EFF Posts New White Paper On Stingray Device Capabilities

from the keeping-abreast-of-the-fuzz dept

The EFF has published a primer on IMSI catchers. Harris Corporation's success in this market has led to near-genericide, as almost every one of these cell tower spoofers is usually referred to as a "stingray."

The white paper [PDF], titled "Gotta Catch 'Em All," runs down what's known about cell-site simulators used by a number of government agencies. Most of this has been gleaned from secondhand info -- the stuff that leaks out during prosecutions or as the result of FOIA requests.

The technical capabilities of CSSs have been kept under wraps for years. The reasoning behind this opacity is that if criminals know how these devices work, they'll be able to avoid being tracked by them. There may be a few technical details that might prove useful in this fashion, but what is known about Stingray devices is that the best way to avoid being tracked by them is to simply not use a cellphone. But who doesn't use a cellphone?

The report is definitely worth reading, even if you've stayed on top of these developments over the past several years. It breaks down the technical subject matter in a way that makes clear what CSSs can and can't do -- and how they're capable of disrupting cellphone networks while in use.

While CSSs can intercept communications, it's hardly worth the effort. Unless the CSS can talk the phone into accepting a 2G connection (which eliminates encryption and severely limits the type of communications originating from the dumbed-down phone), it just doesn't work. This doesn't mean the devices are never used this way. But it does mean it's not a very attractive option.

On the other hand, CSSs impersonate cell towers, so they're able to pull all sorts of info from every device forced to connect with the faux cell tower. These devices are used most often to locate criminal suspects, meaning precise GPS location is a must-have. Operating on their own, cell-site simulators can't generate pinpoint accuracy. Working in conjunction with nearby towers, they can triangulate signals to provide better location info. But there's another option -- one rarely discussed in courtroom proceedings. CSSs can also force phones to give up precise location info.

First, the Stingray extracts info from nearby cell towers. Using this info (which the EFF points out anyone can access), the CSS alters its signal to become the highest priority connection in the area of operation. Once it's done this, GPS info can be coaxed from phones now connected to the fake cell tower.

[T]he attacker creates a “RRC Connection Reconfiguration” command, which contains the cell IDs of at least 3 neighbouring cell towers and their connection frequencies and sends this command to their target’s phone.

Usually, the “RRC Connection Reconfiguration” command is used to modify an existing connection to a base station, but the attacker is only interested in the target phone’s initial response to its message. This response contains the signal strengths of the previously specified cell towers, which can then be used to find the phone’s location via trilateration.

For newer phones and networks which support the “locationInfo-r10” feature, this report will also contain the phone’s exact GPS coordinates, meaning no trilateration calculations are required. The exact GPS coordinates are just a field in the response (Shaik et al, 2017).

There are few options available for people wanting to use a cellphone but are also wanting to avoid being swept up by a Stingray. As the report notes, there are a few cell tower spoofer detection apps on the market, but they may be more likely to generate false positives than detect IMSI catchers. There's no baseline for carrier behavior, much less "normal" Stingray use.

And, in any event, the EFF isn't publishing a handbook on how to evade detection by these devices. It's simply informing the public of the power of these devices, which are becoming as ubiquitous as the phones they track and trace. Since the public hasn't been invited to any these discussions by law enforcement agencies, it's up to everyone else to detail known capabilities and assess the potential damage to the public's expectation of privacy.

Filed Under: imsi catchers, stingray, surveillance

Harris Stingray Nondisclosure Agreement Forbids Cops From Telling Legislators About Surveillance Tech

from the lying-about-the-law-to-ensure-silence dept

The FBI set the first (and second!) rules of Stingray Club: DO NOT TALK ABOUT STINGRAY CLUB. Law enforcement agencies seeking to acquire cell tower spoofing tech were forced to sign a nondisclosure agreement forbidding them from disclosing details on the devices to defendants, judges, the general public… sometimes even prosecutors.

A new wave of parallel construction washed over the land, distancing defendants from the source of evidence used against them. Pen register orders -- used to cover the tracks of Stingray searches -- started appearing en masse, as though it was 1979 all over again. If curious lawyers and/or judges started sniffing around, agencies were instructed to let accused criminals roam free rather than expose details about Stingray devices. According to the FBI, public safety would be irreparably damaged if Stingray details were exposed. Apparently the return of dangerous criminals to the street poses no harm to the public.

Another NDA has been uncovered, thanks to a lengthy public records lawsuit. The document finally handed over by Delaware State Police to the ACLU was once referred to as "mythical" by the DSP in court. Yes, the State Police once claimed this NDA never existed. It did so while claiming it had zero communications with Harris while acquiring its Stingray. The ACLU obviously found this hard to believe and the court sent the DSP back to search harder. The Harris NDA is real. And it's spectacular.

The agreement, signed by a state police detective in 2010, stated that officers could not "discuss, publish, release or disclose any information pertaining to the (cell phone tracking) products" to the general public, to companies, to other governmental agencies, or even to other officers who do not have a "need to know."

