FBI Says It Has No Idea Why Law Enforcement Agencies Are Following The Terms Of Its Stingray Non-Disclosure Agreements

from the geez,-all-these-law-enforcers-take-our-agreement-so-LITERALLY dept

The FBI doesn't want to talk about its Stingray devices. It definitely doesn't want local law enforcement agencies talking about them. It forces any agency seeking to acquire one to sign a very restrictive non-disclosure agreement that stipulates -- among other things -- that as little information as possible on IMSI catchers makes its way into the public domain, which includes opposing counsel, prosecutors' offices and judges. The NDAs also instruct agencies to drop prosecutions if disclosure appears unavoidable. We know this because two NDAs have actually been obtained through Freedom of Information requests.

Now that Stingray usage and its attendant secrecy have been questioned by high-ranking DC legislators, the FBI is apparently feeling it should be a bit more proactive on the Stingray info front, presumably in hopes of heading off a more intrusive official inquiry. So, it has offered some "clarification" on its Stingray policies -- including the NDAs it makes local agencies sign.

The "clarification" seems to contradict a great deal of what the FBI's own NDAs require.

In a handful of criminal cases around the country, local police officers have testified in recent months that non-disclosure agreements with the FBI forbid them from acknowledging the use of secret cellphone-tracking devices. In some, prosecutors have settled cases rather than risk revealing, during court proceedings, sensitive details about the use of the devices.

The FBI, however, says such agreements do not prevent police from disclosing that they used such equipment, often called a StingRay. And only as a “last resort” would the FBI require state and local law enforcement agencies to drop criminal cases rather than sharing details of the devices’ use and “compromising the future use of the technique.”

To date, the bureau hasn’t invoked that provision, FBI spokesman Christopher Allen said in a statement to The Washington Post.

Let's compare the official statement with statements found in the agreement signed with a New York sheriff's department. The FBI says it's OK for law enforcement agencies to disclose Stingray usage in this "clarification." Here's the NDA:

The Erie County Sheriff's Office shall not, in any civil or criminal proceeding, use or provide any information concerning the Harris Corporation wireless collection equipment/technology… beyond the evidentiary results obtained through the use of the equipment/technology including, but not limited to, during pre-trial matters, in search warrants and related affidavits, in discovery, in response to court ordered disclosure, in other affidavits, in grand jury hearings, in the State's case-in-chief, rebuttal, or on appeal, or in testimony in any phase of civil or criminal trial, without the prior written approval of the FBI.

Hmm.

The FBI also denies it instructs agencies to toss cases rather than face possible exposure of Stingray usage. The NDA:

In addition, the Erie County Sheriff's Office will, at the request of the FBI, seek dismissal of the case in lieu of using, or providing, or allowing others to use or provide, any information concerning the Harris Corporation wireless collection equipment/technology [...] if using or providing such information would potentially or actually compromise the equipment/technology.

This "clarification" is mostly bullshit, but it's all in the wordcraft. Everything the FBI stated here could be technically factual. It may have never explicitly directed agencies to dump cases or hide Stingray usage. Instead, it has relied on law enforcement agencies to follow the restrictions laid out in the NDAs -- something they've apparently done without ever bothering to approach the FBI for permission to turn over Stingray information during court cases.

To say these NDAs do not prevent law enforcement agencies from acknowledging the use of Stingray devices is only true insofar as the NDAs themselves are apparently just a pile on unenforceable words. The implication, however, is that these agencies will see their Stingray privileges yanked if they cough up information. Or, in the best case scenario, law enforcement officials will be sternly talked to by FBI officials for breaching the agreement.

As for the claim that the FBI has never directly instructed a law enforcement agency to toss a case rather than disclose information? That may be true, as well as being completely unverifiable. Agencies appear to be taking these agreements literally -- which is, of course, the point of ANY WRITTEN AGREEMENT -- and proactively dropping cases rather than risk breaching the terms of the NDA.

The FBI is washing its hands of the Stingray secrecy mess it created. This "clarification" is astoundingly disingenuous. The FBI forces agencies into these agreements and then steps back and says, "Hey. we didn't make them do this. They just interpreted the agreement to mean exactly what it says it means." It passes the buck to local cop shops, blaming them for not seeking the second opinions these agreements clearly discourage.

If this "clarification" is actually going to approach something akin to honesty, the FBI needs to immediately begin rescinding its non-disclosure agreements. It can't force agencies into restrictive agreements and then throw up its hands and claim it has no idea why these agencies might be interpreting these highly-restrictive NDAs so literally. This is a nasty, self-serving cheap shot wrapped in the guise of transparency.

Filed Under: fbi, imsi catchers, law enforcement, nda, non-disclosure agreements, stingray
Companies: harris corp.

The FBI's Stingray Secrecy May Be Aimed At Preventing Law Enforcement From Overusing A Key 'Exploit'

from the running-the-wheels-off-a-Stingray dept

An interesting angle on the FBI's Stingray secrecy has emerged from -- of all places -- a Princeton gathering of cryptographers that included Edward Snowden via his "Snobot."

