Michigan State Police Used Forfeiture Funds To Upgrade Its Stingray

from the first-with-the-'terrorism,'-then-with-the-'free-money' dept

There are a few ways law enforcement agencies acquire cell tower spoofers. Very rarely do agencies pay for these expensive devices themselves. (Meaning with their funds drawn from their own departments. Obviously, no government agency is self-funded.) In most cases, funding in whole or in part is obtained from the DHS -- something nearly any agency can obtain simply by checking [X] BECAUSE TERRORISM when applying for a Homeland Security grant.

Agencies are also using seized funds from asset forfeiture programs. The Michigan State Police used both methods to buy and upgrade its Stingray, according to documents obtained by the ACLU.

For nearly a decade, the Michigan State Police has had secretive cellphone tracking devices that were bought to fight terrorism but instead are used to solve everyday crimes, internal documents show.

More than 250 pages of emails, invoices and other documents show the state police in 2006 acquired cellphone simulator technology, which lets police collect large amounts of data including the location of users. The equipment was upgraded in 2013 and an internal memo indicates it was used last year on 128 cases ranging from homicide to burglary and fraud, but not terrorism.

But that didn't stop the state police from telling the DHS that it was going to use the device to beat back terrorists.

The documents acquired by the ACLU indicate the state police paid Harris Corp. $206,500 in 2006 for equipment that was “vital to the war on terrorism” and allows “the state to track the physical location of a suspected terrorist.”

The equipment was fully funded by a U.S. Homeland Security grant and the cost matches Harris Corp. prices lists for its Stingray device, Wessler said.

Seeing as burglary and fraud aren't nearly as fund-worthy as actual terrorism, the agency apparently decided against going to the DHS well twice. The second round of funding was internal, but padded by plenty of external "donors."

In 2013, the state used asset forfeiture funds to pay Harris $593,450 for “surveillance and countersurveillance equipment and supplies,” records show.

The money isn't going to waste though. While the state police may have trouble finding enough "serious" crime (documents show 82 arrests and the location of six missing persons… but still no terrorism) to deploy the device against, it apparently needs very little prompting to put it to use. According to the records, the state police fire up the Stingray (now most likely a Stingray 2.0, aka, Hailstorm) once every three days.

Whether further upgrades will be this easy for the state to obtain remains to be seen. For one, this document release, along with last year's discovery of Oakland County (MI) Sheriff's Department's previously-unmentioned Stingray, has placed the use of these surveillance devices under additional scrutiny by legislators.

Additionally, the state government recently passed an asset forfeiture reform bill. While it didn't go as far as many had hoped (thanks to the objections of law enforcement lobbyists), the new law does raise the level of evidence needed to process a forfeiture from "a preponderance" (which sounds much weightier than it is) to "clear and convincing." It also requires additional reporting from law enforcement agencies on the seizure and distribution of funds and property.

That being said, some legislators still don't see a problem with law enforcement agencies doing whatever they want with surveillance equipment they don't want to talk about.

State Rep. Kurt Heise, R-Plymouth Township, chairman of the House Criminal Justice Committee, said McMillin’s bills [introducing a warrant requirement for Stingray use] would have “tied the hands of police.”

“Right now, I don’t think this is an issue ripe for state action,” Heise said. “The burden is on law enforcement to demonstrate they are operating under the constitution ... If the ACLU wants to challenge this in court, then we may have to let the courts sort it out.”

There's a company man. Heise, of course, speaks with authority on the subject of Stingrays, law enforcement burden and the ripeness of the issue. After all, he had no clue about the technology or who had it until someone else pointed it out to him.

Heise said he wasn’t aware the state police have the technology and isn’t concerned about it.

Filed Under: asset forfeiture, imsi catchers, michigan, police, stingrays, surveillance

FBI: Hurricane Katrina Made It Clear We Just Don't Have Enough Stingray Devices

from the because-weather dept

In the wake of Hurricane Katrina, the federal government stepped up to assure the nation that as horrifically damaging as the storm was, we would all come out of it OK.*

*Offer does not apply to affected residents of New Orleans.

President Bush let us know that FEMA head "Brownie" (born Michael D. Brown) was doing a "heckuva job" botching the government's response. The New Orleans Police Department worked hard to secure critical infrastructure, going so far as to show up in civilian clothes, armed with unapproved weapons. And the FBI, which sent its people to assist in search and rescue operations and to help curtail post-storm looting, made sure an unprecedented tragedy wouldn't go to waste.

