Documents Pried Out Of DOJ's Hands Confirm Stingray Devices Can Be Used To Intercept Communications

from the but-we-never-use-them-that-way!-never?-well...-hardly-ever! dept

Something long-believed but short of official documentation has now been confirmed: Stingray devices can intercept phone calls.

[N]ewly released documents confirm long-held suspicions that the controversial devices are also capable of recording numbers for a mobile phone’s incoming and outgoing calls, as well as intercepting the content of voice and text communications. The documents also discuss the possibility of flashing a phone’s firmware “so that you can intercept conversations using a suspect’s cell phone as a bug.”

The information appears in a 2008 guideline prepared by the Justice Department to advise law enforcement agents on when and how the equipment can be legally used.

The closest we've come to official confirmation of this capability is the DOJ's 2015 "official guidance" on Stingray warrant requirements, which noted that all devices must comply with the pen register requirements, which means the interception of phone numbers only. Any device used by agencies under its control must not use them for the interception of communications.

It also would suggest they're not allowed to use them to obtain cell site location data, as that information can't be obtained with pen register orders. The documents obtained by the ACLU (after a protracted legal battle) clarify this in the opening pages.

111. Invocation of 18 U.S.C. 2702(c)(4) to receive prospective cell site: Reliance on this provision to allow repeated, perspective collection of cell site data may be problematic. Judicious use of this provision is advised. Advise the field that the more prudent course of action is to obtain a search warrant under Rule 41 for repeated disclosures of prospective cell site information because Rule 41 has prospective effect.

The document also handily suggests that a good way to get around pen register limitations and/or warrant requirements is to just ask the service provider for the data ("a service provider can voluntarily disclose historical cell site data..."). Anything handed over voluntarily apparently doesn't implicate the Fourth Amendment, even though the location data was generated by the person with the phone, rather than autonomously by the cell phone provider. But that's the Third Party Doctrine for you.

Following that are instructions for "Emergency Wiretap Orders," which directly mentions utilizing IMSI catchers to intercept communications.

Obtain the following, relevant facts: 1) circumstances giving rise to the emergency situation; 2) who, if known, is using the target phone/facility/location; 3) how the target phone/facility/location was identified; 4) when the phone/facility/location was last known to be used; 5) most recent criminal activity; and 6) basis for belief that phone/facility/location will be used for communications concerning the crime, i.e. what evidence is there that the perpetrator is acting in concert with others -- what communications will be obtained.

More confirmation here, in wording that is echoed by the DOJ's 2015 cell tower spoofer guidance:

Digital analyzers/cell site simulators/triggerfish and similar devices may be capable of intercepting the contents of communications and, therefore, such devices must be configured to disable the interception function, unless interceptions have been authorized by a Title III order.

And for those of you who'd like to play along at home, several of the pages can be printed out and used for your own game of Stingray court order Mad Libs.


You won't have to read all the way to the end, though. Most of the interesting stuff happens in the first few pages, but in true bureaucratic fashion, the bulk of the 71 pages is made up of duplicated responsive documents.

These documents, of course, only deal with the DOJ and its agencies. Whatever's being issued as guidance here doesn't necessarily carry over to local law enforcement agencies using these devices. Considering the intense secrecy surrounding IMSI catchers, it's safe to say they've been deployed to collect communications without a warrant (or at least a warrant that directly refers to the device and its intended use), and we do know they've been using them as ad hoc tracking devices by grabbing cell site location data. When the lid finally comes off entirely, I'm sure we'll see a great number of constitutional violations tracing back to IMSI catchers.

Filed Under: doj, fake mobile towers, imsi catchers, stingray, surveillance

FBI Director Finally Starts Answering Questions About Its Surveillance Flights Over US Cities

from the public-areas-still-public,-even-if-viewed-from-above dept

Suspicions confirmed (well, at least by the FBI…): the FBI has been flying its surveillance planes over cities, often at the behest of local law enforcement.

FBI Surveillance flights over Baltimore and Ferguson as residents of those cities engaged in civil disobedience against racially-motivated police violence were lawful and useful, bureau Director James Comey claimed Thursday.

Comey said that the missions were flown at the behest of local law enforcement in each case, as demonstrations raged against the killings of Michael Brown and Freddie Gray by city cops.

In cases where large-scale protests are probable, it's unsurprising that aerial surveillance will be in use. Comey pitches the FBI's secret surveillance flights as a public benefit, which, in these cases, it arguably is.