Generally speaking, the FBI is a very secretive agency, as can be readily gleaned from its tendency to answer FOIA requests with page after page of fully-redacted documents. That it has managed to rope so many law enforcement agencies -- including prosecutors and states' attorneys' offices -- into highly-restrictive non-disclosure agreements is somewhat of a surprise, considering its position as a partner in law enforcement, rather than an overseer of local agencies like the DOJ.

These NDAs keep almost all information about Stingray device usage out of our nation's courts. The desire to protect these specifics is all-encompassing, resulting in prosecutors and police departments cutting suspects loose (including those who have already pled guilty) rather than allowing information to make its way into the public domain.

But there could be more to it than just a naturally-secretive agency being secretive. It may be that it fears law enforcement agencies -- if left to their own devices -- will destroy the effectiveness of IMSI catchers by deploying the devices too often and with too little care.

In a discussion about the NSA's use of exploits, the following observations were made.

FBI operations can be opaque because of the care they take with parallel construction; the Lavabit case was maybe an example. It could have been easy to steal the key, but then how would the intercepted content have been used in court? In practice, there are tons of convictions made on the basis of cargo manifests, travel plans, calendars and other such plaintext data about which a suitable story can be told. The FBI considers it to be good practice to just grab all traffic data and memorialise it forever.

The NSA is even more cautious than the FBI, and won’t use top exploits against clueful targets unless it really matters. Intelligence services are at least aware of the risk of losing a capability, unlike vanilla law enforcement, who once they have a tool will use it against absolutely everybody.

IMSI catchers are "top exploits." While there's plenty of information out there on its capabilities, very little of it has been confirmed by the FBI or other law enforcement agencies. What makes the "exploit" better is that almost every deployment has been successfully hidden… from everyone. Parallel construction, abuse of pen register orders, dismissal of cases -- all of it works together to keep actual usage details out of the public's hands.

Because of this, there's very little anyone can do to avoid being swept up by Stingray devices other than avoid using cell phones. Most criminal enterprises require communication and cell phones are the cheapiest, easiest way to maintain contact. While spoofers can be sussed out with tools and apps, it requires the sort of proactive effort that often isn't present -- or practical -- in many criminal ventures. Yeah, you can sweep a hotel room for bugs, but you can't stop anyone from parking nearby and hoovering up call data and communications.

If this assessment is accurate, the FBI may be applying this intense pressure simply to prevent "vanilla" law enforcement agencies from using Stingrays as often and as carelessly as possible. Every deployment increases the risk of exposure. Tying cop shops up in NDA strings keeps dissemination to a minimum and encourages at least some form of risk analysis before deployment. It's the FBI saving law enforcement agencies from themselves, and protecting itself and its tool of choice at the same time.

[Or not. The Baltimore PD deploys its Stingrays around 600 times a year, so there are exceptions to this theory… or some agencies simply just don't care whether the effectiveness of this "exploit" suffers from diminishing returns.

And definitely click through to read the entire piece by Ross Anderson. It also discusses how intelligence agencies work around crypto they can't crack -- very germane to the discussion of the FBI's current decrypt-or-else complaints.]

Filed Under: enforcement, fbi, imsi catcher, law enforcement, overuse, secrecy, stingray, transparency

DOJ Apparently Last To Know About Widespread Stingray Usage/Secrecy; Vows To Look Into It

from the 'what-is-the-deal-with-all-these-Stingrays?'-no-longer-rhetorical dept

Considering the number of documents confirming the FBI's stranglehold on Stingray device information that have been made public in recent months (including the FBI's nearly-blank 5,000-page FOIA response), this move by the DOJ is a surprising development.

The Justice Department will start revealing more about the government’s use of secret cellphone tracking devices and has launched a wide-ranging review into how law-enforcement agencies deploy the technology, according to Justice officials.

Senior officials have also decided they must be more forthcoming about how and why the devices are used—although there isn’t yet agreement within the Justice Department about how much to reveal or how quickly.

So… caveats, obviously. There's more on the way, but we don't know when we'll get it, or how much it will actually be, but at least the DOJ will finally be taking a look at a technology that's being deployed by law enforcement agencies -- often without warrants. And when they do use warrants, they're often obtained with misleading affidavits so as to comply with the non-disclosure agreements the FBI forces them to sign before deploying the devices.

This is also surprising, considering the FBI wrote itself a large enough loophole to ensure it never needed to bother with this sort of paperwork.

In recent months, the Federal Bureau of Investigation has begun getting search warrants from judges to use the devices, which hunt criminal suspects by locating their cellphones, the officials said. For years, FBI agents didn’t get warrants to use the tracking devices.

One wonders how the Wall Street Journal knows this, considering the FBI is the last agency that would publicly confirm or deny anything about its Stingray usage. Perhaps some more documents are on the way whether the FBI likes it or not…

But it appears outside scrutiny has finally forced the DOJ to confront the all-encompassing secrecy surrounding Stingrays -- something that routinely excludes defendants and judges and sometimes stretches far enough to lock out other "good guys," like prosecutors and states' attorneys.