MuckRock's Shawn Musgrave points out that, hidden among the 5,000 heavily redacted pages it received in April in "response" to its FBI-Stingray query, the agency's Katrina experience somehow made Stingray acquisition a priority.

A year later, as part of post-Katrina review, the FBI’s WITT requested funding for additional equipment from Harris Corporation, which manufactures the StingRay line of cell phone trackers. Two drafts of the same memo (draft 1) and (draft 2) from July 2006, each with competing redactions, together weave a partial glimpse of WITT’s justification.

[...]

“In the summer of 2005, the U.S. Gulf Coast bore the brunt of several hurricanes, including Hurricane Katrina which severely degraded the capabilities of the [redacted],” the memo reads in part. Subsequent, heavily redacted sentences suggest that the storm crippled the FBI’s capacity to conduct certain types of cell phone tracking operations via equipment on-hand at the time of landfall.

Further details are redacted, but it's clear the diminished capabilities pushed IMSI catchers to the front of the acquisition queue. The accompanying purchase order was designated "priority." Previous purchases had only been declared "routine."

The redactions make it impossible to determine why exactly the agency felt the acquisition of more cellphone-tracking technology was a must post-Katrina. Perhaps the agency needed hardware upgrades to existing equipment that functioned in a less-than-ideal manner when local cell infrastructure suffered damage. Maybe it lent some devices to the New Orleans PD and was having trouble getting them back. Maybe it just wanted more IMSI catchers. No matter the stated reason, it can safely be assumed that post-act of God requisition processes receive less scrutiny than those made during times of relative peace and safety. Terrorism and drug dealing may have been off the table in terms of justifications, but any good government agency knows "national disaster" is spelled "O-P-P-O-R-T-U-N-I-T-Y." The FBI is no exception.

Filed Under: fbi, hurricane katrina, imsi catchers, stingray, surveillance

Police Regularly Use Stingrays Without A Warrant To Find Petty Criminals, Then Try To Hide That Fact

from the more-of-the-same dept

Over the last few years, we've published a ton of stories about the growing police reliance on Stingray cell site simulator devices (also known as IMSI catchers), that mimic a real cell phone tower and help provide the location of a certain mobile phone. As we've written, these devices have been super popular with police departments, who often receive them from the federal government with strict non-disclosure agreements, which means law enforcement has been known to lie to courts or simply drop cases where the usage is at risk of coming out in court.

It seems that this story is getting more and more national attention. Brad Heath, over at USA Today, has a fairly deep dive into the fact that police are using these devices to solve petty crimes all the time, without a warrant, and then refusing to tell defendants how they were caught (which is a bit of a constitutional no-no). Heath specifically was able to get a police surveillance log in Baltimore, which detailed how the devices were used there.

The records show that the city's police used stingrays to catch everyone from killers to petty thieves, that the authorities regularly hid or obscured that surveillance once suspects got to court and that many of those they arrested were never prosecuted.

Defense attorneys assigned to many of those cases said they did not know a stingray had been used until USA TODAY contacted them, even though state law requires that they be told about electronic surveillance.

“I am astounded at the extent to which police have been so aggressively using this technology, how long they’ve been using it and the extent to which they have gone to create ruses to shield that use,” Stephen Mercer, the chief of forensics for Maryland’s public defenders, said.

Some of the cases are absolutely ridiculous -- such as the one where an angry husband grabbed his wife's phone and left the house. Police declared it a theft and used an IMSI catcher to track it down... but by that point, the husband had already given it back to his wife, so the police just showed up at her home where she already had the phone. Also, because it's so easy to use these devices to just go and locate anyone, Baltimore police sometimes used it just to find the location of witnesses (i.e., people who haven't committed any crimes). That's going way over the line of what's appropriate.

These things are being used so often in so many cases with so little transparency, one hopes that the growing press attention will finally lead to much more accountability on how these devices are used and a requirement for a warrant.

Filed Under: baltimore, cell site simulators, imsi catchers, law enforcement, police, privacy, stingrays

AP Uncovers More Than 100 FBI Spy Plane Flights, Originating From Shell Companies Located In Virginia

from the if-nothing-else,-FBI-lacks-the-imagination-of-the-NSA-when-naming-things dept

It's not just the US Marshals Service flying spy planes over the US, loaded with cameras and/or cell tower spoofers. The flying "dirtboxes" of the Marshals came to light last year, and were swiftly neither confirmed nor denied by DOJ spokespeople, who also noted the flights that may/may not be happening are all perfectly lawful and very much not the now-(temporarily)-expired Section 215 program. (I am not making that last part up.)

