Congress Forces FCC To Go Beyond Its Tame, 'Voluntary' Anti-Robocalling Plan

from the ill-communication dept

Last June you might recall that the Trump FCC unveiled a new robocall plan that it claimed would finally put the annoying problem to bed. And while the tech press tripped over itself to suggest the plan was a dramatic departure from FCC robocall policies of the past, the reality is there was little to nothing in the plan that was actually new. As is often the case with this FCC, a coagulation of half-measures, already existing efforts, and empty nonsense were just kind of thrown together in a pile and deemed to be something new and revolutionary.

The biggest change was FCC rule adjustment that would let wireless carriers install robocalling blocking tools on consumer devices by default, in contrast to the current paradigm where consumers have to opt in (assuming the tools are offered at all). But while the plan urged wireless carriers deploy anti-spoofing technology like SHAKEN/STIR to help prevent robocallers from hiding their real numbers, there was absolutely nothing in the plan that actually requires they actually do so. Because hard, clear rules with genuine accountability make AT&T and Verizon mad, you see.

Not surprisingly, the voluntary measures weren't likely to actually drive massive telecom companies to actually shore up their anti-robocall efforts. There were also justified concerns that as wireless carriers deployed anti-spoofing technologies, they'd use the opportunity to further price gouge US consumers. Realizing this, Congress passed the Traced Act, which would require wireless carriers provide anti-spoofing tech to consumers at no additional cost.

Amusingly, last week FCC boss Ajit Pai announced he was considering making deployment of SHAKEN/STIR anti-spoofing technology mandatory. In the FCC announcement, Pai tries to frame the effort as something he came up with on his own, despite the fact he was actually being mandated to do so by Congress:

"Pai framed it as his own decision, with his announcement saying the chairman "proposed a major step forward... to protect consumers against spoofed robocalls." But in reality the FCC was ordered by Congress and President Trump to implement this new rule. The requirement on the FCC was part of the TRACED Act that was signed into law in December 2019. Pai previously hoped that all carriers would deploy the technology voluntarily."

Pai didn't actually release his plan, but when he does it's likely to just mirror what was already established by new law. The problem remains that the Pai FCC will still need to be tough with giant companies that lag on deploying this technology, and, given the agency's tendency to roll over and bare its tummy on feckless fealty to industry, actual follow through will likely prove hard to come by, especially if bigger, more politically potent companies are the ones lagging behind.

Filed Under: ajit pai, congress, fcc, robocalling, robocalls, shaken/stir, spoofing

Senator Wyden Asks DHS To Look Into Cell Tower Spoofer Use By Foreign Entities In Washington DC

from the why-hasn't-the-homeland-security-agency-looked-into-this-already? dept

A few years back, news broke about the apparent existence of stationary cell tower spoofers in the Washington DC area. While some could conceivably have been operated by local law enforcement, the location of the fake cell towers suggested they might be the work of foreign actors.

Continuing a sort of cross-country tour to detect phony cell towers, also known as interceptors or IMSI catchers, researchers associated with the security firm ESD America have detected 15 of the covert devices in Washington D.C., plus three more in nearby Virginia.

The company used their ultrasecure CryptoPhone 500 to search for the interceptors, which can compromise phones through baseband hardware and are believed to have a range of roughly 1 mile. ESD America's phones allegedly detected telltale signs of call interception in the vicinity of the White House, the Russian Embassy, the Supreme Court, the Department of Commerce, and the Russell Senate Office Building, among other landmark buildings.

Since then, not much has changed. Or if it has, no updates have been issued. Apparently, the fake cell towers are still there and in use, unmolested by local law enforcement or federal agencies. Ron Wyden would like someone to do something about it and has sent a letter [PDF] to DHS Under Secretary Christopher Krebs, asking the agency to look into it.

In 2014, security researchers reported that they detected a number of IMSI catchers in the National Capital Region, which they suggested may have been operated by foreign governments. The Federal Communications Commission (FCC) subsequently established a task force to investigate the threat posed by foreign governments and criminals using IMSI catcher technology. Unfortunately, the FCC has yet to issue any public findings or guidance since then.

Whether foreign intelligence services and criminals are using IMSI catchers to spy on senior members of the US. government is undoubtedly a question worth answering. Foreign government surveillance of senior American political and business leaders would obviously pose a significant threat to our country's national and economic security.