A letter attached to the agreement, and signed by Harris Corp.'s account manager, said police are not permitted to talk about the devices with "elected officials."

"Stealth, quiet approach and skilled execution are the glue that transforms weapons and technology investments into capabilities and results," Harris Corp.'s Michael E. Dillon said in the letter. "Only officers with arrest authority are permitted to use them (Stingrays) or have knowledge of how they work."

Harris cited federal law for the conditions in the agreement, which it stated is similar to other "intelligence oriented aspects of your operations."

Yes, Harris is deliberately misconstruing federal law to ban law enforcement agencies from discussing its devices with anyone, including those who oversee departments and their spending. This means the public has zero chance of knowing what surveillance tech local officers are deploying. The part of the law cited by Harris -- 18 USC 2512 -- simply forbids entities who are not (a) wireless service providers or (b) government contractors from advertising or selling tools that intercept wireless communications. It has absolutely nothing to say about discussing these devices with other government entities (or the general public for that matter).

But as we all are painfully aware, ignorance of the law is the bread-and-butter of law enforcement. Detective Dennis Smith signed the "mythical" document [PDF] all the way back in 2010, "binding" his agency to an agreement it could have walked away from at any time with zero consequences. (Well, maybe the loss of future business deals with Harris, but no violations of state or federal laws.)

Disappointingly, state legislators seem pretty cool about being kept in the dark by a government contractor's bogus NDA.

[L]awmakers are some of the "worst at keeping secrets," said [Greg] Lavelle, the Senate minority whip.

"I'm not offended that they threw public officials in there (the non-disclosure agreement)," he said.

Lavelle may not speak for the rest of the Delaware legislature, but at this point he has to. All other legislators refused to answer questions about the Harris NDA that allowed the State Police to hide information about surveillance equipment from them. Finding out agencies they oversee have been effectively lying to them should have triggered more of a response. Instead, Delaware residents get a single shrug from a state rep and silence from the rest.

Filed Under: disclosure, due process, evidence, fbi, imsi catchers, nda, stingrays, surveillance
Companies: harris

New York Court Says NYPD Must Get Warrants To Deploy Stingrays

from the take-that-Big-Blue dept

Another court has decided warrants must accompany Stingray use. (via the New York Times) The ruling handed down earlier this month clarifies the distinction between the records obtained and the records requested. In this case, police used a pen register request to deploy their Stingray device. As the court points out, Stingray devices grab a lot more than just phone numbers.

A pen register or trap and trace warrant is authorized under New York's CPL Art. 705.00. According to that Article, a pen register is a device that attaches to a landline phone to identify and record "the numbers dialed or otherwise transmitted" in outgoing and incoming calls." CPL 705.00 (1). In addition, CPL 705.00 (2) defines a trap and trace as a similar device to that of the pen register that identifies the "originating number" for a call. It should be noted, however, that Article 705 does not authorize the gathering of location information using a cell phone's Global Positioning system (GPS), nor does it authorize the gathering of additional information, that might include the content of a phone's calls or text messages by the use of a pen register and/or trap and trace order.

[...]

Thus, it is improper under New York Law to authorize the obtaining of any information from a suspect's phone other that the phone numbers dialed or otherwise transmitted in outgoing and incoming calls and/or an originating phone number.

As the court notes, the addition of GPS location info changes the matrix for law enforcement paperwork. It's not enough to settle for the lower requirements of a pen register order. Tracking and tracing people involves a higher statutory burden. And that's exactly what this is: to deploy a Stingray, a team of officers must fire one up and roam all over the place until they home in on their target. This is completely distinct from showing up at a telco office asking for dialed digits.

Additionally, the court points out that while the information obtained (the phone's location) might ultimately be a third party record accessible with a subpoena, the government can't be the third party collecting the records.

[U]nlike pen register device information or that provided by the CSLI, a cell site simulator device does not involve a third party. "The question of who is recording an individual's information initially is key." See US v Lambis, supra, citing In re US for Historical Cell Site Data, 724 F.3d 600 [5th Circ. 2013] [distinguishing between "whether it is the Government collecting the information or requiring a third party to collect or store it, or whether it is a third party, of its own accord and for its own purposes, recording the information"]. The Lambis court continued: "For both pen register information and CSLI, the Government ultimately obtains the information from the service provider who is keeping a record of the information. With the cell-site simulator, the Government cuts out the middleman and obtains the information directly." US v Lambis, Id.

By its very nature, then, the use of a cell site simulator intrudes upon an individual's reasonable expectation of privacy, acting as an instrument of eavesdropping and requires a separate warrant supported by probable cause rather than a mere pen register/trap and trace order such as the one obtained in this case by the NYPD.

Presumably, the NYPD was less than forthcoming about its Stingray use. In the opening of the opinion, the court points out the location the suspect was tracked to was completely unrelated to any information the NYPD already had in hand when it took its Stingray out for a spin.

