DOJ Apparently Last To Know About Widespread Stingray Usage/Secrecy; Vows To Look Into It

from the 'what-is-the-deal-with-all-these-Stingrays?'-no-longer-rhetorical dept

Considering the number of documents confirming the FBI's stranglehold on Stingray device information that have been made public in recent months (including the FBI's nearly-blank 5,000-page FOIA response), this move by the DOJ is a surprising development.

The Justice Department will start revealing more about the government’s use of secret cellphone tracking devices and has launched a wide-ranging review into how law-enforcement agencies deploy the technology, according to Justice officials.

Senior officials have also decided they must be more forthcoming about how and why the devices are used—although there isn’t yet agreement within the Justice Department about how much to reveal or how quickly.

So… caveats, obviously. There's more on the way, but we don't know when we'll get it, or how much it will actually be, but at least the DOJ will finally be taking a look at a technology that's being deployed by law enforcement agencies -- often without warrants. And when they do use warrants, they're often obtained with misleading affidavits so as to comply with the non-disclosure agreements the FBI forces them to sign before deploying the devices.

This is also surprising, considering the FBI wrote itself a large enough loophole to ensure it never needed to bother with this sort of paperwork.

In recent months, the Federal Bureau of Investigation has begun getting search warrants from judges to use the devices, which hunt criminal suspects by locating their cellphones, the officials said. For years, FBI agents didn’t get warrants to use the tracking devices.

One wonders how the Wall Street Journal knows this, considering the FBI is the last agency that would publicly confirm or deny anything about its Stingray usage. Perhaps some more documents are on the way whether the FBI likes it or not…

But it appears outside scrutiny has finally forced the DOJ to confront the all-encompassing secrecy surrounding Stingrays -- something that routinely excludes defendants and judges and sometimes stretches far enough to lock out other "good guys," like prosecutors and states' attorneys.

For the first time ever, legislators are beginning to ask uncomfortable questions about the technology. While the FBI can apparently blow off a majority of the US population -- including the judicial system -- it's not going to have nearly as much luck fending off determined lawmakers. The technology it loves could become the technology it can no longer have -- or at least see it subjected it to a number of requirements that would make it much less enjoyable to deploy.

Congressional scrutiny is never comfortable. But another contributing factor is the entities directly and indirectly involved with tracking cell phones: service providers. They're unhappy and they've got a pretty good idea how often requests for data are heading their way and how specious or redundant the requests are.

Federal law-enforcement and phone-company officials also have expressed concerns that some local police authorities were abusing a legal shortcut by submitting an inordinate number of requests for cellphone information, according to people familiar with the matter.

Some of this is parallel construction. Some of this is abuse of an avenue previously used to acquire specifically-targeted information: pen register/trap and trace orders. It's already public knowledge that law enforcement agencies -- backed by the FBI's own legal rationalizations -- are using these to cover Stingray usage and/or bypass warrant requirements.

On top of this, law enforcement agencies are busy ensuring that the words "exigent circumstances" become as meaningless as "relevant" or "probable cause."

About a year ago, Baltimore police officials began deluging some phone companies with requests for customer cellphone information, claiming it couldn’t wait for a judge’s order, according to people familiar with the matter. Normally, police need a court order to get that kind of information about a phone customer. But there is an exception for emergency requests. Phone companies’ rules vary, but they generally allow emergency requests to be fulfilled in missing-persons cases or when there is a risk of death or serious injury. Typically, the phone company employee doesn’t ask questions to verify the nature of the emergency.

No doubt the Baltimore PD used the hell out of this loophole, what with its 4,300 Stingray deployments over a seven-year period.

Whether this examination by the DOJ will result in any meaningful changes is debatable. It could easily decide that everyone's following all the rules, at least as far as the FBI's interpretation of statutes governing pen register orders. That it's actually securing warrants is a positive sign, but it would be nice to see if the affidavits actually specify the devices used to perform the "search." It's one thing to gather data on phone calls. It's quite another to lock down where that phone is located by sifting through everyone's data while pretending to be a cell tower -- especially considering the devices also have the capability to intercept certain communications.

Filed Under: doj, imsi catcher, secrecy, stingray, surveillance, transparency

FBI Hands Over 5000 Pages Of Stingray Info To MuckRock, Redacts Nearly All Of It

from the [NOTHING-TO-SEE-HERE] dept

MuckRock has obtained a whole stack of Stingray-related documents from the FBI. As is to be expected, there's not much left unsaid by the agency, which is at least as protective of its own Stingray secrecy as it is with that of law enforcement agencies all over the US.