Wyden would like to know if the DHS has seen any firsthand evidence of these tower spoofers and if it has provided any of this info to Congressional committees. He also wants to know if the DHS has the technology to detect and locate these IMSI catchers and, if not, wants to know what it needs to begin the hunt for foreign surveillance devices.

Certainly the DHS has the tech to do its own cell tower spoofing. A recent FOIA request by Buzzfeed found the DHS has been deploying Stingray devices about once a day for the last three years. A cell tower spoofer isn't the best tool for detecting other cell tower spoofers, but it could turn into a DC-based Spy vs. Spy operation, with the DHS running its equipment to locate competitors' foreign-owned equipment, with the inherent escalation that scenario implies.

The thing about cell tower spoofers is they can be used to intercept communications. That functionality is available, although we have yet to see (acknowledged) use of Stingray devices to eavesdrop here in the US. The tacit agreement to limit Stingray use to locating cell phones is not without its own issues, but there's no agreement, unspoken or otherwise, limiting foreign entities from intercepting phones calls and text messages with their devices. (Undoubtedly, any cell tower "listening posts" deployed by the US in other countries would be similarly unaffected by voluntary limitations on domestic deployment.)

If answers are given to Wyden, it's highly doubtful we'll see them. US agencies are still completely uncomfortable discussing their own tower spoofers. Evidence of communications interception by foreign agencies will likely be buried under black ink and discussed behind closed doors.

Filed Under: dhs, imsi catcher, ron wyden, spoofing, stingray, surveillance, washington dc

CIA Worked With DOJ To Re-Purpose Foreign Surveillance Airborne Cell Tower Spoofers For Domestic Use

from the I-got-a-name-and-I-got-a-number-I-got-a-line-on-you dept

The CIA's recent rebranding as Valhalla for US cyberwarriors notwithstanding, the agency's general focus has been intelligence gathering on foreign governments, corporations and people. That it has often mistaken "torturing people into saying whatever they can to make it stop" for "intelligence gathering" isn't necessarily germane to the following discussion, but it's worth noting that the CIA is almost single-handedly responsible for destroying the term "extraordinary rendition" -- a formerly innocuous (and complimentary) term previously used to highlight something like, say, Johnny Cash's amazing cover of Soundgarden's' "Rusty Cage." (That Cash's two best covers are "Hurt" and "Rusty Cage" is not germane to the discussion of CIA torture programs, but what a coincidence!)

But the emphasis here is foreign. Which is why the following news makes so little sense.

The Central Intelligence Agency played a crucial role in helping the Justice Department develop technology that scans data from thousands of U.S. cellphones at a time, part of a secret high-tech alliance between the spy agency and domestic law enforcement, according to people familiar with the work.

The CIA and the U.S. Marshals Service, an agency of the Justice Department, developed technology to locate specific cellphones in the U.S. through an airborne device that mimics a cellphone tower, these people said.

"These people" are likely keeping both eyes on their backs at this point, considering this revelation sheds more light on two things both agencies would like to keep in permanent darkness: the CIA's involvement in domestic surveillance and the US Marshals' airborne "dirtboxes," which are hoovering up tons of phone call info using high-flying IMSI catchers.

The planes fly from five US cities and cover "most of the US population," according to the Wall Street Journal and its unnamed sources. The technology appears to have debuted overseas under the CIA's auspices. Nothing about that fact is surprising or, indeed, of major concern in terms of US civil liberties (although likely not welcome news for any foreign citizens in the CIA's coverage area). What is more surprising -- or rather, disappointing -- is that the DOJ saw the foreign surveillance tech deployed by the CIA and said, "We could really use this here. In the US. On our fellow Americans."

Not only that, but if the CIA is involved in any significant way, there are some legal issues that need to be discussed.

The CIA has a long-standing prohibition that bars it from conducting most types of domestic operations, and officials at both the CIA and the Justice Department said they didn’t violate those rules.