Based upon the information gathered from this order for the defendant's cell phone, Detective Brown located and arrested the defendant three days later on April 15, 2016, inside of 1540 Sterling Place, Apartment 3E in Brooklyn, an address not previously identified as of any interest to this investigation.

The decision also notes Stingray use was "conceded" by the prosecution, suggesting it fought this disclosure for as long as it could.

This is good news for residents of New York and another small step towards a unified judicial view on Stingray deployments. Better yet, it has probably resulted in audible wailing and gnashing of teeth in the upper levels of the NYPD bureaucracy.

Filed Under: imsi catchers, nypd, privacy, stingrays, warrants

DC Court Says Metro Police Need Warrants To Deploy Stingrays

from the another-win-for-the-4th dept

Another warrant requirement for Stingray use has been established. Again, it's not a federal decision, so jurisdiction is limited, but there's now another case to cite when fighting warrantless Stingray use in federal courts.

This decision comes from the DC Appeals Court (very much not the DC Circuit Court of Appeals). The case involves the Metro PD's use of a Stingray to track two phones: the suspect's and one he had stolen. The lower court handed the government a win. After pointing out there was plenty of time (around 10 hours between report of crime and Stingray deployment) to obtain a warrant (thus no exigent circumstances exception), the court decided the evidence derived from the tracking fell into the "inevitable discovery" exception since the tracking of the stolen phone would have led officers to the suspect.

The problem is the officers testifying for the Metro PD could not say for sure which phone they were tracking: the suspect's or the phone he had allegedly stolen from the victim. The lower court cut the cops some slack, allowing for the possibility of they were tracking a phone (the victim's) the suspect had no privacy interest in.

The appeals court, however, doesn't read it the same way. First, it goes further than the lower court, deciding the use of Stingray devices requires a warrant. As it points out in its opinion [PDF], the use of Stingray devices is far more invasive than other tracking methods. To begin with, it does something historic cell site location data and/or GPS trackers can't: locate a suspect no one's actively tracking.

With a cell-site simulator, however, police no longer need to track a person visually from some starting location or physically install a tracking device on an object that is in, or will come into, his or her possession. Instead, they can remotely activate the latent tracking function of a device that the person is almost certainly carrying in his or her pocket or purse: a cellphone. As the present case demonstrates, police officers first obtain subscriber information and real-time location information from the target‘s telecommunications provider to narrow down the search area. They then proceed to that area with a cell-site simulator, which they use to force the person‘s cellphone to identify itself and reveal its exact location. It is in this sense that a cell-site simulator is a locating, not merely a tracking, device: A cell-site simulator allows police officers who possess a person‘s telephone number to discover that person‘s precise location remotely and at will.

Further, Stingray devices force peoples' phones to relinquish information to law enforcement.

A final consideration is that when the police use a cell-site simulator to locate a person‘s cellphone, the simulator does not merely passively listen for transmissions sent by the phone in the ordinary course of the phone‘s operation. Instead, the cell-site simulator exploits a security vulnerability in the phone—the fact that cellphones are, in the words of the defense expert, ― "dumb devices," unable to differentiate between a legitimate cellular tower and a cell-site simulator masquerading as one — and actively induces the phone to divulge its identifying information.

Which flows directly into this determination:

The preceding considerations lead us to conclude that the use of a cell-site simulator to locate Mr. Jones‘s phone invaded a reasonable expectation of privacy and was thus a search.

There are reasons the court feels a warrant requirement is necessary -- ones that involve government responsibility and accountability.

[T]he simulator‘s operation involve[s] exploitation of a security flaw in a device that most people now feel obligated to carry with them at all times. Allowing the government to deploy such a powerful tool without judicial oversight would surely ―shrink the realm of guaranteed privacy "far below that which existed when the Fourth Amendment was adopted." Kyllo, 533 U.S. at 34. It would also place an individual in the difficult position either of accepting the risk that at any moment his or her cellphone could be converted into tracking device or of forgoing ― "necessary use of" the cellphone.

The government argued cellphone users have no expectation of privacy in location information they know (or should know) is being broadcast to third parties. The appeals court disagrees, pointing to the Supreme Court's decision on wiretap use.

Contrary to the government‘s argument, Katz makes clear that a person does not lose a reasonable expectation of privacy merely because he or she is made aware of the government‘s capacity to invade his or her privacy. When Katz was issued, the public and the courts were well aware of the government‘s capacity to wiretap and eavesdrop through technological means, yet the Supreme Court did not find this fact determinative of the question whether individuals possess a reasonable expectation of privacy in their conversations.

[...]

A person‘s awareness that the government can locate and track him or her using his or her cellphone likewise should not be sufficient to negate the person‘s otherwise legitimate expectation of privacy.

The court also shoots holes in the government's "inevitable discovery" theory. At some point, the officers switched from tracking a phone with zero privacy interest (the victim's) to tracking the suspect's phone. When they did this, they screwed themselves out of a warrant exception. The court decides the government doesn't get to pile up wrongs and ask the court to view them as "right."