There's nearly 5,000 pages of "material" here, most of which contains only some intriguing words and phrases surrounded by page after page of redactions.

Want to know [REDACTED]'s thoughts on the possible legal implications of Triggerfish? Just close your eyes and allow your imagination to run free.

Here's a quick reference guide that allows FBI agents to quickly match up their chosen "technique" with the appropriate legal standard and process.


That's not to say there's nothing of interest left intact. A few pages explain the FBI's legal rationale for IMSI catcher deployment -- including the fact that the Patriot Act expanded the reach of pen register orders to include not just numbers dialed, but also the location of the phone itself. This allows the FBI and other law enforcement agencies to route around one of CALEA's (Communications Assistance for Law Enforcement Act) few limitations related to pen register orders: that service providers not be required to hand over subscriber location info.

In passing CALEA in 1994, Congress required providers to isolate and provide to the government certain information relating to telephone communications. At the same time that it created these obligations, it created an exception: carriers shall not provide law enforcement with "any information that may disclose the physical location of the subscriber" in response to a pen/trap order… By its very terms, this prohibition applies only to information collected by a provider and not to information collected directly by law enforcement authorities. Thus, CALEA does not bar the use of pen/trap orders to authorize the use of cell phone tracking devices used to locate targeted cell phones.

But, for the most part, it's 5000 pages of this:


And this (from a document titled "Stingray for Dummies"):


It's not a complete loss, although it's clear the documents suffer from over-redaction. The FBI clearly doesn't want to discuss methods or technical details, but nothing in the multiple FOIA exemptions deployed justifies covering up its minimization procedures or where the device sits in terms of the Fourth Amendment.

"It does not seem credible to me that they can't release more of those kinds of records," [ACLU attorney Nate] Wessler told me. "Information about ongoing investigations, highly technical details of the devices, how they're put together, those kinds of things, redact them, fair enough. Information about whether they have to get a warrant or not, how they purge or do not purge bystanders data. They're clearly talking about those things."

"There's no conceivable reason why they shouldn't tell the public what their Fourth Amendment rights are protecting when they use these," he added. "The documents are not without value, but what the FBI has released is not adequate."

If nothing else, the documents have given a small, narrow glimpse behind the FBI's veil of secrecy -- as well as some more insight into its Stingray-related legal maneuvering. The FBI has managed to turn a pen register order -- something previously used to collect dialed numbers -- into something that can be deployed to locate an individual, or at least their cellphone. Unsurprisingly, this legal theory traces back to the Patriot Act, one of the largest expansions of intelligence and law enforcement powers ever produced by the US government.

Filed Under: fbi, foia, imsi catcher, redactions, stingray

Baltimore Cops Asked Creators Of 'The Wire' To Keep Cellphone Surveillance Vulnerabilities A Secret

from the works-of-fiction-with-too-much-truth? dept

Over the past decade, criminals have apparently gained an insurmountable technology lead over law enforcement. I'm not sure how this is possible, especially considering many criminals don't have access to the same technology cops do, much less access to generous DHS funding, and yet, here we are witnessing police officers (following orders from the FBI) tossing cases and lying to judges in order to "protect" secret tools that aren't all that much of a secret.

We recently covered a Baltimore detective's courtroom admission that a) the Baltimore PD had deployed its Stingray equipment 4,300 times over the past seven years and b) that it had hidden this information from courts and defendants. The argument for this secrecy was that doing otherwise allows criminals to devise ways to beat the system.

No one's looking to expose ongoing investigations, but as far as some law enforcement agencies are concerned, everyone is under continuous investigation by default. And since that's the case, anything that might be construed as giving criminals a head start is subject to a thoroughly ridiculous code of silence that excludes the majority of the justice system.

This cop-specific technopanic is so all-encompassing that it has bled over into the unreality of creative efforts -- like TV shows. (via The Verge)

David Simon, creator of "The Wire" and a former Baltimore Sun reporter, said in an email that "the transition from landlines to cellular technology left police investigations vulnerable well over a decade ago."

He noted that there was new technology at the time — such as Nextel phones that mimicked walkie-talkies — that "was actually impervious to any interception by law enforcement during a critical window of time."

"At points, we were asked by law enforcement not to reveal certain vulnerabilities in our plotlines," Simon said. That included communications using Nextel devices.

The Wire also featured detectives using a cell signal-capturing device called a "Triggerfish." Any relation to today's Stingrays is likely not coincidental, no matter what the post-credits disclaimer might have stated. The Stingray isn't a secret, but it has been awarded an unprecedented amount of secrecy. Cops lie to judges, defendants and even prosecutors to keep the Stingray out of the public eye. And yet, it seems clear that The Wire's creators knew something about the technology over a decade ago.

