mr. Meadows. Is it okay for the IRS to use reasonable 
suspicion as their guidance?
    Mr. Downing. If what we're talking about is historical 
cell-site information, they would have the same rules as all 
the other law enforcement agencies, yes.
    Mr. Meadows. All right. So let me ask you is when we have 
had this whole Lois Lerner thing, and I don't normally harp on 
that, but they had reasonable suspicion according to them--
according to DOJ they had reasonable suspicion. So what you are 
saying is they could use a stingray for every single group that 
they had out there that was asking for 501(c)(4) status?
    Mr. Downing. I don't have any ----
    Mr. Meadows. Well, that is what they are saying.
    Mr. Downing.--responsibilities ----
    Mr. Meadows. It was DOJ that we actually had a hearing the 
other day, so that is troubling to me that we would do that. 
Wouldn't it be troubling to you?
    Mr. Downing. I think there should be a consistent standard 
for all law enforcement investigations, and the one that ----
    Mr. Meadows. But the consistent standard should be probable 
cause, wouldn't you think, with an expectation of privacy?
    Mr. Downing. There are particular situations like the 
shooting at the judge, though, that caused the probable cause 
standard to not be ----
    Mr. Meadows. I don't know of any Tea Party group that shot 
anybody, do you?
    Mr. Downing. I don't.
    Mr. Meadows. Well, so let's not talk about shooting of a 
judge and comparing it to the IRS, I mean, because you are 
somehow justifying that that would be appropriate.
    Mr. Downing. I'm merely saying that ----
    Mr. Meadows. They can use your same standard.
    Mr. Downing. There should only be one standard ----
    Mr. Meadows. So what about ----
    Mr. Downing.--yes.
    Mr. Meadows. All right. So is it breaking the law if a 
criminal buys a stingray and they start to use this?
    Mr. Downing. Yes, it is.
    Mr. Meadows. Now, why would that be because there is no 
probable cause standard?
    Mr. Downing. No, whether something's a crime and whether 
something is available to the government under ----
    Mr. Meadows. Yes, but here is--the difference is what you 
are doing is superseding the judicial branch by basically 
saying the executive branch here knows best because what you 
are saying is we don't really need probable cause and go before 
a judge because we have this reasonable suspicion standard.
    Mr. Downing. I would emphatically disagree. It's the courts 
that decide this. And when we have obtained those orders, it's 
by going to a judge in order to obtain it, and they've signed 
the--and then it's litigated later. And today, the three 
circuit courts that have decided this issue have not had their 
opinions vacated, have ruled that there is no reasonable 
expectation of privacy ----
    Mr. Meadows. Well, here is where I would caution you, and I 
am going to yield back to the chairman. This is very 
problematic in a bipartisan way, and you have a choice here 
today, to start to work it where we can help law enforcement 
enforce and still protect our Fourth Amendment rights or you 
are going to find yourself without a tool very quickly because 
I think there is a bipartisan desire here to make sure that the 
protection for all Americans is something that they should 
expect.
    I appreciate the patience of the chair.
    Chairman Chaffetz. The gentleman yields back.
    I now recognize the gentleman from Wisconsin, Mr. Grothman, 
for 5 minutes.
    Mr. Grothman. Thank you.
    I am going to switch a little bit more to some other ways 
people are tracked. We are going to start out here with Mr. 
Downing, but we will go on if someone else wants to jump in.
    How would Justice obtain information from, say, OnStar or a 
similar feature? There is a GPS feature built into cars and 
about car movements.
    Mr. Downing. So in the situation where there is a GPS chip 
in a car or, for that matter, in a phone and the company 
activates that chip in order to determine the location of the 
phone or the car and reports that back, that's a situation 
where we would use a search warrant unless there were an 
exception to the Fourth Amendment.
    Mr. Grothman. Okay. Would a grand jury subpoena be 
sufficient?
    Mr. Downing. No, not in that situation.
    Mr. Grothman. Okay. What would be the procedure followed to 
obtain real-time or prospective GPS location from an OnStar-
like device, and is it different from past movements?
