An example of a “trap and trace” or “pen register” order inadvertently left open in public court records.

Frontier Senior Staff Writer Clifton Adcock contributed to this report

It wasn’t the most daring set of crimes, but it was annoying to the Oklahoma Highway Patrol and the state’s turnpike authority.

Rolling down northeastern Oklahoma turnpikes, thieves would stop at the toll collection machines, break them, take the money and drive away.

The string of burglaries lasted at least two years and numbered at least 13.

By early 2017 investigators — believing it was the same band of burglars committing the crimes — decided the thefts had gone on long enough. They couldn’t identify the thieves through surveillance video, but maybe there way another way.

According to a document filed in Tulsa County District Court in February 2017, the Oklahoma Highway Patrol petitioned the court to order four cellular phone companies to turn over all phone records related to cell towers near the locations of the crimes. Scott Miller, the trooper who wrote the petition, said that by looking at details of all incoming and outgoing calls that “pinged” that tower around the specific times of the burglaries, he hoped it would lead him to the thieves.

The court granted the request, though it’s unclear where the investigation ultimately led. Dwight Durant, an Oklahoma Highway Patrol spokesman for the eastern part of the state said he was told to refer questions about the case to the Oklahoma Turnpike Authority.

Jack Damrill, the OTA’s spokesman, questioned why OHP referred questions on the case to him.

“They were the ones that investigated it,” Damrill said.

He told The Frontier he believed at least one arrest was made, though he wasn’t sure if anyone was ever charged.

Requests of this nature are not rare, though they are rarely publicized. In Oklahoma, a growing number of “Pen Register” or “Trap and Trace” requests have been discretely filed by law enforcement agencies seeking incoming and outgoing calls and text messages, subscriber information, and other customer data collected by cellular and other telecommunications companies.

Though the exact definitions of a “pen register” and “trap and trace” differ, the terms are often used interchangeably. Historically a trap and trace would record incoming phone numbers to a device, where as a pen register would record all outgoing calls.

Before the advent of cellular phones, law enforcement wanting to monitor a person’s incoming or outgoing landline telephone calls would be required to physically monitor the phone lines. However, as telecommunications technology improved, law enforcement was able to forgo physically attaching devices to phone lines, though the names “pen register” and “trap and trace” continued to be used for the practice. The scope of pen registers/trap and trace have also expanded beyond just telephone communications, and the orders can now be issued to intercept or retrieve Internet communications kept by Internet Service Providers or online companies.

Typically the requests are not as broad as the one OHP was granted in the turnpike burglar case, though it’s unknown how many similarly extensive requests are filed. That’s because both the requests and the orders are required by law to be sealed immediately.

But sometimes the requests and orders are inadvertently filed and left open to the public through a detailed search of the state’s online court records system. In a review by The Frontier of hundreds of these orders from 2017, we found a handful that had apparently accidentally been scanned and put online.

Most often, the requests targeted a single phone number, usually said to belong to a person suspected of drug dealing. The requests would ask the judge to seal the document to keep from tipping off the person being investigated.

But in the request made by the OHP in the turnpike burglar case, the trooper filing the request asked the judge to order the four cellular companies named in the document to never disclose to their customers that they had turned their information over to law enforcement.

That amount of secrecy is a step above that of a standard search warrant. Search warrants for property, or a phone or vehicle are eventually required to be unsealed, filed publicly and provided to the person whose property is being searched.

However, a pen register or trap and trace order is never revealed to the person whose phone records are being turned over to law enforcement. Orders reviewed by The Frontier show cellular companies are instructed to never tell their customers their information was swept up into law enforcement nets, either.

Pen register and trap and trace orders also must meet a lower bar in order to be approved by a judge. Where a standard search warrant requires “probable cause,” a pen register or trap and trace order must have an affidavit attached with “clear and articulable facts.”

Mark Woodward, spokesman for the Oklahoma Bureau of Narcotics, told The Frontier that still requires “a lot of legal scrutiny.”

“It usually involves a lengthy affidavit covering all aspects of an (ongoing) criminal investigation that includes review from a variety of supervisors in the chain of command,” Woodward said. “And currently, a wiretap order can only be signed by one person: the Presiding Judge for the Oklahoma Court of Criminal Appeals.”

While the number of law enforcement requests for this type of cellular device information has stayed mostly stagnant in Tulsa County in recent years, usage of the these court orders continue to rise in Oklahoma County, records show.

Court records reviewed by The Frontier show the use of “trap and trace” requests by law enforcement rose in Oklahoma County for the third consecutive year. At least 629 requests for a “trap and trace” appear in Oklahoma County court records in 2017 whereas a similar search in Tulsa County showed only 11 requests for a “pen register.”

The OSCN figures are inexact — it’s possible other filings exist that don’t appear in database searches — but show law enforcement is clearly relying more heavily on the orders.

Interest in orders of this type has grown nationally as knowledge about cell site simulators — often referred to as “StingRay” devices after the brand name given by its manufacturer, Harris Corporation — has grown. Rather than capture information off of a specific device, a simulator emulates a cellular tower, allowing its user to cast an indiscriminately wide net — capturing a large amount of information from many individual mobile devices.