For the first time ever, legislators are beginning to ask uncomfortable questions about the technology. While the FBI can apparently blow off a majority of the US population -- including the judicial system -- it's not going to have nearly as much luck fending off determined lawmakers. The technology it loves could become the technology it can no longer have -- or at least see it subjected it to a number of requirements that would make it much less enjoyable to deploy.

Congressional scrutiny is never comfortable. But another contributing factor is the entities directly and indirectly involved with tracking cell phones: service providers. They're unhappy and they've got a pretty good idea how often requests for data are heading their way and how specious or redundant the requests are.

Federal law-enforcement and phone-company officials also have expressed concerns that some local police authorities were abusing a legal shortcut by submitting an inordinate number of requests for cellphone information, according to people familiar with the matter.

Some of this is parallel construction. Some of this is abuse of an avenue previously used to acquire specifically-targeted information: pen register/trap and trace orders. It's already public knowledge that law enforcement agencies -- backed by the FBI's own legal rationalizations -- are using these to cover Stingray usage and/or bypass warrant requirements.

On top of this, law enforcement agencies are busy ensuring that the words "exigent circumstances" become as meaningless as "relevant" or "probable cause."

About a year ago, Baltimore police officials began deluging some phone companies with requests for customer cellphone information, claiming it couldn’t wait for a judge’s order, according to people familiar with the matter. Normally, police need a court order to get that kind of information about a phone customer. But there is an exception for emergency requests. Phone companies’ rules vary, but they generally allow emergency requests to be fulfilled in missing-persons cases or when there is a risk of death or serious injury. Typically, the phone company employee doesn’t ask questions to verify the nature of the emergency.

No doubt the Baltimore PD used the hell out of this loophole, what with its 4,300 Stingray deployments over a seven-year period.

Whether this examination by the DOJ will result in any meaningful changes is debatable. It could easily decide that everyone's following all the rules, at least as far as the FBI's interpretation of statutes governing pen register orders. That it's actually securing warrants is a positive sign, but it would be nice to see if the affidavits actually specify the devices used to perform the "search." It's one thing to gather data on phone calls. It's quite another to lock down where that phone is located by sifting through everyone's data while pretending to be a cell tower -- especially considering the devices also have the capability to intercept certain communications.

Filed Under: doj, imsi catcher, secrecy, stingray, surveillance, transparency

FBI Hands Over 5000 Pages Of Stingray Info To MuckRock, Redacts Nearly All Of It

from the [NOTHING-TO-SEE-HERE] dept

MuckRock has obtained a whole stack of Stingray-related documents from the FBI. As is to be expected, there's not much left unsaid by the agency, which is at least as protective of its own Stingray secrecy as it is with that of law enforcement agencies all over the US.

There's nearly 5,000 pages of "material" here, most of which contains only some intriguing words and phrases surrounded by page after page of redactions.

Want to know [REDACTED]'s thoughts on the possible legal implications of Triggerfish? Just close your eyes and allow your imagination to run free.

Here's a quick reference guide that allows FBI agents to quickly match up their chosen "technique" with the appropriate legal standard and process.


That's not to say there's nothing of interest left intact. A few pages explain the FBI's legal rationale for IMSI catcher deployment -- including the fact that the Patriot Act expanded the reach of pen register orders to include not just numbers dialed, but also the location of the phone itself. This allows the FBI and other law enforcement agencies to route around one of CALEA's (Communications Assistance for Law Enforcement Act) few limitations related to pen register orders: that service providers not be required to hand over subscriber location info.

In passing CALEA in 1994, Congress required providers to isolate and provide to the government certain information relating to telephone communications. At the same time that it created these obligations, it created an exception: carriers shall not provide law enforcement with "any information that may disclose the physical location of the subscriber" in response to a pen/trap order… By its very terms, this prohibition applies only to information collected by a provider and not to information collected directly by law enforcement authorities. Thus, CALEA does not bar the use of pen/trap orders to authorize the use of cell phone tracking devices used to locate targeted cell phones.

But, for the most part, it's 5000 pages of this:


And this (from a document titled "Stingray for Dummies"):


It's not a complete loss, although it's clear the documents suffer from over-redaction. The FBI clearly doesn't want to discuss methods or technical details, but nothing in the multiple FOIA exemptions deployed justifies covering up its minimization procedures or where the device sits in terms of the Fourth Amendment.

"It does not seem credible to me that they can't release more of those kinds of records," [ACLU attorney Nate] Wessler told me. "Information about ongoing investigations, highly technical details of the devices, how they're put together, those kinds of things, redact them, fair enough. Information about whether they have to get a warrant or not, how they purge or do not purge bystanders data. They're clearly talking about those things."

"There's no conceivable reason why they shouldn't tell the public what their Fourth Amendment rights are protecting when they use these," he added. "The documents are not without value, but what the FBI has released is not adequate."