[H]ere the government is asking us to find inevitable discovery where the police had mutually exclusive options and, for whatever reason, chose the option that turned out to be unlawful. The inevitable-discovery doctrine does not apply in this type of situation.

The good faith exception is killed off as well, thanks to the secrecy surrounding the Metro PD's ownership and deployment of a Stingray device.

The Supreme Court has not, however, recognized the applicability of the good-faith exception in a situation remotely like the present one—where the police, not acting pursuant to a seemingly valid warrant, statute, or court opinion, conducted an unlawful search using a secret technology that they had shielded from judicial oversight and public scrutiny. See supra note 26. Indeed, assuming the police believed the warrantless use of the cell-site simulator to be lawful, they could not have reasonably relied on that belief, given the secrecy surrounding the device and the lack of law on the issue.

As for the government's argument suppression of evidence isn't needed to deter future wrongdoing because the PD now abides by DOJ guidance recommending search warrants for Stingray use, the court finds its assertions hollow.

The government has not cited any case in which a court has declined to apply the exclusionary rule based on the government‘s representation that it will not engage in unlawful conduct in the future. [...] And given that the DOJ policy memorandum does not describe any sort of enforcement mechanism that would ensure compliance with the policy, and given that the present administration or a subsequent one may well revise this policy, we are not convinced that the need to deter future constitutional violations is lacking.

And with that, the government loses almost all of its evidence, as well as the testimony of one of its witnesses. The conviction obtained is also reversed. The concurring opinion points out something that clearly separates Stingray cellphone tracking from other cellsite location info collection methods: it turns people's cellphones into investigative tools by law enforcement. And it doesn't do this voluntarily, no matter how the government might choose to misread the Third Party Doctrine. It does it by forcing all phones in the area to connect with the Stingray device and cough up their identifying info, including location.

This decision stands next to the one in Maryland as the first court-determined Stingray warrant requirements. More will come, although it's not entirely clear at this point which way these decisions will go. The Supreme Court is set to hear a case on warrantless access to historic cell site data. Whatever's decided there will factor into ongoing courtroom discussions about warrantless deployment of cell tower spoofers.

Filed Under: 4th amendment, dc, imsi catchers, privacy, stingrays, surveillance

UK Bill Would Force Service Providers To Set Up Fake Cell Towers For Surveillance Of Prisoners' Communications

from the compulsory-attendance dept

The latest arena for deployment of cell tower spoofers is prisons. Along with the diminished rights and lowered expectation of privacy afforded to prisoners, those incarcerated can now expect their cell phone calls to be blocked or intercepted.

The Register reports a new bill being introduced in the UK would give prisons legal authority to install IMSI catchers to monitor prisoners' communications and track/locate contraband devices. The use of Stingray devices in prisons isn't exactly new, although it hasn't really received much attention. Last year, Motherboard reported the Scottish prison system had been deploying cell tower spoofers for one specific reasons: to make prisoners' cell phone communications impossible. The devices blocked 2G and 3G signals, according to FOI'ed documents. (The documents also noted prisoners had already defeated the repurposed cell tower spoofers, so whatever was included in those documents is already outdated.)

In the US, prisons are using similar devices, although no one has copped to deploying a name-brand Stingray within the walls of a prison. ACLU tech head Chris Soghoian's 2014 report on Stingray devices cites a Commerce Department paper on the use of cell tower spoofers to thwart communications and locate contraband devices.

There's a twist in the UK legislation, though, that takes it past previous prison surveillance efforts. This bill would compel the cooperation of telcos, rather than make use of existing cell tower spoofer technology.

Provisions in the new bill will allow the Justice Secretary to order networks to deploy so-called “IMSI catchers” to prevent, detect or investigate the use of mobile phones in prisons.

Currently fake base stations can only be deployed under the legal provisions in the Prisons (Interference with Wireless Telegraphy) Act 2012, which restrict their deployment to within prison walls – and further, only allows prison governors to deploy them.

The new proposals therefore expand the ability of the state to spy on innocent citizens by further co-opting mobile phone companies’ technical abilities.

Rather than leave this to state entities possessing state-owned devices, the bill recruits cell service providers to perform the technical heavy lifting. While prison officials would be able to deploy a device inside a prison's walls to minimize interference with outside cell phone traffic, this bill appears to encourage the deployment of fake cell towers (or the repurposing of existing cell towers) outside prison walls, which would greatly increase the possibility of disrupting legitimate cell phone use and subject a number of non-prisoners to data/communications collections by the prison.

The bill contains no wording pertaining to these two issues. There's no requirement to minimize interference or discard irrelevant data/communications. All it does is expand the UK government's power to compel participation in its prison surveillance efforts. This lack of regulatory specificity is par for the course, as the Register points out.

In effect, use of IMSI catchers is effectively unregulated, albeit legal for the state and bodies authorised by the state under the Data Retention and Investigatory Powers Act 2014. It remains illegal for ordinary citizens to use them.