Consequently, it comes as no surprise that another DOJ agency -- the FBI -- is doing the same thing.

The FBI is operating a small air force with scores of low-flying planes across the country carrying video and, at times, cellphone surveillance technology — all hidden behind fictitious companies that are fronts for the government, The Associated Press has learned.

The planes' surveillance equipment is generally used without a judge's approval, and the FBI said the flights are used for specific, ongoing investigations. The FBI said it uses front companies to protect the safety of the pilots and aircraft. It also shields the identity of the aircraft so that suspects on the ground don't know they're being watched by the FBI.

In a recent 30-day period, the agency flew above more than 30 cities in 11 states across the country, an AP review found.

The AP investigation tracked down documents relating to the FBI's fleet of spy planes, ones that hide the FBI's aircraft behind corporate registrations (i.e., not as easily traceable to the US government) and a variety of three-letter shell companies.

Here's a screenshot of Cessna single-engine planes registered in the Bristow, VA area. (Bristow seems to be the "home" of federal spy planes.)


If this was just one name in a long listing, there would be nothing suspicious about it. But in a single page of search results, the following nonexistent companies can be found, all of them containing no more ownership information than a PO Box:

OTV Leasing
OBR Leasing
PXW Services
KQM Aviation
LCB Leasing
NBR Aviation
FVX Research
RKT Productions
NBY Productions
PSL Surveys
NG Research (an exception!)

A plane registered to PXW Services was spotted flying over Minneapolis, MN. The FBI may be able to hide its planes behind obviously phony companies, but it can't keep its flight data secret. The flights show obvious surveillance patterns, rather than giving any appearance of "normal" behavior.


Despite the secrecy of the shell companies and the FBI's hesitance to discuss its spy tech, the agency claims this is not a secret.

"The FBI's aviation program is not secret," spokesman Christopher Allen said in a statement. "Specific aircraft and their capabilities are protected for operational security purposes." Allen added that the FBI's planes "are not equipped, designed or used for bulk collection activities or mass surveillance."

Except that mounting a camera on the plane (as seen on the FBI plane pictured in this article) or utilizing an airborne Stingray device provides the FBI the opportunity to do both.

And, as usual, the FBI notes that all of its operations are perfectly lawful, even if the public can't actually verify for itself that this assertion is true.

The surveillance flights comply with agency rules, an FBI spokesman said. Those rules, which are heavily redacted in publicly available documents, limit the types of equipment the agency can use, as well as the justifications and duration of the surveillance.

Then there's this:

The FBI asked the AP not to disclose the names of the fake companies it uncovered, saying that would saddle taxpayers with the expense of creating new cover companies to shield the government's involvement, and could endanger the planes and integrity of the surveillance missions. The AP declined the FBI's request because the companies' names — as well as common addresses linked to the Justice Department — are listed on public documents and in government databases.

The fake companies used by the FBI can be "uncovered" through a simple Google search, which is how I arrived at the FAA's listings late last week, before the AP's story broke. (The line about the "expense" of dreaming up wholly-unimaginative "business" names and renting another block of PO Boxes is far too cute, though.) Sure, there's nothing explicitly linking the two (until now), but if the public can be watched in public areas, so too can the FBI's flights. All of this originated from tail numbers of planes seen circling overhead, the flight patterns of those planes and querying publicly-available databases. What's good for the FBI (no expectation of privacy in public areas) is good for the public. The FBI shouldn't be asking journalists to withhold publicly-available information, especially considering the only conceivable purpose it serves is to deprive the AP of evidence for its assertions.

Filed Under: 4th amendment, fbi, imsi catchers, privacy, spy planes, surveillance

FBI Says It Has No Idea Why Law Enforcement Agencies Are Following The Terms Of Its Stingray Non-Disclosure Agreements

from the geez,-all-these-law-enforcers-take-our-agreement-so-LITERALLY dept

The FBI doesn't want to talk about its Stingray devices. It definitely doesn't want local law enforcement agencies talking about them. It forces any agency seeking to acquire one to sign a very restrictive non-disclosure agreement that stipulates -- among other things -- that as little information as possible on IMSI catchers makes its way into the public domain, which includes opposing counsel, prosecutors' offices and judges. The NDAs also instruct agencies to drop prosecutions if disclosure appears unavoidable. We know this because two NDAs have actually been obtained through Freedom of Information requests.