If nothing else, the documents have given a small, narrow glimpse behind the FBI's veil of secrecy -- as well as some more insight into its Stingray-related legal maneuvering. The FBI has managed to turn a pen register order -- something previously used to collect dialed numbers -- into something that can be deployed to locate an individual, or at least their cellphone. Unsurprisingly, this legal theory traces back to the Patriot Act, one of the largest expansions of intelligence and law enforcement powers ever produced by the US government.

Filed Under: fbi, foia, imsi catcher, redactions, stingray

Stingray Uber Alles! St. Louis Cops Drop Case Against Robbery Suspects Rather Than Discuss Use Of IMSI Catcher

from the vigorously-enforcing-the-law-(exceptions-may-apply) dept

According to the FBI and the law enforcement agencies it slaps with restrictive non-disclosure agreements, it's better to have indicted and lost than to not have deployed the Stingray at all.

Just one day before a city police officer was to face questions about a secret device used to locate suspects in a violent robbery spree, prosecutors dropped more than a dozen charges against the three defendants.

The move this month freed the officer from having to testify about a highly controversial surveillance tool — one that is subject to a confidentiality agreement between the St. Louis police and the FBI.

The department insists the Stingray had nothing to do with the dismissal. In fact, the spokesperson doesn't mention the Stingray at all (because one simply mustn't). Instead, it claims that recently uncovered information has "diminished the prosecutive merits of the case." What an odd statement to make when one suspect has already entered a guilty plea in connection with a robbery spree that resulted in the theft of cash and cell phones from seven people in just under two hours.

One of the public defenders assigned to the case believes otherwise. A victim's cell phone was traced to a hotel room using "a proven law enforcement technique." What this "technique" involved was never specified. When asked to explain in greater detail, the St. Louis Police Department called it a day. And now it looks as though it may not even be able to hold onto its single guilty plea.

Defense lawyers scheduled a deposition April 9 to ask an intelligence officer under oath about StingRay. But the charges were dismissed April 8 against all but the female defendant. She had already admitted the crimes and agreed to testify against the others but now wants to rescind her guilty plea.

This is great news for the victims of the crime spree.

Brandon Pavelich, who was pistol-whipped in one of the robberies and required 18 stitches, said he was “shocked” when prosecutors told him the charges were dropped and explained only that “legal issues” had developed.

Sorry 'bout all the stitches, says the FBI. These things will happen, unfortunately, because getting pistol-whipped and relieved of your belongings are integral to protecting this nation against terrorists.

The bureau supplied an April 2014 affidavit from Supervisory Special Agent Bradley Morrison, chief of the Tracking Technology Unit. He wrote that “cell site simulators are exempt from (court) discovery pursuant to the ‘law enforcement sensitive’ qualified evidentiary privilege” and also not subject to freedom of information laws.

Any FBI information shared with local authorities “is considered homeland security information,” he wrote. He warned that targets of investigation could benefit from piecing together minor details, “much like a jigsaw puzzle.”

It's not much of a consolation prize for the victims. In fact, it probably makes things a bit easier for criminals. The "jigsaw puzzle" piece handed over to criminals by this refusal to discuss "techniques" is that cell phone theft has a much better chance of going unprosecuted than criminal activities not involving cell phones. Cell phones are a potential "Get Out of Jail Free" card. Sure, they're also handy tracking devices -- the Narc That Fits in Your Pocket™ -- but if vague but "proven" law enforcement "techniques" are used to obtain warrants or effect arrests, evidentiary challenges and discovery requests have a small chance of resulting in a "screw it" from law enforcement agencies. That's better odds than were in play prior to the widespread use of IMSI catchers.

Certainly the victims of criminal activity are righteous in their anger. But where are the courts? They should be incensed that law enforcement feels it can withhold information from judges and defense attorneys simply because the FBI says so. The FBI doesn't have jurisdiction over courts or law enforcement agencies. The only power it does have is to do what it can to block local law enforcement from obtaining or deploying IMSI catchers if they won't play by its rules.

And where's the DOJ in all of this? It stands to reason the FBI is more concerned with prosecutions than justice, but this is a department wholly dedicated to the premise -- even if its actions often run counter to the "justice" ideal. It sits idly by while its subordinate agency tells law enforcement agencies to conceal Stingray usage and to drop cases rather than risk any national insecurity or additional criminal evasiveness.

This has gone past the point of outrage into the realm of the absurd. Dangerous criminals are being cut loose because certain techniques can't be confirmed or denied -- free to roam the streets like anthropomorphized Glomar responses, only with the potential to cause actual harm, rather than simply acting as existential threats to law enforcement techniques or the nation's well-being.

Filed Under: law enforcement, stingray, surveillance

Baltimore Cops Asked Creators Of 'The Wire' To Keep Cellphone Surveillance Vulnerabilities A Secret

from the works-of-fiction-with-too-much-truth? dept

Over the past decade, criminals have apparently gained an insurmountable technology lead over law enforcement. I'm not sure how this is possible, especially considering many criminals don't have access to the same technology cops do, much less access to generous DHS funding, and yet, here we are witnessing police officers (following orders from the FBI) tossing cases and lying to judges in order to "protect" secret tools that aren't all that much of a secret.

