CIA Worked With DOJ To Re-Purpose Foreign Surveillance Airborne Cell Tower Spoofers For Domestic Use

from the I-got-a-name-and-I-got-a-number-I-got-a-line-on-you dept

The CIA's recent rebranding as Valhalla for US cyberwarriors notwithstanding, the agency's general focus has been intelligence gathering on foreign governments, corporations and people. That it has often mistaken "torturing people into saying whatever they can to make it stop" for "intelligence gathering" isn't necessarily germane to the following discussion, but it's worth noting that the CIA is almost single-handedly responsible for destroying the term "extraordinary rendition" -- a formerly innocuous (and complimentary) term previously used to highlight something like, say, Johnny Cash's amazing cover of Soundgarden's' "Rusty Cage." (That Cash's two best covers are "Hurt" and "Rusty Cage" is not germane to the discussion of CIA torture programs, but what a coincidence!)

But the emphasis here is foreign. Which is why the following news makes so little sense.

The Central Intelligence Agency played a crucial role in helping the Justice Department develop technology that scans data from thousands of U.S. cellphones at a time, part of a secret high-tech alliance between the spy agency and domestic law enforcement, according to people familiar with the work.

The CIA and the U.S. Marshals Service, an agency of the Justice Department, developed technology to locate specific cellphones in the U.S. through an airborne device that mimics a cellphone tower, these people said.

"These people" are likely keeping both eyes on their backs at this point, considering this revelation sheds more light on two things both agencies would like to keep in permanent darkness: the CIA's involvement in domestic surveillance and the US Marshals' airborne "dirtboxes," which are hoovering up tons of phone call info using high-flying IMSI catchers.

The planes fly from five US cities and cover "most of the US population," according to the Wall Street Journal and its unnamed sources. The technology appears to have debuted overseas under the CIA's auspices. Nothing about that fact is surprising or, indeed, of major concern in terms of US civil liberties (although likely not welcome news for any foreign citizens in the CIA's coverage area). What is more surprising -- or rather, disappointing -- is that the DOJ saw the foreign surveillance tech deployed by the CIA and said, "We could really use this here. In the US. On our fellow Americans."

Not only that, but if the CIA is involved in any significant way, there are some legal issues that need to be discussed.

The CIA has a long-standing prohibition that bars it from conducting most types of domestic operations, and officials at both the CIA and the Justice Department said they didn’t violate those rules.

Phew. [Wipes brow.] Oh. Wait. The DOJ utilizing CIA dirtboxes to surveill US citizens probably breaks some rules. (The courts will probably have to sort this out -- and, unfortunately, there's a chance they'll find otherwise.) But that's not what the DOJ is saying. It's saying that the CIA doesn't violate the "don't conduct [most types] of domestic surveillance" rules. Which is probably true. It just hands of the tools of totalitarianism to the DOJ and the domestic side of the equation takes over. It's wrong because it subverts the roles of both agencies but it's technically right because the DOJ's agencies do the actual surveillance -- not the CIA. That's how that works. Technically legal. But wrong in just about every other way.

It isn't as though the DOJ just stopped by to ask about the CIA's flying machines. It had a very active role in the creation of the domestic Mile High Spy Club.

For years, the U.S. Marshals’ Technical Operations Group worked with the CIA’s Office of Technical Collection to develop the technology. In the early days it was the CIA that provided the most resources, said the people familiar with the matter.

For now, it's the unnamed "people" vs. the public front-mouths for various incestuously intertwined intelligence/law enforcement agencies. Last last year, the DOJ was asked to explain its flying cell tower spoofers, but the best defense it offered was, "Hey, at least it's not the Section 215 program," along with a half-assed Glomar ("neither confirm nor deny") that admitted more than it withheld.

The CIA is likewise mostly silent on the matter, offering up only the weak defense that the CIA has given other stuff to domestic agencies and that's all been perfectly legal. Likewise the DOJ… again with its "We're not the NSA" assertions meant to make it look like Captain Fourth Amendment by comparison:

A Justice Department spokesman said Marshals Service techniques are “carried out consistent with federal law, and are subject to court approval.” The agency doesn’t conduct “domestic surveillance, intelligence gathering, or any type of bulk data collection,” the spokesman said, adding that it doesn’t gather any intelligence on behalf of U.S. spy agencies.

But it's not just metadata or call records. The CIA-built, DOJ-deployed devices also listen in.

In 2005, the CIA gave the Marshals Service technology to conduct “silent stimulation” of those types of cellphones, both for identifying them and, with a court order, intercepting the communications, these people said.

So, according to the DOJ, it doesn't participate in bulk data collection. But an untargeted device that flies overhead and forces all phones in range to submit to its advances isn't anything but a bulk data collection. Sure, there may be an eventual target, but until that target is acquired, everything else gets swept up into the DOJ's flying coffers. Even with "catch-and-release" -- the least intrusive form of cell tower spoofing -- innocent Americans are still at the mercy of the government as spoofers gather communications, cut off data usage and force all phones to the least technologically-advanced connection possible.

