USCA4 Appeal: 18-1953 Doc: 142 Filed: 09/24/2026 Pg: 1 of 32
PUBLISHED
UNITED STATES COURT OF APPEALS
FOR THE FOURTH CIRCUIT
No. 18-1953
KERRON D. ANDREWS,
Plaintiff – Appellant,
v.
BALTIMORE CITY POLICE DEPARTMENT; KEVIN DAVIS, Commissioner;
MICHAEL SPINNATO, Detective; JOHN HALEY, Detective,
Defendants – Appellees,
L3HARRIS TECHNOLOGIES, INC.,
Intervenor.
Appeal from the United States District Court for the District of Maryland, at Baltimore.
Stephanie A. Gallagher, District Judge; Catherine C. Blake, Retired District Judge. (1:16-cv-02010-CCB)
Argued: January 27, 2026 Decided: September 24, 2026
Before QUATTLEBAUM, HEYTENS, and BERNER, Circuit Judges.
Affirmed by published opinion. Judge Berner wrote the opinion, in which Judge Heytens
joined. Judge Quattlebaum wrote an opinion concurring in part and in the judgment.
ARGUED: Michael A. Pichini, GOODELL, DEVRIES, LEECH & DANN, Baltimore,
Maryland, for Appellant. Natalie Rose Amato, BALTIMORE CITY LAW
DEPARTMENT, Baltimore, Maryland, for Appellees. ON BRIEF: James B. Astrachan, USCA4 Appeal: 18-1953 Doc: 142 Filed: 09/24/2026 Pg: 2 of 32
H. Mark Stichel, Elizabeth A. Harlan, Trisha L. Scott, ASTRACHAN GUNST THOMAS,
P.C., Baltimore, Maryland; Michael C. Heyse, George S. Mahaffey, GOODELL,
DEVRIES, LEECH & DANN, Baltimore, Maryland, for Appellant. Andre M. Davis, City
Solicitor, Ebony M. Thompson, City Solicitor, Brent D. Schubert, Deputy Chief, Michael
P. Redmond, Chief Solicitor, Rachel A. Simmonsen, Assistant Solicitor, BALTIMORE
CITY LAW DEPARTMENT, Baltimore, Maryland, for Appellees.
2
USCA4 Appeal: 18-1953 Doc: 142 Filed: 09/24/2026 Pg: 3 of 32
BERNER, Circuit Judge:
While investigating a shooting, Baltimore City Police Department detectives
obtained a warrant for the arrest of a suspect, Kerron Andrews. They also obtained a court
order to allow them access to certain records from Andrews’s cellphone provider. Using
records received from the provider, the detectives were able to narrow down Andrews’s
location to a few city blocks. They then used a device known as a cell-site simulator to
track the location of Andrews’s cellphone to a specific townhome. Cell-site simulators
prompt all nearby cellphones to automatically send an electronic signal to the simulator,
thereby revealing the location of each cellphone and, in most instances, the location of the
cellphone’s owner. With the consent of the resident, the detectives entered the townhome.
There they found Andrews sitting on a couch with his cellphone in his pocket.
Following a search of the townhome, prosecutors brought criminal charges against
Andrews. The detectives’ use of the cell-site simulator was only revealed to Andrews’s
counsel a year after the criminal proceedings against him began. Following this revelation,
Andrews moved to suppress the evidence obtained through the use of the simulator. Both
the Maryland trial and appellate courts ruled that the detectives’ use of the cell-site
simulator without a warrant violated Andrews’s Fourth Amendment rights. The charges
against Andrews were subsequently dismissed, and he was released after spending nearly
two years in pretrial detention.
Andrews subsequently filed this civil lawsuit seeking damages for the violation of
his federal and state constitutional rights. A district court granted summary judgment to the
defendants, finding as a matter of law that Andrews’s constitutional rights had not been
3
USCA4 Appeal: 18-1953 Doc: 142 Filed: 09/24/2026 Pg: 4 of 32
violated. A different panel of this court reversed and remanded to the district court for
discovery. After discovery, the district court once again entered summary judgment on
behalf of the defendants. The case now returns to our court.
We hold that the use of the cell-site simulator constituted a search within the
meaning of the Fourth Amendment. We conclude, however, that the detectives are entitled
to qualified immunity and state law public official immunity, and that the Baltimore City
Police Department cannot be held liable for the violation of Andrews’s Fourth Amendment
rights. We therefore affirm the district court’s grant of summary judgment to the
defendants.
I. Cell-Site Simulators
This case involves the use of a little-known—though long-utilized—technology
called a cell-site simulator. We begin by explaining this technology.
Cell sites are a “set of radio antennas” that create a wireless network and provide
the signals that cellphones rely on to function. Carpenter v. United States, 585 U.S. 296,
300 (2018). “Most modern devices, such as smartphones, tap into the wireless network
several times a minute whenever their signal is on, even if the owner is not using one of
the phone’s features.” Id. at 300–01. When a phone connects to a cell site, “it generates a
time-stamped record known as cell-site location information (CSLI). The precision of this
information depends on the size of the geographic area covered by the cell site.” Id. at 301.
CSLI supplies a cellphone provider with the equivalent of historical and real-time location
data for all cellphones in the provider’s network.
4
USCA4 Appeal: 18-1953 Doc: 142 Filed: 09/24/2026 Pg: 5 of 32
A cell-site simulator functions by essentially “impersonat[ing]” an actual cell site.
Andrews v. Balt. City Police Dep’t, 8 F.4th 234, 235 (4th Cir. 2020) (Andrews I). “In
response to signals emitted by the simulator, every cell phone and other cellular-enabled
device in the area [using the same service provider] identifies the simulator as the best local
cell tower and transmits a connection signal containing that device’s unique identifier to
the simulator.” Id. Through the use of a handheld cell-site simulator, law enforcement can
“home in on the location of a suspect’s cell phone by moving around an area while
observing the strength and direction of the phone’s signal.” Id. In this way, cell-site
simulators enable law enforcement to determine the location of an individual cellphone
without seeking information from the cellphone provider. This location data, which is
available instantly and in real time, is generally more precise than CSLI.
The Baltimore City Police Department (BPD), like other law enforcement agencies
around the country, has used cell-site simulators for decades. 1 Hailstorm, the specific cellsite simulator at issue in this case, is manufactured by L3Harris (previously the Harris
Corporation). The BPD obtained Hailstorm, and its predecessor, Stingray, from the Federal
Bureau of Investigation.
