Michigan State Politicians Looking Into Sheriff Department's Use Of A Cell Tower Spoofer

from the 'we-haven't-discussed-it-because-9/11' dept

More news has surfaced of cell tower spoofers being deployed without the public's knowledge. This time it's the Oakland County (Michigan) Sheriff's Department rolling out an upgraded Stingray device from Harris Manufacturing, known as "Hailstorm." The sad thing here is that the opportunity for public input presented itself pre-rollout but local politicians slept on the issue.

Oakland County commissioners asked no questions last March before unanimously approving a cellphone tracking device so powerful it was used by the military to fight terrorists.

Now, though, some privacy advocates question why one of the safest counties in Michigan needs the super-secretive Hailstorm device that is believed to be able to collect large amounts of cellphone data, including the locations of users, by masquerading as a cell tower.

“I don’t like not knowing what it’s capable of,” said county Commissioner Jim Runestad, R-White Lake Township, who has met in recent weeks with sheriff’s officials about his concerns.

Harris, as it has been noted, heads off criticism and the impertinent questions of the public by tying up law enforcement officials with restrictive non-disclosure agreements. These NDAs have proven handy for some LEOs -- particularly in Florida where officials made the case that the restrictions of the contract prevented them from seeking warrants before using the cell tower spoofer.

State politicians are now attempting to have a belated discussion of the technology's privacy implications, thanks in part to prompting by local journalists. The Michigan House Oversight Committee brought in Christopher Soghoian, policy analyst from the ACLU and former magistrate judge Brian Owsley. (Recording embedded below.)

Soghoian's concerns aren't simply about the privacy implications or the secrecy Harris has shrouded its technology in, but also the fact that there's no way to track misuse of the equipment.

What’s particularly worrisome is there is no telltale sign they’ve been used, Soghoian said: “It doesn’t leave a trace. No one would ever catch you.” That means no one would know if police misused the device or activated it without a warrant, Soghoian said.

Owsley, in his statement to the committee, noted that the first time discussion of this technology occurred in his courtroom, it was presented by law enforcement as something along the lines of a pen register. As Owsley points, all it takes in most cases to get a pen register granted is a pulse. As long as both the magistrate judge and the law enforcement official are technically alive, the pen register will be signed off on.

That law enforcement portrayed cell tower spoofing in this fashion is no surprise, since it gives them the greatest chance of securing permission to deploy it. (The NSA/FBI did the same thing in order to push through its bulk phone metadata program.) Unlike regular pen registers, however, Stingrays/Hailstorms are deployed in cases where law enforcement may not even have a known phone number. Instead, they may be working off a list of numbers potentially tied to the subject of their investigation, or are just waiting for communications to originate from a certain location.

Now that the technology is finally being questioned, representatives of the Oakland County Sheriff's Department are stepping up to defend their acquisition.

Undersheriff Michael McCabe said, “Hailstorm helps us capture fugitives from the law, people wanted for murder and rape” and can be used only with a search warrant. He said the federal Homeland Security Act bars him from discussing Hailstorm, but he elaborated at length about what it doesn’t do.

Interestingly, McCabe cites the Homeland Security Act as prohibiting discussion, rather than the manufacturer's restrictive NDA. The county also cited "homeland security" terminology in its refusal to release requested documents about the Hailstorm device.

The county denied The News’ Freedom of Information Act request, saying the information is protected by anti-terror laws and includes “investigating records compiled for law enforcement purposes that would disclose law enforcement investigative techniques or procedures.”

Law enforcement officials in one of the safest counties in Michigan are conjuring up terrorism as an excuse for deploying a questionable device, as well as to avoid having to answer any tough questions about its capabilities or usage.

Undersheriff McCabe claims the device is used to go after "people wanted for murder and rape," while simultaneously claiming the DHS won't allow the department to talk about its non-terrorist-related use. He also claims it's not used without a warrant, a statement the county itself isn't allowing anyone to verify. (Among the documents requested were returned warrants on closed cases.) The Sheriff's Department refuses to discuss the technology (other than to highlight how great it is at catching bad guys) or back up its statements with documentation and somehow expects the public to be just fine with all of this. With state politicians now looking into its Hailstorm usage, the normal combination of obfuscation and bluster likely won't keep these details secret for much longer.

Filed Under: hailstorm, michigan, mobile phones, oakland county, privacy, spoofing, stingray
Companies: harris manufacturing