The DOJ's excuses are horrible, especially in light of the surveillance tool's origins. If the Wall Street Journal's sources are correct, the DOJ re-deployment of foreign intelligence gathering tech makes it the Victor Kiam of domestic spookery: "We liked it so much, we used it on our own people!"

Filed Under: cia, doj, domestic surveillance, fbi, imsi catchers, spoofing, stingray

In Unsealed Document, FBI Admits Stingray Devices Will Disrupt Phone Service

from the making-Stingray-omelets-required-breaking-a-few-communications dept

A small crack in the FBI's Stingray secrecy has appeared. A 2012 pen register application obtained by the ACLU was previously sealed, but a motion to dismiss the evidence obtained by the device forced it out into the open. Kim Zetter at Wired notes that the application contains a rare admission that Stingray use disrupts cellphone service.

[I]n the newly uncovered document (.pdf)—a warrant application requesting approval to use a stingray—FBI Special Agent Michael A. Scimeca disclosed the disruptive capability to a judge.

“Because of the way, the Mobile Equipment sometimes operates,” Scimeca wrote in his application, “its use has the potential to intermittently disrupt cellular service to a small fraction of Sprint’s wireless customers within its immediate vicinity. Any potential service disruption will be brief and minimized by reasonably limiting the scope and duration of the use of the Mobile Equipment.”

Notably, the application (and the magistrate's approval) do not refer to the device by any of the common names (Stingray, IMSI catcher, cell tower spoofer, etc.), but rather as "mobile pen register/trap and trace equipment." While it does admit the device will "mimic Sprint's cell towers," it downplays the potential impact of the device's use.

The fact that Stingray devices disrupt cell service isn't new, but an on-the-record admission by law enforcement is. The warrant application claims that numbers unrelated to the ones being sought will be "released" to other cell towers. The unanswered question is how long it takes before this release occurs.

“As each phone tries to connect, [the stingray] will say, ‘I’m really busy right now so go use a different tower. So rather than catching the phone, it will release it,” says Chris Soghoian, chief technologist for the ACLU. “The moment it tries to connect, [the stingray] can reject every single phone” that is not the target phone.

But the stingray may or may not release phones immediately, Soghoian notes, and during this period disruption can occur.

The problem with the so-called "release" is related to the amount of disruption that occurs when the device is used. Advances in cell technology have surpassed the ability of Stingray devices to capture calling info and location data. Upgrades are available and law enforcement agencies are scrambling to get their cell tower spoofers up-to-date, but the general process still involves "dumbing down" everyone's connection to the least secure and most easily-intercepted connection: 2G.

In order for the kind of stingray used by law enforcement to work, it exploits a vulnerability in the 2G protocol. Phones using 2G don’t authenticate cell towers, which means that a rogue tower can pass itself off as a legitimate cell tower. But because 3G and 4G networks have fixed this vulnerability, the stingray will jam these networks to force nearby phones to downgrade to the vulnerable 2G network to communicate.

If a device is in operation nearby, all calls that can't find a better connection will be routed to the cell tower spoofer. This means calls won't be connected, texts won't be sent/received and internet service will be knocked offline. While Stingrays are supposed to allow 911 calls to pass through without interruption, these are far from the only type of "emergency" communications. If the device is deployed for any considerable length of time, citizens completely unrelated to the criminal activity being investigated may find themselves unable to communicate.

And while the targeted number apparently belonged to Sprint, the warrant application notes that all service providers in the area will be asked to turn over a large amount of subscriber information.

[D]irecting AT&T, T-Mobile U.S.A., Inc., Verizon Wireless, Metro PCS, Sprint-Nextel and any and all other providers of electronic communication service (hereinafter the "Service Providers") to furnish expeditiously real-time location information concerning the Target Facility (including all cell site location information but not including GPS, E-911, or other precise location information) and, not later than five business days after receipt of a request from the Federal Bureau of Investigation, all information about subscriber identity, including the name, address, local and long distance telephone connection records, length of service (including start date) and types of service utilized, telephone or instrument number or other subscriber number or identity, and means and source of payment for such service (including any credit card or bank account number), for all subscribers to all telephone numbers, published and nonpublished, derived from the pen register and trap and trace device during the 60-day period in which the court order is in effect…

This request seems to run contrary to what's asserted earlier in the warrant application, in reference to the Stingray device itself.

In order to achieve the investigative objective (i.e., determining the general location of the Target Facility) in a manner that is the least intrusive, data incidentally acquired from phones other than the Target Facility shall not be recorded and/or retained beyond its use to identify or locate the Target Facility.

It appears there is a "catch-and-release" policy when it comes to Stingray devices, but the FBI's data request to every cell phone service provider in the area contains no such assurances about minimization. Additionally, the request for data on "all subscribers to all telephone numbers" covers a 60-day period, while the use of the tower spoofer is limited to two weeks.