Only one StingRay device is known to exist in Oklahoma, though a 2016 Oklahoma Watch story indicated Oklahoma City Police had possibly used one on loan from a federal agency.

Oklahoma Bureau of Narcotics and Dangerous Drugs spokesman Mark Woodward told The Frontier that a “StingRay” was gifted to the agency about 10 years ago, but “it is still in the box and unused.”

Oklahoma City police, Tulsa police, the Tulsa County Sheriff’s Office and the Oklahoma State Bureau of Investigation all responded to requests by The Frontier and said they do not have a “StingRay” or similar device. Unsealed documents show the OBNDD, OHP and Tulsa Police have requested “pen register” warrants as recently as 2017, however.

The number of orders being filed appear likely to continue to rise — already in 2018, Oklahoma County court records show 66 “trap and trace” orders. That pace would result in nearly 800 being filed by the end of the year, a figure that would dwarf the total from 2017.

A look at the orders

Though the requests and orders for cellular records are required by law to be immediately sealed, sometimes the documents are inadvertently filed in the state’s public online court database. Here’s a look at some of the records discovered and reviewed by The Frontier.

Oklahoma Bureau of Narcotics and Dangerous Drugs Pen Register/Trap and Trace order 

Tulsa Police Department order 

Oklahoma Highway Patrol request

Secrecy
Secrecy about cellular surveillance remains a barrier to public knowledge, and perhaps a driver in much of the growing public interest.

The Frontier asked Woodward to compare a “pen register” or a “trap and trace” order to that of a “StingRay”device  in order to differentiate between the information that can be gleaned by law enforcement.

He responded by touting the legal scrutiny an agency must face in order to have a pen register or trap and trace order granted. Indeed, all such warrants in Oklahoma must be signed by the Presiding Judge of the Oklahoma Court of Criminal appeals (Tulsan Dana Kuehn currently holds that position,) though critics of cell surveillance technology claim the judge’s role is little more than a rubber stamp.

Woodward did not expound on the capabilities of a “StingRay,” saying in an email “Having not used a StingRay, our agency would be unable to articulate the usage and legal requirements that an agency would undergo to utilize that technology.”

Complicating public oversight of uses of cellular surveillance, any use of a “StingRay” would also require a warrant indistinguishable of that of a pen register or trap and trace warrant. A similar device, referred to as a “Dirtbox,” can be placed in a plane and flown high above the target zone, soaking up cellular information from hundreds of people.

National website CityLab wrote in 2017 that records appeared to show the Oklahoma City Police Department “appear to include” the purchase of a “Cloud Analyzer tool” by the Cellebrite company.

The device “extracts ‘private–user cloud data’ by ‘utilizing login information extracted from the mobile device,’” the website wrote. “According to Cellebrite, in some cases cloud data does not only include communications on platforms like Facebook and Instagram, but also individuals’ ‘timestamped movements minute by minute,’ based (on) private Google Location History collected from Google cloud servers.”

And though civil rights groups, like the Oklahoma ACLU, state a belief that “StingRay” devices have been used in the state, it can be impossible to determine based on court records. That’s because warrants for pen register or a trap and trace are immediately sealed upon being ordered.

The ACLU has claimed that the FBI has had agreements with dozens of law enforcement agencies across the nations in regard to cell site simulator usage. In the agreements, the ACLU claims, the FBI allowed agencies to use the devices, but required them to provide no information to the public or court system about their operation.

The Frontier asked law enforcement agencies across Oklahoma to respond to two questions — if they owned a cellular site simulator, or if they had ever used one on loan from a federal agency. Responses varied.

Spokespeople for the Tulsa County Sheriff’s Office and Tulsa Police Department both said only that agencies did not have a cell site simulator — and both said they did not know what a “StingRay” was.

A spokesman for the Oklahoma City Police Department only responded that his agency did not have a “StingRay,” as did Jessica Brown, the spokeswoman for the OSBI. Asked if the OSBI could comment on the differences between information gleaned through a “trap and trace” as compared to a “StingRay,” Brown said she would check. No response followed.

Orders
The 629 trap and trace orders that appear in Oklahoma County court records in 2017 represent a nearly 20 percent increase over the previous year. Records show 525 such orders in 2016 and 358 in 2015.

Meanwhile in Tulsa County, a search of court records showed only 10 in 2017 — including one that appeared to be an unsealed file from a 2014 criminal investigation.

The orders are sealed immediately upon being issued and rarely become unsealed, though occasionally one is filed accidentally. A review of “pen register” requests in 2017 in Tulsa County turned up four such accidentally filed documents — one by TPD, one by the OBNDD and two by the Oklahoma Highway Patrol. None of the requests reviewed by The Frontier were denied in any part by the judge who ultimately granted the order.

Though the vast majority of these warrants are filed in the middle of an ongoing criminal investigation — thus necessitating the secrecy — the orders appear similar to an affidavit filed in a criminal case following a charge being filed. However, even at the conclusion of a criminal case, the orders and requests are never unsealed, unless specifically ordered so by a judge.