UK law enforcement are also using IMSI catchers, but have yet to be subjected to the (belated) judicial and legislative scrutiny we see happening here in the US. Stingray use in the UK falls under legal authorities for the interception of communications, all of which were written long before police had the (portable) power to disrupt communications and harvest communications and data.

The debate over this legislation may change that. While law enforcement agencies are generally receptive to new laws that expand their power and reach, there's always the danger legislative discussions may lead to more direct oversight and/or the removal of a few layers of opacity.

Filed Under: imsi catchers, prisoners, stingrays, surveillance, uk

South Carolina Legislators Introduce Three Bills Targeting Police Stingray Use

from the some-fullwits-hidden-among-the-halfwits dept

It's really, really difficult to give the South Carolina legislature any credit whatsoever. In the past few years, it has offered up bills that:

- required journalists to register with the government before enjoy their First Amendment rights (to make a point about the Second Amendment)

- criminalized profanity in public forums (including the internet)

- criminalized the recording of criminal acts

- required computer sellers to install default porn blockers in devices (that could be removed for $20)

The track record of this state's legislature is less than stellar. Hell, it's less than passable. 1/5 would not re-elect.

But there are still a few legislators with good ideas trying to do good things within the confines of a state where adultery is still considered a criminal act. The Tenth Amendment Center briefly highlights three new bills targeting law enforcement Stingray device use, all with their own merits.

The first, brought by state rep J. Todd Rutherford, is the most extreme of the three.

The legislation would prohibit any state or local law enforcement agency in South Carolina from purchasing cell site simulators, commonly known as “stingrays.”

At this point, use of these devices by South Carolina law enforcement is unconfirmed. If, indeed, no agencies are in possession of IMSI catchers, this bill would maintain the status quo. If agencies are already in possession of the devices, the bill would require these agencies to discontinue use and... ask Harris Corp. for a refund, I guess. This wouldn't prevent state agencies from asking for federal assistance and borrowing their devices, but it's still the most restrictive Stingray-related legislation proposed yet.

As such, it will probably never become law. The other proposals have a much better chance of reaching the governor's desk. Rutherford's backup proposal would prevent agencies purchasing cell tower spoofers from entering into nondisclosure agreements with manufacturers.

The third bill being introduced should be pushed in concert with Rutherford's second bill. Rep. Cezar McKnight's proposal would prevent state law enforcement agencies from signing nondisclosure agreements with the FBI, which has been standard procedure since the modified military tech began making its way to police departments around the nation. This would help ensure any evidence obtained with these devices will be properly presented in court, rather than obscured behind parallel construction. Or it could, theoretically. The bill ties this to warrant usage, so nondisclosure agreements would be allowed if the agreement doesn't stipulate the devices should be deployed without securing a warrant first. This ties it to the DOJ's current Stingray guidelines, which is better than continuing to obscure device deployment behind pen register orders.

The FBI's nondisclosure agreements have never specifically instructed law enforcement to avoid seeking warrants. However, the implication of the demanded secrecy pretty much made it impossible to seek a warrant, since doing so would disclose use of the device. Parallel construction was encouraged if warrants were sought and evidence introduced in court, but the FBI never strictly forbade the use of warrants in its nondisclosure agreements. So, the bill should be reworded to forbid entering into nondisclosure agreements with federal agencies and drop the clause tying it to warrant requests.

All in all, it's an encouraging set of proposals, but it's hard to see law enforcement agencies letting any of these make it to the governor's desk without a fight.

Filed Under: imsi catchers, south carolina, stingray, surveillance

House Oversight Committee Calls For Stingray Device Legislation

from the and-only-two-decades-from-their-first-appearance dept

The Congressional Committee on Oversight and Government Reform has issued its recommendations on the use of cell site simulators (a.k.a. "Stingrays," presumably to Harris Corporation's trademark erosion dismay) by law enforcement. Its recommendations are… that something needs to be done, preferably soon-ish. (h/t Chris Soghoian)

Congress should pass legislation to establish a clear, nationwide framework for when and how geolocation information can be accessed and used.

Before it reaches this conclusion, the Committee spends a great deal of time recounting the history of both the devices' usage, as well as any steps taken (most of them very recently) to govern their use.

The report [PDF] points to the Supreme Court's Jones decision, albeit not in a very helpful way. The justices punted on the warrant question, leaving it up to lower courts' interpretation as to whether or not tracking someone with a GPS device violated their privacy. The only thing they did agree on was the intrusion onto the property to install the device on the petitioner's vehicle. Everything else was left unclear, including the lack of a bright line for how much location tracking equals unconstitutional tracking.

Cell site simulators can perform the same function and, until recently, every law enforcement agency in possession of the devices deployed them without seeking search warrants. The DOJ finally suggested warrants might be necessary in 2015, which would only be about 18 years since DOJ elements began using Stingray devices.