Phew. [Wipes brow.] Oh. Wait. The DOJ utilizing CIA dirtboxes to surveill US citizens probably breaks some rules. (The courts will probably have to sort this out -- and, unfortunately, there's a chance they'll find otherwise.) But that's not what the DOJ is saying. It's saying that the CIA doesn't violate the "don't conduct [most types] of domestic surveillance" rules. Which is probably true. It just hands of the tools of totalitarianism to the DOJ and the domestic side of the equation takes over. It's wrong because it subverts the roles of both agencies but it's technically right because the DOJ's agencies do the actual surveillance -- not the CIA. That's how that works. Technically legal. But wrong in just about every other way.

It isn't as though the DOJ just stopped by to ask about the CIA's flying machines. It had a very active role in the creation of the domestic Mile High Spy Club.

For years, the U.S. Marshals’ Technical Operations Group worked with the CIA’s Office of Technical Collection to develop the technology. In the early days it was the CIA that provided the most resources, said the people familiar with the matter.

For now, it's the unnamed "people" vs. the public front-mouths for various incestuously intertwined intelligence/law enforcement agencies. Last last year, the DOJ was asked to explain its flying cell tower spoofers, but the best defense it offered was, "Hey, at least it's not the Section 215 program," along with a half-assed Glomar ("neither confirm nor deny") that admitted more than it withheld.

The CIA is likewise mostly silent on the matter, offering up only the weak defense that the CIA has given other stuff to domestic agencies and that's all been perfectly legal. Likewise the DOJ… again with its "We're not the NSA" assertions meant to make it look like Captain Fourth Amendment by comparison:

A Justice Department spokesman said Marshals Service techniques are “carried out consistent with federal law, and are subject to court approval.” The agency doesn’t conduct “domestic surveillance, intelligence gathering, or any type of bulk data collection,” the spokesman said, adding that it doesn’t gather any intelligence on behalf of U.S. spy agencies.

But it's not just metadata or call records. The CIA-built, DOJ-deployed devices also listen in.

In 2005, the CIA gave the Marshals Service technology to conduct “silent stimulation” of those types of cellphones, both for identifying them and, with a court order, intercepting the communications, these people said.

So, according to the DOJ, it doesn't participate in bulk data collection. But an untargeted device that flies overhead and forces all phones in range to submit to its advances isn't anything but a bulk data collection. Sure, there may be an eventual target, but until that target is acquired, everything else gets swept up into the DOJ's flying coffers. Even with "catch-and-release" -- the least intrusive form of cell tower spoofing -- innocent Americans are still at the mercy of the government as spoofers gather communications, cut off data usage and force all phones to the least technologically-advanced connection possible.

The DOJ's excuses are horrible, especially in light of the surveillance tool's origins. If the Wall Street Journal's sources are correct, the DOJ re-deployment of foreign intelligence gathering tech makes it the Victor Kiam of domestic spookery: "We liked it so much, we used it on our own people!"

Filed Under: cia, doj, domestic surveillance, fbi, imsi catchers, spoofing, stingray

Law Enforcement Agencies Scramble For Pricey Cell Tower Spoofer Upgrades As Older Networks Are Shut Down

from the losing-the-tech-arms-race-to-slow-moving-service-providers dept

The surveillance device that dare not speak its name (thanks, FBI!) is on its last legs… or at least one version is. Cyrus Farivar at Ars Technica reports that law enforcement agencies are moving quickly to avoid being locked out of the cell tower spoofing racket.

Documents released last week by the City of Oakland reveal that it is one of a handful of American jurisdictions attempting to upgrade an existing cellular surveillance system, commonly known as a stingray.

The Oakland Police Department, the nearby Fremont Police Department, and the Alameda County District Attorney jointly applied for a grant from the Department of Homeland Security to "obtain a state-of-the-art cell phone tracking system," the records show.

The Stingray is Harris Corporation's most infamous product. But the original version has its limitations. While the nation's cell phone carriers have largely moved on to 3G/4G networks, Stingray devices without optional upgrades haven't. All they can access is 2G, the default connection when nothing better is available. Those looking to capture cell activity on 3G and 4G networks will need to purchase Harris' "Hailstorm" upgrade… which also means they'll need to start generating paperwork and asking federal and local governments for funds. The problem with these actions is that they have the tendency to expose those in need of new capabilities.

Other locales known to be in the process of related federally-funded upgrades include Tacoma, Wash.; Baltimore, Md.; Chesterfield, Va.; Sunrise, Fla.; and Oakland County, Mich. There are likely many more, but such purchases are often shrouded in secrecy.