Now that Stingray usage and its attendant secrecy have been questioned by high-ranking DC legislators, the FBI is apparently feeling it should be a bit more proactive on the Stingray info front, presumably in hopes of heading off a more intrusive official inquiry. So, it has offered some "clarification" on its Stingray policies -- including the NDAs it makes local agencies sign.

The "clarification" seems to contradict a great deal of what the FBI's own NDAs require.

In a handful of criminal cases around the country, local police officers have testified in recent months that non-disclosure agreements with the FBI forbid them from acknowledging the use of secret cellphone-tracking devices. In some, prosecutors have settled cases rather than risk revealing, during court proceedings, sensitive details about the use of the devices.

The FBI, however, says such agreements do not prevent police from disclosing that they used such equipment, often called a StingRay. And only as a “last resort” would the FBI require state and local law enforcement agencies to drop criminal cases rather than sharing details of the devices’ use and “compromising the future use of the technique.”

To date, the bureau hasn’t invoked that provision, FBI spokesman Christopher Allen said in a statement to The Washington Post.

Let's compare the official statement with statements found in the agreement signed with a New York sheriff's department. The FBI says it's OK for law enforcement agencies to disclose Stingray usage in this "clarification." Here's the NDA:

The Erie County Sheriff's Office shall not, in any civil or criminal proceeding, use or provide any information concerning the Harris Corporation wireless collection equipment/technology… beyond the evidentiary results obtained through the use of the equipment/technology including, but not limited to, during pre-trial matters, in search warrants and related affidavits, in discovery, in response to court ordered disclosure, in other affidavits, in grand jury hearings, in the State's case-in-chief, rebuttal, or on appeal, or in testimony in any phase of civil or criminal trial, without the prior written approval of the FBI.

Hmm.

The FBI also denies it instructs agencies to toss cases rather than face possible exposure of Stingray usage. The NDA:

In addition, the Erie County Sheriff's Office will, at the request of the FBI, seek dismissal of the case in lieu of using, or providing, or allowing others to use or provide, any information concerning the Harris Corporation wireless collection equipment/technology [...] if using or providing such information would potentially or actually compromise the equipment/technology.

This "clarification" is mostly bullshit, but it's all in the wordcraft. Everything the FBI stated here could be technically factual. It may have never explicitly directed agencies to dump cases or hide Stingray usage. Instead, it has relied on law enforcement agencies to follow the restrictions laid out in the NDAs -- something they've apparently done without ever bothering to approach the FBI for permission to turn over Stingray information during court cases.

To say these NDAs do not prevent law enforcement agencies from acknowledging the use of Stingray devices is only true insofar as the NDAs themselves are apparently just a pile on unenforceable words. The implication, however, is that these agencies will see their Stingray privileges yanked if they cough up information. Or, in the best case scenario, law enforcement officials will be sternly talked to by FBI officials for breaching the agreement.

As for the claim that the FBI has never directly instructed a law enforcement agency to toss a case rather than disclose information? That may be true, as well as being completely unverifiable. Agencies appear to be taking these agreements literally -- which is, of course, the point of ANY WRITTEN AGREEMENT -- and proactively dropping cases rather than risk breaching the terms of the NDA.

The FBI is washing its hands of the Stingray secrecy mess it created. This "clarification" is astoundingly disingenuous. The FBI forces agencies into these agreements and then steps back and says, "Hey. we didn't make them do this. They just interpreted the agreement to mean exactly what it says it means." It passes the buck to local cop shops, blaming them for not seeking the second opinions these agreements clearly discourage.

If this "clarification" is actually going to approach something akin to honesty, the FBI needs to immediately begin rescinding its non-disclosure agreements. It can't force agencies into restrictive agreements and then throw up its hands and claim it has no idea why these agencies might be interpreting these highly-restrictive NDAs so literally. This is a nasty, self-serving cheap shot wrapped in the guise of transparency.

Filed Under: fbi, imsi catchers, law enforcement, nda, non-disclosure agreements, stingray
Companies: harris corp.

California Legislators Pushing Warrant Requirement For All Access To Electronic Information, Including That Obtained By Stingrays

from the strong-nod-towards-long-ignored-rights dept

Good news from California: a bill requiring warrants for Stingray device usage (among other things) has passed out of a Senate committee and is headed for an assembly vote.

