How Milwaukee Police Do Cell Phone Surveillance

Through an open records request, the Wisconsin Examiner has obtained a log from a cell site simulator used by the Milwaukee Police Department (MPD). This release marks the second time a log documenting use of the powerful phone surveillance technologies by MPD has been made public.

The last time a log was made public in Milwaukee was nearly seven years ago, during the fall of 2015. The new log documents 227 investigations where the devices were used dating from October 15, 2019, to July 29, 2021. It includes incident numbers, the types of crimes for which the device was deployed, dates of use, the phone service provider of targeted devices, and more.

During a recent in-person meeting with the Examiner, MPD Inspector Paul Lough helped explain aspects of the log, as well as how cell site simulators are used. Lough, who oversees the Criminal Investigation Bureau, was joined by other MPD staff who work directly with the cell site simulator. “We have a team of guys that are trained on all the equipment,” said Lough, “and they essentially manage it, control it, maintain data and logs.”

The devices mimic cell towers, gathering identification and location data from mobile phones. Cell phones work by connecting to a cell tower with the nearest, strongest signal. Cell site simulators act as a man-in-the-middle, gathering information before the signal reaches a legitimate tower. Although primarily used to track location, cell site simulators can also intercept calls and text messages, send fake short messages, and may disrupt phone service.

Previously maintained by MPD’s fusion center intelligence hub, cell simulator technology was moved to the Special Investigations Division (SID). Lough explained that the change made logistical sense. “We were able to have more personnel up here who could be trained on it,” he said. “And also, the Fugitive Apprehension Unit, that actually hunts or goes after guys who are wanted for the felonies, are all stationed in this unit. So it made more sense to have some of those guys trained on this technology, and have it run out of here. Just to have it be more efficient. Instead of having to call down there [to Fusion], just bring everything here.”

Responsible for coordinating and focusing resources on “the investigation, arrest, and prosecution of prolific offenders of violence,” according to a 2021 MPD organizational document, SID has a variety of functions. It handles fugitive apprehension for those wanted for outstanding felony warrants as well as “locating other subjects who are not in warrant status but wanted for serious crimes,” according the document. SID maintains an extradition unit which supports its fugitive operations. SID is also the home of the MPD’s High Intensity Drug Trafficking Area (HIDTA) unit, tackling large-scale drug trafficking investigations. The division follows up on leads generated by the fusion center’s Gun Intelligence Center and investigates suspicious overdose deaths.

The SID’s specialty focus on felony and violent crimes was one motivation for moving cell tracking operations there from the fusion center. The vast majority of crimes documented in the log are violent in nature including recklessly endangering safety, shootings, homicide, felon in possession of a firearm, burglary, sexual assault, armed robbery, strangulation and “mayhem,” which is actually specifically defined in state statute. Other categories include drug cases, vehicle theft, fleeing, interfering with the custody of a child, human trafficking, probation violations, possession of child pornography and abduction.

The recently obtained cell site simulator log.

Homicide, felon in possession of a firearm and “shooting” accounted for about 51% of all log entries. That’s not including endangering safety by use of a dangerous weapon. Only the 2020 year is entirely represented in the log. So far this year, the city of Milwaukee has experienced 119 homicides. By the end of 2021 there had been 193 homicides, an all-time record, breaking the record of 190 set in 2020.

Some entries are simply logged as “ongoing investigation” or “long term.” Of the investigations included in the log 205 were listed as tracking a “suspect,” 15 tracked a “victim,” and seven were listed as “other.” The devices were also used to locate material witnesses, missing persons, and subjects in domestic violence cases. T-Mobile and Sprint were the most requested service providers. Together, they account for 76.3% of all entries included in the log. Other tracked carriers include AT&T, US Cellular, Verizon and, in just one case, Metro-PCS.

Confidential sources, and Title III

About seven personnel are trained on the system. One of them, Officer Christopher Randazzo, serves as the “quality control manager,” as Lough put it. Randazzo and his teammates essentially comprise the MPD’s Confidential Source (CS) team. Once connected to the fusion center, the team handles confidential technology used in MPD’s investigations. Every entry on both the 2021 and 2015 logs reads, “completed, located by CS Team.” Log entries are entered manually. “It’s not like something that’s automatic,” Randazzo told Wisconsin Examiner, “so there is human error in it, just like with anything else.”