1
In 2004, an episode of the television show The Wire portrayed a Baltimore police
officer using a cell-site simulator called a “Triggerfish” to monitor a suspect’s cell phone
activity. The Wire, Season 3, Episode 11: Middle Ground (HBO Max, accessed Sep. 17,
2026); see also Jessica Anderson, Sun Investigates: Cellphone surveillance seen years
earlier in ‘The Wire’, Balt. Sun (Apr. 11, 2015), www.baltimoresun.com/2015/04/11/suninvestigates-cellphone-surveillance-seen-years-earlier-in-the-wire/
[https://plus.lexis.com/api/permalink/f83b7c00-484e-4359-923b-1700f49159e0/].
5
USCA4 Appeal: 18-1953 Doc: 142 Filed: 09/24/2026 Pg: 6 of 32
As a condition for acquiring Hailstorm, the FBI required the BPD to enter into a
non-disclosure agreement (NDA). The NDA between the FBI and the BPD obligates the
BPD to “immediately notify the FBI” before it discloses the “use or provide any
information” about Hailstorm in criminal or civil proceedings and to avoid such disclosure
“without the prior written approval of the FBI.” Parties’ Joint Appendix (J.A.) 120. In other
words, the NDA requires the BPD to keep its use of the cell-site simulator secret from
litigants and courts unless the BPD first notifies and receives approval from the FBI. This
notification is designed to provide the FBI an opportunity to “intervene to protect the
equipment/technology and information from disclosure and potential compromise.” Id.
The NDA also requires “the Office of the State’s Attorney for Baltimore [to], at the request
of the FBI, seek dismissal of the case in lieu of using or providing, or allowing others to
provide, any information concerning the Harris Corporation wireless collection
equipment/technology[.]” Id. at 121.
This case calls upon us to consider the constitutional restraints on the BPD’s use of
cell-site simulators.
II. Factual Background
On review of a grant of summary judgment, we view the facts in the light most
favorable to the nonmovant. Aleman v. City of Charlotte, 80 F.4th 264, 293 (4th Cir.
6
USCA4 Appeal: 18-1953 Doc: 142 Filed: 09/24/2026 Pg: 7 of 32
2023). 2 Here, the parties largely agree on the relevant facts. They dispute the legal
determinations arising out of those facts.
A. Pen Register Order
In 2014, the BPD began to suspect that Kerron Andrews, a young man who had
previously worked with them as an informant, had been involved in a recent shooting that
injured three people. The BPD obtained an arrest warrant charging Andrews with attempted
murder. Three days later, unable to determine where Andrews lived, BPD Detective
Michael Spinnato, one of the defendants in this case, sought a pen register order from the
Circuit Court for Baltimore City.
A pen register is a device or process that phone companies can use to record the
telephone numbers dialed from a specific telephone line. 3 See, e.g., 18 U.S.C. § 3127(3)
(defining pen register for purposes of federal law); Md. Code Ann., Cts. & Jud. Proc. (CJP)
§ 10-4B-01(c) (defining pen register for purposes of Maryland law). Importantly, though a
pen register captures a record of incoming and outgoing telephone calls, it does not record
the content of the calls. A pen register order (PRO) is a court order that requires a phone
2
Andrews argues that the district court did not present the facts in the light most
favorable to him in its description of the technology. We review the grant of summary
judgment de novo and present the facts in the light most favorable to Andrews, as we are
obliged to do.
3
In the past, phone companies had to install a physical device to collect this data.
As a result, a pen register would include only a record of telephone calls going forward.
As technology has evolved, however, phone companies no longer need to rely on a physical
tool. Phone companies now generally maintain a record of all incoming and outgoing
phone calls of every phone.
7
USCA4 Appeal: 18-1953 Doc: 142 Filed: 09/24/2026 Pg: 8 of 32
company to provide law enforcement a copy of an individual’s records of incoming and
outgoing phone calls.
Because of its “limited capabilities”—providing only a list of phone calls—the
Supreme Court has held that the use of a pen register device is not a “search” within the
meaning of the Fourth Amendment. Smith v. Maryland, 442 U.S. 735, 742–46 (1979). In
seeking a PRO, therefore, law enforcement need not meet the heightened standard required
by the Fourth Amendment to issue a valid warrant—namely, probable cause that
“contraband or evidence of a crime will be found in a particular place.” Illinois v. Gates,
462 U.S. 213, 238 (1983). The only requirements to obtain a PRO, therefore, are those set
out in the relevant federal statutes and state law. Meeting these requirements is generally
not onerous. To issue a PRO in Maryland, a court need only find that “the information
likely to be obtained by the installation and use [of the device] is relevant to an ongoing
criminal investigation.” CJP § 10-4B-04(a)(1); see also 18 U.S.C. § 31239(a) (providing
that a federal court shall issue a PRO if the court finds that “the information likely to be
obtained by such installation and use is relevant to an ongoing criminal investigation”).
In applying for the PRO for Andrews’s cellphone data, Detective Spinnato attested
that a pen register was necessary to “assist in the apprehension of” Andrews. J.A. 30.
Detective Spinnato certified that “the information likely to be obtained concerning
[Andrews’s] location will be obtained by learning the numbers, locations and subscribers
of the telephone number(s) being dialed or pulsed from or to [Andrews’s] telephone and
that such information is relevant to the ongoing criminal investigation being conducted by
the Agency.” Id. Detective Spinnato further certified that “probable cause exists based
8
USCA4 Appeal: 18-1953 Doc: 142 Filed: 09/24/2026 Pg: 9 of 32
upon the information supplied in this application, that [Andrews] is using the cellular phone
number [listed in the application] for criminal activity and that the application will lead to
evidence of the crime(s) under the investigation.” Id. at 38.
A Maryland magistrate granted the request for the PRO, authorizing the government
to obtain information about Andrews’s cellphone for a period of sixty days. The PRO
stated:
[T]he Court finds that probable cause exists and that the applicant has
certified that the information likely to be obtained by the use of the above
listed device(s) is relevant to an ongoing criminal investigation.
Id. at 39. The PRO required Andrews’s cellphone provider to turn over information about
Andrews’s cellphone, including the equivalent of the phone’s electronic serial number.