    Mr. Downing. So as I mentioned, a search warrant would be 
the type of tool that we would use when it's that kind of GPS 
level and collecting it prospectively. I don't believe that 
OnStar collects historical location information. I'm not 
familiar with that.
    Mr. Grothman. Okay. Can you have a service provider send 
real-time data location from the device's GPS?
    Mr. Downing. If you're asking--if it's a real-time 
collection of that GPS information, that would be, as I said, 
with a search warrant to the provider.
    Mr. Grothman. Okay. I will yield the remainder of my time.
    Chairman Chaffetz. Before he yields, let me--if the 
gentleman would yield just to kind of follow up on that.
    Can the government have them turn on the GPS device in a 
car?
    Mr. Downing. Yes, I believe in many ways a car GPS device 
of that sort is very similar to a cell phone, and there are--
some of the companies--I don't know about OnStar in 
particular--that have that capability in the same way that some 
cell phone companies do.
    Chairman Chaffetz. Ms. Guliani, can you give us your 
perspective on that?
    Ms. Guliani. I think that ----
    Chairman Chaffetz. I am sorry, your microphone.
    Ms. Guliani. You know, one of the things that's been 
particularly concerning to us is, you know, as I understand it, 
part of the reason that the Department of Justice believes that 
a probable cause standard is not the appropriate one is this 
idea that, you know, individuals have voluntarily provided this 
information. And that's certainly not true in the cell phone 
contacts for most of us, you know, are not aware of the 
information that phone carriers collect, and when it comes to 
GPS information, don't really have an ability to turn that 
feature off.
    And I think whether its OnStar, whether it's the medical 
devices of the future, the ability to turn that information off 
may not exist. And the idea that law enforcement can, you know, 
in some cases ping the device or remotely turn on the device 
and capture our location information when we are not aware, we 
wouldn't want it captured, and do so potentially without 
appropriate protections is very concerning and doesn't comport 
with what the Fourth Amendment would require in this context.
    Chairman Chaffetz. I would assume that the gentleman from 
Wisconsin yields back, and then I will recognize myself and 
then Mr. Cummings as we wrap up here.
    We have been talking a lot about the Federal, you know, the 
Department of Justice. Mr. Downing, the positions that you 
represent, is that true throughout all of the Department of 
Justice? Is it specific to just the criminal division, which 
you represent? I mean, are we to assume that this includes the 
DEA and the marshals and the FBI, et cetera?
    Mr. Downing. The positions that I've been discussing apply 
across the board to all criminal investigations. I can't speak 
for national security investigations.
    Chairman Chaffetz. Okay. I just want to make sure I 
understand the scope.
    And what is also important for those listening to this 
hearing and members is that is just the Department of Justice. 
And the concern is that other Departments have their own 
standards, their own way of collecting and securing these data.
    As Ms. Duckworth talked about, one of my concerns is what 
are the standards? Because if you are going back to not having 
to use a warrant to gather historical information, there are no 
bounds on that. If you knew that some political group or 
organization was meeting at a certain location at a certain 
time, you could go get all that information and not have to get 
a warrant, correct, Ms. Guliani?
    Ms. Guliani. That's correct, and I think even more 
concerning is that there's no notice. So, for example, if 
you're in a situation where, you know, the Department of 
Justice or another law enforcement agency is collecting 
information about hundreds of individuals and what cell tower 
they connected to, it's not the case that after 90 days or the 
conclusion of the investigation that you'll be provided 
notification and able to challenge that conduct in court. And 
that's different than the approach taken, for example, by the 
wiretap statute. And so what we've essentially got is a 
situation where innocent people who have their information 
collected as a practical matter just don't have recourse to 
challenge this conduct in court.
    Chairman Chaffetz. The ACLU did a very interesting report. 
I can't remember the date of it but I was fascinated by it. It 
is part of what compelled my interest in this topic where you 
did a survey across the Nation of the various law enforcement--
I believe it was municipal, county, and State law enforcement. 
Can you generalize that?