So, not only did the FBI potentially disrupt cell service while searching for the robbery suspects, it also collected a massive amount of data on every subscriber whose phone happened to connect with its fake tower. It's not really "catch-and-release" if additional call/location data on unrelated subscribers is obtained from from other providers. This broad request was granted without question or additional stipulations by the magistrate judge -- the only limitation applied (in a handwritten addition, no less) being that the FBI would not be able to use the device "in any private place or when they have reason to believe the Target Facility is in a private place." (This falls in line with the FBI's "warrant requirement," which is written in a way that ensures the FBI will never have to seek a warrant for Stingray use.)

The FBI, along with other law enforcement agencies, has refused to answer questions about the disruptive side effects of Stingray device usage. With the unsealing of this document, their silence no longer matters. These agencies are well aware of these devices' capabilities -- something they're clearly not comfortable discussing. The excuses deployed routinely involve "law enforcement means and methods" and claims about "compromising current and future investigations," but with more heat being applied by the nation's legislators, this code of silence may finally be broken. The use of these devices -- despite being fully aware that critical communications may be at least temporarily prevented -- sends a continual implicit message to the public: your safety and well-being is subject to law enforcement's needs and wants.

Filed Under: fbi, phone service, stingray

Senator Asks FCC To Explain Its Involvement In The Proliferation Of Stingray Devices

from the let-the-finger-pointing-begin! dept

Despite the feds' best efforts to keep IMSI catchers (Stingray devices, colloquially and almost certainly to the dismay of manufacturer Harris Corporation, as they head to becoming the kleenex of surveillance tech) a secret, there's still enough information leaking out around the edges of the FBI's non-disclosure agreements to provoke public discussion.

The discussion appears to have reached the top of the food chain. Sen. Bill Nelson -- following the lead of Senators Leahy and Grassley -- has sent a letter to FCC chairman Tom Wheeler asking the following:

[image credit: Julian Sanchez]

Dear Chairman Wheeler:

On Feb. 23, The Washington Post published a front-page article “Secrecy around Police Surveillance Equipment Proves a Case’s Undoing.” That article indicated that the Tallahassee Police Department and other law enforcement agencies around the country have been using a device called the StingRay to collect cell phone call information.

That article and previous others concerning the device reveal the StingRay was certified for use by the Federal Communications Commission (FCC), contingent upon the conditions that StingRay’s manufacturer sell these devices solely to federal, state, and local public safety and law enforcement; and that state and local law enforcement agencies must coordinate in advance with the Federal Bureau of Investigation (FBI) before acquiring or using this equipment. According to the article, these devices now have been purchased by 48 law enforcement agencies in 20 states and the District of Columbia and used in hundreds of cases.

Yep, the devices are pretty much everywhere and no one wants to talk about them. When the US Marshals Service isn't stepping in to physically remove Stingray-related documents, local law enforcement agencies are disguising their use of these devices behind vague warrants and subpoenas.

What Sen. Nelson wants to know is what the FCC knows about Stingrays.

What information the FCC may have had about the rationale behind the restrictions placed on the certification of the StingRay, and whether similar restrictions have been put in place for other devices;

Whether the FCC inquired about what oversight may be in place to make sure that use of the devices complied with the manufacturer’s representations to the FCC at the time of certification; and

A status report on the activities of the “task force” you previously formed to look at questions surrounding the use of the StingRay and similar devices.

What we DO know so far about the interplay of Harris, the FBI and the FCC is that the first two parties have been less than forthright with the third. Harris managed to push its devices past the FCC by implying they would only be used in emergencies -- even though it was already clear at the point it made that statement that law enforcement agencies were frequently deploying them in non-emergency situations.

The FBI has performed its own obfuscation, implying in a letter to law enforcement agencies that the FCC required the signing off a non-disclosure agreement with the FBI. The FCC has since denied this, and obtained documents indicate it's the FBI that wants to control the flow of information regarding Stingrays, not the other way around.

I imagine the FCC would be compliant with this request, considering its past relationship with the FBI and Harris. But it can expect to run into significant resistance from the DOJ, which still believes that the long-exposed technology should still be afforded NSA-level secrecy -- especially when answers to Sen. Nelson's questions will likely expose its less-than-honest dealings with the FCC.

Sen. Nelson deserves some extra praise for being willing to put himself in an awkward situation. As the ACLU's Chris Soghoian notes, the senator has picked a very public fight with his second biggest campaign contributor.


Somebody needs to provide some answers and, while it's really the FBI that should be talking at this point, the FCC's take on this -- and its dealings with the FBI -- should be enlightening. The FBI's insistence on secrecy is not only screwing defendants during the discovery process, but it's also harming local law enforcement itself, which has shown an alarming willingness to drop cases/charges rather than reveal the use of Stingray devices.

Filed Under: bill nelson, doj, fbi, fcc, imsi catcher, imsi catchers, stingray, us marshals
Companies: harris corp.

Baltimore PD Hides Its Stingray Usage Under A Pen Register Order; Argues There's Really No Difference Between The Two

from the yeah-but-no-not-even-close dept

Another case involving Stingray devices has made its way into the federal court system, prompting the ACLU to join the battle on behalf of the defendant. A murder-for-hire sting conducted by the Baltimore police and the FBI involved the use of a Stingray device, but the paperwork used to justify the deployment says nothing about an IMSI catcher. The order obtained by the Baltimore PD is for a pen register/trap and trace device. [pdf link]

Uncharacteristically, the Baltimore PD disclosed its use of a Stingray device to locate a suspect's phone during court proceedings. Even more uncharacteristically, the government is fighting to keep the evidence from being suppressed, rather than opting to protect its means and methods at the expense of collected evidence.