“If there is tremendous turbulence in a community, it’s useful to everybody—civilians and law enforcement—to have a view of what’s going on,” Comey said. “Where are the fires in this community? Where are people gathering? Where do people need help?” he went on.

What's more concerning are the FBI's other flights -- the ones it's not as eager to talk about. These flights were uncovered by journalists and hobbyists, who tracked the planes' bizarre flight patterns, as well as traced their ID numbers back to a plethora of shell companies the FBI created to hide the planes' purpose and origin.

To be clear, aerial surveillance rarely implicates Fourth Amendment concerns. In order to do so, planes/helicopters/drones have to fly at very low altitudes and disturb normal ground activities. At this point, the airborne surveillance becomes legally analogous to a breaching of the curtilage -- more or less a warrantless search.

Comey also answered questions from Senator John Conyers, who had concerns about observed FBI flights over his home state of Michigan. As Comey explained, the flights are simply standard operating procedure.

We use planes in our predicated investigations to conduct surveillance of people who are under investigation. We do not use planes for mass surveillance. And so the good folks in Michigan who saw a plane in the air, I think a lot of them had a chance to meet with my SAC (special agent in charge) out there, and have him explain: 'Look, this is what we do in criminal cases. It should make sense, if you understand how we use it in individual cases.' So we have a small number of airplanes — I actually wish we had more — that we use to follow people in places where it's hard to follow them on foot or in a car."

Even if lawful, the planes are still raising surveillance concerns. Targeted surveillance is one thing, but it's common knowledge that US government agencies are using airborne cell tower simulators. Much like the ground version (commonly known as Stingrays), these devices scoop cell phone connection data (which includes location info). Many can be configured to obtain communications as well. The FBI denies using any of its planes for "mass surveillance," but the agency possesses all of the necessary technology to deploy them in this fashion.

Filed Under: fbi, ferguson, flights, james comey, privacy, stingray, surveillance

The IRS Has A Stingray As Well Because Of Course It Does

from the you-get-a-Stingray!-and-you-get-a-Stingray!-every-agency-gets-a-Stingray! dept

Did this sort of thing come about because someone at the nation's most hated agency whined that "everyone else was getting one?" Because there seems to be no logical explanation for this:

The Internal Revenue Service is the latest in a growing list of US federal agencies known to have possessed the sophisticated cellphone dragnet equipment known as Stingray, according to documents obtained by the Guardian.

Invoices obtained following a request under the Freedom of Information Act show purchases made in 2009 and 2012 by the federal tax agency with Harris Corporation, one of a number of companies that manufacture the devices.

No explanation will be forthcoming. The documents The Guardian obtained were heavily redacted and requests for comments were met with silence. But there it is: the IRS not only has a Stingray, but it paid $65,000 to upgrade it to the Hailstorm model, allowing it to continue to intercept calls and data without being locked out by upgraded cell networks.

It appears the agency does have the legal authority to deploy the devices. (The IRS is part of the Treasury Department and not subject to the new, exception-loaded warrant requirement handed down by the DOJ.)

[Former IRS Deputy Commissioner Mark] Matthews said there are currently between 2,000 and 3,000 “special agents” in the IRS who form the criminal investigation division (CID). They have the ability to get PEN register orders – the only authority needed to use Stingray devices.

Considering the criminal activity the IRS investigates most frequently -- tax evasion -- rarely involves highly-mobile suspects or the use of burner phones, it seems unlikely the IRS's Stingray sees much use. Then again, it does partner with other law enforcement agencies in criminal investigations, presumably under the Al Capone Theory of "tax evasion, if nothing else."

He said the IRS on its own usually uses gentler investigation tactics. But increasingly, investigating agents from the agency are brought on board for joint operations with the FBI and other agencies when the latter need financial expertise to look at, for example, money laundering from drug organisations.

Even if the IRS is frequently assisting with these investigations, it's pretty much guaranteed that whatever agency it's partnering with already has this technology on hand. The IRS's acquisition of a cell tower spoofer would seem to be redundant, at best. Then again, maybe it's redundancy the government wants. Can't have drug-running suspects slipping out of sight just because the local DEA office's Stingray is in the shop.

Of course, the IRS's Stingray could become the go-to device in the future, if federal law enforcement agents are looking for a way to circumvent the DOJ's new warrant requirement. They could send IRS agents with pen register paperwork to obtain permission to deploy cell tower spoofers.