The requesting officer lists their name and agency and lays the case out before the judge. The requesting officer is required to list the phone number or computer IP address they desire to get data about, and at times even will list the suspect’s name.

In one warrant discovered during The Frontier’s review, the OBNDD was given an order for the phone of a Tulsa man suspected of communicating with a woman being investigated for drug trafficking. The Frontier is not identifying either person because, despite being identified by name in the publicly-available warrant, neither person has been charged with the crimes alleged in the document.

The signed order for the information was filed Feb. 22, 2017, and in it the judge states the document is to be filed under seal because the suspects are considered flight risks. However, both the request for the order and the order itself appear to have become publicly viewable on the state online court records system immediately.

In another order discovered during The Frontier’s review, Metro PCS a mobile phone company under the T-Mobile corporate umbrella, was ordered by a judge to turn over a bevy of information on a specific number to the Tulsa Police Department.

According to the document, TPD did not know the name of the suspect, only the phone number itself. Metro PCS was thus ordered to provide not only the locations of the towers pinged by the phone, but also all incoming and outgoing calls records of text messages to and from that phone number for a three-month span. The company also was required to release the identity of the person whose name was on the contract for that phone number.

House Bill 3072
At least one Oklahoma lawmaker has proposed legislation that would greatly increase leeway given to law enforcement officers submitting a request for a trap and trace or pen register order.

House Bill 3072, authored by Rande Worthen, R-Lawton, would affect not only trap and trace and pen registers, but other kinds of cellular surveillance as well.

Worthen, who served as a prosecutor for 29 years in the Comanche and Cotton County District Attorneys Offices, did not respond to requests for comment by The Frontier.

The bill would greatly expand law enforcement’s ability to obtain warrants for wiretaps and electronic communications, track and monitor people located outside of a judge’s jurisdiction who have not yet committed a crime, and obtain customers’ data from cell phone and internet service providers without a court order.

It also updates language in the laws regulating the procedures for law enforcement to obtain wiretaps, customer cell phone and Internet information from provider companies and real-time tracking of individuals. The updates strongly hint at use by Oklahoma law enforcement of controversial devices used by a number of other law enforcement agencies around the country known as cell-site simulators, IMSI catchers, or commonly by the popular brand name “Stingray.”

The bill broadens which judges can issue an order for a wiretap or allowing law enforcement to intercept the actual contents of an electronic communication. Currently, only the presiding judge of the Oklahoma Court of Criminal Appeals may issue those orders. Under the proposed bill, the vice-presiding judge of the Criminal Appeals court or the presiding judge of a multi-county grand jury would also be allowed to issue orders for wiretaps or communication content intercepts.

Rep. Rande Worthen, R-Lawton

The bill also allows law enforcement officers who have intercepted communications through wiretaps or other means to share the contents of those messages or recordings with city, county or state law enforcement officers in other states.

The bill would also update language in the law dealing with pen register and trap and trace orders to include cellular and more modern modes of communication. Unlike wiretap or communication intercept orders, any district judge may issue trap and trace or pen register orders, and only require that the law enforcement officer requesting the order certify that “the information likely to be obtained is relevant to an ongoing criminal investigation” before such an order is issued.

However, the bill, under certain circumstances, would require a cell phone service provider, Internet service provider, or online company to hand over a customer’s or user’s information at the request of a law enforcement officer without a court order.

Under the bill, in situations “where an emergency exists that involves and immediate danger or death or serious bodily injury to any person,” a law enforcement officer would not need to receive court approval prior to obtaining a person’s cell phone information. The bill does not contain any provisions that would require the officer to notify the court later, and only requires that there be enough grounds to where a trap and trace order could have been issued for the information had there been more time.

Finally, the bill would expand the ability of Oklahoma judges to issue a warrant for a “tracking device” to monitor people located outside of the judge’s jurisdiction. Like a trap and trace order, a search warrant to track an individual can be issued by any district court judge in the state, though it does require probable cause to be shown prior to being issued.

Often, rather than using a special tracking device to follow a person’s location in real-time, law enforcement will be issued a warrant allowing investigators to track an individual using cellular, GPS or other methods.

And in many cases, law enforcement uses Stingrays and other similar devices to perform real-time tracking using an individual’s cell phone.

Currently, Oklahoma law requires that for a judge to issue a warrant allowing tracking, the tracking device must be used within the judge’s jurisdiction. The bill would allow a judge to issue a tracking warrant if the tracking device is being used or monitored from within his or her jurisdiction.

However, the bill goes a step further.

It also allows judges to issue a tracking warrant if law enforcement is able to show probable cause that the person being tracked might commit an offense within the judge’s jurisdiction at some point in the future.

“If court authorized monitoring is sought for a tracking device where a physical installation would be unnecessary, monitoring may be authorized for a tracking device under such circumstances by any magistrate outside of the magistrate’s jurisdiction where there is probable cause evidence that an offense has been committed, is being committed, or may be committed in the jurisdiction of the magistrate.”