    And I would ask unanimous consent to enter into the 
record--although I don't have it here, I will get it in the 
next 2 days. Without objection, so ordered.
    Chairman Chaffetz. But, Ms. Guliani, can you give us the 
framework of that survey?
    Ms. Guliani. Sure. We've done two surveys. One was we filed 
FOIA requests with law enforcement jurisdictions across the 
country to ask, you know, what--whether they're using--
collecting location information, and if so, what standards 
apply. And what we found was, by and large, most law 
enforcement agencies were collecting this location information 
but that standards differed widely. So in some cases, 
jurisdictions such as those in Kentucky and Hawaii had 
voluntarily decided to follow a probable cause standard. In 
others, we found that jurisdictions were following a lower 
standard or not requiring a warrant.
    As part of that report, one of the things that we found was 
that, despite Department of Justice policy that states that a 
warrant should be required for real-time prospective 
collection, in both New Jersey and Florida, it appeared that 
there had been cases where location information had been 
collected without a warrant. So that was one report we've done.
    The second examination we've done is we've also conducted 
FOIA requests on the use of stingrays, you know, these cell-
state simulators which can collect massive amounts of 
information.And what we found is, despite the fact that there 
are, you know, no Federal laws and no Federal guidance even 
concerning localities that receive Federal funds to purchase 
stingrays, but also the standard varied widely. In some cases, 
law enforcement were not getting any court authorization. In 
other cases, even in cases where they received court 
authorization, they weren't informing judges, hey, this is what 
we're using, this is the impact of what it has. So judges were 
in some senses blindly, you know, signing orders.
    And the third thing that we found was that there had been a 
concerted effort to keep these devices secret from both judges 
and defense attorneys and the public. And so the Department of 
Justice signs nondisclosure agreements with States and 
localities who purchase these devices, and those nondisclosure 
agreements say that information cannot be released.
    And there may be cases where, in lieu of releasing 
information to a judge, the State or locality is suggested to 
drop the case or offer a plea bargain. And that was 
particularly concerning to us because, as we see it, the courts 
represent a way to provide oversight of the use of these 
devices, and to the extent that we are--there is a concerted 
effort to keep them secret from even these entities, that is a 
loss to the American people.
    Chairman Chaffetz. So coming back, Mr. Downing, the 
Department of Justice has these nondisclosure agreements, these 
cell-site simulator nondisclosure agreements with State and 
local law enforcement. Is that something you can provide to 
this committee?
    Mr. Downing. Yes, we can provide those. I would note, 
though, that the approach that we've taken particularly 
following the cell-site simulator policy is to make clear that 
we're not trying to conceal and nor should that policy be 
implied to conceal the fact that a cell-site simulator was used 
and that, of course, there's always an obligation of candor to 
the court. At this point, the FBI is actually looking again at 
those nondisclosure agreements and is in the process of 
revising them and trying to clarify what the approach is now.
    Chairman Chaffetz. Why the change?
    Mr. Downing. Well, I don't know that I have all the 
factors, but certainly when the environment has changed, 
there's a certainly a lot more information publicly available 
about these devices. And when the Department did an analysis 
that--of looking at this whole situation, we decided to 
institute the policy in the end, and now we're trying to make 
sure that all of our practices are consistent with that policy.
    Chairman Chaffetz. I now recognize the ranking member.
    Mr. Cummings. Ms. Guliani, as I was just listening to you, 
it sounds like different standards or no standards all over the 
place, is that right?
    Ms. Guliani. That's exactly right. There's different 
standards among States. There's different standards, as you've 
heard, between types of location information, and there's 
different standards that appears from even how you collect that 
information, whether it's a stingray or whether it's through a 
phone carrier.
    Mr. Cummings. So would you agree that we have a serious 
equal protection issue here?
    Ms. Guliani. I think there are serious concerns that, you 
know, depending on where you live or the type of technique 
being used, that you will have a different standard apply, 
which is one of the reasons we believe it's so important that 
we have legislation or at a minimum that the average American 
has information from the Department of Justice as to what 
standard actually applies, you know, what standard applies when 
they're collecting historical location information, historical 
location information from a phone carrier versus the 
information that might be collected from, say, a phone app. 