Among other sweeping new requirements to enhance digital privacy, the bill notably imposes a warrant requirement before police can access nearly any type of digital data produced by or contained within a device or service.

In other words, that would include any use of a stingray, also known as a cell-site simulator, which can not only used to determine a phone’s location, but can also intercept calls and text messages. During the act of locating a phone, stingrays also sweep up information about nearby phones—not just the target phone.

Despite similar bills being killed by governor vetoes in 2012 and 2013, California legislators are still looking to reform the state's privacy laws. For one thing, this new bill would put the state's Electronic Communication Privacy Act in compliance with the Supreme Court's recent Riley v. California decision (warrant requirement for cell phone searches incident to arrest), as Cyrus Farivar points out.

The committee passed it with a 6-1 vote, suggesting there's broader support for privacy and Fourth Amendment protections now than there were in the pre-Snowden days. Of course, the usual opposition was on hand to portray those pushing for a warrant requirement as being in favor of sexually abusing children.

[Marty] Vranicar [California District Attorneys Association] told the committee that the bill would "undermine efforts to find child exploitation," specifically child pornography.

"SB 178 threatens law enforcement’s ability to conduct undercover child porn investigation. the so-called peer-to-peer investigations," he said. "Officers, after creating online profiles—these e-mails provide metadata that is the key to providing information. This would effectively end online undercover investigations in California."

Vranicar failed to explain how an officer conducting an ongoing investigation would be unable to obtain a warrant for PTP user data… unless, of course, the "investigation" was nothing more than unfocused trolling or a sting running dangerously low on probable cause. Nothing in the bill forbids officers from using other methods -- Fourth Amendment-respecting methods -- to pursue those suspected of child exploitation. What it does do is make it more difficult to run stings and honeypots, both of which are already on shaky ground in terms of legality.

Additionally, the bill demands extensive reporting requirements pertaining to government requests for data, and makes an effort to strip away the secrecy surrounding search warrants.

1546.2 (a) Except as otherwise provided in this section, any government entity that executes a warrant or wiretap order or issues an emergency request pursuant to Section 1546.1 shall contemporaneously serve upon, or deliver by registered or first-class mail, electronic mail, or other means reasonably calculated to be effective, the identified targets of the warrant, order, or emergency request, a notice that informs the recipient that information about the recipient has been compelled or requested, and states with reasonable specificity the nature of the government investigation under which the information is sought. The notice shall include a copy of the warrant or order, or a written statement setting forth facts giving rise to the emergency.

(b) If there is no identified target of a warrant, wiretap order, or emergency request at the time of its issuance, the government entity shall take reasonable steps to provide the notice, within three days of the execution of the warrant, to all individuals about whom information was disclosed or obtained.

This isn't blanket coverage or without exceptions. Officers can still offer sworn affidavits in support of sealing to the court, which may then seal warrants on a rolling 90-day basis at its discretion.

Law enforcement will continue to fight this bill, but its opposition seemingly had no effect on the Public Safety Committee. This bill brings the government into a much tighter alignment with the wording and the intent of the Fourth Amendment. The arguments against it demonstrate that the law enforcement community continues to prize efficient policing over the public's (supposedly) guaranteed rights.

Filed Under: california, imsi catchers, stingrays, warrants

CIA Worked With DOJ To Re-Purpose Foreign Surveillance Airborne Cell Tower Spoofers For Domestic Use

from the I-got-a-name-and-I-got-a-number-I-got-a-line-on-you dept

The CIA's recent rebranding as Valhalla for US cyberwarriors notwithstanding, the agency's general focus has been intelligence gathering on foreign governments, corporations and people. That it has often mistaken "torturing people into saying whatever they can to make it stop" for "intelligence gathering" isn't necessarily germane to the following discussion, but it's worth noting that the CIA is almost single-handedly responsible for destroying the term "extraordinary rendition" -- a formerly innocuous (and complimentary) term previously used to highlight something like, say, Johnny Cash's amazing cover of Soundgarden's' "Rusty Cage." (That Cash's two best covers are "Hurt" and "Rusty Cage" is not germane to the discussion of CIA torture programs, but what a coincidence!)

But the emphasis here is foreign. Which is why the following news makes so little sense.

The Central Intelligence Agency played a crucial role in helping the Justice Department develop technology that scans data from thousands of U.S. cellphones at a time, part of a secret high-tech alliance between the spy agency and domestic law enforcement, according to people familiar with the work.