The PRO required the provider to give the detectives “up to 24 months of prior
detailed call history[.]” Id. at 42. In addition, borrowing the exact language used by
Detective Spinnato in his application, the PRO required the provider to supply an array of
specialized data, including “cell site information of the aforesaid target telephone,
Historical Global Position System Tracing and Tracking, Mobile Locator tools, R.T.T.
(Real Time Tracking Tool), . . . Precision Locations[,] and any and all locations only if
requested by the Agency.” Id. at 42–43. The PRO, again adopting Detective Spinnato’s
language, further permitted the detectives to “employ surreptitious or duplication of
facilities, technical devices or equipment to accomplish the installation and use of a Pen
Register” and to “initiate a signal to determine the location of the subject’s mobile
device. . . .” Id. at 40.
9
USCA4 Appeal: 18-1953 Doc: 142 Filed: 09/24/2026 Pg: 10 of 32
B. Use of the Hailstorm Cell-Site Simulator
On the same day that the magistrate issued the PRO, Andrews’s cellphone provider,
Sprint Communications, began to supply data about Andrews’s cellphone to the BPD. The
data included the cellphone’s identifying information, thirty days of historical CSLI, sixty
days of pen register data (incoming and outgoing call history), and recent GPS coordinates.
State v. Andrews, 134 A.3d 324, 328–29 (Md. Ct. Spec. App. 2016).
The GPS coordinates showed the past location of Andrews’s phone “within a . . .
200 to 1600 meter radius[.]” Id. at 329. Based on this data, the BPD concluded that
Andrews’s phone had been located somewhere near the 5000 blocks of Clifton Avenue in
Baltimore City. Id. These blocks contain approximately thirty-five townhomes, and the
BPD were unable to obtain a more precise location for Andrews’s cellphone. Id. Detective
John Haley, a member of the BPD’s Advanced Tactical Team (ATT) and a defendant in
this case, proceeded to use a Hailstorm cell-site simulator in an effort to locate Andrews.
A group of law enforcement officers, including Detectives Haley and Spinnato, walked up
and down the 5000 blocks of Clifton Avenue until the simulator connected with Andrews’s
cellphone, pinpointing its location within a specific townhome.
Detective Spinnato knocked on the door of the townhome and, after obtaining
consent from the woman who answered, went inside. There he found Andrews sitting on a
couch in the living room with his cellphone in his pocket. The officers detained Andrews.
While in the townhome, they obtained and executed a search warrant. During the search,
10
USCA4 Appeal: 18-1953 Doc: 142 Filed: 09/24/2026 Pg: 11 of 32
the officers discovered a gun stuffed between the cushions on the couch where Andrews
had been sitting.
Despite repeated questions from Andrews’s counsel concerning the search of the
townhome, the prosecution did not disclose the use of Hailstorm to locate Andrews until a
year into Andrews’s criminal case. See id. at 329–30. Following the disclosure, Andrews
moved to suppress evidence obtained by the use of Hailstorm, and the Maryland trial court
granted the motion. Id. at 333–34. The prosecution appealed that ruling to Maryland’s
intermediate court, which affirmed the suppression ruling. Id. at 365.
The Maryland intermediate court, as a matter of first impression, held that the use
of Hailstorm to locate Andrews constituted a “search” within the meaning of the Fourth
Amendment because of the simulator’s ability to “locate and track the movements of a cell
phone and its user across both public and private spaces.” Id. at 348. Given that the Fourth
Amendment applied, the officers needed a warrant in order to use the cell-site simulator.
The Maryland intermediate court ruled, also as a matter of first impression, that the
Maryland Pen Register Statute is “limited by its terms and is not intended to apply to other,
newer technologies” like cell-site simulators. Id. at 356–57. The intermediate court rejected
the prosecution’s argument that the PRO was functionally equivalent to a search warrant.
Id. at 358–60. Finally, the intermediate court determined that the good faith exception to
the warrant requirement did not apply. 4 Id. at 363–65. Accordingly, the Maryland
4
Under the good faith exception, “evidence obtained by an officer who acts in
objectively reasonable reliance on a search warrant will not be suppressed, even if the
warrant is later deemed invalid” unless the warrant is so facially invalid that a reasonable
(Continued)
11
USCA4 Appeal: 18-1953 Doc: 142 Filed: 09/24/2026 Pg: 12 of 32
intermediate court affirmed the exclusion of evidence obtained by the BPD through the use
of the Hailstorm cell-site simulator. Id. at 365. The prosecution dropped the criminal case
against Andrews.
III. Procedural Background
Shortly after his criminal case was dismissed, Andrews brought this Section 1983
civil rights action against the BPD, the Commissioner of the BPD in his official capacity,
and BPD Detectives Spinnato and Haley in their official and individual capacities
(collectively the Defendants). See 42 U.S.C. § 1983. Andrews alleges that Detectives
Spinnato and Haley violated his rights under the Fourth and Fourteenth Amendments of
the United States Constitution and the Maryland Declaration of Rights through their use of
the cell-site simulator. He also alleges that the BPD and the BPD Commissioner are
responsible for the purported constitutional violations by enacting or perpetuating an
unconstitutional policy to permit and encourage the use of cell-site simulators without a
warrant. Andrews filed suit in the Circuit Court for Baltimore City, seeking damages for
the two years he spent in detention awaiting trial in his criminal case. 5
officer would not have relied upon it. United States v. Ray, 141 F.4th 129, 134 (4th Cir.
2025) (quoting United States v. Thomas, 908 F.3d 68, 72 (4th Cir. 2018)).
5
Andrews also sought an injunction that would require the BPD to seek a warrant
prior to using this technology. Andrews’s request for injunctive relief is now moot because,
subsequent to the events underlying this case, the State of Maryland enacted a law requiring
law enforcement to obtain a search warrant before using a cell-site simulator to locate a
suspect. See Md. Code Ann., Crim. Proc. § 1-203.1; Roberts v. Engelke, 180 F.4th 634,
642 (4th Cir. 2026) (“[T]he mootness doctrine recognizes that some intervening
circumstances deprive the plaintiff of a personal stake in the outcome of the lawsuit, such
(Continued)
12
USCA4 Appeal: 18-1953 Doc: 142 Filed: 09/24/2026 Pg: 13 of 32
The Defendants subsequently removed the case to federal court and then moved to
dismiss. The district court converted the Defendants’ motion to dismiss to a motion for
summary judgment, which it granted. The district court concluded that the PRO
“objectively authorized the use of a cell-site simulator,” and, therefore, there was no
constitutional violation. Andrews v. Balt. City Police Dep’t, No. CV CCB-16-2010, 2018
WL 3649602, at *9 n.9 (D. Md. Aug. 1, 2018).