We recently covered a Baltimore detective's courtroom admission that a) the Baltimore PD had deployed its Stingray equipment 4,300 times over the past seven years and b) that it had hidden this information from courts and defendants. The argument for this secrecy was that doing otherwise allows criminals to devise ways to beat the system.

No one's looking to expose ongoing investigations, but as far as some law enforcement agencies are concerned, everyone is under continuous investigation by default. And since that's the case, anything that might be construed as giving criminals a head start is subject to a thoroughly ridiculous code of silence that excludes the majority of the justice system.

This cop-specific technopanic is so all-encompassing that it has bled over into the unreality of creative efforts -- like TV shows. (via The Verge)

David Simon, creator of "The Wire" and a former Baltimore Sun reporter, said in an email that "the transition from landlines to cellular technology left police investigations vulnerable well over a decade ago."

He noted that there was new technology at the time — such as Nextel phones that mimicked walkie-talkies — that "was actually impervious to any interception by law enforcement during a critical window of time."

"At points, we were asked by law enforcement not to reveal certain vulnerabilities in our plotlines," Simon said. That included communications using Nextel devices.

The Wire also featured detectives using a cell signal-capturing device called a "Triggerfish." Any relation to today's Stingrays is likely not coincidental, no matter what the post-credits disclaimer might have stated. The Stingray isn't a secret, but it has been awarded an unprecedented amount of secrecy. Cops lie to judges, defendants and even prosecutors to keep the Stingray out of the public eye. And yet, it seems clear that The Wire's creators knew something about the technology over a decade ago.

But the inherent ridiculousness of asking a fictional television show to withhold dramatic elements just because they may have hewed too closely to reality can't be ignored. Criminals will find vulnerabilities in the system and law enforcement will work hard to close these gaps. But criminals aren't so far ahead as to be unstoppable.

This attempt to censor The Wire isn't much different than the law enforcement secrecy efforts we see being deployed in courts. The motivation behind these efforts is highly suspect. It doesn't seem so much to be aimed at preventing criminals from exploiting vulnerabilities as it is at keeping law enforcement officers from working any harder than they feel they should have to. It's not about keeping bad guys from outmaneuvering cops. It has more to do with preventing public disclosure from resulting in unwanted changes -- like additional scrutiny from magistrate judges or the challenging of submitted evidence. It's about preserving the most efficient law enforcement methods -- generally anything that doesn't require permission from an outside entity or generate a paper trail.

Filed Under: baltimore, baltimore police, fbi, imsi catcher, secrecy, stingray, the wire, vulernabilities

Baltimore PD Has Deployed Stingray Devices Over 4,300 Times, Instructed By FBI To Withhold Info From Courts

from the 'to-sever-and-deflect' dept

Say what you will about the Baltimore PD and its cell tower spoofers (like... "It would rather let accused criminals go than violate its [bogus] non-disclosure agreement with the FBI…" or "It hides usage of these devices behind pen register/trap and trace warrants and then argues the two collection methods are really the same thing…"), but at least it's making sure the hundreds of thousands of dollars it's spent on the technology isn't going to waste.

On Wednesday, Baltimore police Det. Emmanuel Cabreja said the department has deployed the device, called Hailstorm, and similar technology about 4,300 times since 2007.

As the AP notes, the number of deployments admitted to here is the largest ever made public. This doesn't necessarily mean the rate of usage (more than once a day, on average) is out of the ordinary, however. Thanks to the very restrictive non-disclosure agreement the FBI forces law enforcement agencies to sign (while falsely claiming "the FCC made us do it!"), information on cell tower spoofers has very rarely been disclosed.

Det. Cabreja confirmed the ultra-restrictive terms of the FBI's NDA, which forbids law enforcement agencies from producing any information on Stingray devices, no matter who's asking for it.

Cabreja said under questioning from defense attorneys that he did not comply with a subpoena to bring the device to court because of a nondisclosure agreement between the Baltimore police and the Federal Bureau of Investigation.

“Does it instruct you to withhold evidence from the state’s attorney and the circuit court of Baltimore city, even if upon order to produce?” asked defense attorney Joshua Insley.

“Yes,” Cabreja replied, saying he spoke with the FBI last week about the case.

There's nothing quite like hearing confirmation that two law enforcement agencies worked together to withhold information from a party being prosecuted by directly violating a court order. But it gets even better. The Baltimore PD's NDA was made public, and it shows the State's Attorney's office signing off on withholding Stingray information from judges and defendants, as well as agreeing to toss cases if exposure seems unavoidable. In contrast, the Erie County Sheriff's Department's agreement obtained by the NYCLU only contained signatures from law enforcement officials.