How the evidence was obtained matters, even though the government's lawyers are arguing that it doesn't.

The government said the court order obtained by authorities, called a pen register, covers the technology because it refers to cellular tracking device and GPS location information.

But the ACLU argues that the state's statute for such pen register orders "makes no provision for, or even mention of, a 'cellular tracking device' " and is commonly understood to only include the "trapping" of call log information.

"In addition, there is absolutely no indication in the application or the order that the authorization will subject potentially unlimited numbers of innocent third parties to dragnet surveillance, none of whom will ever receive notice that their phones were tracked and that the search will intrude into constitutionally protected spaces," the ACLU wrote.

The government argues that no Fourth Amendment violations occurred, even if the court order said nothing about the device used to locate the phone. It asserts that everything was legit, and even if it wasn't, it was an honest mistake and it would have just found the suspect and his phone sooner or later -- perhaps even by using the method it actually requested. [pdf link]

[T]he Government argues that the search was not in violation of the Fourth Amendment for three reasons: (1) the search was authorized by the February 5, 2014, Order (the “Order”), which was a valid warrant; (2) even if the warrant was deficient, law enforcement acted in good faith reliance on it; and (3) even without a warrant, the evidence obtained would not be subject to exclusion because the inevitable discovery doctrine applies.

Wrong, wrong and wrong, according to the defendant's (Robert Harrison) counsel.

The Order was not a valid warrant for at least three reasons. First, the Application in support of the Order was purposefully misleading. The Government crafted the Application as if it were a routine application for a pen register or a trap and trace device, citing the applicable Maryland statutory authorization. It did not mention the term “cell site simulator,” nor did it describe the novel technology in a manner that the judge would understand its intrusiveness on the privacy rights of Harrison or others. Second, although the Government now seeks to treat the Order as a warrant, it failed to comply with the statutory temporal requirements for the execution of warrants, which impacts probable cause. Third, the Order fails the particularity requirement because it specified that it was authorizing a search of only the target phone, but, instead, the cell site simulator searched the phones of infinite third parties in the vicinity. As such, if it was a warrant, it was an illegal general warrant.

The "good faith" exception -- the benefit of a doubt the government frequently extends to itself -- is also addressed.

Further, the Government cannot rely on the good faith exception or the inevitable discovery doctrine. The good faith exception cannot apply here because the purported warrant was facially invalid, and the affiant knowingly or recklessly misled the magistrate with material omissions concerning the cell site simulator. The inevitable discovery doctrine likewise does not apply because the Government’s argument is predicated on an alternative plan that is latent with speculation and conjecture, instead of historically verifiable facts.

Going beyond this, the government attempts to claim the Pen Register order is no different than an actual search warrant -- something it didn't have in its possession when it used the cell site spoofer to "search" Harrison's premises (as well as anyone else's within range) for the cell phone. The filing points out that the statute under which the order was obtained doesn't provide for the issuance of warrants. Even if the government wanted to treat the order like a warrant, it was missing all sorts of specifics crucial to search warrants -- like the particularity of the search, time limitations and probable cause findings.

Not only that, but by obtaining a Pen Register order rather than a search warrant, the government deliberately hid its methods from the courts. The particulars of the technology being deployed were never presented to the magistrate. All of this adds up to one thing: even if the government wants to pretend the order was a warrant, at the very best, it was in possession of a general warrant -- the sort of thing that the Fourth Amendment is in place to safeguard against.

The government also blew past temporal limits normally found in warrants. In its arguments, it wants to have it both ways -- the leniency of the 60-day window provided for Pen Register orders and the powers granted to those in possession of actual search warrants, which are only good for 15 days after issuance. The deployment of the Stingray didn't occur until 50 days after the Pen Register order was obtained.

Addtionally, the phone sought by the FBI and Baltimore PD was no longer in possession of the sting target by the time it went "searching" for it. Within a day of obtaining the Pen Register order, the phone was answered by an unknown male, who told the informant that the suspect (Smith) would call him back on his personal phone. Further records submitted as evidence note that every call between Smith and informants occurred on personal phones, rather than the phone the government was looking for. As the filing points out, had the government sought a warrant to locate this phone, it would have been unable to provide probable cause findings. As things stood nearly a month after the Pen Register order was obtained, the government didn't know much about who actually had the phone, much less whether the phone was still being used as part of the murder-for-hire plot.

By covering up its use of a Stingray device, the government availed itself of the less stringent standards inherent to Pen Register orders. But when it comes to defending itself against complaints of Fourth Amendment violations, the government attempts to portray the order as indistinguishable from a search warrant -- except for all the stuff it's supposed to do on its end to ensure rights aren't violated.