But the inherent ridiculousness of asking a fictional television show to withhold dramatic elements just because they may have hewed too closely to reality can't be ignored. Criminals will find vulnerabilities in the system and law enforcement will work hard to close these gaps. But criminals aren't so far ahead as to be unstoppable.

This attempt to censor The Wire isn't much different than the law enforcement secrecy efforts we see being deployed in courts. The motivation behind these efforts is highly suspect. It doesn't seem so much to be aimed at preventing criminals from exploiting vulnerabilities as it is at keeping law enforcement officers from working any harder than they feel they should have to. It's not about keeping bad guys from outmaneuvering cops. It has more to do with preventing public disclosure from resulting in unwanted changes -- like additional scrutiny from magistrate judges or the challenging of submitted evidence. It's about preserving the most efficient law enforcement methods -- generally anything that doesn't require permission from an outside entity or generate a paper trail.

Filed Under: baltimore, baltimore police, fbi, imsi catcher, secrecy, stingray, the wire, vulernabilities

Baltimore PD Has Deployed Stingray Devices Over 4,300 Times, Instructed By FBI To Withhold Info From Courts

from the 'to-sever-and-deflect' dept

Say what you will about the Baltimore PD and its cell tower spoofers (like... "It would rather let accused criminals go than violate its [bogus] non-disclosure agreement with the FBI…" or "It hides usage of these devices behind pen register/trap and trace warrants and then argues the two collection methods are really the same thing…"), but at least it's making sure the hundreds of thousands of dollars it's spent on the technology isn't going to waste.

On Wednesday, Baltimore police Det. Emmanuel Cabreja said the department has deployed the device, called Hailstorm, and similar technology about 4,300 times since 2007.

As the AP notes, the number of deployments admitted to here is the largest ever made public. This doesn't necessarily mean the rate of usage (more than once a day, on average) is out of the ordinary, however. Thanks to the very restrictive non-disclosure agreement the FBI forces law enforcement agencies to sign (while falsely claiming "the FCC made us do it!"), information on cell tower spoofers has very rarely been disclosed.

Det. Cabreja confirmed the ultra-restrictive terms of the FBI's NDA, which forbids law enforcement agencies from producing any information on Stingray devices, no matter who's asking for it.

Cabreja said under questioning from defense attorneys that he did not comply with a subpoena to bring the device to court because of a nondisclosure agreement between the Baltimore police and the Federal Bureau of Investigation.

“Does it instruct you to withhold evidence from the state’s attorney and the circuit court of Baltimore city, even if upon order to produce?” asked defense attorney Joshua Insley.

“Yes,” Cabreja replied, saying he spoke with the FBI last week about the case.

There's nothing quite like hearing confirmation that two law enforcement agencies worked together to withhold information from a party being prosecuted by directly violating a court order. But it gets even better. The Baltimore PD's NDA was made public, and it shows the State's Attorney's office signing off on withholding Stingray information from judges and defendants, as well as agreeing to toss cases if exposure seems unavoidable. In contrast, the Erie County Sheriff's Department's agreement obtained by the NYCLU only contained signatures from law enforcement officials.


The courts -- at least in Baltimore -- seem to be tiring of this secrecy. Baltimore judge Barry Williams has previously questioned the Baltimore PD's citation of its non-disclosure agreement with the FBI, with one memorably pointing out that the PD "doesn't have a non-disclosure agreement with this court." Unfortunately, if the Baltimore PD prioritizes its NDA over its obligation to obey court orders and turn over requested evidence, then it does actually have an NDA "with the court," albeit one the court never agreed to. If the FBI says Stingray info isn't going to be turned over -- no matter who's asking for it -- that information will remain hidden, even if it means tossing criminal cases.

Filed Under: baltimore, baltimore police, doj, fbi, imsi catcher, nda, secrecy, stingray, surveillance, transparency
Companies: harris corp.

US Marshals Service Withholds Publicly-Available Data From Its Stingray Device FOIA Response

from the open-[secrets] dept

Overclassification and abuse of FOIA exemptions is a given with most of our nation's security/law enforcement agencies. Two agencies -- the DHS and the FBI -- both redacted publicly-available information on drone possession and usage. Why? Because no one will stop them. Public accountability isn't something these agencies embrace. Their real love is secrecy, obfuscation and an allegiance to the eternal protection of "techniques and procedures," even when the information has already been disseminated elsewhere.