But at the same time, the IRS's Stingray device seems to be more a product of "because it's available" thinking. Why not have one on hand, just in case? When the news arrives that Fish and Wildlife or the US Postal Inspector's Office has one, it will be greeted with "of course they do" shrugs, because that's just the way things go these days.The US government is sold on the "essentialness" of cell tower simulators and with funding for devices often tied to ever-swelling budget lines for Wars A (Drugs) and B (Terrorism), no agency should have to go without.

Filed Under: hailstorm, irs, stingray, surveillance, warrants
Companies: harris corp.

Tacoma Police Sued Over Heavily-Redacted Stingray Non-Disclosure Agreement

from the utilizing-the-'because-reasons'-public-records-exemption dept

Despite there being multiple copies of nearly-identical FBI/Stingray non-disclosure agreements in the public domain at this point, the Tacoma (WA) Police Department still refuses to provide FOIA requesters with an unredacted version of its own NDA.

In late 2014, the Tacoma Police Dept. handed Seattle's Phil Mocek a copy of its NDA, which, perhaps unsurprisingly, failed to disclose much about the non-disclosure agreement. The only things left unredacted were the two opening paragraphs of the agreement and the signatures at the end of it. In the middle was a solid wall of black ink.

A year later and nothing has changed. Other Stingray/FBI NDAs have been liberated via public records requests with very little redacted, but the Tacoma PD still won't provide Mocek with an unredacted version of its. So, Mocek has filed a lawsuit against the law enforcement agency.

The complaint, filed Sept. 17 in Pierce County Superior Court by a Seattle advocacy group, contends police and the city’s legal advisers wrongly cite an exemption in state public-records law that protects “specific investigative records.”

“The redacted information is not within this exemption, as it is not intelligence gathered, nor results of intelligence gathering, nor intelligence gathered in a specific case, and is not specific intelligence information,” the lawsuit states.

“The information in the agreement was created before there was any investigation at all conducted with the Stingray equipment, and before any specific intelligence information was gathered with it.”

All good points and all ones that can be easily verified by reading any of the other NDAs acquired by FOIA requesters. (Or just reading the Tacoma PD's in camera...) There are many reasons the Tacoma PD may not want to make this agreement public -- like the fact that it will drop cases rather than reveal Stingray use -- but none of those are valid reasons for withholding the bulk of the agreement.

The Tacoma PD hasn't singled out Mocek with its over-redaction. The Tacoma News Tribune requested the same document and received the same amount of black toner.

If the court finds in favor of Mocek and the Center for Open Policing (the other plaintiff in the suit), it could cost Tacoma's taxpayers a fair amount of cash.

The lawsuit filed against Tacoma police seeks cash penalties calculated by the number of days — 395 – that passed since Mocek, the Seattle activist, made his original request and later filed suit.

Under state law, courts can levy fines of up to $100 per day for wrongful withholding of records.

That's a lot of money to be shelling out for overly-redacting an agreement that's 99% boilerplate and already publicly-available thanks to other FOIA requests targeting other law enforcement agencies. While it's true the Tacoma PD applied its heavy redaction before the others were made public, it still has yet to release an unredacted version of its agreement..

It could be the black ink adds a layer of foreboding secrecy to the now-commonplace document. This undoubtedly assists the Tacoma PD in projecting its law enforcement mystique -- the same thing it used to keep its Stingray acquisition secret for more than five years. It wasn't until the PD needed to purchase an upgrade to its equipment that it finally was forced to deal with public scrutiny of its surveillance equipment. This new scrutiny included town legislators, who apparently approved the original purchase without question. Even now, with the PD's subterfuge exposed, legislators still believe the devices are being used to do good things, so why worry too much about all the obfuscation?

With a payout of $40,000 potentially on the line, the city might finally start asking its police force for a little more transparency and accountability.

Filed Under: imsi catcher, nda, non-disclosure, police, public records, stingray, tacoma, tacoma police

Wall Street Journal Scores Very Limited Win In Fight With DOJ Over Sealed Surveillance Documents

from the here's-a-modicum-of-government-accountability,-will-that-do? dept

The Wall Street Journal has obtained a nominal "win" in a Stingray-related legal action aimed at unsealing electronic surveillance orders, but the decision reads more like a loss. Jennifer Valentino-Devries reports:

In the order, made after a series of legal motions brought by the Journal’s publisher, Dow Jones & Co., U.S. District Judge Nelva Gonzales Ramos of the Southern District of Texas found that Dow Jones has a legal right to see government applications for surveillance, an idea the U.S. Justice Department had fought. But she agreed with the Justice Department that the requested documents shouldn't be disclosed yet because the 14 applications, dating from 2010 to 2013, all relate to continuing cases.