Randazzo goes over the entries, ensuring the information is accurate. First affidavits need to be submitted and warrants approved by a judge. After that, orders are sent to whichever phone company provides service to the target phone. Companies normally retain records when they’re served with phone tracking or intercept orders. “There’s a process of when it gets submitted, to when it gets set up, to when we’re out doing what we do, to when we terminate everything and we’re done, to when the billing actually comes,” said Randazzo. In May 2019, the department replaced its cell site simulator system at an upfront price of $498,9000. Each time it’s used, additional fees are charged by the phone company.

In addition to the information that  was released, MPD explained that it logs the current status of each target it  tracks with tags that include “analyzing phone number” or “awaiting phone company action.” The name of the investigator requesting the warrant is also logged, as well as the agency or district they’re from. That information was included in the 2015 version, which documented 579 investigations and showed that the technology was requested by numerous agencies outside of MPD. Notes made by the “track team” are also recorded, which may include updates of the target’s location. The date an order is signed by a judge is also included, since a warrant is only valid for 60-days after it’s been authorized.

Mike Katz-Lacabe, director of research at the Center for Human Rights and Privacy, was responsible for getting MPD to release the first cell simulator log in 2015. Reviewing the most recent log, he noticed that about 6.5% of the tracks were of victims, and seven entries were listed as “other.”

Katz-Lacabe also highlighted that 86 of the 227 cases, or 38%, had no incident number. “That seems like a large usage of the [cell site simulator] without an incident number,” he said. “If it’s serious enough to use a very expensive piece of technical equipment like a [cell site simulator], it would seem to warrant an incident number.” Without an incident number, it can be more difficult to file records requests for those cases of phone tracking. He also called the entries for “long term” investigations or simply “drugs” “disturbingly  vague.” Both the 2015 and 2021 logs also include a “project list page” number, which is undefined. Records requests have been unsuccessful at yielding more information about what the page is.

Lough stressed that the department’s use of this technology is thoroughly vetted through the courts. Affidavits filed by investigating officers and the district attorney must be reviewed by a judge. “And even before it goes to a DA, the investigator brings it to his or her own boss, the supervisor, and it has to be taken and approved,” Lough told Wisconsin Examiner. It’s a multi-level process which department officials have stressed isn’t taken lightly. “The only time we don’t have to do that is in an emergency situation,” Lough explained. Known as “exigent” circumstances, such situations normally involve life or death situations including kidnapping, missing persons, or suicide risks.

Although SID mostly uses the devices to track location, that doesn’t mean their more exotic capabilities don’t exist. In order to intercept calls and texts, or perform other functions, even more rigorous Title III approval is needed. Title III wiretap investigations authorize police to capture content, requiring what’s known as exhaustion. “Not just probable cause for the crime,” Lough noted, “it’s exhausting all other means of effectively, maybe catching the person that you’re investigating. Like, we can’t get ’em any other way. And you need to demonstrate that for investigative approval.”

Federal wiretaps take even more steps, with the request having to go out to Washington D.C. for approval. Randazzo feels that this encompasses one of the biggest misunderstandings the public may have about cell site simulators. “I think that’s a big misconception by people,” said Randazzo, “that they think that we get content of everybody’s phone calls that are around, it just isn’t the case.” He added that, “there might be some devices out there that you can do that with,” though the requirement for court authorizations would remain.

Those other kinds of surveillance technologies may come in different forms. In June, it was revealed that one of the most famous producers of cell site simulators was in negotiations to acquire the notorious Israeli NSO Group. The company produced spyware called Pegasus, which has been linked to murders and unethical surveillance around the world. Pegasus turns a phone against the targeted person with capabilities far beyond the known functions of cell site simulators. Earlier this week, after backlash from privacy advocates and the White House, the U.S. defense contractor L3 Harris backed out of the negotiations. Harris once sold its cell site simulators under the brand name “Stingray,” including to MPD. The department now utilizes cell site simulators produced by a different company, Tactical Support Equipment.

Questions about surveillance and public oversight

Particularly since the protests of 2020, more attention has focused on police surveillance in Wisconsin. Milwaukee’s once obscure fusion center has attracted much of this attention. It leaves some to wonder what additional oversight measures could be implemented to bring the public into the loop. In Oakland, California, a privacy commission was created which helps oversee local use of cell site simulators. “Sometimes the technology is advancing quicker than the oversight and transparency that needs to come with it,” Rep. Jonathan Brostoff (D-Milwaukee) told Wisconsin Examiner. “That’s why we have to remain vigilant and be on top of it. And we can’t forget the value and importance of individual civil liberties and to make sure law enforcement is not stepping over appropriate boundaries — even if they think it’s more convenient or whatever the rationalization at the time is.”