MuckRock's Phil Mocek recently received responsive documents from the US Marshals Service on its Stingray usage. The Marshals Service is notoriously secretive about the Stingrays in its law enforcement stable and is equally infamous for the thug-like tactics it has deployed to hide documents from public records requests.

So protective is it of this information that its response to Mocek jumped the secrecy shark. Hidden behind the numerous black redaction bars is information freely available on an official government website.

While it appears the USMS is not under any nondisclosure agreement with the device manufacturer, the agency has withheld a wide range of basic information under an exemption meant to protect law enforcement techniques. However, much of the redacted data is already available online via a federal accounting website…

Particular item names and descriptions are universally redacted throughout the documents. But released invoices and purchase orders indicate that USMS spending on cell site simulators and related services totaled nearly $10 million between September 2009 and April 2014.

As MuckRock's Shawn Musgrave points out, this information deemed too sensitive to be released to a FOIA requester can be found at the General Services Administration's website. The GSA handles a majority of government contracts and, as a government entity, is only allowed to display information deemed suitable for public consumption. The same information withheld by the US Marshals Service has been previously cleared for release on the GSA's site.

An overabundance of caution by the US Marshals Service? Maybe. Or maybe it's just accustomed to throwing plenty of black ink around when fielding FOIA requests. Either way, this withholding of publicly-available data suggests one thing: the USMS's justification for blotting out this info doesn't mean shit.

Extensive redactions throughout the document cache are made under a provision in the federal Freedom of Information Act — exemption (b)(7)(E), for the FOIA nerds — meant to protect law enforcement information.

Specifically, per the Justice Department’s own guidelines, this exemption covers information that "would disclose techniques and procedures for law enforcement investigations or prosecutions”, or that “would disclose guidelines for law enforcement investigations or prosecutions if such disclosure could reasonably be expected to risk circumvention of the law."

The trouble is, much of the information blacked out by USMS FOIA officers is already available online to the general public, and hardly qualifies as law enforcement information as defined in this provision.

It's not that the US Marshals Service doesn't understand the correct deployment of FOIA exemptions. It just doesn't care. How a dollar amount can be both publicly-available through the GSA and a too-sensitive-for-the-public "technique or procedure" will never be explained by the wilfully opaque law enforcement agency. At best, it will suggest the redaction was an error. But more likely, it will be happy to stay quiet on the issue and allow the BS exemptions to speak for themselves.

Filed Under: foia, imsi catcher, stingray, us marshals

NY Court Orders Sheriff To Reveal Details On Stingray Mobile Phone Surveillance

from the finally,-a-victory dept

For quite some time now, we've been covering how various law enforcement agencies have been using "Stingray" (or similar) cell tower spoofing devices to track the public. Beyond the questionable Constitutionality of such mass surveillance techniques, what's been really quite incredible is the level of secrecy surrounding such devices. We've written about how the US Marshals have "intervened" in various court cases to hide info about the use of Stingrays -- and even telling local law enforcement to lie about their use of the devices. We've written about law enforcement officials claiming "terrorism" as the reason for needing Stingrays, but then using them for everyday law enforcement. We've written about the company that makes Stingrays, Harris Corp., forcing police to sign non-disclosure agreements barring them from revealing any info about their use. It also appears that Harris Corp. misled the FCC to receive approval for its mobile tower spoofing capabilities. Some police departments have even withdrawn evidence rather than talk about their use of Stingrays.

Thankfully, there's been growing concern about these devices. Congress has been investigating and now it appears at least some courts are getting skeptical about the use of Stingrays. The New York Civil Liberties Union (NYCLU) has highlighted that a judge in one of its cases has ordered the Erie County Sheriff's Office to reveal information to the public about its Stingray operations. The full ruling [pdf] is worth reading. While denying the NYCLU's claim that the Sheriff's Office didn't conduct a thorough search as required, the judge is not at all impressed by the redactions in the documents that were released:

The purchase orders should have been disclosed in their entirety, without redaction of the various words, phrases, and figures thus far withheld. The purchase orders (and more particularly the redacted words, phrases, and prices), were not "compiled for law enforcement purposes" in the sense meant by the statute but, even if they were, their disclosure would not: "interfere with law enforcement investigations or judicial proceedings"; "identify a confidential source or disclose confidential information relating to a criminal investigation," meaning a particular ongoing one; or "reveal [non-'routine'] criminal investigative techniques or procedures, meaning techniques a knowledge of which would permit a miscreant to evade detection, frustrate a pending or threatened investigation, or construct a defense to impede a prosecution.... Further, the purchase orders (or, more precisely, the information redacted therefrom), although clearly constituting inter-agency materials" (the other agency involved was Erie County and its Office of the Comptroller), amount entirely to "instructions to staff that affect the public".... Indeed, the instructions set forth in the purchase orders—'in essence, "Pay this bill of this vendor for this item purchased by the Sheriff's Office at this price"—was and is of quintessentially compelling interest to and of undeniable impact upon the taxpaying public.