A 1997 DOJ guidance bulletin discussed the agency’s views on what legal authority governed the various law enforcement surveillance options, including “cell-site simulator.” According to the 1997 guidance, DOJ took the position that “it does not appear that there are constitutional or statutory constraints on the warrantless use of such a device.” According to a chart that was issued with the guidance, court orders, search warrants, and subpoena requirements were not applicable when deploying this device.

For most law enforcement agencies, the lack of a warrant requirement has allowed them to disguise their Stingray deployments. Most have sought pen register orders instead for this form of real-time location tracking. Others have used parallel construction to hide use of IMSI catchers from courts, defendants, and, in some cases, the prosecutors they work with. This was all heavily encouraged by the FBI's nondisclosure agreement, which it made law enforcement officials sign before allowing them to purchase the devices.

Now, they're everywhere. The IRS has its own devices and feds are attaching IMSI catchers to planes and flying them over cities in hopes of tracking down suspects. What's more concerning is the devices' capabilities, which federal and local law enforcement agencies all swear they've never used.

In testimony before the Committee, DOJ and DHS both confirmed the simulator devices they use do not intercept any communications or content from the cellular devices to which they connect. Specifically, DOJ confirmed that between January 1, 2010 and September 2, 2015, its component agencies using the technology—the FBI; the Drug Enforcement Administration (DEA); the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF); and U.S. Marshals Service (USMS)—only collected dialing, routing, signaling and addressing information in domestic criminal investigations and did not use the devices to collect the content of communications. While the current DOJ and DHS policies require the cell-site simulators to be configured as pen registers and to not collect content, some of the cell-site simulator models used by law enforcement components within DOJ and DHS would be capable of collecting content if the devices had the necessary software installed.

The Committee points out that if the federal government doesn't hand down universal controls for the deployment of these devices, the situation will only devolve from here.

Further, the Committee notes that these devices are available all over the world and with even fewer usage restrictions. And the tech is more widely available than the US government would hope, which means those who care little for policies, guidance, or federal law won't hesitate to deploy these themselves.

It is possible, if not likely, bad actors will use these devices to further their aims. Criminals and spies, however, will not be adopting the DOJ and DHS policies and procedures or any other ethics of surveillance. They will not be self-limiting in their use of these devices so as to not capture the content of others’ conversations. Criminals could use these devices to track potential victims or even members of law enforcement. One can imagine scenarios where criminals or foreign agents use this type of technology to intercept text messages and voice calls of law enforcement, corporate CEOs, or elected officials.

The report notes that devices are already for sale on foreign websites, and those selling them are suggesting purchasers set them up in high-traffic areas (near banks, restaurants, hospitals, etc.) for maximum effectiveness. On top of that, hobbyists and researchers have been able to put together their own IMSI catchers, all without the guidance or assistance of companies who sell their devices to a highly-restricted list of government agencies. The secret is out -- and has been out for years. While any legislation would do little to deter bad actors, it would at least allow the US to act as a role model for foreign governments to emulate and give it some sort of (belated) moral high ground to stand on when restricting US companies from selling surveillance tech to governments with human rights abuse track records.

If nothing else, the hope is that the legislation called for will result in a cohesive, coherent ruleset that's also Constitutionally-sound. Obviously, this will be met with law enforcement resistance, as anything that implements a warrant requirement generally does.

Filed Under: house oversight committee, imsi catchers, stingrays, surveillance
Companies: harris corporation

Leaked Law Enforcement Supply Catalog Shows Souped-Up Cell Tower Spoofers, Tons Of Pervasive Surveillance Options

from the all-the-better-to-see/hear-you-with,-my-dears dept

The Intercept has obtained what appears to be another set of leaked documents -- these ones originating from the Florida Department of Law Enforcement. The first document released (assuming that more are on the way) is a catalog of law enforcement-only tech products from UK firm Cobham, including Stingray-like devices capable of not only locating suspects, but also intercepting their phone calls and messages.

Information about Cobham’s own suite of Stingray-style boxes is almost nonexistent on the web. But starting far down on Page 105 of the catalogue is a section titled “Cellular Surveillance,” wherein the U.K.-based manufacturer of defense and intelligence-oriented hardware lays out all the small wonders it sells for spying on people’s private conversations, whether they’re in Baghdad or Baltimore...

From the catalog [PDF]:

Cobham designs and manufactures Active Cellular Surveillance Systems. These are designed for tactical operations in short to medium range missions and provide the user with intelligence to help identify and monitor criminal activities, criminals and terrorists.

They can also be employed for humanitarian operations. Solutions are typically used for:

• Counter terrorism and organized crime operations, identifying and monitoring suspects, exploring target contact details and intercepting outgoing voice calls and SMS messages.

• Situational control, enabling identification and network denial of cellular devices through ‘intelligent’ jamming, including creating controlled areas of coverage.

• Suspect geo-locating capabilities.