Those are all missing pieces where the public and it appears in 
some cases the Members of Congress have been left in the dark.
    Mr. Cummings. Mr. Downing, you know, in listening to the 
other members of the committee and the chairman, it is good 
that we were able to reach an agreement, but if I were another 
member, I would be very upset. I am being frank with you. I 
mean, we all represent approximately the same amount of people, 
and I think we made reasonable arguments that we are entrusted 
with all kinds of very sensitive information.
    And I am hoping that we can--I know we reached our 
agreement, but I hope that we can revisit that because I think 
it is unfair to members, but particularly with something as 
sensitive as this. It affects almost every single person, am I 
right, Ms. Guliani ----
    Ms. Guliani. Almost every ----
    Mr. Cummings.--in this country?
    Ms. Guliani. Almost every American has a cell phone.
    Mr. Cummings. And we represent them. And I think the public 
would be alarmed if they knew that there was such a memo 
apparently giving guidance and their Members could not see it. 
I mean, it just strikes me as just--something is not right 
there. And that is after--you know, the chairman will tell you, 
we try to reach a balance, but it seems to me like this is kind 
of not balanced. But thank you all for your testimony. I really 
appreciate you.
    Chairman Chaffetz. As we conclude here, I just want to kind 
of go down the panel, just take 30 seconds or so if you have 
any concluding thought. I wasn't able to let all panel members 
answer all questions, so if there is something you want to 
share verbally here, and again, we would always welcome your 
ongoing communication and input and thoughts.
    But let's start with Mr. Downing and kind of go down the 
line, and then we will conclude this hearing.
    Mr. Downing. Just in closing, I've heard a lot of talk 
about whether there's a need for legislation. Obviously, we 
don't have a position--obviously--we don't have a position on 
particular legislation, but I would encourage the members of 
the committee to think about the different kinds of location 
information there are and to consider whether there are 
different balances that need to be struck between those 
different kinds, taking into account the needs of public safety 
and the justice system. And we look forward to working with the 
committee as that process moves forward.
    Chairman Chaffetz. Look, we have a duty and an obligation 
to help keep the public safe, but I would also argue that we 
are different in the United States of America. We are more open 
and transparent and critical. And part of my frustration is not 
the good work that you and so many of the men and women at the 
Department of Justice do. It is just that in order to try to 
craft the right solution, if we don't see all the facts, we are 
going to come to the wrong conclusion. And Congress is 
notorious for coming up with wrong conclusions. So we are 
trying to get it right, and having the maximum information 
helps us to get there. And that is the spirit with which we 
approach this. So thank you personally for your commitment to 
this country and all that you do, and thanks for being here 
today.
    Mr. Doucette?
    Mr. Doucette. Thank you, Mr. Chairman.
    One of the questions that was asked during the course of 
today's hearings was dealing with who should act, whether it 
should be Congress or the courts, and who can act most quickly 
in order to deal with the changing technology. I think the 
answer is clearly that the--this particular body needs to--can 
act more quickly as the technology change. But that's not my 
original thought. That's Justice Alito in his concurrence, and 
United States v. Jones certainly suggested that.
    That concurrence also brought up the concept that Mr. Hice 
was asking the questions about the mosaic theory, and that's 
certainly the topic of a law review article written by 
Professor Orin Kerr of the George Washington University School 
of Law. It's a fascinating article. The problem that is raised 
by the mosaic theory and that Professor Kerr raises is that, 
just as Mr. Larkin has pointed out, at what point in time does 
what is a--not a violation of a Fourth Amendment become a 
violation of the Fourth Amendment?
    And I think that obviously if Congress is going to act and 
should act in this particular matter and can act in a number of 
different ways saying that historic cell tower information 
needs a probable cause determination or doesn't need a probable 
cause determination or finds the middle ground that Mr. Larkin 
was suggesting perhaps as far as his second alternative is that 
maybe at some point in time, whether it's 5, 10 days, what has 
been justified by a reasonable and articulable suspicion, 
current burden of a probable cause determination, that would 
aid us tremendously in guiding law enforcement and guiding the 
courts as to how to imply the standard for historic cell tower 
information.