Andrews appealed and a different panel of this court remanded for the limited
purpose of discovery on six specific questions: 1) the range at which the simulator can
prompt nearby cellular devices to connect to it; 2) the maximum number of devices with
which the simulator can connect; 3) the categories of data collected from the cellphones;
4) the data stored by Hailstorm; 5) the data accessible to law enforcement officers; and 6)
the means by which Hailstorm was configured to minimize data collection from third party
cell devices not belonging to Andrews. Andrews I, 8 F.4th at 238. The court also directed
the district court to make factual findings “as to whether—aside from the non-disclosure
agreement between BPD and the FBI—BPD had, at the time of its application for the
[PRO], any formal or informal policies, practices, or procedures that prevented BPD
officers seeking a warrant or pen register/trap and trace order from stating to the reviewing
magistrate that a cell site simulator would be used.” Id. The court retained jurisdiction. Id.
at 235.
that the action can no longer proceed.” (quoting Synopsys, Inc. v. Risk Based Sec., Inc., 70
F.4th 759, 764 (4th Cir. 2023))).
13
USCA4 Appeal: 18-1953 Doc: 142 Filed: 09/24/2026 Pg: 14 of 32
On remand, Andrews moved to compel discovery of an operator’s manual for
Hailstorm, arguing that it was necessary to answer the panel’s questions. The district court
denied the request. 6 At the close of discovery, three years after that denial, the Defendants
moved for summary judgment. The district court made findings of fact in response to each
of the questions posed in Andrews I. Andrews v. Balt. City Police Dep’t, No. CV SAG-16-2010, 2025 WL 876711, at *3–10 (D. Md. Mar. 19, 2025). Because this court had retained
jurisdiction, however, the district court was precluded from ruling on the Defendants’
motion for summary judgment. Id. at *10. The case then returned to this court for further
adjudication. Id.
In April 2025, this court again sent the case back to the district court, this time with
instructions to rule on the outstanding motion for summary judgment. On remand from this
court for the second time, the district court granted the Defendants’ motion. Andrews v.
Balt. City Police Dep’t, No. CV SAG-16-2010, 2025 WL 1346547, at *8–10 (D. Md. May
8, 2025). The district court concluded, in the alternative, that even if the search was
improper, Detectives Haley and Spinnato were entitled to qualified immunity and
Maryland’s public official immunity. Id. at *11–12. Finally, the district court found that
Andrews had failed to put forth evidence to create a genuine dispute of material fact as to
6
Among his claims on appeal, Andrews argues that the district court abused its
discretion by denying his request for further discovery. We disagree. The district court
permitted ample discovery. Regardless, because our ruling is based on qualified immunity,
which is a question of law, further discovery on the technological capacities of Hailstorm
would not change that result.
14
USCA4 Appeal: 18-1953 Doc: 142 Filed: 09/24/2026 Pg: 15 of 32
whether the BPD and Commissioner could be held liable for the alleged constitutional
violation. Id. at *12.
Before us is Andrews’s appeal from this grant of summary judgment. 7
IV. Analysis
This court reviews a district court’s grant of summary judgment de novo, viewing
the evidence and drawing reasonable inferences in the light most favorable to the
nonmovant, here, Andrews. Henry v. Purnell, 652 F.3d 524, 531 (4th Cir. 2011) (en banc).
Summary judgment is appropriate only if a party shows that there is no genuine dispute of
material fact and that they are entitled to judgment as a matter of law. See id.; Fed. R. Civ.
P. 56(a).
We begin our analysis with the threshold question: whether the use of the cell-site
simulator constituted a search for purposes of the Fourth Amendment. We then address the
various defenses raised by the Defendants. We hold that the Fourth Amendment requires a
valid warrant for the use of a cell-site simulator. We conclude, nonetheless, that the
Defendants are entitled to summary judgment.
7
The company that manufactures Hailstorm, L3Harris, intervened in this appeal for
the limited purpose of filing a motion to seal the courtroom, which this court granted in
part.
15
USCA4 Appeal: 18-1953 Doc: 142 Filed: 09/24/2026 Pg: 16 of 32
A. Constitutional Violations
Andrews alleges that the BPD violated his federal and state constitutional rights
when the Defendants used the cell-site simulator to track his location inside of a residence.
The Fourth Amendment to the United States Constitution, which was made applicable to
the states by the Fourteenth Amendment, protects against unreasonable search and seizure
by the government. U.S. Const. amend. IV. So too do Articles 24 and 26 of the Maryland
Constitution. Md. Const., Declaration of Rights, arts. 24 and 26. Maryland interprets its
state constitutional provisions related to search and seizure to provide the same protections
as the Fourth Amendment. See Wilson v. Prince George’s County, Maryland, 893 F.3d
213, 224 (4th Cir. 2018). We therefore analyze the claims as one.
The government conducts a search when a law enforcement officer “obtains
information by physically intruding on a constitutionally protected area,” which the Fourth
Amendment defines as “persons, houses, papers, and effects.” United States v. Jones, 565
U.S. 400, 406 n.3, 404 (2012). Even absent physical trespass, the government may conduct
a search for purposes of the Fourth Amendment when it intrudes upon an individual’s
reasonable expectation of privacy. Katz v. United States, 389 U.S. 347, 351–52, 360–62
(1967). This rule is often referred to as the “Katz test.” Kyllo v. United States, 533 U.S. 27,
34 (2001).
Fourth Amendment jurisprudence endeavors to strike a delicate balance between
individual privacy and public safety. It is the responsibility of the judiciary to ensure that,
as “[s]ubtler and more far-reaching means of invading privacy have become available to
16
USCA4 Appeal: 18-1953 Doc: 142 Filed: 09/24/2026 Pg: 17 of 32
the Government,” the “progress of science does not erode Fourth Amendment protections.”
Carpenter, 585 U.S. at 320 (internal quotation marks and citation omitted).