Yes, the WSJ has a right to see these files… but not until the DOJ decides these investigations are really and truly over -- a determination that has yet to be reached for files zooming past the half-decade mark.

The oral arguments delivered in June provide a little more insight into the DOJ's thought processes -- mainly that it should be the sole arbiter of document releases. The DOJ went past the constraints of its earlier argument -- that "open" investigations are not subject to "common law access" -- by claiming that documents used in the course of investigations, even closed ones, are not public records.

I think our position is that "ongoing" is perhaps the wrong word choice in order to determine where the common law right of access and the First Amendment right of access applies. What we would say is that there is significant authority for the government's argument that pre-indictment investigations and the warrants and the applications and the orders that are contained in the context of pre-indictment investigations are not subject to the common law right of access.

Dow Jones had asked the government to provide periodic status updates on these supposedly "open" investigations. The DOJ ignored these requests until prompted by the court, at which point it declared the files to be beyond the reach of the public. Here's the judge's recap of the events:

Dow Jones then filed earlier this year the motion for an updated status report requesting various things: the government to update the report regarding the status of the investigations, and then making public certain versions of the status report, and the sealed appendix. I believe then the government responded as I said, basically saying no updating is necessary here because there is no common presumption of access or First Amendment right.

The court didn't necessarily agree with this assertion but it did find the "balancing test" favored the government's interests. Dow Jones' legal counsel has asked for some additional transparency in docket filings, which would both provide the public with more information as well as assist the WSJ in determining the accuracy of the DOJ's assertions. (It could potentially aid in sussing out the form of surveillance being used as well.)

I would just make the one small addition that, you know, a lot of these applications have a bunch of different requests kind of all pulled together. We've got pen register, trap and trace, we've got D orders, we've got subpoenas, we've got statutory search warrants. And so I would think that an entry ought to reflect that, particularly as it relates to ongoing access issues.

You know, one -- some of these cases in which we've sought access are called In Re Sealed Application, some are called In Re Pen Register. The last one -- the most recent one is In Re Search Warrant. Well, if it's In Re Search Warrant, then the government's argument that these aren't search warrants looks a lot different. And so I think that the more specificity with regard to the basis of the application would help guide the Court as well as anyone who is seeking access to these to try and determine exactly what types of access might apply.

The DOJ, unsurprisingly, isn't a fan of this idea. The surprising part is that -- in arguing against Dow Jones' proposal -- it basically admitted it deploys multiple investigative tools and techniques using a single, apparently non-specific judicial authorization.

[F]or efficiency purposes, we've tended to bring a lot of these actions under one single document so that we don't have to keep coming back to the judge to get separate authorizations for different types of investigatory techniques in the same investigation, so we've just found it expedient to do that at one time.

There are your parallel construction and your Stingrays d/b/a pen registers, etc. And this slips by the court unquestioned.

As it stands now, the DOJ owes the Wall Street Journal a status update in two weeks… and that's about it. The paper may have won the right to unseal these documents, but apparently any future transparency will be left to the discretion of the government.

Filed Under: doj, foia, secrecy, stingray, surveillance, transparency, wall street journal, wsj
Companies: wall street journal

FBI: Hurricane Katrina Made It Clear We Just Don't Have Enough Stingray Devices

from the because-weather dept

In the wake of Hurricane Katrina, the federal government stepped up to assure the nation that as horrifically damaging as the storm was, we would all come out of it OK.*

*Offer does not apply to affected residents of New Orleans.

President Bush let us know that FEMA head "Brownie" (born Michael D. Brown) was doing a "heckuva job" botching the government's response. The New Orleans Police Department worked hard to secure critical infrastructure, going so far as to show up in civilian clothes, armed with unapproved weapons. And the FBI, which sent its people to assist in search and rescue operations and to help curtail post-storm looting, made sure an unprecedented tragedy wouldn't go to waste.

MuckRock's Shawn Musgrave points out that, hidden among the 5,000 heavily redacted pages it received in April in "response" to its FBI-Stingray query, the agency's Katrina experience somehow made Stingray acquisition a priority.

A year later, as part of post-Katrina review, the FBI’s WITT requested funding for additional equipment from Harris Corporation, which manufactures the StingRay line of cell phone trackers. Two drafts of the same memo (draft 1) and (draft 2) from July 2006, each with competing redactions, together weave a partial glimpse of WITT’s justification.