Finally, the Court finds that the purchase orders, and particularly the matters redacted therefrom, are not "specifically exempted from disclosure by state or federal statute" .... The Court rejects respondent's arguments that the disclosure sought here would, if made, violate a particular federal statute, regulatory scheme, and executive order forbidding (and indeed criminalizing) the export of certain sensitive technology without government license or the illicit revelation of sensitive information about such sensitive technology to foreign nationals. The Court instead is convinced by petitioner's argument that the disclosure of public records pursuant to New York's Freedom of Information Law and the within judicial directive -- even records concerning respondent's ownership and use of a cell site simulator device -- does not amount to the actual export of such arms, munitions, or defense technology. Further, the Court is satisfied by showing on this record that petitioner, a New York not-for-profit corporation, is not a "foreign person," meaning that the disclosures sought by it pursuant to FOIL would not in fact run afoul of related federal legal restrictions on the revelation of sensitive technical data about export-restricted arms or technology.

Got that? Basically the court rejects the Sheriff's Office's contention that disclosing this information was somehow "exporting munitions" to "foreign persons."

Oh, as for the non-disclosure agreement with Harris Corp.? The judge notes that a non-disclosure agreement is not a federal regulation:

At the outset, the Court notes its agreement with petitioner's observation that the FBI-drafted non-disclosure agreement is not itself a federal statute specifically exempting anything from disclosure....

In fact, later in the order, the court says that the non-disclosure agreement itself should be disclosed:

Likewise, the Court concludes that this public record ought to have been disclosed in its entirety. As indicated, the agreement was entered into between the FBI and respondent as an apparent pre-condition of respondent's being allowed to acquire and use the cell site simulator. The gist of the letter is not a recitation of the technological capabilities of the device or even the "hows" and "whens" or the advantages of its use for law enforcement purposes, but rather simply the need for the Sheriff's Office to avoid disclosing the existence, the technological capabilities, or any use of the device to anyone, lest "individuals who are the subject of investigation ... employ countermeasures to avoid detection," thereby endangering the lives and safety of law enforcement officers and others and compromising criminal law enforcement efforts as well as national security. The Court has no difficulty in concluding that the agreement (or, more precisely, each redacted-at-length passage of it) was not "compiled for law enforcement purposes" in the sense meant by the statute.... Again, even if it was, the Court would conclude that the disclosure of the non-disclosure agreement would not thwart or prejudice any particular ongoing law enforcement investigation or pending prosecution.... Nor, the Court concludes, would the disclosure of the non-disclosure agreement "identify a confidential source or disclose confidential information relating to a criminal investigation," again meaning a specific ongoing one, or "reveal" other than "routine" "criminal investigative techniques or procedures"....

There's a lot more, including other documents, and all of that leads the judge to also grant attorney's fees to the NYCLU. It will be interesting to see if the Sherriff's Office challenges this, but it's a pretty complete win for transparency in an area that law enforcement has been trying to keep totally secret for quite some time now.

Filed Under: erie county sherriff's office, foia, foil, imsi catcher, new york, stingray, surveillance
Companies: aclu, nyclu

Senator Asks FCC To Explain Its Involvement In The Proliferation Of Stingray Devices

from the let-the-finger-pointing-begin! dept

Despite the feds' best efforts to keep IMSI catchers (Stingray devices, colloquially and almost certainly to the dismay of manufacturer Harris Corporation, as they head to becoming the kleenex of surveillance tech) a secret, there's still enough information leaking out around the edges of the FBI's non-disclosure agreements to provoke public discussion.

The discussion appears to have reached the top of the food chain. Sen. Bill Nelson -- following the lead of Senators Leahy and Grassley -- has sent a letter to FCC chairman Tom Wheeler asking the following:

[image credit: Julian Sanchez]

Dear Chairman Wheeler:

On Feb. 23, The Washington Post published a front-page article “Secrecy around Police Surveillance Equipment Proves a Case’s Undoing.” That article indicated that the Tallahassee Police Department and other law enforcement agencies around the country have been using a device called the StingRay to collect cell phone call information.