Among the manifold technological advances since the founding of our country,
cellphones pose a unique threat to individual privacy. Cellphones are “such a pervasive
and insistent part of daily life that the proverbial visitor from Mars might conclude they
were an important feature of human anatomy.” Riley v. California, 573 U.S. 373, 385
(2014). A cellphone effectively “tracks nearly exactly the movements of its owner.”
Carpenter, 585 U.S. at 311. Accordingly, the Supreme Court has recognized that
individuals have a heightened expectation of privacy both in their cellphones’ contents and
historical location data. See Chatrie v. United States, 609 U.S. ---, 146 S. Ct. 2193, 2207–
09 (2026); Carpenter, 585 U.S. at 311; Riley, 573 U.S. at 394–97.
We must assess two questions. First, whether an individual has a reasonable
expectation of privacy in the real-time location of his cellphone, which generally
corresponds with his location. Second, whether law enforcement conducts a search by
using technology that briefly seizes the cellphone’s signals—unbeknownst to the owner—
to track that location. Despite the ubiquity of cell-site simulators, no federal court of
appeals has squarely addressed whether law enforcement’s use of this technology for realtime tracking of a cellphone constitutes a search for purposes of the Fourth Amendment. 8
Today, we hold that it does.
8
The Defendants initially conceded that the BPD’s use of Hailstorm constituted a
search for purposes of the Fourth Amendment. Andrews I, 8 F.4th at 236. Now before this
(Continued)
17
USCA4 Appeal: 18-1953 Doc: 142 Filed: 09/24/2026 Pg: 18 of 32
The Supreme Court’s most recent decisions on the constitutional boundaries of
cellphone location surveillance, United States v. Carpenter, 585 U.S. 296 (2018), and
Chatrie v. United States, 609 U.S. ---, 146 S. Ct. 2193 (2026), are instructive. Both cases
were decided after the BPD used Hailstorm to locate Andrews.
In Carpenter, the Supreme Court considered “whether the Government conducts a
search under the Fourth Amendment when it accesses historical cell phone records that
provide a comprehensive chronicle of the user’s past movements [known as CSLI].” 585
U.S. at 300. In investigating a series of robberies, the government applied for a court order
to access historical CSLI from a suspect’s cellphone provider. Id. at 301–02. In arguing
that there was no Fourth Amendment search, the prosecution analogized to Smith v.
Maryland, which established that individuals do not have a reasonable expectation of
privacy in pen register data. 442 U.S. 735, 742–46 (1979). The Supreme Court rejected this
argument, noting that “few could have imagined a society in which a phone goes wherever
its owner goes, conveying to the wireless carrier not just dialed digits, but a detailed and
comprehensive record of the person’s movements.” Carpenter, 585 U.S. at 309. The
Supreme Court made clear that an individual maintains a reasonable “anticipation of
privacy in his physical location.” Id. at 311. Accordingly, accessing historical CSLI
constitutes a search for purposes of the Fourth Amendment. Id. at 316.
court for the second time, the Defendants disavow their prior concession. See Oral
Argument at 21:47; Response Br. at 6 n.3.
Our concurring colleague suggests that we should not address whether the use of
the Hailstorm was a search or whether it invaded a protected privacy interest. We disagree.
Lower courts may exercise their sound discretion to determine the ordering of the qualified
immunity analysis. Pearson v. Callahan, 555 U.S. 223, 236 (2009).
18
USCA4 Appeal: 18-1953 Doc: 142 Filed: 09/24/2026 Pg: 19 of 32
Nearly a decade later, in Chatrie, the Supreme Court considered a similar challenge
to law enforcement’s access of cellphone location data collected and stored by a third-party
tech company. 146 S. Ct. at 2199. The Supreme Court reaffirmed that “an individual has a
legitimate expectation of privacy in the information . . . about his cell phone’s—meaning
his own—movements” and that “police invade that expectation, and thus conduct a search,
when they acquire that information, even though for only a limited period of time and even
though via a third[ ]party.” Id. at 2206.
The Supreme Court’s rulings in both Carpenter and Chatrie were animated by
concerns about the extent of the invasion of privacy provided by such tracking. Notably,
CSLI allows police “‘near perfect surveillance’ of an individual holding a cellphone.” Id.
at 2208 (quoting Carpenter, 585 U.S. at 311–12). The precision of this data allows law
enforcement to monitor the “comings and goings in any area” of “any number of people in
any number of places, public and private[.]” Id.
Unlike the data obtained by law enforcement in Carpenter and Chatrie, the data
collected by a cell-site simulator like Hailstorm provides only a snapshot of an individual’s
real-time location, rather than a log of his historical movements. Nonetheless, the use of a
cell-site simulator to identify or track an individual’s physical location implicates similar
privacy concerns. The Supreme Court in Chatrie made clear that the duration of the
incursion does not impact the reasonableness of an individual’s expectation of privacy.
Rather, “[w]here the Fourth Amendment applies, it applies—regardless of ‘the quality or
quantity of information’ the government obtains.” Id. at 2210 (quoting Kyllo, 533 U.S. at
37).
19
USCA4 Appeal: 18-1953 Doc: 142 Filed: 09/24/2026 Pg: 20 of 32
This case demonstrates the relative invasiveness of cell-site simulator technology.
First, the location information provided by the cell-site simulator was more precise than
the real-time location data that Detectives Haley and Spinnato obtained from Andrews’s
cellphone provider. See id. at 2208 (comparing the ability of a cellphone provider’s CSLI
data to pinpoint a suspect within “one-eighth to four square miles” with the ability of a tech
company’s cellphone location data to pinpoint a suspect’s location within “around twenty
meters” (citation omitted)). Here, the Detectives relied upon the CSLI obtained from
Andrews’s cellphone provider to narrow down his location to a few city blocks. When
Detectives Haley and Spinnato could not pinpoint in which townhome Andrews was
located from this data, they turned to the cell-site simulator. Following the Supreme Court’s
rulings in Carpenter and Chatrie, law enforcement officers would have needed to obtain a
warrant to access CSLI and comparable data. This principle applies equally to a technology
that can provide even more precise information about an individual’s location.