[...]

“In the summer of 2005, the U.S. Gulf Coast bore the brunt of several hurricanes, including Hurricane Katrina which severely degraded the capabilities of the [redacted],” the memo reads in part. Subsequent, heavily redacted sentences suggest that the storm crippled the FBI’s capacity to conduct certain types of cell phone tracking operations via equipment on-hand at the time of landfall.

Further details are redacted, but it's clear the diminished capabilities pushed IMSI catchers to the front of the acquisition queue. The accompanying purchase order was designated "priority." Previous purchases had only been declared "routine."

The redactions make it impossible to determine why exactly the agency felt the acquisition of more cellphone-tracking technology was a must post-Katrina. Perhaps the agency needed hardware upgrades to existing equipment that functioned in a less-than-ideal manner when local cell infrastructure suffered damage. Maybe it lent some devices to the New Orleans PD and was having trouble getting them back. Maybe it just wanted more IMSI catchers. No matter the stated reason, it can safely be assumed that post-act of God requisition processes receive less scrutiny than those made during times of relative peace and safety. Terrorism and drug dealing may have been off the table in terms of justifications, but any good government agency knows "national disaster" is spelled "O-P-P-O-R-T-U-N-I-T-Y." The FBI is no exception.

Filed Under: fbi, hurricane katrina, imsi catchers, stingray, surveillance

Chicago, Los Angeles Police Departments Have Been Using 'Stingrays On Steroids' For Over A Decade

from the all-up-in-your-everything dept

More evidence has surfaced showing local law enforcement agencies are using high-powered surveillance equipment -- equipment originally designed for the military and highly-recommended by the NSA. Ali Winston and the Center for Investigative Reporting have obtained documents showing both Chicago and Los Angeles have used "dirt boxes" (DRT -- Digital Receiver Technology "boxes:" high-powered cell site simulators) since 2005.

In Chicago, the Digital Receiver Technology equipment was purchased in 2005 with funds collected in asset forfeiture cases. In Los Angeles, the police department purchased a package of Digital Receiver Technology equipment with $260,000 in homeland security grant funding. The sole-source purchase was approved unanimously by the Los Angeles City Council in 2005. Both departments also use StingRays, a more commonly known cell-site simulator manufactured by the Florida-based Harris Corp.

As usual, the agencies remain close-lipped about their DRTbox deployment. In fact, the LAPD simply refused to release responsive documents about its DRT equipment, in violation of the state's FOI laws. Boeing, which purchased DRT in 2008, has also refused to comment.

The LAPD's refusal to hand over documents didn't stop the Center for Investigative Reporting from uncovering its DRTbox purchase, however. It found confirmation of the department's DHS grant-supported purchase in the city's public records.

While much of what's been uncovered about Stingrays and other cell tower spoofers tends to focus on the collection of phone and location data, the devices are also used to intercept communications.

Documents from Digital Receiver Technology clearly spell out these interception capabilities.

The DRT1000 System Software is a suite of applications that includes the software that runs on the DRT system, Alaska (GUI), Applause (Audio Playback), DF and Geolocation (with DRTview), and Yukon (IP Configuration utility). The DRT1000 system may be used to: identify and collect audio, data and Signal Related Information (SRI).

The company also manufactures auxiliary products that capture "push-to-talk" communications, something that has been used in the past to elude law enforcement surveillance efforts.

While very few law enforcement agencies have produced documents indicating the purchase and use of these "Stingrays on steroids," DRT's own marketing materials proudly note the company has sold more than 5,000 units as of May 2015. And it is indeed bulked-up. The Los Angeles city clerk's notes on the LAPD's purchase states that DRT's products offer more capabilities than its competitors.

The LAPD has done extensive research to determine the best product available for tracking cellular telephone calls. Most vendors only offered a product that could track phones issued by one or two cellular service providers. Conversely, DRT's equipment can track and monitor all cellular phone traffic, making it the most advanced product on the market. To match the capability of DRT's product, the LAPD would be required to purchase several individual systems from other vendors at a far greater total cost.

This increased capability comes at a premium price, but it's not as though local police departments will be expected to pick up the tab.

Funding from the FY04 State Homeland Security Grant Program (Council File 04-2499), in the amount of $260,000, was previously allocated for the purchase of a Cell Phone Tracking System (CPTS).

Chicago's route to greater surveillance capabilities ran through its asset forfeiture program. In addition to its DRT purchases, the 193 pages of responsive documents show multiple purchases from Harris, including multiple upgrades to existing equipment.