That article and previous others concerning the device reveal the StingRay was certified for use by the Federal Communications Commission (FCC), contingent upon the conditions that StingRay’s manufacturer sell these devices solely to federal, state, and local public safety and law enforcement; and that state and local law enforcement agencies must coordinate in advance with the Federal Bureau of Investigation (FBI) before acquiring or using this equipment. According to the article, these devices now have been purchased by 48 law enforcement agencies in 20 states and the District of Columbia and used in hundreds of cases.

Yep, the devices are pretty much everywhere and no one wants to talk about them. When the US Marshals Service isn't stepping in to physically remove Stingray-related documents, local law enforcement agencies are disguising their use of these devices behind vague warrants and subpoenas.

What Sen. Nelson wants to know is what the FCC knows about Stingrays.

What information the FCC may have had about the rationale behind the restrictions placed on the certification of the StingRay, and whether similar restrictions have been put in place for other devices;

Whether the FCC inquired about what oversight may be in place to make sure that use of the devices complied with the manufacturer’s representations to the FCC at the time of certification; and

A status report on the activities of the “task force” you previously formed to look at questions surrounding the use of the StingRay and similar devices.

What we DO know so far about the interplay of Harris, the FBI and the FCC is that the first two parties have been less than forthright with the third. Harris managed to push its devices past the FCC by implying they would only be used in emergencies -- even though it was already clear at the point it made that statement that law enforcement agencies were frequently deploying them in non-emergency situations.

The FBI has performed its own obfuscation, implying in a letter to law enforcement agencies that the FCC required the signing off a non-disclosure agreement with the FBI. The FCC has since denied this, and obtained documents indicate it's the FBI that wants to control the flow of information regarding Stingrays, not the other way around.

I imagine the FCC would be compliant with this request, considering its past relationship with the FBI and Harris. But it can expect to run into significant resistance from the DOJ, which still believes that the long-exposed technology should still be afforded NSA-level secrecy -- especially when answers to Sen. Nelson's questions will likely expose its less-than-honest dealings with the FCC.

Sen. Nelson deserves some extra praise for being willing to put himself in an awkward situation. As the ACLU's Chris Soghoian notes, the senator has picked a very public fight with his second biggest campaign contributor.


Somebody needs to provide some answers and, while it's really the FBI that should be talking at this point, the FCC's take on this -- and its dealings with the FBI -- should be enlightening. The FBI's insistence on secrecy is not only screwing defendants during the discovery process, but it's also harming local law enforcement itself, which has shown an alarming willingness to drop cases/charges rather than reveal the use of Stingray devices.

Filed Under: bill nelson, doj, fbi, fcc, imsi catcher, imsi catchers, stingray, us marshals
Companies: harris corp.

Baltimore PD Hides Its Stingray Usage Under A Pen Register Order; Argues There's Really No Difference Between The Two

from the yeah-but-no-not-even-close dept

Another case involving Stingray devices has made its way into the federal court system, prompting the ACLU to join the battle on behalf of the defendant. A murder-for-hire sting conducted by the Baltimore police and the FBI involved the use of a Stingray device, but the paperwork used to justify the deployment says nothing about an IMSI catcher. The order obtained by the Baltimore PD is for a pen register/trap and trace device. [pdf link]

Uncharacteristically, the Baltimore PD disclosed its use of a Stingray device to locate a suspect's phone during court proceedings. Even more uncharacteristically, the government is fighting to keep the evidence from being suppressed, rather than opting to protect its means and methods at the expense of collected evidence.

How the evidence was obtained matters, even though the government's lawyers are arguing that it doesn't.

The government said the court order obtained by authorities, called a pen register, covers the technology because it refers to cellular tracking device and GPS location information.

But the ACLU argues that the state's statute for such pen register orders "makes no provision for, or even mention of, a 'cellular tracking device' " and is commonly understood to only include the "trapping" of call log information.

"In addition, there is absolutely no indication in the application or the order that the authorization will subject potentially unlimited numbers of innocent third parties to dragnet surveillance, none of whom will ever receive notice that their phones were tracked and that the search will intrude into constitutionally protected spaces," the ACLU wrote.

The government argues that no Fourth Amendment violations occurred, even if the court order said nothing about the device used to locate the phone. It asserts that everything was legit, and even if it wasn't, it was an honest mistake and it would have just found the suspect and his phone sooner or later -- perhaps even by using the method it actually requested. [pdf link]

[T]he Government argues that the search was not in violation of the Fourth Amendment for three reasons: (1) the search was authorized by the February 5, 2014, Order (the “Order”), which was a valid warrant; (2) even if the warrant was deficient, law enforcement acted in good faith reliance on it; and (3) even without a warrant, the evidence obtained would not be subject to exclusion because the inevitable discovery doctrine applies.

