Stingray Operations: Are Police Tracking Your Cell-Phone Calls?

Utah: Four Detained, Cited Under AgGag
September 28, 2014
Six years late and too many lives short: Obama & Holder on racial profiling
October 2, 2014
Utah: Four Detained, Cited Under AgGag
September 28, 2014
Six years late and too many lives short: Obama & Holder on racial profiling
October 2, 2014

Are police tracking your cell-phone calls without a warrant? Law-enforcement agencies in 15 states have acquired devices known as IMSI (International Mobile Subscriber Identity) catchers that collect data on the numbers contacted from mobile phones in the area and the subscriber’s identity. Commonly known as “stingrays,” after the StingRay brand manufactured by the Harris Corporation, they work by simulating transmission towers.

According to a December USA Today investigation, at least 25 police departments across the United States have managed to acquire stingrays without breaking their budgets—thanks in part to generous anti-terror grants from the Department of Homeland Security. The American Civil Liberties Union (ACLU) says there are 43 federal, state, and local law-enforcement agencies that possess them. (It’s also possible that some agencies are borrowing them from the manufacturer or another law-enforcement agency.)

Small. Portable and Multi-Talented

The suitcase-sized devices are small enough to be easily packed into cars, and can even be carried by a police officer on foot. In broad data-scooping mode, they suck up info from any mobile phones in a particular area that are switched on. This data enables police to locate individual phones. However, law-enforcement agencies claim that domestic stingrays do not record the actual content of calls or texts.

Stingrays can also block calls and data access in phones while they search. They force cell phones to use their full power, making them drain more quickly. When police search for a particular phone, other phones in a block, apartment building, or home are affected. Data from “innocent” phones is acquired, throwing the use of stingrays into a legally hazy area.

There has been disagreement since the 1990s over whether stingrays count as searches or are free game for law enforcement, says Julian Sanchez, a specialist in technology and privacy issues at the libertarian Cato Institute. More recently, he adds, the Justice Department has taken the position that they’re a form of “pen register,” a device that logs the numbers of calls made from or received by a particular number. Law-enforcement agencies need a judge’s signature before using a pen register, but the standards for authorizing one are very low.

Because stingrays acquire information directly from an individual’s phone, Sanchez says, that makes their use a search under the Fourth Amendment. This also means that the “third party” doctrine, which holds that records freely shared with a business or other entity do not have rigorous privacy protections—the National Security Agency’s justification for collecting data from e-mail providers without a warrant—does not apply.

“When [stingrays are] used as de facto tracking devices—to locate a phone or wireless modem in a particular building or apartment—the policy increasingly seems to be to obtain a warrant,” Sanchez says. “The DOJ now appears to be recommending a warrant be obtained for precise location tracking, but it’s not remotely clear that the local police forces that increasingly use this equipment are equally scrupulous.”

In Tallahassee, Florida in 2008, police alerted to a reported rape tracked a stolen cellphone to an apartment by use of a stingray. Some hours after identifying the building and then the apartment number (by taking a stingray door to door, searching for the missing phone’s signal), they forced the suspect’s girlfriend into letting them search her apartment—all of this without a warrant. A court first upheld the search, but the suspect’s rape charges were eventually thrown out.

The use of the stingray didn’t come up, only that police had entered the suspect’s girlfriend’s apartment illegally. What did come up in court, however, was that Tallahassee police had used stingrays more than 2,000 times since 2008. Last March, the city’s new  police chief, Michael DeLeo, said that a review of cases where they were used in 2013 found that 90 percent involved a warrant and the rest were “emergency situations” such as finding an endangered missing person.

The ACLU has requested records on stingray use from Tallahassee police and 29 other law-enforcement agencies in Florida. The Supreme Court has ruled in the past year both that a warrant is required for searching a phone of an arrested suspect—which puts restrictions on what is known as search incident to arrest—and that putting a GPS device on someone’s vehicle counts as a search. Those rulings could logically be extended to cover the use of stingrays.

Cloaked in Secrecy

Law-enforcement agencies are usually secretive and evasive when asked for details about how many of the devices are in use in the United States and how they are used. Police departments in Chicago, San Diego, and the Oakland County suburbs of Detroit refused the Associated Press’s request for information on stingrays earlier this year. When they don’t refuse, their response to groups such as the ACLU is commonly a mix of redacted documents or vague excuses about “anti-terrorism.” The StingRay’s manufacturer, the Florida-based Harris Corporation—which specializes in communications systems, many for the military, police, and intelligence agencies—requires any buyer of the device to sign a nondisclosure agreement and coordinate use with the Federal Bureau of Investigation.

Cops all over the United States have repeatedly used that nondisclosure agreement as an excuse for not complying with requests under state freedom-of-information laws. Harris may not have a strong legal foundations for it, but police and Feds all the way up to the Department of Justice seem to be just fine with using it to justify keeping mum about the devices.

Harris points to its contracts with the Department of Defense and the FBI, and local police point to the NDA with Harris. Meanwhile, according to the Associated Press, the Obama administration is particularly interested in keeping the details of these devices hidden, ostensibly for homeland security reasons. In Sarasota, Florida, U.S. Marshals deputized a local police officer as a federal agent in order to remove files on stingrays that the ACLU had requested under the state’s sunshine law. Once a technically federal authority physically removed files from the state, they could not be released.

A lawsuit in Tucson, Arizona alleges that a request for stingray documents from the local police would have gone through—if the FBI hadn’t stepped in and said arms-control laws and national security made it illegal to divulge the files. An FBI agent filed an affidavit that said disclosing such details would “result in the FBI’s inability to protect the public from terrorism and other criminal activity,” because it would render the technology “essentially useless for future investigations.” After some pushing, the ACLU did gain access to several e-mails between police officers in Sarasota and North Port, Florida from earlier this year that demonstrated the officers’ plans to hide that a case had originated from information gathered by a stingray.

This technique, reverse-engineering an investigation to conceal its source, is similar to the “parallel construction” the Drug Enforcement Administration uses when it receives tips from the NSA. It is a controversial—and arguably unconstitutional—tactic: It prevents defendants, their counsel, and even judges from knowing the true origin of evidence against a suspected criminal, thereby violating their right to due process.

“I suspect their fear is that the more people are convicted in cases where the use of StingRays is openly discussed in court,” Sanchez says, “the more conscious criminals will become that the use of these devices has become quite common in many areas, at which point they’ll start turning off those convenient little tracking devices they carry around.” In August, Federal Communications Commission chair Tom Wheeler said the agency had set up a task force “to combat the illicit and unauthorized use of IMSI catchers”—by criminal gangs and foreign intelligence services, not domestic law enforcement.

The FCC partially denied an ACLU request under the federal Freedom of Information Act for documents about its policies on stingrays, saying that information was classified. Meanwhile, police and prosecutors in the Oakland, California area have applied for a $205,000 grant from the Department of Homeland Security to help upgrade their StingRay system. The “Hailstorm” upgrade, which will cost $460,000, will enable the devices to track cell phones once the less secure 2G network is phased out. Stingrays now track phones that use the 3G and 4G networks by jamming their signals and forcing them to drop down to 2G. Police in Baltimore and Tacoma, Washington purchased the upgrade last year, and Michigan’s Oakland County acquired Hailstorm earlier this year, using a Homeland Security grant.