The CIA and the U.S. Marshals Service, an agency of the Justice Department, developed technology to locate specific cellphones in the U.S. through an airborne device that mimics a cellphone tower, these people said.

"These people" are likely keeping both eyes on their backs at this point, considering this revelation sheds more light on two things both agencies would like to keep in permanent darkness: the CIA's involvement in domestic surveillance and the US Marshals' airborne "dirtboxes," which are hoovering up tons of phone call info using high-flying IMSI catchers.

The planes fly from five US cities and cover "most of the US population," according to the Wall Street Journal and its unnamed sources. The technology appears to have debuted overseas under the CIA's auspices. Nothing about that fact is surprising or, indeed, of major concern in terms of US civil liberties (although likely not welcome news for any foreign citizens in the CIA's coverage area). What is more surprising -- or rather, disappointing -- is that the DOJ saw the foreign surveillance tech deployed by the CIA and said, "We could really use this here. In the US. On our fellow Americans."

Not only that, but if the CIA is involved in any significant way, there are some legal issues that need to be discussed.

The CIA has a long-standing prohibition that bars it from conducting most types of domestic operations, and officials at both the CIA and the Justice Department said they didn’t violate those rules.

Phew. [Wipes brow.] Oh. Wait. The DOJ utilizing CIA dirtboxes to surveill US citizens probably breaks some rules. (The courts will probably have to sort this out -- and, unfortunately, there's a chance they'll find otherwise.) But that's not what the DOJ is saying. It's saying that the CIA doesn't violate the "don't conduct [most types] of domestic surveillance" rules. Which is probably true. It just hands of the tools of totalitarianism to the DOJ and the domestic side of the equation takes over. It's wrong because it subverts the roles of both agencies but it's technically right because the DOJ's agencies do the actual surveillance -- not the CIA. That's how that works. Technically legal. But wrong in just about every other way.

It isn't as though the DOJ just stopped by to ask about the CIA's flying machines. It had a very active role in the creation of the domestic Mile High Spy Club.

For years, the U.S. Marshals’ Technical Operations Group worked with the CIA’s Office of Technical Collection to develop the technology. In the early days it was the CIA that provided the most resources, said the people familiar with the matter.

For now, it's the unnamed "people" vs. the public front-mouths for various incestuously intertwined intelligence/law enforcement agencies. Last last year, the DOJ was asked to explain its flying cell tower spoofers, but the best defense it offered was, "Hey, at least it's not the Section 215 program," along with a half-assed Glomar ("neither confirm nor deny") that admitted more than it withheld.

The CIA is likewise mostly silent on the matter, offering up only the weak defense that the CIA has given other stuff to domestic agencies and that's all been perfectly legal. Likewise the DOJ… again with its "We're not the NSA" assertions meant to make it look like Captain Fourth Amendment by comparison:

A Justice Department spokesman said Marshals Service techniques are “carried out consistent with federal law, and are subject to court approval.” The agency doesn’t conduct “domestic surveillance, intelligence gathering, or any type of bulk data collection,” the spokesman said, adding that it doesn’t gather any intelligence on behalf of U.S. spy agencies.

But it's not just metadata or call records. The CIA-built, DOJ-deployed devices also listen in.

In 2005, the CIA gave the Marshals Service technology to conduct “silent stimulation” of those types of cellphones, both for identifying them and, with a court order, intercepting the communications, these people said.

So, according to the DOJ, it doesn't participate in bulk data collection. But an untargeted device that flies overhead and forces all phones in range to submit to its advances isn't anything but a bulk data collection. Sure, there may be an eventual target, but until that target is acquired, everything else gets swept up into the DOJ's flying coffers. Even with "catch-and-release" -- the least intrusive form of cell tower spoofing -- innocent Americans are still at the mercy of the government as spoofers gather communications, cut off data usage and force all phones to the least technologically-advanced connection possible.

The DOJ's excuses are horrible, especially in light of the surveillance tool's origins. If the Wall Street Journal's sources are correct, the DOJ re-deployment of foreign intelligence gathering tech makes it the Victor Kiam of domestic spookery: "We liked it so much, we used it on our own people!"

Filed Under: cia, doj, domestic surveillance, fbi, imsi catchers, spoofing, stingray

Senator Asks FCC To Explain Its Involvement In The Proliferation Of Stingray Devices

from the let-the-finger-pointing-begin! dept

Despite the feds' best efforts to keep IMSI catchers (Stingray devices, colloquially and almost certainly to the dismay of manufacturer Harris Corporation, as they head to becoming the kleenex of surveillance tech) a secret, there's still enough information leaking out around the edges of the FBI's non-disclosure agreements to provoke public discussion.