Filed Under: 4th amendment, baltimore, imsi catcher, pen register, police, stingray, warrant

FBI Says It Has A Warrant Requirement For Stingray Use; Has Exception Broad Enough To Ensure It Never Needs A Warrant

from the the-warrant-that-wasn't-there dept

As Mike covered here earlier, Sens. Grassley and Leahy are asking the FBI for more answers on its Stingray usage. Not that anyone should be holding their breath in anticipation of a response. The government's use of Stingray devices has been actively hidden from the public (and criminal defendants) for years. Local law enforcement's use has also been hidden, thanks to a bizarre set of non-disclosure agreements, both with the manufacturer (Harris) and the FBI itself.

So, while we wait for the heavily-redacted responses to the senators' queries to eventually arrive at an undetermined point in the far future, let's take a closer look at what the FBI has actually gone on record with about its Stingray use.

The good news (that actually isn't) is this: the FBI now has a warrant requirement for Stingray deployment. But there are (of course) exceptions.

[W]e understand that the FBI’s new policy requires FBI agents to obtain a search warrant whenever a cell-site simulator is used as part of a FBI investigation or operation, unless one of several exceptions apply, including (among others): (1) cases that pose an imminent danger to public safety, (2) cases that involve a fugitive, or (3) cases in which the technology is used in public places or other locations at which the FBI deems there is no reasonable expectation of privacy.

A Stingray device is rarely deployed from the comfort of the suspect's living room. In fact, it's safe to say this never happens. What does happen is that Stingrays are deployed from vehicles on public streets or flown overhead in aircraft. It would probably be safe to say that there has not been a Stingray deployment that didn't occur in a public place.

So, there's really no need to ever seek a warrant. The FBI can point proudly to its new warrant requirement as evidence of its respect for privacy, just as long as no one asks if there are any exceptions. Grassley and Leahy, however, have asked. And they have mastered the art of the understatement. They continue:

We have concerns about the scope of the exceptions.

The rule is demolished by the exception. There is no rule. There is no need for the FBI to ever seek a warrant for Stingray usage. If some weird situation does manage to crop up, it will probably involve some other exception (including ones that aren't listed here), and we're back to square one.

If and when the answers arrive, the numbers following these questions will be highly illuminating.

2.   From January 1, 2010, to the effective date of the FBI’s new policy:
a.   How many times did the FBI use a cell-site simulator?
b.   In how many of these instances was the use of a cell-site simulator authorized by a search warrant?
c.   In how many of these instances was the use of the cell-site simulator authorized by some other form of legal process? Please identify the legal process used.
d.   In how many of these instances was the cell-site simulator used without any legal process?
e.   In how many of the instances referenced in Question 2(d) did the FBI use a cell-site simulator in a public place or other location in which the FBI deemed there is no reasonable expectation of privacy?

Given the scope of the "public place" exception, the answers to (d) and (e) should be nearly identical. All that remains to be seen is how close those numbers are to 2(a).

Filed Under: 4th amendment, doj, fbi, privacy, stingray, warrant

Senators Leahy & Grassley Quiz DOJ & DHS About Secret Fake Phone Towers Intercepting Calls

from the good-for-them dept

We've written plenty about Stingrays and other "IMSI Catcher" devices that allow law enforcement to set up what are effectively fake cell phone towers, designed to intercept calls and locate certain individuals. These devices are deployed in near total secrecy, often by law enforcement who got them from the federal government. There is little to no oversight over how these are used (and abused). The attempts to keep the details a total secret represent really egregious behavior from all involved. As we've covered, police have claimed that non-disclosure agreements with the manufacturers (such as Harris Corp.) prevent them from getting a warrant to use the devices. The DOJ, somewhat famously, had a whole plan for how to mislead judges about the use of these devices, with official documentation telling DOJ officials to be "less than explicit" and "less than forthright" to judges about how the tech was being used. In some cases, the US Marshals have stepped in and seized documents from local police forces to block them from being released in response to FOIA requests.

In short, law enforcement really doesn't want how it uses these devices revealed. And yet, reporters and activists keep digging up more information, including the WSJ finding out that the US Marshals (them again!) have been putting airborne versions of these devices, called DRT boxes, on airplanes and flying them over cities, likely scooping up information on tons of innocent people with no warrant.

At least some in our government are concerned about this. Senators Patrick Leahy and Chuck Grassley have been pressing government officials on this, and before the holidays sent a letter to Attorney General Eric Holder and Homeland Security Boss Jeh Johnson demanding answers. One very interesting tidbit is that in response to some of this public disclosure, the FBI now, at least, gets warrants before using the technology -- but the Senators would like more details:

We wrote to FBI Director Comey in June seeking information about law enforcement use of cell-site simulators. Since then, our staff members have participated in two briefings with FBI officials, and at the most recent session they learned that the FBI recently changed its policy with respect to the type of legal process that it typically seeks before employing this type of technology. According to this new policy, the FBI now obtains a search warrant before deploying a cell-site simulator, although the policy contains a number of potentially broad exceptions and we continue to have questions about how it is being implemented in practice. Furthermore, it remains unclear how other agencies within the Department of Justice and Department of Homeland Security make use of cell-site simulators and what policies are in place to govern their use of that technology.