Milwaukee County Supervisor Ryan Clancy stressed that transparency is crucial, as is public engagement. “These are conversations, overall, that we should be having before they deploy these technologies, and not after the fact,” said Clancy. He fears that elected officials and the courts are “assuming that there has to be oversight happening on some other level, and it’s not.” Although not responsible for the MPD, Clancy has encountered issues in inquiring into the Milwaukee County Sheriff’s activities. “One of the only tools that electeds have in terms of accountability on surveillance and policing is the budget,” said Clancy. “And to continue to throw money at law enforcement both broadly and in terms of surveillance, without demanding data about it, is really a losing strategy. We’ve been doing that for a while now.” Clancy encourages his counterparts on Milwaukee’s common council to more proactively monitor the MPD’s use of surveillance technologies.

Both Brostoff and Clancy have reason to feel strongly about the topic. Brostoff was placed on a list of protesters, which the crime analyst who created it labeled a “target list.” The list was shared shared among local and federal law enforcement departments in southeastern Wisconsin. A fusion center bulletin also mentioned a film screening in June 2020 of The Blood Is at the Doorstep, a documentary about Dontre Hamilton who was killed by a Milwaukee officer in 2014. The documentary was to play at 8:30 p.m. at Bounce Milwaukee, a family entertainment venue owned by Clancy’s wife. Clancy was also photographed by Wauwatosa officers as he served as a legal observer during the protests of 2020.

Clancy questions why the showing of a police-related documentary would earn a place on the intelligence hub’s situational awareness bulletin. “I am well aware that both law enforcement and people adjacent to law enforcement are watching myself and my family and everybody else,” he said. “And watching and surveilling organizers in general. But to see that in a report, see that in writing, just underlines what a massive waste of resources that is.”

“We had kids and adults jumping around in inflatables,” he added. “The idea that law enforcement thinks that’s something to pay attention to is incredibly frustrating.”

Deja Vishny, a Milwaukee-area criminal defense attorney and the retired head of the state’s public defender’s homicide practice group, understands the concerns. Vishny was also placed on the same list as Brostoff, along with other lawyers, elected officials, and a Wisconsin Examiner journalist. The list was created by the Wauwatosa Police Department, and later shared with MPD.

“The problem is that, No. 1, how close is the supervision of judges in terms of looking at these warrants,” Vishny asked. “I mean, the judges should supervise it closely. Hopefully that’s actually happening.” She added, “When the technology exists, sometimes law enforcement officers use the technology, and then go try to retrace their steps and get a warrant after the fact to try and cover their tracks.”

A fusion center intelligence bulletin mentioning protest activities, including the showing of “The Blood Is At The Doorstep” at Bounce Milwaukee.

It’s a process called “parallel construction,” and it’s something that Vishny finds very troubling. “The biggest concern I have, warrant or no warrant, it’s really an infringement of people’s privacy that law enforcement has so many tools to track people. What we call a Stingray, or an IMSI tool, is just one of those but there’s many others. Pole cameras, automatic license plate readers, street cameras, there is just a lot of technology out there that is infringing on our privacy in a way that has never occurred historically.”

“One cannot count on law enforcement to police themselves,” she added. Questions have always hovered around the legal implications of surveillance technology. “What is the reliability of the technology?” Vishny asked. “What is the error rate of the technology? Does the technology entrap innocent people? Does the technology surveil people who really have a right to privacy?” In the past, rather than admitting to using a Stingray in court, police officers have said the information came from a confidential source. Whereas most people may associate “confidential source” with human informants, surveillance technologies like Stingray add new dimensions.

In regions with law enforcement governed by more conservative policies, Vishny fears that Stingray-type devices may be used in prosecuting abortion cases as new laws come into effect following the overturning of Roe v. Wade. Suppose a woman traveling to get an abortion is being tracked by a Stingray to a clinic, and the doctor is later arrested for performing the procedure. Would the doctor’s lawyers ever be able to determine the technology was used to find the clinic, since the client was the target of the surveillance but not of criminal charges?

Vishny wonders if in places where getting an abortion is now a criminal offense, “these tools can be used to infringe upon the freedom and privacy of people doing something as simple, and something we don’t think of as a horrible crime, as terminating a pregnancy? So what do we think about that? Where do we draw the line?”

“The ends don’t justify the means,” she adds. “We have to look at the entire picture and what is the danger to us as a society. And I think, frankly, we’re living in a very dangerous period where there are many, unfortunately, politicians and individuals who seem to not put a priority on what we have traditionally thought of as living in a free society.”

How the Milwaukee PD uses cell phone surveillance technology was originally published by the Wisconsin Examiner.