Vallejo Police | Cell-site simulator
Vallejo's policy for its cell-site simulator requires a warrant, bars use for immigration enforcement, forbids storing the captured data anywhere, and promises a public deployment log every quarter. Whether that log is published is the open question.
At a glance
- Legal threshold
- A search warrant, or an identified exigency with a warrant application filed no later than 72 hours after use [1]
- What it collects
- Azimuth, signal strength and a device identifier. The policy says it does not capture calls, texts, emails, contacts or images [1]
- Authorised purposes
- Locate missing persons, at-risk individuals and victims of mass casualty incidents; assist felony investigations; apprehend fugitives [1]
- Federal immigration enforcement
- Barred, naming ICE and Customs and Border Patrol [1]
- First Amendment activity
- The policy bars targeting protests and gatherings at places of worship [1]
- Storage
- No data recorded by the equipment is stored on any server, device or cloud system; data is deleted at least daily when locating a known device [1]
- Who may operate it
- Trained detectives assigned to the investigations division surveillance unit, currently the Crime Reduction Team [1]
- Public reporting
- The policy says the deployment log will be posted online quarterly, with redactions for ongoing investigations [1]
- Whether that quarterly log is published
- we did not sweep for it on this pass, so this is a question rather than a finding [1]
- Number of deployments to date
- not in any record we fetched
How it happened
- Context
Atlas snapshot records the purchase
The EFF Atlas of Surveillance records the department purchasing a cell-site simulator for $766,018. The row names Jacobs Technology and KeyW. [2]
- Context
Policy 610 published in the May 2024 manual
The policy manual released on May 20, 2024 carries Policy 610, "Cellular Site Simulator Usage and Privacy", a chapter written to the requirements California places on agencies that use cellular communications interception technology. [1]
What the policy establishes
A cell-site simulator transmits as though it were a mobile phone tower, so that phones nearby identify themselves to it. Vallejo’s policy describes the mechanism in those terms and then limits it more tightly than most surveillance policies we have read.
Use requires a warrant. The policy says the technology “may only be used by the Vallejo Police Department with a search warrant or for an identified exigency, with a concurrent application for a search warrant”, and that the application “shall be made no later than 72 hours after use in an identified exigency”.[1] Outside a mass casualty incident, personnel “may only attempt to locate cellular devices whose unique identifiers are already known to law enforcement”.[1]
The authorised purposes are a closed list: locating missing persons, at-risk individuals and victims of mass casualty incidents, assisting felony investigations, and apprehending fugitives. The same section says the equipment “shall not be used to target First Amendment activities, such as protests and gatherings at places of worship”, and “shall not be used for immigration enforcement purposes”, naming Immigration and Customs Enforcement and Customs and Border Patrol.[1]
The policy also states what the equipment does not do: it “does not capture nor receive any content such as text messages, voicemails, applications, multimedia messages”, has no capability to listen to calls, and the city “will not add software or otherwise modify the equipment in any way to enable these capacities”.[1]
On storage the rule is unusually flat. Data is deleted once the objective is met and “no fewer than once daily” when locating a known device, and “no data derived or recorded by cellular site simulator software or equipment will be stored on any server, device, cloud-based storage system or in any capacity”.[1]
Operation is limited to trained detectives in the investigations division surveillance unit, and the investigations division commander “shall quarterly review all deployment logs for compliance with applicable laws and policy”.[1]
The promise worth holding
Policy 610 commits the department to publishing. It says the deployment log “will be made available to the public and posted online on a quarterly basis with redaction of information related to any ongoing investigations or other exempt material”, and it requires an annual report to the chief counting deployments, deployments run for other agencies, and the purpose of each.[1]
A policy that promises a public log is a policy a resident can check. We did not sweep for the log on this pass and make no claim about whether it is posted.
What the record does not establish
How many times the equipment has been deployed, under warrant or under exigency, and whether any of those deployments were run for another agency. Whether the quarterly log exists in public. The Atlas of Surveillance snapshot in this repo records a purchase price of $766,018 and names Jacobs Technology and KeyW, which is a dated third-party dataset row rather than a city record.[2]
Where to ask
The quarterly deployment log and the annual report are named in the department’s own policy, which makes them straightforward to ask for by name. Vallejo City Council meets in public and takes comment. If the log is not being posted, that is a question for the council rather than for a court, because the council is where the policy that promises it was adopted.
Questions
- What is a cell-site simulator?
- A device that transmits as though it were a mobile phone tower. Phones nearby treat it as the strongest tower and send it the signals that identify them. Vallejo's policy describes it that way and says the department's equipment returns only an angle, a signal strength and a device identifier, and that it is not used to collect the contents of communications. [1]
- Does an officer need a warrant?
- Yes, under the policy. It says the technology "may only be used ... with a search warrant or for an identified exigency, with a concurrent application for a search warrant", and that in an exigency the warrant application must be made no later than 72 hours after use. An exigency is defined as an emergency involving danger of death or serious physical injury. [1]
- What happens to data from phones that were not the target?
- The policy says data is deleted once the objective is met, at least once daily when locating a known device, and that no data recorded by the equipment "will be stored on any server, device, cloud-based storage system or in any capacity". A warrant application must tell the court how the department intends to address deletion of data not associated with the target phone. [1]
- Can I see how often it has been used?
- The policy says the deployment log "will be made available to the public and posted online on a quarterly basis" with redactions for ongoing investigations, and that an annual report to the chief counts deployments by purpose. We did not sweep for those postings on this pass, so we cannot say whether they are up. That makes them a good records request. [1]
What we do not know
- Whether the quarterly public deployment log the policy promises is actually posted, and where.
- How many times the equipment has been deployed, and under warrant or exigency.
- How many of those deployments were on behalf of another agency.
- The written agreements with any outside agency that has asked to use it.
What you can do
Show up
Systems like this one are approved by boards, councils and committees that meet in public. We have not yet confirmed where each of them meets in Solano County.
What we have documented in Solano County →Protect yourself
Practical steps to shrink your personal data trail. Our guides publish at launch; until then, EFF's Surveillance Self-Defense is the best starting point.
Surveillance Self-Defense →Sources
- 1. Vallejo Police Department Policy Manual, Policy 610, Cellular Site Simulator Usage and Privacy (released 2024-05-20) · Primary document · · accessed · archived copy
- 2.
Get the digest
A regular digest of what changed in the world of surveillance: the counties we published, the devices that appeared on the map, and the public meetings where these decisions get made. We send it when there is enough to report.
One click to unsubscribe. What we do with your address is on the newsletter page.