But, still, the Senators would like a few more details:

The Judiciary Committee needs a broader understanding of the full range of law enforcement agencies that use this technology, the policies in place to protect the privacy interests of those whose information might be collected using these devices, and the legal process that DOJ and DHS entities seek prior to using them.

For example, we understand that the FBI’s new policy requires FBI agents to obtain a search warrant whenever a cell-site simulator is used as part of a FBI investigation or operation, unless one of several exceptions apply, including (among others): (1) cases that pose an imminent danger to public safety, (2) cases that involve a fugitive, or (3) cases in which the technology is used in public places or other locations at which the FBI deems there is no reasonable expectation of privacy.

We have concerns about the scope of the exceptions. Specifically, we are concerned about whether the FBI and other law enforcement agencies have adequately considered the privacy interests of other individuals who are not the targets of the interception, but whose information is nevertheless being collected when these devices are being used. We understand that the FBI believes that it can address these interests by maintaining that information for a short period of time and purging the information after it has been collected. But there is a question as to whether this sufficiently safeguards privacy interests.

The specific questions being asked:

1. Since the effective date of the FBI’s new policy:

a. How many times has the FBI used a cell-site simulator?
b. In how many of these instances was the use of the cell-site simulator authorized by a search warrant?
c. In how many of these instances was the use of the cell-site simulator authorized by some other form of legal process? Please identify the legal process used.
d. In how many of these instances was the cell-site simulator used without any legal process?
e. How many times has each of the exceptions to the search warrant policy, including those listed above, been used by the FBI?

2. From January 1, 2010, to the effective date of the FBI’s new policy:

a. How many times did the FBI use a cell-site simulator?
b. In how many of these instances was the use of a cell-site simulator authorized by a search warrant?
c. In how many of these instances was the use of the cell-site simulator authorized by some other form of legal process? Please identify the legal process used.
d. In how many of these instances was the cell-site simulator used without any legal process?
e. In how many of the instances referenced in Question 2(d) did the FBI use a cell-site simulator in a public place or other location in which the FBI deemed there is no reasonable expectation of privacy?

3. What is the FBI’s current policy on the retention and destruction of the information collected by cell-site simulators in all cases? How is that policy enforced?

4. What other DOJ and DHS agencies use cell-site simulators?

5. What is the policy of these agencies regarding the legal process needed for use of cell-site simulators?

a. Are these agencies seeking search warrants specific to the use of cell-site simulators?
b. If not, what legal authorities are they using?
c. Do these agencies make use of public place or other exceptions? If so, in what proportion of all instances in which the technology is used are exceptions relied upon?
d. What are these agencies’ policies on the retention and destruction of the information that is collected by cell-site simulators? How are those policies enforced?

6. What is the Department of Justice’s guidance to United States Attorneys’ Offices regarding the legal process required for the use of cell-site simulators?

7. Across all DOJ and DHS entities, what protections exist to safeguard the privacy interests of individuals who are not the targets of interception, but whose information is nevertheless being collected by cell-site simulators?

Anyone taking bets on how few of these questions will actually be answered?

Filed Under: chuck grassley, drt boxes, imsi catchers, patrick leahy, privacy, stingray, stingrays, us marshals, warrants
Companies: boeing, harris corp.

Canadian Law Enforcement Agency Dropping Cases Rather Than Deal With New Warrant Requirements For ISP Subscriber Info

from the if-at-first-you-don't-succeed,-quit dept

A funny thing happens when courts start requiring more information from law enforcement: law enforcers suddenly seem less interested in zealously enforcing the law.

Back in June of this year, Canada's Supreme Court delivered its decision in R. v. Spencer, which brought law enforcement's warrantless access of ISP subscriber info to an end.

In a unanimous decision written by (Harper appointee) Justice Thomas Cromwell, the court issued a strong endorsement of Internet privacy, emphasizing the privacy importance of subscriber information, the right to anonymity, and the need for police to obtain a warrant for subscriber information except in exigent circumstances or under a reasonable law.

The effects of this ruling are beginning to be felt. Michael Geist points to a Winnipeg Free Press article that details the halcyon days of the Royal Canadian Mounted Police's warrantless access.

Prior to the court decision, the RCMP and border agency estimate, it took about five minutes to complete the less than one page of documentation needed to ask for subscriber information, and the company usually turned it over immediately or within one day.

Five minutes! Amazing. And disturbing. A 5-minute process indicates no one involved made even the slightest effort to prevent abuse of the process. The court's decision has dialed back that pace considerably. The RCMP is now complaining that it takes "10 hours" to fill out the 10-20 pages required to obtain subscriber info. It's also unhappy with the turnaround time, which went from nearly immediate to "up to 30 days."

In response, the RCMP has done what other law enforcement agencies have done when encountering a bit of friction: given up.

"Evidence is limited at this early stage, but some cases have already been abandoned by the RCMP as a result of not having enough information to get a production order to obtain (basic subscriber information)," the memo says.