As is the case nearly everywhere, the acquisitions were done in secret and usually without a true bidding process -- a very popular option for departments acquiring surveillance technology. No bidding process means no generation of additional FOIA-able paperwork.

Not found among the responsive documents was anything detailing policies regarding use of these powerful devices or any examination of potential privacy implications by the agencies seeking the equipment. Despite almost-daily revelations of cell tower spoofer acquisition and use (via FOIA requests, mostly), law enforcement agencies are still willing to drop cases and dismiss evidence rather than allow additional public scrutiny. The use of these tools also continues to be hidden behind pen register requests and parallel construction.

The good news is that the continued revelations have finally caught the eye of the nation's legislators.

U.S. Rep. Alan Grayson, D-Florida, who is on the House Foreign Affairs and Science, Space and Technology committees, said the use of technology with eavesdropping capabilities without a warrant is “a clear violation of the Fourth Amendment.”

By using such technology without informing judges of the full capabilities of these devices, Grayson said, law enforcement officials are exposing their casework to appeals under the exclusionary rule, which mandates that evidence gathered illegally cannot be used in court proceedings.

“They’re essentially messing up every case they use these devices in,” he said.

Whether or not this additional attention will result in Fourth Amendment-friendly legislation remains to be seen. Strongly-worded statements are great, but it will take a real, concerted effort to create a warrant requirement, much less restore some expectation of privacy to "business records" like connection and location info.

Filed Under: chicago, dirt boxes, drt boxes, imsi catcher, la, los angeles, police, stingray, surveillance

Israeli-Made Stingray Device Found In The Hands Of South African Businessmen

from the snooping-for-the-masses! dept

IMSI catchers: not just for law enforcement agencies anymore! (via Slashdot) The cellphone signal-slurping devices are normally found in the hands of cops and investigators and carefully hidden from public examination by a fine mesh of redactions, withheld documents, non-disclosure agreements and dismissed cases. But two South African men walked into a sting operation, leaving behind an intriguing bit of interception equipment.

At 10am on Friday, [two people] were lured to Irene Mall outside Pretoria in a police and intelligence sting that resulted in their arrest for illegally being in possession of the cellphone-tapping, -tracking and -locator machine worth over R25 million.

The machine, specially installed in a German-made multi-purpose vehicle, was impounded.

The Star knows the identity of the two arrested men - a top businessman in the gold industry and a bank employee - but can only identify them once they have appeared in court.

The device recovered during this appears to be some sort of Stingray-esque device, albeit not one manufactured by Harris Corporation. Instead, "The Grabber" (as it's known) is manufactured in Israel. "The Grabber" is likely not its official name, as the web is largely free of other references to an IMSI catcher with this name. Israel's Rayzone Group offers a selection of interception devices, but so far, only one (the Pirahna) has any documentation that has surfaced publicly.

Like any powerful interception device, its sales are supposed to be limited to government agencies. From what's being reported here, the South African government was involved, but not in the typical way.

The Hawks [special investigative unit] said senior government officials are believed to have helped the suspects purchase the device – which is highly regulated in South Africa and globally.

According to the report, an official from the Department of Public Works is alleged to have written a fraudulent letter “on a government letterhead” claiming that the government wanted to buy the device.

Putting everything together from multiple reports, it appears the device was used (or intended to be used) to intercept communications of government officials overseeing certain lucrative bidding processes: small scale industrial/economic espionage by private persons acting on behalf of both themselves and a few government officials.

If the claims made by unnamed police officials are to be believed, the "Grabber" is possibly more powerful than Harris' Stingrays.

Police sources told The Star that evidence showed The Grabber, which could bug at least 10,000 lines at a time, had been used to advance certain parties in commercial transactions.

MyBroadband brings these claims a bit more down to earth with a longer examination of the device's purported capabilities. It appears to be, more or less, a Stingray. It imitates a cell tower and boosts its signal to route as many phone calls through it as possible. It can "grab" phones and track their location. According to the unnamed "security professional" interviewed by MyBroadband, it's unlikely the device can actually intercept calls, which makes the police sources' claims of "bugging 10,000 lines" particularly suspect.

In the abstract, a Stingray-device can gather any number of "lines," but actual interception (i.e., "bugging") of calls and text messages tends to be on a smaller scale. Whether or not this device can actually intercept communications (as the Stingray has been reported to do), it's likely true that it does have some interception capabilities, considering that in this context (snooping on government contract bidding, hints of blackmail) call records and phone location would be of minimal use.