Wrong, wrong and wrong, according to the defendant's (Robert Harrison) counsel.

The Order was not a valid warrant for at least three reasons. First, the Application in support of the Order was purposefully misleading. The Government crafted the Application as if it were a routine application for a pen register or a trap and trace device, citing the applicable Maryland statutory authorization. It did not mention the term “cell site simulator,” nor did it describe the novel technology in a manner that the judge would understand its intrusiveness on the privacy rights of Harrison or others. Second, although the Government now seeks to treat the Order as a warrant, it failed to comply with the statutory temporal requirements for the execution of warrants, which impacts probable cause. Third, the Order fails the particularity requirement because it specified that it was authorizing a search of only the target phone, but, instead, the cell site simulator searched the phones of infinite third parties in the vicinity. As such, if it was a warrant, it was an illegal general warrant.

The "good faith" exception -- the benefit of a doubt the government frequently extends to itself -- is also addressed.

Further, the Government cannot rely on the good faith exception or the inevitable discovery doctrine. The good faith exception cannot apply here because the purported warrant was facially invalid, and the affiant knowingly or recklessly misled the magistrate with material omissions concerning the cell site simulator. The inevitable discovery doctrine likewise does not apply because the Government’s argument is predicated on an alternative plan that is latent with speculation and conjecture, instead of historically verifiable facts.

Going beyond this, the government attempts to claim the Pen Register order is no different than an actual search warrant -- something it didn't have in its possession when it used the cell site spoofer to "search" Harrison's premises (as well as anyone else's within range) for the cell phone. The filing points out that the statute under which the order was obtained doesn't provide for the issuance of warrants. Even if the government wanted to treat the order like a warrant, it was missing all sorts of specifics crucial to search warrants -- like the particularity of the search, time limitations and probable cause findings.

Not only that, but by obtaining a Pen Register order rather than a search warrant, the government deliberately hid its methods from the courts. The particulars of the technology being deployed were never presented to the magistrate. All of this adds up to one thing: even if the government wants to pretend the order was a warrant, at the very best, it was in possession of a general warrant -- the sort of thing that the Fourth Amendment is in place to safeguard against.

The government also blew past temporal limits normally found in warrants. In its arguments, it wants to have it both ways -- the leniency of the 60-day window provided for Pen Register orders and the powers granted to those in possession of actual search warrants, which are only good for 15 days after issuance. The deployment of the Stingray didn't occur until 50 days after the Pen Register order was obtained.

Addtionally, the phone sought by the FBI and Baltimore PD was no longer in possession of the sting target by the time it went "searching" for it. Within a day of obtaining the Pen Register order, the phone was answered by an unknown male, who told the informant that the suspect (Smith) would call him back on his personal phone. Further records submitted as evidence note that every call between Smith and informants occurred on personal phones, rather than the phone the government was looking for. As the filing points out, had the government sought a warrant to locate this phone, it would have been unable to provide probable cause findings. As things stood nearly a month after the Pen Register order was obtained, the government didn't know much about who actually had the phone, much less whether the phone was still being used as part of the murder-for-hire plot.

By covering up its use of a Stingray device, the government availed itself of the less stringent standards inherent to Pen Register orders. But when it comes to defending itself against complaints of Fourth Amendment violations, the government attempts to portray the order as indistinguishable from a search warrant -- except for all the stuff it's supposed to do on its end to ensure rights aren't violated.

Filed Under: 4th amendment, baltimore, imsi catcher, pen register, police, stingray, warrant

Canadian Law Enforcement Agency Dropping Cases Rather Than Deal With New Warrant Requirements For ISP Subscriber Info

from the if-at-first-you-don't-succeed,-quit dept

A funny thing happens when courts start requiring more information from law enforcement: law enforcers suddenly seem less interested in zealously enforcing the law.

Back in June of this year, Canada's Supreme Court delivered its decision in R. v. Spencer, which brought law enforcement's warrantless access of ISP subscriber info to an end.

In a unanimous decision written by (Harper appointee) Justice Thomas Cromwell, the court issued a strong endorsement of Internet privacy, emphasizing the privacy importance of subscriber information, the right to anonymity, and the need for police to obtain a warrant for subscriber information except in exigent circumstances or under a reasonable law.

The effects of this ruling are beginning to be felt. Michael Geist points to a Winnipeg Free Press article that details the halcyon days of the Royal Canadian Mounted Police's warrantless access.