The RCMP also points out that the 30-day response period will sometimes outlast the 30-day IP log retention period, resulting in information being destroyed before the agency can access it. It also notes that it's facing a bit of backlash in the wake of the Supreme Court's decision.

Banks, hotels, and car rental companies are reviewing the Supreme Court decision and "a few have signalled less voluntary co-operation" in future.

Yeah, that's a shame. But it seems to be a feeling that's becoming increasingly common as the pendulum swings back towards protecting the rights of the public. Several companies have spent years being forced to play the submissive part in this involuntary relationship, handing out an endless number of "how highs" in response to the government's "jump!" orders. "Less voluntary" is what the future holds for intelligence agencies and law enforcement alike.

If the RCMP is dropping cases because it doesn't have enough put together to "fulfill the requirements" of its warrant paperwork, then it really doesn't have enough of a case put together to be demanding that third parties turn over information related to the suspect. It's that simple. The cases it has dropped obviously aren't strong enough to justify attempts to gather more information. The warrant requirement is going to turn the RCMP into a better law enforcement agency -- one that doesn't pursue certain investigations just because they're easy. This forces the RCMP to better evaluate its caseload and cut loose those that suffer from a dearth of information. The RCMP may now be counting up its theoretical losses (the cases that it's dropping), but Canadian citizens are better protected against ad hoc bulk surveillance and law enforcement fishing expeditions.

Filed Under: canada, evidence, imsi catcher, law enforcement, privacy, stingray, warrants

Baltimore Prosecutors Withdraw Evidence Rather Than Talk About Police Department's Stingray Usage

from the should-go-back-to-simpler-days-of-planting-evidence-and-falsifying-reports dept

They justify the use of Stingray devices (IMSI catchers/cell tower spoofers) by pointing out how great they are at catching criminals. They justify the secrecy surrounding them by claiming the release of any details will compromise investigations. And then they pull something like this.

Baltimore prosecutors withdrew key evidence in a robbery case Monday rather than reveal details of the cellphone tracking technology police used to gather it.

So… great for catching crooks but not all that great at keeping them caught. How embarrassing. That has to suck for Baltimore citizens, who have just discovered their local PD prizes non-disclosure agreements over putting bad guys away.

City police Det. John L. Haley, a member of a specialized phone tracking unit, said officers did not use the controversial device known as a stingray. But when pressed on how phones are tracked, he cited what he called a "nondisclosure agreement" with the FBI.

Which most people would take to mean don't go around spilling the details to normal citizens, family members or journalists. But as we've seen repeatedly, law enforcement agencies have taken this FBI-required NDA to mean (very conveniently, I might add) that they're allowed to tell no one. Goodbye, crusty old "due process" ideals. Hello, parallel construction.

But in this case, the judge responded with an obvious statement -- one that is made far too infrequently.

"You don't have a nondisclosure agreement with the court," Baltimore Circuit Judge Barry G. Williams replied.

Then Judge Williams called the PD's bluff: explain the evidence's origin or face contempt charges. Faced with this, the prosecution folded.

It's no secret the Baltimore Police Dept. has a Stingray device. Here's a document from 2009 containing the city council's approval of the Stingray purchase. Here's another document showing the PD's request for additional funds to upgrade the device. The general public is already aware of the device's existence and capabilities, and yet, the police balk at discussing it publicly, even if it means potentially damaging a prosecutor's case.

It's not just the phone-related evidence that's being withdrawn. It's everything derived from that Stingray-related search, including a handgun.

This isn't Judge Williams' first experience with police officers unwilling to discuss Stingray usage. The Baltimore Sun reports he also dealt with a non-discussion of the technology back in September. The device was used to track a phone (and a suspect) to a certain location. When Williams asked how the officers ascertained that the suspect actually had the phone on him, they actually invoked national security rather than answer the question.

"This kind of goes into Homeland Security issues, your honor," [Sgt. Scott] Danielczyk said.

Williams nailed this response, too.

"If it goes into Homeland Security issues, then the phone doesn't come in," Williams said. "I mean, this is simple. You can't just stop someone and not give me a reason."

That's how this is supposed to work. If law enforcement agencies want to deploy super-secret technology, then they shouldn't be able to drag evidence of unexplained origin into the courts with them. Allowing them to have it both ways steamrolls due process.

Filed Under: baltimore, courts, non-disclosure, secrecy, stingray, surveillance

Feds Put Fake Cell Towers On Planes, Spied On Tons Of Innocent Americans

from the because-surveillance-is-fun,-yo dept

The Wall Street Journal broke the news that the DOJ has been spying on tons of innocent Americans by putting fake mobile phone towers on airplanes and scooping up all sorts of data from people who thought they were connecting to regular mobile phone towers.

The U.S. Marshals Service program, which became fully functional around 2007, operates Cessna aircraft from at least five metropolitan-area airports, with a flying range covering most of the U.S. population, according to people familiar with the program.

Planes are equipped with devices—some known as “dirtboxes” to law-enforcement officials because of the initials of the Boeing Co. unit that produces them—which mimic cell towers of large telecommunications firms and trick cellphones into reporting their unique registration information.