Furthermore, the cell-site simulator was used to track Andrews inside a private
residence. The privacy of the home holds special importance in Fourth Amendment
jurisprudence. “[P]rivate residences are places in which the individual normally expects
privacy free of governmental intrusion not authorized by a warrant, and that expectation is
plainly one that society is prepared to recognize as justifiable.” United States v. Karo, 468
U.S. 705, 714 (1984). Surveillance that passes from public streets into private homes has
long been recognized to convert a permissible law enforcement tactic into a Fourth
Amendment search. Compare United States v. Knotts, 460 U.S. 276, 281 (1983) (finding
that the use of a beeper to tail a car did not constitute a search because the car was always
20
USCA4 Appeal: 18-1953 Doc: 142 Filed: 09/24/2026 Pg: 21 of 32
“in plain view” (citation omitted)), with Karo, 468 U.S. at 716 (finding that the same
technology brought into a private residence could constitute a Fourth Amendment search). 9
While a cell-site simulator may only provide limited information, it is likely to
“reveal a critical fact about the interior of the premises that the Government is extremely
interested in knowing and that it could not have otherwise obtained without a warrant.”
Karo, 468 U.S. at 715. This technology is akin to sense-enhancing technology that allows
the government to peer into a private home, which the Supreme Court has repeatedly held
requires a warrant. See id. at 714 (granting a motion to suppress evidence obtained from
warrantless use of a GPS device to monitor a private residence “not open to visual
surveillance”); Kyllo, 533 U.S. at 37 (finding that warrantless use by law enforcement of
sensory-enhancing technology to trace heat signatures in a home violated the Fourth
Amendment). The cell-site simulator here effectively “crack[ed] open the front door” of
the townhome to reveal Andrews inside. Kyllo, 533 U.S. at 37.
Furthermore, while Carpenter and Chatrie dealt with the government’s ability to
access location data that individuals voluntarily share with private third parties, the BPD
used Hailstorm to collect location information directly. See Carpenter, 585 U.S. at 309–
10, 314 (distinguishing between the expectations of privacy related to information
9
The Seventh Circuit held, prior to Chatrie, that law enforcement’s use of live cellsite location information obtained from a cellphone provider did not constitute a Fourth
Amendment search. See United States v. Hammond, 996 F.3d 374, 391–92 (7th Cir. 2021).
In its ruling, the Seventh Circuit stressed that the facts in that case did “not suggest that
law enforcement used either the real-time CSLI . . . to examine the defendants’ movements
inside of a home or other highly protected area.” Id. at 389. Here, that is exactly what the
BPD did with its use of Hailstorm.
21
USCA4 Appeal: 18-1953 Doc: 142 Filed: 09/24/2026 Pg: 22 of 32
willingly shared with a third party and information obtained solely by the government
through its own surveillance techniques). The cell-site simulator functions by taking
control of the suspect’s phone, albeit briefly. When Hailstorm connects to a cellphone, the
cellphone’s owner is unable to receive phone calls (other than a 911 call) or text messages.
In addition to the suspect’s cellphone, Hailstorm connects with—and therefore temporarily
renders inoperable—all cellphones in the area that rely on the same cellular service
provider.
We agree with the Maryland intermediate court that Andrews had an objectively
reasonable expectation that his “cell phone[] will not be used as [a] real-time tracking
device[] through the direct and active interference of law enforcement.” Andrews, 134 A.3d
22
USCA4 Appeal: 18-1953 Doc: 142 Filed: 09/24/2026 Pg: 23 of 32
at 350. We therefore conclude that the use of a cell-site simulator constitutes a search,
deserving of the protection of the Fourth Amendment. 10
B. Defenses to Liability
Our inquiry does not end there. The Defendants raise a number of defenses that they
argue nonetheless preclude a ruling in Andrews’s favor: qualified immunity, public official
immunity, and Monell liability. Qualified immunity shields individual law enforcement
officers from civil liability when, in light of clearly established law, they could reasonably
have believed that their actions were lawful. Henry, 652 F.3d at 531. Maryland’s public
10
The Defendants argue that, even if the use of Hailstorm constituted a search, the
search was authorized by the PRO. Andrews contends that the PRO does not satisfy the
warrant requirement of the Fourth Amendment. Our concurring colleague agrees with the
Defendants that the PRO satisfied the warrant requirement. The Maryland state trial and
intermediate courts disagreed, concluding that orders issued under the Maryland Pen
Register statute cannot authorize the use of a cell-site simulator and furthermore that the
order obtained in Andrews’s case was not the functional equivalent of a warrant. Andrews,
134 A.3d at 354–61. We need not reach the issue of whether the PRO satisfied the warrant
requirement, however. As we explain below, we conclude that the Defendants are entitled
to summary judgment given the lack of precedent establishing that the use of a cell-site
simulator constitutes a Fourth Amendment search.
Moreover, law enforcement in Maryland can no longer rely on PROs as a
permissible mechanism to obtain authorization for the use of a cell-site simulator. Several
months after the BPD used Hailstorm to locate Andrews, Maryland’s legislature passed a
law in 2014 mandating that law enforcement obtain a warrant before using a cell-site
simulator. See Md. Code Ann., Crim. Proc. § 1-203.1. In 2015, just over one year after
Andrews’s arrest, Congress launched a bi-partisan congressional investigation that
prompted the Department of Justice to similarly establish an official policy that, moving
forward, federal law enforcement officials must seek a warrant before using this technology
in a criminal investigation. See U.S. Dep’t of Just., Justice Department Announces
Enhanced Policy for Use of Cell-Site Simulators (Sept. 3, 2015),
http://www.justice.gov/opa/pr/justice-department-announces-enhanced-policy-use-cellsite-simulators [https://perma.cc/2B7G-PNLN].
23
USCA4 Appeal: 18-1953 Doc: 142 Filed: 09/24/2026 Pg: 24 of 32
official immunity similarly limits the liability of Maryland public officials from state-law
claims unless the public official acted with “malice or gross negligence.” Gelin v.
Maryland, 132 F.4th 700, 707 (4th Cir. 2025) (citation omitted). Finally, though
municipalities do not have immunity from suit under 42 U.S.C. § 1983, their liability for
violations of constitutional rights is cabined to situations where the municipality’s own
“custom, policy, or practice” caused the violation. Owens v. Balt. City State’s Att’ys Off.,
767 F.3d 379, 402 (4th Cir. 2014). This doctrine has come to be known as Monell liability.
The Defendants assert that each of these doctrines applies here. We agree.