The discussion appears to have reached the top of the food chain. Sen. Bill Nelson -- following the lead of Senators Leahy and Grassley -- has sent a letter to FCC chairman Tom Wheeler asking the following:

[image credit: Julian Sanchez]

Dear Chairman Wheeler:

On Feb. 23, The Washington Post published a front-page article “Secrecy around Police Surveillance Equipment Proves a Case’s Undoing.” That article indicated that the Tallahassee Police Department and other law enforcement agencies around the country have been using a device called the StingRay to collect cell phone call information.

That article and previous others concerning the device reveal the StingRay was certified for use by the Federal Communications Commission (FCC), contingent upon the conditions that StingRay’s manufacturer sell these devices solely to federal, state, and local public safety and law enforcement; and that state and local law enforcement agencies must coordinate in advance with the Federal Bureau of Investigation (FBI) before acquiring or using this equipment. According to the article, these devices now have been purchased by 48 law enforcement agencies in 20 states and the District of Columbia and used in hundreds of cases.

Yep, the devices are pretty much everywhere and no one wants to talk about them. When the US Marshals Service isn't stepping in to physically remove Stingray-related documents, local law enforcement agencies are disguising their use of these devices behind vague warrants and subpoenas.

What Sen. Nelson wants to know is what the FCC knows about Stingrays.

What information the FCC may have had about the rationale behind the restrictions placed on the certification of the StingRay, and whether similar restrictions have been put in place for other devices;

Whether the FCC inquired about what oversight may be in place to make sure that use of the devices complied with the manufacturer’s representations to the FCC at the time of certification; and

A status report on the activities of the “task force” you previously formed to look at questions surrounding the use of the StingRay and similar devices.

What we DO know so far about the interplay of Harris, the FBI and the FCC is that the first two parties have been less than forthright with the third. Harris managed to push its devices past the FCC by implying they would only be used in emergencies -- even though it was already clear at the point it made that statement that law enforcement agencies were frequently deploying them in non-emergency situations.

The FBI has performed its own obfuscation, implying in a letter to law enforcement agencies that the FCC required the signing off a non-disclosure agreement with the FBI. The FCC has since denied this, and obtained documents indicate it's the FBI that wants to control the flow of information regarding Stingrays, not the other way around.

I imagine the FCC would be compliant with this request, considering its past relationship with the FBI and Harris. But it can expect to run into significant resistance from the DOJ, which still believes that the long-exposed technology should still be afforded NSA-level secrecy -- especially when answers to Sen. Nelson's questions will likely expose its less-than-honest dealings with the FCC.

Sen. Nelson deserves some extra praise for being willing to put himself in an awkward situation. As the ACLU's Chris Soghoian notes, the senator has picked a very public fight with his second biggest campaign contributor.


Somebody needs to provide some answers and, while it's really the FBI that should be talking at this point, the FCC's take on this -- and its dealings with the FBI -- should be enlightening. The FBI's insistence on secrecy is not only screwing defendants during the discovery process, but it's also harming local law enforcement itself, which has shown an alarming willingness to drop cases/charges rather than reveal the use of Stingray devices.

Filed Under: bill nelson, doj, fbi, fcc, imsi catcher, imsi catchers, stingray, us marshals
Companies: harris corp.

Senators Leahy & Grassley Quiz DOJ & DHS About Secret Fake Phone Towers Intercepting Calls

from the good-for-them dept

We've written plenty about Stingrays and other "IMSI Catcher" devices that allow law enforcement to set up what are effectively fake cell phone towers, designed to intercept calls and locate certain individuals. These devices are deployed in near total secrecy, often by law enforcement who got them from the federal government. There is little to no oversight over how these are used (and abused). The attempts to keep the details a total secret represent really egregious behavior from all involved. As we've covered, police have claimed that non-disclosure agreements with the manufacturers (such as Harris Corp.) prevent them from getting a warrant to use the devices. The DOJ, somewhat famously, had a whole plan for how to mislead judges about the use of these devices, with official documentation telling DOJ officials to be "less than explicit" and "less than forthright" to judges about how the tech was being used. In some cases, the US Marshals have stepped in and seized documents from local police forces to block them from being released in response to FOIA requests.