FOIA requests have turned up some information, but much of it is redacted and many more requests have been refused or ignored. With the federal government itself instructing local law enforcement to cover up its acquisition and use of tower spoofers, the FOIA process becomes even more of an uphill battle.

Law enforcement can't be happy to see 2G networks being switched off. When you're in the untargeted dragnet business, 2G is a willing supplier of "business records."

2G networks are notoriously insecure. Handsets operating on 2G will readily accept communication from another device purporting to be a valid cell tower, like a stingray. So the stingray takes advantage of this feature by jamming the 3G and 4G signals, forcing the phone to use a 2G signal.

What's considered a criminal act when performed by a civilian is just SOP for law enforcement. The same can be said for the fake sworn documents (warrant requests, subpoenas) obtained to cover the use of these devices. The manufacturer with the most devices in use is no better than the agencies it sells to. When approached about this scramble for upgrades, Harris Corporation borrowed the NSA's Glomar.

"We do not comment on solutions we may or may not provide to classified Department of Defense or law enforcement agencies," Jim Burke, a spokesman for Harris, told Ars.

The timeline for 2G shutoff is still vague. Verizon says "by the end of the decade." AT&T says 2017. So there's still some time for law enforcement agencies to avoid being bypassed by the slow rollout of network upgrades. But between now and then, these agencies need to put together nearly $500,000 just to stay current. And as usual, as much as possible about the process will be obscured, because otherwise the terrorists criminals win.

"Once that's disclosed then the targets of the technology will know how to avoid it," [Alameda County Assistant DA Michael] O’Connor, the assistant district attorney, told Ars. "Once the bad guys understand how to beat it then they will."

It seems like all the bad guys would need to know is that the technology exists and is being used and just stay off their cell phones. But in this day and age, being completely unconnected while away from home is untenable, if not nearly impossible. Communication is key in criminal enterprises, and the steady disappearance of pay phones doesn't leave them with many options. O'Connor completely overstates the "exposure" danger and follows it up with this:

"It can't easily be resolved—the public's right to know, the Fourth Amendment rights of people who might be subject to this kind of analysis and the needs of law enforcement to keep sources confidential especially in a day and age when the bad guys have acquired considerable technology that is turned against good guys."

One: if it can't "easily be resolved," why not err on the Fourth Amendment/public knowledge side, rather than on the cop side? Two: the bad guys' "considerable technology" isn't lapping law enforcement's. This ridiculous claim has been used as justification for warrantless cell phone searches, and it failed to move the Supreme Court justices. Pushing this narrative now just makes the pusher look like the sort of credulous rube who would put together a Powerpoint presentation on food-trucks-as-terrorist-vehicles.

The bright side here is that more paperwork is being generated… which eventually means more of the public will know their local law enforcement is scooping up their location/connection info (most likely without a warrant) at any given time and is not above killing their network to do it.

Filed Under: 2g, 3g, hailstorm, law enforcement, non-disclosure agreements, police, privacy, spoofing, stingray, tower spoofing
Companies: harris corp.

Judge Tells ACLU It Can't Make The US Government Give Back The Stingray Records It Removed From A Florida Police Department

from the not-even-a-wrist-slap dept

The federal government doesn't want local law enforcement agents turning over cell tower spoofer documents. It has spent a great deal of time behind the scenes advising the agencies to withhold information from requesters, citing "security" and the fear of disclosing "methods" in defense of its actions.

In Sarasota, FL, it took a more overt route, sending US Marshals to seize responsive Stingray documents from the local police department. This time, it claimed it had "deputized" a department detective, making him part of a regional task force. As such, the records now "belonged" to the US Marshals Service and could not be turned over to the ACLU.

The ACLU responded to by filing an emergency injunction seeking to prevent US Marshals from confiscating any more SPD documents, as well as asking it to find that local law enforcement violated Freedom of Information law by handing over requested documents to the federal government.

The judge has now ruled on this motion, and almost everything about it is bad. In his decision, Judge Charles Williams found that his court had no jurisdiction over the federal agency and dismissed the case. But other concerns went unaddressed.

