The FBI's Stingray Secrecy May Be Aimed At Preventing Law Enforcement From Overusing A Key 'Exploit'
from the running-the-wheels-off-a-Stingray dept
An interesting angle on the FBI's Stingray secrecy has emerged from -- of all places -- a Princeton gathering of cryptographers that included Edward Snowden via his "Snobot."
Generally speaking, the FBI is a very secretive agency, as can be readily gleaned from its tendency to answer FOIA requests with page after page of fully-redacted documents. That it has managed to rope so many law enforcement agencies -- including prosecutors and states' attorneys' offices -- into highly-restrictive non-disclosure agreements is somewhat of a surprise, considering its position as a partner in law enforcement, rather than an overseer of local agencies like the DOJ.
These NDAs keep almost all information about Stingray device usage out of our nation's courts. The desire to protect these specifics is all-encompassing, resulting in prosecutors and police departments cutting suspects loose (including those who have already pled guilty) rather than allowing information to make its way into the public domain.
But there could be more to it than just a naturally-secretive agency being secretive. It may be that it fears law enforcement agencies -- if left to their own devices -- will destroy the effectiveness of IMSI catchers by deploying the devices too often and with too little care.
In a discussion about the NSA's use of exploits, the following observations were made.
FBI operations can be opaque because of the care they take with parallel construction; the Lavabit case was maybe an example. It could have been easy to steal the key, but then how would the intercepted content have been used in court? In practice, there are tons of convictions made on the basis of cargo manifests, travel plans, calendars and other such plaintext data about which a suitable story can be told. The FBI considers it to be good practice to just grab all traffic data and memorialise it forever.IMSI catchers are "top exploits." While there's plenty of information out there on its capabilities, very little of it has been confirmed by the FBI or other law enforcement agencies. What makes the "exploit" better is that almost every deployment has been successfully hidden… from everyone. Parallel construction, abuse of pen register orders, dismissal of cases -- all of it works together to keep actual usage details out of the public's hands.
The NSA is even more cautious than the FBI, and won’t use top exploits against clueful targets unless it really matters. Intelligence services are at least aware of the risk of losing a capability, unlike vanilla law enforcement, who once they have a tool will use it against absolutely everybody.
Because of this, there's very little anyone can do to avoid being swept up by Stingray devices other than avoid using cell phones. Most criminal enterprises require communication and cell phones are the cheapiest, easiest way to maintain contact. While spoofers can be sussed out with tools and apps, it requires the sort of proactive effort that often isn't present -- or practical -- in many criminal ventures. Yeah, you can sweep a hotel room for bugs, but you can't stop anyone from parking nearby and hoovering up call data and communications.
If this assessment is accurate, the FBI may be applying this intense pressure simply to prevent "vanilla" law enforcement agencies from using Stingrays as often and as carelessly as possible. Every deployment increases the risk of exposure. Tying cop shops up in NDA strings keeps dissemination to a minimum and encourages at least some form of risk analysis before deployment. It's the FBI saving law enforcement agencies from themselves, and protecting itself and its tool of choice at the same time.
[Or not. The Baltimore PD deploys its Stingrays around 600 times a year, so there are exceptions to this theory… or some agencies simply just don't care whether the effectiveness of this "exploit" suffers from diminishing returns.
And definitely click through to read the entire piece by Ross Anderson. It also discusses how intelligence agencies work around crypto they can't crack -- very germane to the discussion of the FBI's current decrypt-or-else complaints.]
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: enforcement, fbi, imsi catcher, law enforcement, overuse, secrecy, stingray, transparency
Reader Comments
Subscribe: RSS
View by: Time | Thread
How com
[ link to this | view in chronology ]
Re: How com
[ link to this | view in chronology ]
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
B.S.
[ link to this | view in chronology ]
Antibiotics
[ link to this | view in chronology ]
It's game over for the FBI's unconstitutional and lawless behavior if a defendant has standing and brings a constitutional case against Stingrays. The FBI's top lawyers must feel the same way, thus the NDA.
I also believe Stingrays allow law enforcement to plant malware on the cellphone of any target of their choosing. Especially if they're flying Stingray equipped UAV drones over people's houses and have everyone's SIM card keys in their possession. Which we know they do thanks to the Intercept's "Great SIM Heist" news story.
[ link to this | view in chronology ]
I don't often listen to the voices in my head. but the little fuckers have been right too often lately.
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Cell phone monitoring is defeated by the same communications obfuscation tactics that have been in use for decades.
The tactic was used in Harris' Hannibal. C'mon, guys! This is old news!
Or maybe they just enjoy snooping on ordinary citizens doing ordinary things.
[ link to this | view in chronology ]
The obvious point
This stuff used to be called "common sense".
[ link to this | view in chronology ]