Prior to the court decision, the RCMP and border agency estimate, it took about five minutes to complete the less than one page of documentation needed to ask for subscriber information, and the company usually turned it over immediately or within one day.

Five minutes! Amazing. And disturbing. A 5-minute process indicates no one involved made even the slightest effort to prevent abuse of the process. The court's decision has dialed back that pace considerably. The RCMP is now complaining that it takes "10 hours" to fill out the 10-20 pages required to obtain subscriber info. It's also unhappy with the turnaround time, which went from nearly immediate to "up to 30 days."

In response, the RCMP has done what other law enforcement agencies have done when encountering a bit of friction: given up.

"Evidence is limited at this early stage, but some cases have already been abandoned by the RCMP as a result of not having enough information to get a production order to obtain (basic subscriber information)," the memo says.

The RCMP also points out that the 30-day response period will sometimes outlast the 30-day IP log retention period, resulting in information being destroyed before the agency can access it. It also notes that it's facing a bit of backlash in the wake of the Supreme Court's decision.

Banks, hotels, and car rental companies are reviewing the Supreme Court decision and "a few have signalled less voluntary co-operation" in future.

Yeah, that's a shame. But it seems to be a feeling that's becoming increasingly common as the pendulum swings back towards protecting the rights of the public. Several companies have spent years being forced to play the submissive part in this involuntary relationship, handing out an endless number of "how highs" in response to the government's "jump!" orders. "Less voluntary" is what the future holds for intelligence agencies and law enforcement alike.

If the RCMP is dropping cases because it doesn't have enough put together to "fulfill the requirements" of its warrant paperwork, then it really doesn't have enough of a case put together to be demanding that third parties turn over information related to the suspect. It's that simple. The cases it has dropped obviously aren't strong enough to justify attempts to gather more information. The warrant requirement is going to turn the RCMP into a better law enforcement agency -- one that doesn't pursue certain investigations just because they're easy. This forces the RCMP to better evaluate its caseload and cut loose those that suffer from a dearth of information. The RCMP may now be counting up its theoretical losses (the cases that it's dropping), but Canadian citizens are better protected against ad hoc bulk surveillance and law enforcement fishing expeditions.

Filed Under: canada, evidence, imsi catcher, law enforcement, privacy, stingray, warrants

Feds Put Fake Cell Towers On Planes, Spied On Tons Of Innocent Americans

from the because-surveillance-is-fun,-yo dept

The Wall Street Journal broke the news that the DOJ has been spying on tons of innocent Americans by putting fake mobile phone towers on airplanes and scooping up all sorts of data from people who thought they were connecting to regular mobile phone towers.

The U.S. Marshals Service program, which became fully functional around 2007, operates Cessna aircraft from at least five metropolitan-area airports, with a flying range covering most of the U.S. population, according to people familiar with the program.

Planes are equipped with devices—some known as “dirtboxes” to law-enforcement officials because of the initials of the Boeing Co. unit that produces them—which mimic cell towers of large telecommunications firms and trick cellphones into reporting their unique registration information.

The technology in the two-foot-square device enables investigators to scoop data from tens of thousands of cellphones in a single flight, collecting their identifying information and general location, these people said.

We have, of course, reported for a while now on so-called Stingray devices, which mimic mobile phone towers on the ground (and have noted that Stingray is just one brand of a few such devices, known as IMSI catchers), but putting them on special planes and flying them around would allow law enforcement agencies to get a lot more information on a lot more people. Given that law enforcement efforts like this are supposed to be narrowly targeted towards those actually suspected of breaking the law, this seems like a massive 4th Amendment abuse, creating mass surveillance programs for law enforcement with little real oversight or control.

While it may not be entirely surprising that this is happening, it is yet another surveillance program being done with zero public transparency, zero public debate and zero public input. That's a huge concern as we've seen time and time again how such programs get abused.

And, while the WSJ doesn't come out and say it, it certainly sounds like it got this info from a concerned whistleblower inside the US Marshals Service:

Within the Marshals Service, some have questioned the legality of such operations and the internal safeguards, these people said. They say scooping up of large volumes of information, even for a short period, may not be properly understood by judges who approve requests for the government to locate a suspect’s phone.

Some within the agency also question whether people scanning cellphone signals are doing enough to minimize intrusions into the phone system of other citizens, and if there are effective procedures in place to safeguard the handling of that data.

As such programs keep getting disclosed, think of how many such other programs there are that we just don't know about?

Filed Under: 4th amendment, doj, imsi catcher, planes, stingray, surveillance, us marshals, warrants