The courts -- at least in Baltimore -- seem to be tiring of this secrecy. Baltimore judge Barry Williams has previously questioned the Baltimore PD's citation of its non-disclosure agreement with the FBI, with one memorably pointing out that the PD "doesn't have a non-disclosure agreement with this court." Unfortunately, if the Baltimore PD prioritizes its NDA over its obligation to obey court orders and turn over requested evidence, then it does actually have an NDA "with the court," albeit one the court never agreed to. If the FBI says Stingray info isn't going to be turned over -- no matter who's asking for it -- that information will remain hidden, even if it means tossing criminal cases.

Filed Under: baltimore, baltimore police, doj, fbi, imsi catcher, nda, secrecy, stingray, surveillance, transparency
Companies: harris corp.

New Documents Show FBI Instructing Law Enforcement To Throw Out Cases Rather Than Give Up Info On Stingray Use

from the in-order-to-ensure-the-public's-safety,-we-must-compromise-the-public's dept

Documents obtained by the New York ACLU (via a lawsuit, naturally) provide more details on the FBI's efforts to cover up usage of Stingray devices. Back in February, an FBI memo obtained by the Minnesota Star Tribune stated clearly that the agency required all public records requests for Stingray documents be routed through it.

This agreement between the FBI and the Erie County (NY) Sheriff's Department is even more restrictive. It opens up with the FBI repeating one of its lies in hopes of making the highly-restrictive agreement following it seem less like federal bullying and more like just one of those unfortunate byproducts of pesky regulation.

Consistent with the conditions on the equipment authorization granted to Harris Corporation by the Federal Communications Commission (FCC), state and local law enforcement agencies must coordinate with the FBI to complete this non-disclosure agreement prior to the acquisition and use of the equipment/technology authorized by the FCC authorization.

This paragraph is apparently included in every FBI/Stingray agreement and, according to the FCC, it's all a bunch of BS. The FCC may require coordination with the FBI prior to the purchase of Stingray equipment, but it does NOT require the signing of a non-disclosure agreement. Here's its reply to an FOIA requester seeking the text of this supposed FCC requirement.

We do not require that state and local law enforcement agencies have to complete one or more non-disclosure agreements with the Federal Bureau of Investigation prior to acquisition and/or use of the authorized equipment. We have no documents responsive to your request.

So, the FBI opens with a lie, and then moves on to instructing law enforcement agencies to lie about their Stingray usage... to damn near everybody.

In order to ensure that such collection equipment/technology continues to be available for use by the law enforcement community, the equipment/technology and any information related to its functions, operation, and use shall be protected from potential compromise by precluding disclosure of this information to the public in any manner including but not limited to: in press releases, in court, during judicial hearings, or during other public forums or proceedings.

The government wants law enforcement agencies to lie to the courts -- which includes lying to judges, prosecutors and defendants. Everyone is included. This is made even more explicit a few paragraphs later.

The Erie County Sheriff's Office shall not, in any civil or criminal proceeding, use or provide any information concerning the Harris Corporation wireless collection equipment/technology… beyond the evidentiary results obtained through the use of the equipment/technology including, but not limited to, during pre-trial matters, in search warrants and related affidavits, in discovery, in response to court ordered disclosure, in other affidavits, in grand jury hearings, in the State's case-in-chief, rebuttal, or on appeal, or in testimony in any phase of civil or criminal trial, without the prior written approval of the FBI.

In short: parallel construction. The Sheriff's Office can hand over the results of Stingray collections, but not divulge how it arrived at these results. If it's going to deploy a Stingray, it either needs to do it without a warrant, or mislead the judge on its search techniques when applying for one.

When not lying to judges, the Sheriff's Office will need to lie to defendants and their counsel. Most incredibly, the FBI instructs the law enforcement agency to directly disobey court orders, if it would mean turning over Stingray information.

If any of this seems unavoidable, our nation's top law enforcement agency encourages its colleagues to toss out criminal prosecutions rather than risk exposing Harris Technology's equipment.

In addition, the Erie County Sheriff's Office will, at the request of the FBI, seek dismissal of the case in lieu of using, or providing, or allowing others to use or provide, any information concerning the Harris Corporation wireless collection equipment/technology [...] if using or providing such information would potentially or actually compromise the equipment/technology.

With one caveat…

This point supposes that the agency has some control or influence over the prosecutorial process.

But what a caveat. This is the FBI stating that it assumes any law enforcement agency it enters into this agreement with can easily push prosecutors to drop cases. It naturally follows that this sort of influence would also allow law enforcement agencies to push questionable prosecutions forward, if so inclined.

If the law enforcement agency doesn't have that kind of pull, the FBI suggests they make rogue prosecutors sign on the dotted line as well.

Where such is not the case, or is limited so as to be inconsequential, it is the FBI's expectation that the law enforcement agency identify the applicable prosecuting agency, or agencies, for inclusion in this agreement.

And the lies being told by the Erie County Sheriff's Department have already been numerous. As the NYCLU points out, a court order for the deployment of the devices was obtained only once in the 47 incident reports returned as responsive documents -- which isn't what Sheriff Howard said when (mostly not) answering questions about his office's Stingray use last May:

Howard said the machines are used under "judicial review" in all criminal matters.