In short, law enforcement really doesn't want how it uses these devices revealed. And yet, reporters and activists keep digging up more information, including the WSJ finding out that the US Marshals (them again!) have been putting airborne versions of these devices, called DRT boxes, on airplanes and flying them over cities, likely scooping up information on tons of innocent people with no warrant.

At least some in our government are concerned about this. Senators Patrick Leahy and Chuck Grassley have been pressing government officials on this, and before the holidays sent a letter to Attorney General Eric Holder and Homeland Security Boss Jeh Johnson demanding answers. One very interesting tidbit is that in response to some of this public disclosure, the FBI now, at least, gets warrants before using the technology -- but the Senators would like more details:

We wrote to FBI Director Comey in June seeking information about law enforcement use of cell-site simulators. Since then, our staff members have participated in two briefings with FBI officials, and at the most recent session they learned that the FBI recently changed its policy with respect to the type of legal process that it typically seeks before employing this type of technology. According to this new policy, the FBI now obtains a search warrant before deploying a cell-site simulator, although the policy contains a number of potentially broad exceptions and we continue to have questions about how it is being implemented in practice. Furthermore, it remains unclear how other agencies within the Department of Justice and Department of Homeland Security make use of cell-site simulators and what policies are in place to govern their use of that technology.

But, still, the Senators would like a few more details:

The Judiciary Committee needs a broader understanding of the full range of law enforcement agencies that use this technology, the policies in place to protect the privacy interests of those whose information might be collected using these devices, and the legal process that DOJ and DHS entities seek prior to using them.

For example, we understand that the FBI’s new policy requires FBI agents to obtain a search warrant whenever a cell-site simulator is used as part of a FBI investigation or operation, unless one of several exceptions apply, including (among others): (1) cases that pose an imminent danger to public safety, (2) cases that involve a fugitive, or (3) cases in which the technology is used in public places or other locations at which the FBI deems there is no reasonable expectation of privacy.

We have concerns about the scope of the exceptions. Specifically, we are concerned about whether the FBI and other law enforcement agencies have adequately considered the privacy interests of other individuals who are not the targets of the interception, but whose information is nevertheless being collected when these devices are being used. We understand that the FBI believes that it can address these interests by maintaining that information for a short period of time and purging the information after it has been collected. But there is a question as to whether this sufficiently safeguards privacy interests.

The specific questions being asked:

1. Since the effective date of the FBI’s new policy:

a. How many times has the FBI used a cell-site simulator?
b. In how many of these instances was the use of the cell-site simulator authorized by a search warrant?
c. In how many of these instances was the use of the cell-site simulator authorized by some other form of legal process? Please identify the legal process used.
d. In how many of these instances was the cell-site simulator used without any legal process?
e. How many times has each of the exceptions to the search warrant policy, including those listed above, been used by the FBI?

2. From January 1, 2010, to the effective date of the FBI’s new policy:

a. How many times did the FBI use a cell-site simulator?
b. In how many of these instances was the use of a cell-site simulator authorized by a search warrant?
c. In how many of these instances was the use of the cell-site simulator authorized by some other form of legal process? Please identify the legal process used.
d. In how many of these instances was the cell-site simulator used without any legal process?
e. In how many of the instances referenced in Question 2(d) did the FBI use a cell-site simulator in a public place or other location in which the FBI deemed there is no reasonable expectation of privacy?

3. What is the FBI’s current policy on the retention and destruction of the information collected by cell-site simulators in all cases? How is that policy enforced?

4. What other DOJ and DHS agencies use cell-site simulators?

5. What is the policy of these agencies regarding the legal process needed for use of cell-site simulators?

a. Are these agencies seeking search warrants specific to the use of cell-site simulators?
b. If not, what legal authorities are they using?
c. Do these agencies make use of public place or other exceptions? If so, in what proportion of all instances in which the technology is used are exceptions relied upon?
d. What are these agencies’ policies on the retention and destruction of the information that is collected by cell-site simulators? How are those policies enforced?

6. What is the Department of Justice’s guidance to United States Attorneys’ Offices regarding the legal process required for the use of cell-site simulators?

7. Across all DOJ and DHS entities, what protections exist to safeguard the privacy interests of individuals who are not the targets of interception, but whose information is nevertheless being collected by cell-site simulators?

Anyone taking bets on how few of these questions will actually be answered?

Filed Under: chuck grassley, drt boxes, imsi catchers, patrick leahy, privacy, stingray, stingrays, us marshals, warrants
Companies: boeing, harris corp.