Cell emulators, direction finders and coverage analysis provide ideal applications for: suspect identification, exploration of target’s contact networks, suspect monitoring and search and rescue. In-country support contracts are available to ensure effective maintenance and support of the cellular technologies.

Harris' Stingrays also provide the same interception capabilities, but every law enforcement agency that has been forced to discuss their use of IMSI catchers denies using these features, including the FBI. But the fact that this capability is in the hands of law enforcement is still a concern.

[ACLU attorney Nathan] Wessler said “the note at the top of the page about the ability to intercept calls and text messages (in addition to the ability to geo-locate phones)” is of particular interest, because “domestic law enforcement agencies generally say they don’t use that capability.” Also remarkable to Wessler is the claim that cellphone users can be “tracked to less than 1 [meter] of accuracy.”

Just as concerning is the fact that law enforcement has routinely deployed this equipment using only pen register orders -- locating suspects using legal paperwork that's only supposed to cover numbers dialed by a phone, not its current location. With these features built in, law enforcement agencies have access to wiretap capabilities at pen register prices, in terms of the Fourth Amendment.

Also of note are the variety of IMSI catchers offered by Cobham, which include products with enough power to grab as many connecting phones as a full-blown cell tower. Others offer the capability to deny service to all phones within their reach or, conversely, grab up to 200 unique cell phone identifiers a minute. Cobham also sells body-worn companion trackers for use with its larger cell tower spoofers, designed to be worn covertly to better narrow down the location of devices.

Cobham also offers cities complete surveillance systems with IP mesh networks for securely transmitting footage, data, etc. to control centers and cameras that do more than simply watch -- they also tag, track and locate suspects. Add-ons include thermal cameras and ground sensors.

And there's so much more. A plethora of covert surveillance cameras which Cobham will gladly shove into anything from a street light cover to a smoke detector (or a splice boot, wall clock, utility pedestal…). Many of the product descriptions contain a bit of military op lingo -- which makes sense considering Cobham's history of acquiring US defense and intelligence contractors like Sparta and Argotek, along with its partnership with Northrop Grumman. (It also -- like other purveyors of surveillance/intelligence tech -- is less than discriminate as to who it sells to. Its customer list includes Pakistan, Saudi Arabia, and Singapore.) What could make more sense than selling repurposed war gear to law enforcement agencies which seemingly view themselves as both military forces and intelligence agencies?

Finally, like all good leaked documents, this catalog comes with a warning to unauthorized readers.

This catalog is the property of Cobham Tactical Communications and Surveillance and must be returned upon request.

Yeah. Let us know how that goes.

Filed Under: imsi catchers, law enforcement, spoofers, surveillance
Companies: cobham

Prosecutors Say Cops Don't Need Warrants For Stingrays Because 'Everyone Knows' Cell Phones Generate Location Data

from the we'll-let-you-know-when-you-have-an-expectation-of-privacy dept

Up in Baltimore, where law enforcement Stingray device use hit critical mass faster and more furiously than anywhere else in the country (to date...) with the exposure of 4,300 deployments in seven years, the government is still arguing there's no reason to bring search warrants into this.

The state's Attorney General apparently would like the Baltimore PD's use of pen register orders to remain standard operating procedure. According to a brief filed in a criminal case relying on the warrantless deployment of an IMSI catcher (in this case a Hailstorm), the state believes there's no reason for police to seek a warrant because everyone "knows" cell phones generate data when they're turned on or in use. (h/t Brad Heath of USA Today)

The whereabouts of a cellular telephone are not "withdrawn from public view" until it is turned off, or its SIM card removed. Anyone who has ever used a smartphone is aware that the phone broadcasts its position on the map, leading to, for example, search results and advertising tailored for the user's location, or to a "ride-sharing" car appearing at one's address. And certainly anyone who has ever used any sort of cellular telephone knows that it must be in contact with an outside cell tower to function.

The state's brief folds in parts of the Third Party Doctrine and the Supreme Court's 1979 Smith v. Maryland decision to make a truly terrible argument that because certain aspects of cell phones involuntarily create location data, the Fourth Amendment never comes into play.

Matt Blaze rephrases the state's argument slightly, exposing the ridiculousness of this assertion.

"People let people into their houses sometimes, therefore no warrant is needed to search houses". Or something. https://t.co/XncuaZvdwW

— matt blaze (@mattblaze) January 14, 2016

"People let people into their houses sometimes, therefore no warrant is needed to search houses". Or something.

The state follows this up by arguing that, because the use of a pen register order to deploy an IMSI catcher is not expressly forbidden by local statutes, the evidence shouldn't be suppressed.

There was no cellular tracking device statute in effect at the time. There was an order from a neutral magistrate, finding probable cause to authorize precisely what was done in this case; the closest applicable statute does not contain an exclusionary provision. Thus, the court erred in excluding evidence in this case.