Well, obviously not. And for that matter, the Sheriff's Office isn't performing much oversight on its own. The NYCLU requested several more Stingray-related documents, including department policies, warrant applications, agreements with communications providers and records concerning the technology's use in investigations. None of these requested documents were withheld. They simply did not exist. The NYCLU sees this as extremely odd:

This leaves us puzzled. Either the $200,000 device is just sitting around somewhere without being used or the agency is using the device without creating and maintaining records.

The latter is more probable, especially in light of the FBI's restrictive non-disclosure agreement. There's no better way to avoid violating that agreement than simply not creating any records that might somehow find their way to the many venues the FBI has listed as off-limits.

What it all boils down to is this: the FBI believes it is more important to protect law enforcement technology than protect the public. It says toss out prosecutions if it might compromise Stingray specifics and actively withhold information from every other participant in the justice system -- from defendants seeking information in discovery all the way up to every judge, at every level, presiding over these cases. The first potentially puts dangerous criminals right back out on the street. The latter guts the protections built into the system. Neither of these are done in the public's interest, and as far as these documents go, the public is way, way down on the FBI's list of priorities. The same goes for law enforcement agencies that willingly sign these agreements.

Filed Under: doj, erie county, erie county sheriff's department, fbi, secrecy, stingray
Companies: aclu

US Marshals Service Withholds Publicly-Available Data From Its Stingray Device FOIA Response

from the open-[secrets] dept

Overclassification and abuse of FOIA exemptions is a given with most of our nation's security/law enforcement agencies. Two agencies -- the DHS and the FBI -- both redacted publicly-available information on drone possession and usage. Why? Because no one will stop them. Public accountability isn't something these agencies embrace. Their real love is secrecy, obfuscation and an allegiance to the eternal protection of "techniques and procedures," even when the information has already been disseminated elsewhere.

MuckRock's Phil Mocek recently received responsive documents from the US Marshals Service on its Stingray usage. The Marshals Service is notoriously secretive about the Stingrays in its law enforcement stable and is equally infamous for the thug-like tactics it has deployed to hide documents from public records requests.

So protective is it of this information that its response to Mocek jumped the secrecy shark. Hidden behind the numerous black redaction bars is information freely available on an official government website.

While it appears the USMS is not under any nondisclosure agreement with the device manufacturer, the agency has withheld a wide range of basic information under an exemption meant to protect law enforcement techniques. However, much of the redacted data is already available online via a federal accounting website…

Particular item names and descriptions are universally redacted throughout the documents. But released invoices and purchase orders indicate that USMS spending on cell site simulators and related services totaled nearly $10 million between September 2009 and April 2014.

As MuckRock's Shawn Musgrave points out, this information deemed too sensitive to be released to a FOIA requester can be found at the General Services Administration's website. The GSA handles a majority of government contracts and, as a government entity, is only allowed to display information deemed suitable for public consumption. The same information withheld by the US Marshals Service has been previously cleared for release on the GSA's site.

An overabundance of caution by the US Marshals Service? Maybe. Or maybe it's just accustomed to throwing plenty of black ink around when fielding FOIA requests. Either way, this withholding of publicly-available data suggests one thing: the USMS's justification for blotting out this info doesn't mean shit.

Extensive redactions throughout the document cache are made under a provision in the federal Freedom of Information Act — exemption (b)(7)(E), for the FOIA nerds — meant to protect law enforcement information.

Specifically, per the Justice Department’s own guidelines, this exemption covers information that "would disclose techniques and procedures for law enforcement investigations or prosecutions”, or that “would disclose guidelines for law enforcement investigations or prosecutions if such disclosure could reasonably be expected to risk circumvention of the law."

The trouble is, much of the information blacked out by USMS FOIA officers is already available online to the general public, and hardly qualifies as law enforcement information as defined in this provision.

It's not that the US Marshals Service doesn't understand the correct deployment of FOIA exemptions. It just doesn't care. How a dollar amount can be both publicly-available through the GSA and a too-sensitive-for-the-public "technique or procedure" will never be explained by the wilfully opaque law enforcement agency. At best, it will suggest the redaction was an error. But more likely, it will be happy to stay quiet on the issue and allow the BS exemptions to speak for themselves.

Filed Under: foia, imsi catcher, stingray, us marshals

NY Court Orders Sheriff To Reveal Details On Stingray Mobile Phone Surveillance

from the finally,-a-victory dept

For quite some time now, we've been covering how various law enforcement agencies have been using "Stingray" (or similar) cell tower spoofing devices to track the public. Beyond the questionable Constitutionality of such mass surveillance techniques, what's been really quite incredible is the level of secrecy surrounding such devices. We've written about how the US Marshals have "intervened" in various court cases to hide info about the use of Stingrays -- and even telling local law enforcement to lie about their use of the devices. We've written about law enforcement officials claiming "terrorism" as the reason for needing Stingrays, but then using them for everyday law enforcement. We've written about the company that makes Stingrays, Harris Corp., forcing police to sign non-disclosure agreements barring them from revealing any info about their use. It also appears that Harris Corp. misled the FCC to receive approval for its mobile tower spoofing capabilities. Some police departments have even withdrawn evidence rather than talk about their use of Stingrays.