We begin by discussing whether Detectives Haley and Spinnato are entitled to
qualified immunity and public official immunity for their use of the cell-site simulator. We
then consider whether the BPD and Commissioner are entitled to summary judgment
because there is not a genuine issue of material fact as to whether a municipal policy,
practice or custom caused the violation.
i. Qualified Immunity
Qualified immunity is “an affirmative defense to liability where a defendant
makes a decision that, even if constitutionally deficient, reasonably misapprehends the law
governing the circumstances . . . confronted.” Case v. Beasley, 167 F.4th 651, 662 (4th Cir.
2026) (quoting Taylor v. Riojas, 592 U.S. 7, 8 (2020)). Having concluded that Andrews’s
Fourth Amendment rights were violated, we turn to whether the constitutional right at issue
was clearly established at the time of the violation. A constitutional right is considered
clearly established when it is “sufficiently clear that every reasonable official would have
understood that what he is doing violates that right.” Mullenix v. Luna, 577 U.S. 7, 11
24
USCA4 Appeal: 18-1953 Doc: 142 Filed: 09/24/2026 Pg: 25 of 32
(2015) (quoting Reichle v. Howards, 566 U.S. 658, 664 (2012)). We look to “decisions of
the United States Supreme Court and our own court” as well as decisions of our sister
circuits to determine whether a constitutional right is clearly established. Case, 167 F.4th
at 662. Because Andrews’s constitutional right was not well-established, Detectives Haley
and Spinnato are entitled to qualified immunity.
Fourth Amendment jurisprudence has understandably struggled to keep pace with
rapidly evolving technology. Though this technology has been used by law enforcement
agencies for decades, this court has mentioned cell-site simulators in a handful of prior
cases, none of which addressed the constitutional limits of their use. See United States v.
Graham, 824 F.3d 421, 427 (4th Cir. 2016) (en banc) (discussing the need for a warrant to
use cell-site simulators in a footnote), abrogated on other grounds by Carpenter v. United
States, 585 U.S. 296 (2016); Andrews I, 8 F.4th at 235 (describing cell-site simulators);
Leaders of a Beautiful Struggle v. Balt. City Police Dep’t, 2 F.4th 330, 347 (4th Cir. 2021)
(en banc) (identifying cell-site simulators as part of the mass surveillance systems in the
City of Baltimore); United States v. Briscoe, 101 F.4th 282, 294–96 (4th Cir. 2024) (finding
that a court order issued pursuant to Md. Code Ann., Crim. Proc. § 1–203.1(b)(1)(ii)
constitutes a valid search warrant authorizing the use of a cell-site simulator); United States
v. Wilford, 689 F. App’x 727, 730 (4th Cir. 2017) (per curiam) (finding that the defendant
lacked standing to challenge the use of a cell-site simulator authorized by a PRO). The
25
USCA4 Appeal: 18-1953 Doc: 142 Filed: 09/24/2026 Pg: 26 of 32
Supreme Court has never addressed this question, and a survey of cases from other circuits
similarly shows a lack of clear guidance.
Andrews’s criminal case marked the first time a Maryland appellate court addressed
whether the use of a cell-site simulator constitutes a search within the meaning of the
Fourth Amendment. While legislative action and policy changes have helped clarify law
enforcements’ obligations in using this technology, these changes occurred after the events
at issue in this case.
We therefore agree with the district court that Detectives Haley and Spinnato are
entitled to qualified immunity, and we affirm summary judgment on Andrews’s claims
against the Detectives arising under the federal Constitution.
ii. Public Official Immunity
Applying the same reasoning, we conclude that Detectives Haley and Spinnato are
entitled to public official immunity for Andrews’s claims arising under the Maryland State
Constitution. Maryland extends immunity to public officials who “perform negligent acts
during the course of their discretionary . . . duties” unless they have acted with gross
negligence or malice. Cooper v. Rodriguez, 118 A.3d 829, 848 (Md. 2015) (citation
omitted). The lack of clarity regarding whether the Detectives were required to obtain a
warrant at the time coupled with the Detectives’ reasonable reliance on the PRO would
preclude a reasonable juror from finding that the Detectives acted with gross negligence or
malice. Accordingly, we affirm the district court’s grant of summary judgment on
Andrews’s state constitutional claims.
26
USCA4 Appeal: 18-1953 Doc: 142 Filed: 09/24/2026 Pg: 27 of 32
iii. Monell Liability
Andrews also named the BPD and the BPD Commissioner 11 as defendants.
Municipalities and their agencies, including police departments, can be held liable for
constitutional violations, including in civil rights lawsuits brought under 42 U.S.C. § 1983.
Monell v. New York City Dep’t of Soc. Servs., 436 U.S. 658, 694 (1978). Such liability is,
however, “expressly cabined.” Owens, 767 F.3d at 402. A municipality can be liable for
civil rights violations under Monell only if the municipality “follows a custom, policy, or
practice by which local officials violate a plaintiff’s constitutional right.” Id.
Andrews alleges that the BPD maintained unconstitutional policies or practices of
using cell-site simulators without first obtaining a proper warrant and of withholding
information regarding the use of this technology in legal proceedings. The district court
granted summary judgment to the municipal defendants, concluding that Andrews failed
to produce evidence sufficient to create a genuine issue of material fact regarding the
existence of such policies or practices.
In support of his arguments regarding the BPD’s policies or practices, Andrews
points to the NDA between the BPD and the FBI. While the NDA requires the BPD to
notify the FBI before it discloses its use of Hailstorm to a court, Andrews has presented
insufficient evidence to show that the requirements of the NDA were carried out in an
unconstitutional manner. Rather, the Defendants put forward testimonial evidence that
11
A suit against a government official in his official capacity is treated as a suit
against the government entity itself. Lewis v. Clarke, 581 U.S. 155, 162 (2017). Because
Andrews sued the Commissioner only in his official capacity, we consider this claim to be
against the BPD itself and analyze it under Monell.
27
USCA4 Appeal: 18-1953 Doc: 142 Filed: 09/24/2026 Pg: 28 of 32
BPD officers understood that the NDA did not preclude them from seeking a search
warrant or from disclosing the use of cell-site simulators in court. This court explicitly
directed the parties to conduct discovery to identify any additional evidence to support
Andrews’s contention. After three years of discovery, Andrews cannot point to any
evidence apart from the existence of the NDA. Having discerned no genuine dispute of
material fact on this claim, we affirm the district court’s grant of summary judgment to the
BPD and its Commissioner.
