State v. Andrews
The landmark Maryland appellate decision holding that police generally must obtain a probable-cause warrant before using a cell-site simulator to transform a person's phone into a real-time tracking device and locate it inside a residence.
Executive Summary
Baltimore police were searching for Kerron Andrews under a valid arrest warrant. After obtaining a broadly worded pen register/trap-and-trace order, officers used a Hailstorm cell-site simulator to make Andrews's phone connect to law-enforcement equipment masquerading as a cellular tower. The device allowed officers to pinpoint the phone inside a residence. Police arrested Andrews there and later obtained a warrant to search the residence, where they recovered a firearm. The Maryland Court of Special Appeals held that people reasonably expect their cellphones will not be used as real-time tracking devices through direct government interference. Cell-site simulator use therefore requires a probable-cause warrant—or an order satisfying the constitutional requirements of a warrant—unless an established exception applies. The pen-register order did not disclose the technology or meaningfully limit its scope, and the later premises warrant depended entirely on the unlawfully acquired location. The court affirmed suppression.
State v. Andrews is one of the foundational appellate decisions governing Stingrays and other active cell-site simulators. Its importance goes beyond the device's brand name. It establishes that government cannot avoid the warrant requirement by describing a powerful location search as ordinary pen-register or cellular-tracking process.
Key Holdings at a Glance
How a Cell-Site Simulator Works
A cell-site simulator imitates a legitimate cellular base station. Nearby phones may connect or transmit identifying signals to the simulator. By measuring signal strength and direction while moving the equipment, operators can narrow the location of a target device, sometimes to a particular building, room, or area within a building.
The Hailstorm used in Andrews was configured with an identifier associated with the target phone. It sought that identifier and displayed information allowing the operator to determine the direction and relative proximity of the signal. The phone did not need to be used affirmatively by Andrews for the device to locate it.
| Method | Source of Location | Key Distinction |
|---|---|---|
| Historical CSLI | Previously stored carrier records | Retrospective record obtained from a provider |
| Carrier-assisted ping | Real-time or near-real-time carrier information | Provider participates in locating the device |
| Cell-site simulator | Direct interaction between phone and police equipment | Government equipment impersonates a cell site and actively locates the phone |
| GPS device data | Coordinates generated by the phone or application | Precision and access method vary |
Facts of the Investigation
Andrews was identified as a suspect in an April 2014 shooting, and an arrest warrant was issued. Detectives confirmed a telephone number associated with him and applied for a pen register/trap-and- trace order. The application sought cellular tracking information for sixty days and contained no geographic limit.
The carrier initially supplied location information that brought officers to a general area containing approximately thirty to thirty-five residences. A technical team then used Hailstorm to pinpoint the target phone inside 5032 Clifton Avenue. Officers entered with the consent of the woman who answered the door and found Andrews sitting on a couch with the phone in his pocket.
After arresting Andrews under the outstanding warrant, police obtained a warrant to search the residence. A firearm was recovered from the couch cushions. The application for the premises warrant, however, depended on the location learned through Hailstorm to connect Andrews with the residence.
Procedural History and Result
The defense learned during pretrial discovery that police had used a cell-site simulator. Andrews moved to suppress the information obtained through Hailstorm and the evidence recovered from the residence. The Circuit Court for Baltimore City found a Fourth Amendment violation and suppressed the derivative evidence. The State appealed.
Why Simulator Use Was a Constitutional Search
The court applied the principle that the Fourth Amendment protects people, not merely physical places. A phone owner does not surrender all privacy in the phone's location merely by carrying a device that communicates with a cellular network.
Hailstorm did more than passively receive information exposed to the public. It acted like a cell tower, drew the target phone to law-enforcement equipment, and used signals to locate the phone precisely. The government thereby obtained information that officers could not otherwise obtain through ordinary visual observation—particularly the phone's presence inside a home.
The Special Protection of the Home
The simulator narrowed Andrews's location from a neighborhood containing many residences to a specific home. That capability implicated the strong Fourth Amendment protection against using technology to learn details inside a residence that would otherwise be unavailable without physical intrusion.
The court relied on the reasoning of United States v. Karo, involving a beeper monitored inside a home, and Kyllo v. United States, involving thermal imaging. Those decisions emphasize that technology cannot be used without constitutional oversight to determine whether a person or object is inside a home when the information is not exposed to ordinary observation.