    I thank you for the opportunity to address this body.
    Chairman Chaffetz. Thank you. And again, thanks for your 
good work and thanks for your expertise in being here today. I 
do appreciate it.
    Mr. Larkin?
    Mr. Larkin. Three brief points. First, several members 
asked what is the adverse effect from a search warrant 
requirement? I think the right answer to that is we don't know. 
We don't know in individual cases because no individual police 
office or agent is going to be able to say the reason I 
couldn't make an arrest was I had to use a probable cause 
standard rather than a reasonable suspicion standard. Plus, at 
a macro level, we don't have anybody collecting that 
information on individual cases. So we really don't know the 
answer to what is the adverse effect from a search warrant 
requirement.
    Second, with respect to the post-Jones memo, there isn't a 
good argument why DOJ shouldn't share it. It's, I think, a 
historic artifact. I was at DOJ for 9 years, and the executive 
branch and DOJ tend to look at Congress as not being part of 
the government. Congress has always taken a position that the 
attorney-client privilege, for example, doesn't apply between 
the branches because it's all one government. The same is true 
here, and certainly as your colleague said, if you can get 
information dealing with the government's nuclear capabilities, 
you can get information dealing with stingrays.
    Finally, your colleague from Wisconsin, I think ----
    Chairman Chaffetz. Yes.
    Mr. Larkin.--asked about OnStar. OnStar is a private 
company. The relationship OnStar has with a customer, whether 
it's Ford or John Doe who buys a Ford with OnStar, is not 
governed by the Constitution. There may be Federal statutes 
that regulate to whom OnStar can give that location 
information, but the Constitution doesn't come into play at 
all. So if there's no statute limiting what OnStar can do, 
OnStar can give that information to the New York Times if it 
wants. So what happens when you regulate the government is 
different than private parties.
    Chairman Chaffetz. Well said. And again, thank you, Mr. 
Larkin, for your expertise and your participation here today. 
We do appreciate it.
    Mr. Larkin. Thank you, sir.
    Chairman Chaffetz. Ms. Guliani?
    Ms. Guliani. Well, thank you very ----
    Chairman Chaffetz. Microphone.
    Ms. Guliani. Thank you very much for having this hearing.
    I would underscore, you know, the points I made earlier. I 
think that now the time is ripe for a congressional action here 
and for legislation and for holding law enforcement to the same 
standard that applies to information in a variety of other 
contexts, you know, whether it is entering your home or getting 
a letter in a probable cause standard.
    I would say, though, in the interim, as we wait for such 
legislation, I know that members of the committee will continue 
to press, and I hope that they will press the Department of 
Justice to release its policies publicly. I appreciate the fact 
members of this committee will now have an opportunity to see 
the Jones memos. That's an opportunity that all Americans 
should have.
    And we should also understand exactly what standards are 
governing collection of location information. And to the extent 
that the Department of Justice can release a policy, similar to 
what it did with stingrays, release a public policy so that 
Americans can understand what standard applies, and we hope 
that that policy will have a probable cause standard. And we 
think that it should have a probable cause standard to comport 
with the Fourth Amendment.
    And without such actions, I think we risk being in a place 
where simply due to modern technology, the fact that I want to 
use a cell phone or I want to have a GPS system in my car that 
somehow I'm entitled to less privacy, somehow my life is an 
open book in a way that the Founders didn't intend. And, you 
know, given these technological realities, I certainly hope 
that Congress will press the Department of Justice to take 
these actions.
    Chairman Chaffetz. Thank you. You have been very insightful 
and very helpful on this, Ms. Guliani, and I do appreciate your 
participation and your insight, your help with this committee. 
So thank you so much for being here.
    Ms. Guliani. Thank you.
    Chairman Chaffetz. Thank you all. The committee stands 
adjourned.
    [Whereupon, at 12:12 p.m., the committee was adjourned.]

                                 [all]