All well and good, except that the only reason there was no statute in place is because local law enforcement spent years keeping its cell phone tracking devices hidden from judges and defendants, obscuring the technology through parallel construction and misleading pen register order requests. This case is no different than the hundreds preceding it. The magistrate judge signing the pen register order had no idea what the Baltimore PD was actually doing. The presiding judge in this prosecution declared the Baltimore PD's pen register request contained "material misrepresentations" on his way towards granting the suppression of evidence.

For the state to claim everything was above board and no Fourth Amendment violations occurred is rather audacious, considering it spent months dodging discovery requests related to the methods used to locate the defendant.

The request, asking for no more than what the State was compelled to disclose pursuant to Maryland Rule 4-263, sought: 1) "records, notes, and documents" relating to the Baltimore Police Department's investigation into a second suspect from the April 27, 2014 shooting; as well as 2) information "indicating how Mr. Andrews was located at 5032 Clifton Avenue."

Over two months later, on January 8, 2015, the State responded to the discovery request. The State claimed not to "possess information related to the method used to locate the Defendant at 5032 Clifton Avenue." (T1 9) This turned out to be false.

In fact, the state did not turn over its IMSI catcher-related information until mid-May 2015, more than seven months from the point it was originally requested. That's a long time to withhold information on a Hailstorm deployment the state now claims was both perfectly legal and intruded on no one's privacy.

Filed Under: 4th amendment, baltimore, cell phones, expectation of privacy, hailstorm, imsi catchers, police, stingrays, warrants

Documents Pried Out Of DOJ's Hands Confirm Stingray Devices Can Be Used To Intercept Communications

from the but-we-never-use-them-that-way!-never?-well...-hardly-ever! dept

Something long-believed but short of official documentation has now been confirmed: Stingray devices can intercept phone calls.

[N]ewly released documents confirm long-held suspicions that the controversial devices are also capable of recording numbers for a mobile phone’s incoming and outgoing calls, as well as intercepting the content of voice and text communications. The documents also discuss the possibility of flashing a phone’s firmware “so that you can intercept conversations using a suspect’s cell phone as a bug.”

The information appears in a 2008 guideline prepared by the Justice Department to advise law enforcement agents on when and how the equipment can be legally used.

The closest we've come to official confirmation of this capability is the DOJ's 2015 "official guidance" on Stingray warrant requirements, which noted that all devices must comply with the pen register requirements, which means the interception of phone numbers only. Any device used by agencies under its control must not use them for the interception of communications.

It also would suggest they're not allowed to use them to obtain cell site location data, as that information can't be obtained with pen register orders. The documents obtained by the ACLU (after a protracted legal battle) clarify this in the opening pages.

111. Invocation of 18 U.S.C. 2702(c)(4) to receive prospective cell site: Reliance on this provision to allow repeated, perspective collection of cell site data may be problematic. Judicious use of this provision is advised. Advise the field that the more prudent course of action is to obtain a search warrant under Rule 41 for repeated disclosures of prospective cell site information because Rule 41 has prospective effect.

The document also handily suggests that a good way to get around pen register limitations and/or warrant requirements is to just ask the service provider for the data ("a service provider can voluntarily disclose historical cell site data..."). Anything handed over voluntarily apparently doesn't implicate the Fourth Amendment, even though the location data was generated by the person with the phone, rather than autonomously by the cell phone provider. But that's the Third Party Doctrine for you.

Following that are instructions for "Emergency Wiretap Orders," which directly mentions utilizing IMSI catchers to intercept communications.

Obtain the following, relevant facts: 1) circumstances giving rise to the emergency situation; 2) who, if known, is using the target phone/facility/location; 3) how the target phone/facility/location was identified; 4) when the phone/facility/location was last known to be used; 5) most recent criminal activity; and 6) basis for belief that phone/facility/location will be used for communications concerning the crime, i.e. what evidence is there that the perpetrator is acting in concert with others -- what communications will be obtained.

More confirmation here, in wording that is echoed by the DOJ's 2015 cell tower spoofer guidance:

Digital analyzers/cell site simulators/triggerfish and similar devices may be capable of intercepting the contents of communications and, therefore, such devices must be configured to disable the interception function, unless interceptions have been authorized by a Title III order.

And for those of you who'd like to play along at home, several of the pages can be printed out and used for your own game of Stingray court order Mad Libs.


You won't have to read all the way to the end, though. Most of the interesting stuff happens in the first few pages, but in true bureaucratic fashion, the bulk of the 71 pages is made up of duplicated responsive documents.

These documents, of course, only deal with the DOJ and its agencies. Whatever's being issued as guidance here doesn't necessarily carry over to local law enforcement agencies using these devices. Considering the intense secrecy surrounding IMSI catchers, it's safe to say they've been deployed to collect communications without a warrant (or at least a warrant that directly refers to the device and its intended use), and we do know they've been using them as ad hoc tracking devices by grabbing cell site location data. When the lid finally comes off entirely, I'm sure we'll see a great number of constitutional violations tracing back to IMSI catchers.

Filed Under: doj, fake mobile towers, imsi catchers, stingray, surveillance