Why the Third-Party Doctrine Did Not Apply
The State argued that Andrews assumed the risk of disclosure because cellphones communicate with carrier towers. The court rejected that argument. The precise location used to find Andrews was obtained directly by law-enforcement equipment, not voluntarily transmitted to a carrier and later turned over to police.
Unlike dialing a telephone number, the target phone's interaction with Hailstorm did not involve a conscious choice by Andrews to convey his location to a third party. The government created the connection and used it to extract directional and proximity information.
Why the Pen-Register Order Was Insufficient
The application referred generally to a pen register, trap-and-trace process, cellular tracking, and the ability to initiate a signal. It did not clearly tell the issuing judge that police intended to deploy an active cell-site simulator that would impersonate a tower, interact with nearby phones, and pinpoint a device inside a residence.
The order authorized sixty days of activity without geographic limits. It lacked the particularized showing, scope restrictions, reporting requirements, deletion requirements, and protections for unrelated phones needed for the intrusive technique. The appearance of the words “probable cause” did not convert the order into a warrant because the stated standard concerned relevance to an investigation, not a fair probability that evidence would be found through a particularly described search.
What a Simulator Warrant Should Address
| Element | Required Showing or Limitation |
|---|---|
| Target | Particular phone, identifier, account, or other adequately described object |
| Probable cause | Facts connecting the target device and proposed location search to the offense |
| Technology | Disclosure that an active simulator will impersonate a cell site and directly interact with devices |
| Manner | How the system will locate the target and what information it will collect |
| Duration and geography | Reasonable time and area limitations tied to the investigation |
| Non-target devices | Controls for incidental identifiers or signals from bystander phones |
| Data handling | Retention, segregation, deletion, access, and reporting requirements |
| Return | Documentation of execution, results, and deviations from authorized scope |
Andrews allows the possibility of a specialized court order rather than a document formally labeled a search warrant, but only when that order satisfies the constitutional requisites of a warrant. The safer practice is a conventional probable-cause warrant that candidly describes the equipment and proposed use.
Incidental Collection from Bystander Devices
A simulator's electronic activity may reach many phones within range before the equipment isolates the target identifier. Andrews treated the possible interception of third-party cellphone information as a central reason for requiring judicially imposed limits.
Agencies should determine exactly what their equipment collects from non-target devices, whether those records are retained, and whether the system affects network service. Applications and policies should describe controls for filtering, segregating, deleting, and auditing incidental information.
Fruit of the Poisonous Tree and Good Faith
The later search warrant for the residence relied on the fact that Andrews had been located there. Once the Hailstorm-derived location was removed from the affidavit, no adequate nexus remained between the residence and the alleged offense.
The court declined to apply the good-faith exception. The problem was not merely a judge's technical error. Police submitted an overbroad application that did not clearly disclose the intended simulator use, then relied on the resulting location to obtain a premises warrant. Officers could not insulate the antecedent violation by obtaining a second warrant based on information produced by that violation.
Disclosure, Discovery, and Auditability
The method used to locate Andrews was not disclosed promptly. The defense initially received responses that failed to reveal the simulator, and the technique emerged only through later discovery and hearings. That history illustrates why agencies and prosecutors must identify surveillance technology early and preserve the records necessary to litigate its legality.
Andrews After Carpenter v. United States
Andrews preceded the Supreme Court's 2018 decision in Carpenter v. United States. Carpenter held that acquisition of at least seven days of historical CSLI generally requires a warrant. Although Carpenter expressly did not decide real-time tracking, its treatment of cellphones and location privacy reinforces Andrews's refusal to apply the third-party doctrine mechanically to modern location technology.
The cases address different acquisition methods. Carpenter involved provider-held historical records; Andrews involved police equipment directly inducing a target phone to reveal its current location. Agencies should analyze each technique independently and avoid assuming that authority for one permits the other.
Cell-Site Simulator Technology in 2026
Modern systems may support newer cellular standards, portable or vehicle-mounted deployment, target discrimination, and integration with other location sources. The constitutional rule remains technology- neutral: active government use of a phone as a precise locating beacon generally demands meaningful judicial authorization.
Operational review should account for the effective capability of the particular hardware and software, not a historical description of an earlier product. Agencies must know whether the system collects device identifiers, estimates direction or distance, identifies a particular room, affects service, logs non-target devices, or exports data to another platform.