Though we affirm the grant of summary judgment on the basis of Monell liability,
we nonetheless echo concerns expressed by the district court that law enforcement may not
rely on a private nondisclosure agreement as an excuse to conceal or obfuscate important
information when seeking a search warrant or information it is required to disclose in court
proceedings.
V. Conclusion
For the reasons above, we affirm the judgment of the district court.
AFFIRMED
28
USCA4 Appeal: 18-1953 Doc: 142 Filed: 09/24/2026 Pg: 29 of 32
QUATTLEBAUM, Circuit Judge, concurring in part and in the judgment:
This appeal requires us to apply principles of qualified immunity to Kerron
Andrews’ Fourth Amendment claims under 42 U.S.C. § 1983. As is well-settled, to
overcome qualified immunity, a plaintiff must prevail on two prongs, which a court can
assess in either order. See Rambert v. City of Greenville, 107 F.4th 388, 398 (4th Cir. 2024).
One—a plaintiff must show a constitutional violation. See id. And two—a plaintiff must
show that the right he alleges was violated was clearly established at the time of the
challenged conduct. See id. I agree with my colleagues that the right Andrews claims the
defendants violated was not clearly established. Thus, I join in affirming the district court’s
order granting summary judgment to the defendants. And while I think the pen register/trap
& trace order (PRO) the defendants obtained satisfied the Fourth Amendment’s warrant
requirements, I agree that issue doesn’t have to be addressed given the right Andrews
claims was violated was not clearly established.
I write briefly to address two matters. First, I note some additional facts regarding
the PRO. Second, I address my colleagues’ findings that the defendants’ use of the
Hailstorm constituted a search for purposes of the Fourth Amendment and invaded privacy
interests that were constitutionally protected. See Op. at 22–23.
On the former, it is right that the Hailstorm is not the same as a pen register/trap &
trace device. But the application for the PRO specifically sought something more than a
pen register/trap & trace device. It sought authorization to install and use “a device known
as a Pen Register \ Trap & Trace and Cellular Tracking Device to include cell site
information, call detail, without geographical limits, which registers telephone numbers
29
USCA4 Appeal: 18-1953 Doc: 142 Filed: 09/24/2026 Pg: 30 of 32
dialed or pulsed from or to” Andrews’ cell phone. J.A. 28. And the application sought
“authoriz[ation] to employ surreptitious or duplication of facilities, technical devices or
equipment to accomplish the installation and use of” the device, that the state court
authorize law enforcement to “initiate a signal to determine the location of the subject’s
mobile device on the service provider’s network or with such other reference points as may
be reasonably available,” and that the order remain in place for 60 days. Id. at 31. So, the
Baltimore Police Department did not seek approval to install a pen register/trap & trace
device and then instead use the cell site simulator. Its application to the state court
referenced use of the cell site simulator.
Additionally, on probable cause, the application stated that a shooting occurred; that
law enforcement identified Andrews as the suspect; that law enforcement obtained an arrest
warrant for Andrews; that Detective Michael Spinnato located several possible addresses
for Andrews but he wasn’t found at those locations; that law enforcement confirmed
Andrews’ phone number; that suspects often contact family and friends for help hiding;
that Andrews knew about the warrant and was evading law enforcement; that suspects
generally use cell phones until their service cuts off or their phone stops working; and that
tracking and monitoring Andrews’ phone would assist in his apprehension. See id. at. 29.
So, Detective Spinnato backed up his probable cause certification with specific facts.
On the latter point—my colleagues’ determinations that the use of the Hailstorm
was a search and invaded constitutionally protected privacy interests—those findings are
made without completing prong one of the qualified immunity analysis, which must
include evaluating whether the PRO was a valid warrant. And while I agree with my
30
USCA4 Appeal: 18-1953 Doc: 142 Filed: 09/24/2026 Pg: 31 of 32
colleagues that a court can award qualified immunity based on success under either prong,
see Pearson v. Callahan, 555 U.S. 223, 236 (2009), I question the precedential value of
analyzing some, but not all, of prong one, where the award of qualified immunity rests
entirely on prong two, see Payne v. Taslimi, 998 F.3d 648, 654–55 (4th Cir. 2021) (“Dictum
is a ‘statement in a judicial opinion that could have been deleted without seriously
impairing the analytical foundations of the holding . . . .’” (quoting Pittston Co. v. United
States, 199 F.3d 694, 703 (4th Cir. 1999))).
In addition to being unnecessary to the clearly established conclusion, there are
other reasons we shouldn’t address those points. As to whether the use of the Hailstorm
was a search, the defendants conceded below that it was. And neither Andrews nor the
defendants appealed the district court’s finding that there was a search. So, I see no need
to analyze that issue. See Hicks v. Ferreyra, 965 F.3d 302, 310 (4th Cir. 2020) (“It is well
established that this court does not consider issues raised for the first time on appeal, absent
exceptional circumstances.” (citation modified)).
As to the privacy interest question, I think the answer is far from clear. To me, there
are significant differences between this case and Carpenter v. United States, 585 U.S. 296
(2018) and Chatrie v. United States, 609 U.S. ---, 146 S. Ct. 2193 (2026)—two of the
primary cases the decision relies on. See Op. at 17–19. As my colleagues note, “[u]nlike
the data obtained by law enforcement in Carpenter and Chatrie, the data collected by a
cell-site simulator like Hailstorm provides only a snapshot of an individual’s real-time
location, rather than a log of his historical movements.” Id. at 19. To me, since we’re not
31
USCA4 Appeal: 18-1953 Doc: 142 Filed: 09/24/2026 Pg: 32 of 32
deciding whether there was ultimately a constitutional violation by declining to consider
the PRO, we should not weigh in on this debatable issue.
In sum, because I agree that the right Andrews alleges was violated was not clearly
established, I would refrain from addressing any part of prong one of the qualified
immunity inquiry. ∗
∗
I also join in affirming the district court’s grant of summary judgment to the
defendants based on public official immunity and Andrews’ failure to make out a Monell
claim, as well as in affirming the district court’s denial of Andrews’ motion to compel.
32