The technology in the two-foot-square device enables investigators to scoop data from tens of thousands of cellphones in a single flight, collecting their identifying information and general location, these people said.

We have, of course, reported for a while now on so-called Stingray devices, which mimic mobile phone towers on the ground (and have noted that Stingray is just one brand of a few such devices, known as IMSI catchers), but putting them on special planes and flying them around would allow law enforcement agencies to get a lot more information on a lot more people. Given that law enforcement efforts like this are supposed to be narrowly targeted towards those actually suspected of breaking the law, this seems like a massive 4th Amendment abuse, creating mass surveillance programs for law enforcement with little real oversight or control.

While it may not be entirely surprising that this is happening, it is yet another surveillance program being done with zero public transparency, zero public debate and zero public input. That's a huge concern as we've seen time and time again how such programs get abused.

And, while the WSJ doesn't come out and say it, it certainly sounds like it got this info from a concerned whistleblower inside the US Marshals Service:

Within the Marshals Service, some have questioned the legality of such operations and the internal safeguards, these people said. They say scooping up of large volumes of information, even for a short period, may not be properly understood by judges who approve requests for the government to locate a suspect’s phone.

Some within the agency also question whether people scanning cellphone signals are doing enough to minimize intrusions into the phone system of other citizens, and if there are effective procedures in place to safeguard the handling of that data.

As such programs keep getting disclosed, think of how many such other programs there are that we just don't know about?

Filed Under: 4th amendment, doj, imsi catcher, planes, stingray, surveillance, us marshals, warrants

Washington DC Metro Police Also Have A Stingray And Have Been Using It To Do Normal Police Work

from the so-many-Stingrays,-so-few-terrorists-captured dept

The facts are in, thanks to Vice Media and Jason Leopold. Washington, DC police have a Stingray cell tower spoofer and have been using it for several years. The Metropolitan Police Department was an early adopter, but moving too fast cost it about five years of use.

Back in 2003, the Metropolitan Police Department (MPD) in Washington, DC was awarded a $260,000 grant from the Department of Homeland Security (DHS) to purchase surveillance technology called Stingray — a contraption the size of a suitcase that simulates a cell phone tower and intercepts mobile phone calls and text messages.

The rationale behind the DHS grant to MPD and other law enforcement agencies was to help them secure new anti-terrorism technology from private corporations. But the grant fell a little short, because the MPD couldn't come up with the extra several thousands dollars it needed to train officers how to use and maintain Stingray — so the device sat unused in an "Electronic Surveillance Unit equipment vault" at the department for more than five years.

In 2008, the Stingray was revived and upgraded and has apparently been in use ever since. Of course, it's no longer terrorism that justifies its usage, but rather good, old-fashioned drug dealing and other vanilla criminal activity, as one memo points out.

"The procurement of this equipment will increase the number of MPD arrests for fugitives, drug traffickers, and violent offenders (robbery, assault with a deadly weapon, Homicide), while reducing the time it takes to locate dangerous offenders that need to be removed from the streets of DC."

No doubt the news that bad guys are being speedily apprehended will make up for all the dropped calls and blocked data experienced by public servants employed in the metro area. They'll also be pleased to know that all sorts of unfiltered information about their phone calls, location, etc. was hoovered up along with the suspects'.

Not that this doesn't affect the "little people," who are just as likely to wonder why their cell phones aren't picking up a signal and are just as likely to be irritated that the local PD is scooping up a bunch of unrelated data in its search for bad guys, but this now affects the "real people" of DC -- policymakers and higher-ups whose complaints actually manage to find worthy ears quite frequently.

If the MPD is driving around DC with Stingray devices, it is likely capturing information about the locations and movements of members of Congress, cabinet members, federal law enforcement agents, and Homeland Security personnel, consular staff, and foreign dignitaries, and all of the other people who congregate in the District…. If cell phone calls of congressional staff, White House aides, or even members of Congress are being disconnected, dropped, or blocked by MPD Stingrays, that's a particularly sensitive and troublesome problem.

Of course, this has been ongoing for half a decade now, and if no one's complaining about it yet, it's because it hasn't been noticed or it's because too many of those officials mentioned are more than willing to sacrifice their privacy (along with everyone else's) for small gains in law enforcement efficiency -- even more so if the spectre of international terrorism is raised (which it was, initially), despite everyone knowing that the real targets would be normal, no-panic-needed criminal activities (as is almost always the case).

Will these newly-freed documents prompt a bit more activity from the Beltway? Well, the cheery outlook says, "anything's possible," which is as much an admission of defeat as it is a rallying cry. The more realistic viewpoint sees that multiple documents have been uncovered over the past few years with little more than a few, very localized reactions being observed. It will probably take more than the off-chance of being swept up in a surveillance dragnet to convince those in charge to take a second look at law enforcement tools and capabilities. In fact, many of them helped agencies (via legislation) like the DHS and FBI sell the courts on the idea that nearly everything related to human communication in this day and age carries with it "no expectation of privacy."

Filed Under: police, stingray, washington dc