Practical Guidance for Law Enforcement Agencies
Cell-Site Simulator Operator Checklist
| Question | Why It Matters |
|---|---|
| Is there a valid probable-cause warrant or recognized exception? | Simulator use is presumptively subject to the warrant requirement. |
| Does the authorization expressly describe active simulator use? | The judge must understand the technique being approved. |
| Is the target device or identifier particularized? | Prevents exploratory use and mistaken targeting. |
| Are time and geographic limits defined? | Constrains the duration and reach of the search. |
| What will be collected from non-target devices? | Determines necessary minimization and deletion controls. |
| Could the operation reveal presence inside a home? | Implicates the Fourth Amendment's highest privacy protection. |
| Will the device disrupt communications? | Raises safety, operational, and disclosure concerns. |
| Are deployment logs and outputs being preserved? | Supports accountability, discovery, and later litigation. |
| Is the operator trained on current hardware and authorization limits? | Reduces execution outside the warrant's scope. |
Litigation Checklist for Agency Counsel and Prosecutors
- Identify the exact equipment, software version, and capabilities used.
- Determine whether the technique was provider-assisted or directly operated by police.
- Review the application and authorization for probable cause, candor, and particularity.
- Document target identifiers, deployment time, geography, and manner of operation.
- Identify all non-target data collected and how it was handled.
- Establish whether the simulator located the phone inside a home or other protected area.
- Preserve operator logs, output, screenshots, maps, exports, and audit records.
- Trace every later warrant, arrest, search, and item of evidence to determine derivative use.
- Evaluate exigency or another exception only from contemporaneous facts.
- Resolve discovery, privilege, vendor, and nondisclosure issues before trial.
- Check controlling federal, state constitutional, statutory, and policy authority.
Frequently Asked Questions
What did State v. Andrews hold?
It held that police generally need a probable-cause warrant, or an order satisfying the constitutional requirements of a warrant, to use a cell-site simulator to locate a phone in real time.
Was there an arrest warrant for Andrews?
Yes. The valid arrest warrant authorized his arrest once found, but it did not authorize the separate technological search used to discover his location inside a residence.
Why was the pen-register order insufficient?
The application did not clearly disclose active simulator use, and the order lacked the probable-cause, particularity, scope, geographic, reporting, and third-party protections required for the search performed.
Can police use a specialized order instead of a document titled “search warrant”?
Under Andrews, only if the order satisfies the constitutional requisites of a warrant, including a particularized probable-cause showing and reasonable limits on the object and manner of the search.
Does the third-party doctrine authorize simulator use?
Not under the facts of Andrews. Police obtained the precise location directly through their own equipment; the information was not voluntarily conveyed to a carrier and later disclosed to police.
What about exigent circumstances?
Andrews preserves established warrant exceptions. Any exigency must be supported by the specific, contemporaneous facts and should be documented carefully.
Why were the gun and premises-search evidence suppressed?
The premises-warrant affidavit depended on the unlawfully acquired location to connect Andrews with the residence. Without that information, the affidavit lacked the required nexus, and good faith did not cure it.
Is Andrews binding nationwide?
No. It is binding Maryland intermediate appellate authority and persuasive elsewhere. Agencies must review controlling authority in their jurisdiction, along with applicable statutes and state constitutions.
Primary Authorities
Reported Maryland appellate opinion addressing active cell-site simulator use, real-time location, the third-party doctrine, warrant requirements, derivative evidence, and good faith.
Read the official State v. Andrews opinion
United States Supreme Court decision addressing historical CSLI and the third-party doctrine.
Read Carpenter v. United States
United States Supreme Court decision recognizing the distinctive privacy implications of modern cellphones.
Read Riley v. California
United States Supreme Court decision addressing electronic tracking that reveals information inside a home.
Read United States v. Karo
Final Assessment
State v. Andrews establishes that cell-site simulator deployment is not merely an extension of ordinary pen-register practice. The technology actively interacts with a phone, provides precise real-time location, may expose presence inside a home, and can affect unrelated devices. Those capabilities require candid and particularized judicial authorization.
The decision also demonstrates the downstream cost of inadequate process. The unlawfully acquired location supplied the only nexus for the later premises warrant, causing the physical evidence recovered from the home to be suppressed. Accurate warrant applications, limited execution, evidence preservation, and timely discovery are therefore part of both constitutional compliance and successful prosecution.