Thankfully, there's been growing concern about these devices. Congress has been investigating and now it appears at least some courts are getting skeptical about the use of Stingrays. The New York Civil Liberties Union (NYCLU) has highlighted that a judge in one of its cases has ordered the Erie County Sheriff's Office to reveal information to the public about its Stingray operations. The full ruling [pdf] is worth reading. While denying the NYCLU's claim that the Sheriff's Office didn't conduct a thorough search as required, the judge is not at all impressed by the redactions in the documents that were released:

The purchase orders should have been disclosed in their entirety, without redaction of the various words, phrases, and figures thus far withheld. The purchase orders (and more particularly the redacted words, phrases, and prices), were not "compiled for law enforcement purposes" in the sense meant by the statute but, even if they were, their disclosure would not: "interfere with law enforcement investigations or judicial proceedings"; "identify a confidential source or disclose confidential information relating to a criminal investigation," meaning a particular ongoing one; or "reveal [non-'routine'] criminal investigative techniques or procedures, meaning techniques a knowledge of which would permit a miscreant to evade detection, frustrate a pending or threatened investigation, or construct a defense to impede a prosecution.... Further, the purchase orders (or, more precisely, the information redacted therefrom), although clearly constituting inter-agency materials" (the other agency involved was Erie County and its Office of the Comptroller), amount entirely to "instructions to staff that affect the public".... Indeed, the instructions set forth in the purchase orders—'in essence, "Pay this bill of this vendor for this item purchased by the Sheriff's Office at this price"—was and is of quintessentially compelling interest to and of undeniable impact upon the taxpaying public.

Finally, the Court finds that the purchase orders, and particularly the matters redacted therefrom, are not "specifically exempted from disclosure by state or federal statute" .... The Court rejects respondent's arguments that the disclosure sought here would, if made, violate a particular federal statute, regulatory scheme, and executive order forbidding (and indeed criminalizing) the export of certain sensitive technology without government license or the illicit revelation of sensitive information about such sensitive technology to foreign nationals. The Court instead is convinced by petitioner's argument that the disclosure of public records pursuant to New York's Freedom of Information Law and the within judicial directive -- even records concerning respondent's ownership and use of a cell site simulator device -- does not amount to the actual export of such arms, munitions, or defense technology. Further, the Court is satisfied by showing on this record that petitioner, a New York not-for-profit corporation, is not a "foreign person," meaning that the disclosures sought by it pursuant to FOIL would not in fact run afoul of related federal legal restrictions on the revelation of sensitive technical data about export-restricted arms or technology.

Got that? Basically the court rejects the Sheriff's Office's contention that disclosing this information was somehow "exporting munitions" to "foreign persons."

Oh, as for the non-disclosure agreement with Harris Corp.? The judge notes that a non-disclosure agreement is not a federal regulation:

At the outset, the Court notes its agreement with petitioner's observation that the FBI-drafted non-disclosure agreement is not itself a federal statute specifically exempting anything from disclosure....

In fact, later in the order, the court says that the non-disclosure agreement itself should be disclosed:

Likewise, the Court concludes that this public record ought to have been disclosed in its entirety. As indicated, the agreement was entered into between the FBI and respondent as an apparent pre-condition of respondent's being allowed to acquire and use the cell site simulator. The gist of the letter is not a recitation of the technological capabilities of the device or even the "hows" and "whens" or the advantages of its use for law enforcement purposes, but rather simply the need for the Sheriff's Office to avoid disclosing the existence, the technological capabilities, or any use of the device to anyone, lest "individuals who are the subject of investigation ... employ countermeasures to avoid detection," thereby endangering the lives and safety of law enforcement officers and others and compromising criminal law enforcement efforts as well as national security. The Court has no difficulty in concluding that the agreement (or, more precisely, each redacted-at-length passage of it) was not "compiled for law enforcement purposes" in the sense meant by the statute.... Again, even if it was, the Court would conclude that the disclosure of the non-disclosure agreement would not thwart or prejudice any particular ongoing law enforcement investigation or pending prosecution.... Nor, the Court concludes, would the disclosure of the non-disclosure agreement "identify a confidential source or disclose confidential information relating to a criminal investigation," again meaning a specific ongoing one, or "reveal" other than "routine" "criminal investigative techniques or procedures"....

There's a lot more, including other documents, and all of that leads the judge to also grant attorney's fees to the NYCLU. It will be interesting to see if the Sherriff's Office challenges this, but it's a pretty complete win for transparency in an area that law enforcement has been trying to keep totally secret for quite some time now.

Filed Under: erie county sherriff's office, foia, foil, imsi catcher, new york, stingray, surveillance
Companies: aclu, nyclu