Documentation on devices sold by Israel's Rayzone Group do hint at some powerful interception capabilities. Its "Pirahna" offers "remote control" of targeted devices, and additional software provides even more access via a targeted phone's WiFi connection.


However, there's not enough information available to ascertain exactly what device the South African police have recovered. But the technology has been around for years and a number of companies worldwide are steadily improving capabilities.

Finding one of these in the hands of private citizens is a bit surprising, but certainly can't be completely unexpected. Stingray-type technology was never going to remain under strict government control. The tech itself can be duplicated and utilized by criminals -- either by fraudulently obtaining a device from a manufacturer or by putting one together themselves. China's Amazon (AliBaba) has listings for IMSI catchers and Bruce Schneier points to researchers at 2010's Def Con displaying a home-built IMSI catcher that ran about $1,500 for parts. So, the capabilities the police feel they enjoy exclusively are undoubtedly in the hands of civilians.

What is remarkable is the circuitous nature of the criminal activity, which involved government insiders providing the paperwork needed for the acquisition, which was then deployed against other government officials to the mutual benefit of both.

Filed Under: imsi catcher, law enforcement, private use, south africa, stingray, surveillance
Companies: rayzone group

And, Of Course, UK Law Enforcement ALSO Using Cell Tower Spoofers, Refusing To Talk About Them

from the our-shared-surveillance-culture dept

No one seriously believed it was just US law enforcement agencies using repurposed war gear to track cellphone users, did they?

An investigation by the British news channel Sky News claims to have found evidence of fake cellphone towers operating in London and elsewhere that acts similarly to devices known as IMSI catchers, the most famous of which is manufactured under the brand name StingRay.

The results of Sky News' GDMK Cryptophone-enabled cell tower wardriving can be found in this file, which supposedly uncovered more than 20 cell tower imposters in London alone in a three-week period. We've still got the UK beat on nomenclature, though. IMSI catchers are pretty much always referred to as "stingrays" (actually a product name trademarked by manufacturer Harris Corporation). Due to the lack of official acknowledgement or FOA-ed documents, we're stuck with the clunky "ICT hardware," as produced by manufacturer Datong.*

*Time to crowdsource a better British nickname. We honestly can't be using "ICT hardware" in the future when further details inevitably leak out. You'd think the Brits would already have this handled, considering the split development of the language (American/English) has necessitated a need for an English-to-English dictionary at this point.

Here's what officials don't have to say about the Sky News revelations, which follows on the heels of previous investigations by The Guardian and the Times of London. The only thing on record -- outside of the inevitable refusal to confirm or deny -- is this statement, which implies the public's right to know what law enforcement is up to falls far, far behind law enforcement's need to bust bad guys.

“We’re not going to talk about it,” Met official Bernard Hogan-Howe told Sky News when asked for comment. “The only people who benefit [from a comment] are the other side, and I see no reason in giving away that sort of thing."

Of course. And then there's this "reassurance," which only states that whatever the police are doing with these devices, it's certainly not as bad as the worst case scenarios envisioned by the most overactively-imaginative.

“If people imagine that we’ve got the resources to do as much intrusion as they worry about, I would reassure them that’s impossible,” Hogan-Howe added without providing any evidence to support his claim.

But that's OK, because what we do know about IMSI catchers should be scary enough. They force phones to the "dumbest" connection -- 2G -- to better facilitate the interception of calls and texts. They indiscriminately hoover up all call data in the area and can often disrupt normal phone service. Their exisitence is routinely hidden from courts, judges and criminal defendants. And they've been deployed thousands of times by hundreds of law enforcement agencies without a warrant.

These are all reason the public should be made aware of the purchase and use of these devices. But because usage isn't as "intrusive" as Hogan-Howe fails to specify it could be, British citizens are apparently supposed to believe everything is perfectly fine.

Filed Under: cell tower spoofing, gag orders, imsi catcher, law enforcement, stingray, surveillance, uk

'Insert Probable Cause:' Pen Register Boilerplate Hides Sheriff's Department's Hundreds Of Stingray Deployments

from the nothing-to-see-here-[hides-everything] dept

Despite the combined secretive efforts of nearly every law enforcement agency everywhere (including the FBI), some more Stingray documents have made their way into the public domain, thanks to an FOIA request by Cyrus Farivar of Ars Technica. The San Bernardino Sheriff's Department has released 17 pages of documents that show -- among other things -- that it never seeks a warrant before deploying Stingrays.

