Illinois Puts Limits on Police StingRay Use

Bloomberg Law: Privacy & Data Security brings you single-source access to the expertise of Bloomberg Law’s privacy and data security editorial team, contributing practitioners,...

By Michael J. Bologna

May 20 — Legislation placing restrictions on Illinois law enforcement agencies' use of cell-site simulation technology is headed to the desk of Gov. Bruce Rauner (R) after winning overwhelming support in the General Assembly.

The bill, S.B. 2343, would affect police agencies' use of cell-site simulators—frequently referred to as “StingRays.” The technology permits users to track the general location or identifying information of targeted cellular devices. Such simulators can intercept data from cellphones without the users' knowledge or consent. Civil liberties groups have argued that unregulated use of the technology could trigger privacy and civil liberty abuses by law enforcement.

The Illinois House May 19 unanimously supported the bill, creating the Citizen Privacy Protection Act. The bill passed unanimously in the Senate April 19.

State Sen. Dan Biss (D), who sponsored the bill, told Bloomberg BNA May 20 that Rauner's intentions are unclear, “but my sense is he will sign it. It passed with overwhelming bipartisan majorities.”

S.B. 2343 generally prohibits law enforcement from using cell-site simulators, except to locate or track the location of a communications device or to identify the device. Broader use of the technology is permissible only if police agencies gain a court order based on probable cause showing that a target has committed, is committing or is about to commit a crime.

The bill was amended during the legislative process to establish further privacy protections for cell phone users. The changes require law enforcement to delete all non-target data “as soon as reasonably practicable” during an investigation, but no later than once every 24 hours. The bill further provides that if the cell site simulator device is used to identify an unknown communications device, all non-target data must be deleted no later than within 72 hours. Non-target data collected in an investigation can be retained, but the bill specifies that the agency must have a court order showing good cause.

Federal Standards

Biss said the restrictions were negotiated with administrators of state policing agencies and stressed that the strategies outlined in S.B. 2343 mirror federal standards established for the FBI and the Department of Homeland Security.

Law enforcement “gets it,” Biss said. “They understand they can't just have unfettered use of these incredibly powerful technologies. And generally law enforcement finds statutory guidelines incredibly helpful.”

The American Civil Liberties Union of Illinois said S.B. 2343 establishes reasonable protections against unreasonable surveillance.

“Given our reliance on smartphones in today’s society, cell site simulator technology is too powerful to remain unregulated,” Khadine Bennett, the ACLU's associate legislative director, said when the bill cleared the Senate. “The federal government has adopted modest guidelines similar to those in S.B. 2343. If the restrictions are good enough for the FBI, they should be workable for local law enforcement in Illinois.”

To contact the reporter on this story: Michael J. Bologna in Chicago at

To contact the editor responsible for this story: George R. Lynch at

Request Bloomberg Law Privacy and Data Security