The sheriff in San Bernardino County—east of Los Angeles County—has deployed a stingray hundreds of times without a warrant, and under questionable judicial authority.

In response to a public records request, the San Bernardino Sheriff’s Department (SBSD) sent Ars, among other outlets, a rare example of a template for a "pen register and trap and trace order" application. (In the letter, county lawyers claimed this was a warrant application template, when it clearly is not.) The SBSD is the law enforcement agency for the entire county, the 12th-most populous county in the United States, and the fifth-most populous in California.

Ah, the old "an IMSI catcher is really just a high-tech pen register" argument, one that has been deployed by other law enforcement agencies. It really isn't. A pen register is a targeted order seeking calls made from a specific number. A Stingray hoovers up everything in its vicinity (including, in some cases, communications), with disposal of "non-hit" calls/communications left to the discretion of the law enforcement agency that has already hidden its use of this technology from the magistrate signing the order.

This Sheriff's Department hides its use behind pen register orders -- which is either a front-loaded lie or back-end reconstruction, but either way, it definitely is not a "warrant application." This agency has deployed its Stingray 303 times -- apparently often enough that the department felt it wise to streamline its bogus PR/TT orders using a fill-in-the-blank template.

DetectiveName, a Detective for the San Bernardino County Sheriff's Department. hereby applies to the Court for an Order (1) authorizing the use of a PEN register on the telephone lines currently designated by the numbers; Telephone Number (The “Telephone Line”); (2) authorizing the use of a trap-and-trace device on the Telephone Line: and (3) requiring the disclosure of subscriber name and address, whether listed or unlisted. for numbers called by the Telephone Line or numbers calling the Telephone Line. or found during investigation of this case upon oral or written demand of agents of the San Bernardino County Sheriff‘s Department. In support of this application, he states the following:

1) I am a detective for the San Bernardino County Sheriff's Departmant and am requesting an Order authorizing the installation and use of a PEN register and a trap-and-trace device. and the disclosure of subscriber information.

2) I certify that the San Bernardino County Sheriffs Department is conducting a criminal investigation of Crime in connection with possible violations of Crime Definition. It is believed that the below named persons and other unknowns are using the Telephone Lines in furtherance of the subject offenses and that the information likely to be obtained from the PEN register and the trap-and-trace devices is relevant to the ongoing criminal investigation being conducted by the above named agency.

AFFIDAVIT "Insert Probable Cause"

It's that last line -- the one that implies PC is almost an afterthought -- that is a bit problematic. The Sheriff's Department obviously wants to hide its Stingray use from magistrate judges (as per the now-standard non-disclosure agreement with the FBI and DOJ) but its application includes something not needed to acquire pen register orders: probable cause.

Curiously, in the SBSD template application, it includes a section for the detective to "insert probable cause," which is not required under the federal pen register statute.

"The fact that order requires probable cause but isn’t labelled a warrant is also interesting," [Hanni] Fakhoury [EFF] said. "[It's] definitely good that the Sheriff and the court are using the probable cause standard but a warrant is about more than just probable cause; a warrant also requires particularity and continuing oversight by the judge who has to review the inventory and receipt to make sure only authorized things were taken."

"So it’s like this order does some of the stuff a warrant would do, but not all," he said.

And, for whatever reason, also included in the responsive document is what appears to be a boilerplate form for judicial approval of (faux) pen register requests. It certainly gives the appearance of judicial rubber stamping (which, considering the low evidentiary bar for actual pen register order requests, isn't that surprising), but it may be nothing more than an example of an approved order for use in training or as reference material.

Notably, the documents include the NDA agreement with the FBI and DOJ, which states the San Bernardino Sheriff's Department is to route FOIA requests through the feds. Did it? The documents returned here don't technically fall into the areas the agreement specifies (mainly Harris Corp. docs that would expose technical details, etc.), but similar requests have returned fewer documents, with the standard NDA being cited as justification for withholding documents. It's far too early for the DOJ's plan to eventually compel the release of more Stingray documents to have kicked in (something like this seems to take at least a half-decade to implement), so it may be that the Sheriff's Department made its own logical determination as to what fell outside of the FBI's many FOIA restrictions. Still, it's considered bad form to show the public how your agency abuses its legal authorities to hide its surveillance activities.

Filed Under: 4th amendment, imsi catcher, pen register, probable cause, san bernardino, sheriff's department, stingray