When Sarasota Circuit Judge Charles E. Williams issued his order dismissing the lawsuit, there was nothing about this act by the federal government to essentially abscond with documents to prevent them from potentially becoming public. In fact, the judge did not hold an appropriate hearing on the evidence, even though [Michael] Barfield [ACLU of Florida] had wanted one to resolve key issues.

The ACLU is also “mystified” because Williams included in his latest order a statement that suggests the ACLU did not “challenge as a matter of fact to the representation of the United States government as to the status of Detective Jackson.”

Williams did order the government to turn over Stingray-related applications and orders that have already been filed under seal, but did not offer to lift that seal, meaning the ACLU will be returning to court to attempt to unseal the documents. But this doesn't mean Sarasota's Stingray documents will make their way into the public domain anytime soon.

[A]ccording to Barfield, the federal government “may not comply with the order. They did not seem to think the judge could order them to do anything and even implied they could “remove the case to federal court.”

Once again, we have to ask what's in these documents. The federal government is obviously going above and beyond to ensure the information stays out of the public's hands. Maybe it's just the government's collective paranoia over "means and methods" of surveillance. Or maybe it's something more egregious, like the 200+ times Tallahassee (FL) police deployed Stingray devices without a warrant. Either way, it sends a strong signal to the constituents that the only real right they have is the right to be surveilled.

Filed Under: foia, freedom of information, mobile phone spoofing, sarasota, spoofing, stingray, us marshals
Companies: aclu, harris

When Aaron Swartz Spoofed His MAC Address, It Proved He Was A Criminal; When Apple Does It, It's Good For Everyone

from the only-the-second-one-is-true dept

Whenever we write about Aaron Swartz and the criminal prosecution against him, some of our (and Aaron's) critics scream that it was "obvious" that he knew he was up to no good, because he chose to spoof his MAC address on the machine he used to download JSTOR articles. Of course, as many people explained, spoofing a MAC address isn't some crazy nefarious thing to do, and often makes a lot of sense. In fact, Apple recently announced that iOS 8 will have randomized MAC addresses to better protect people's privacy. Simply speaking: Apple is making "MAC spoofing" standard. And, as the folks over at EFF are noting, this is a very good thing for your privacy.

As Cory Doctorow points out, this highlights the ridiculousness of MAC spoofing being used as evidence against Swartz, when now it's going to be a standard feature of iPhones and iPads (and, hopefully, other device makers will quickly follow suit).

This, of course, is one of the unfortunate results when you have law enforcement folks who simply don't understand much technology. People who actually understand both privacy and the ways you might approach problems you face on the internet, recognize that things like MAC spoofing are perfectly reasonable to do at times -- but such actions are twisted by law enforcement as being nefarious and dangerous because it makes it easier to "build a case" and because they don't understand how perfectly common such actions are.

Filed Under: aaron swartz, ios, mac address, privacy, spoofing

Administration Helping Bury Documents Related To Local Law Enforcement Use Of Cell Tower Spoofers

from the widening-the-gap-between-'us'-and-'them' dept

The recent story about the US Marshals Service stepping in to prevent the ACLU from obtaining documents related to the Sarasota (FL) Police Department's ownership and use of cell tower spoofers is apparently not an isolated instance. According to an AP report, the US government is actively inserting itself into the "discussion" by ensuring no one gets to talk about the controversial devices.

The Obama administration has been quietly advising local police not to disclose details about surveillance technology they are using to sweep up basic cellphone data from entire neighborhoods, The Associated Press has learned.

Citing security reasons, the U.S. has intervened in routine state public records cases and criminal trials regarding use of the technology. This has resulted in police departments withholding materials or heavily censoring documents in rare instances when they disclose any about the purchase and use of such powerful surveillance equipment.

Beyond the obvious negative impact on the much-vaunted "transparency" this administration claims to personify, there's also the new disturbing level of overreach -- the US government actively interfering with state-level Freedom of Information requests. In addition to the restrictive non-disclosure agreements that law enforcement agencies must sign when purchasing Stingray devices (and these agencies' general reluctance to share surveillance equipment info with the public), the government itself is taking an active role in erecting a wall between the public and its public servants.

Interviews, court records and public-records requests show the Obama administration is asking agencies to withhold common information about the equipment, such as how the technology is used and how to turn it on. That pushback has come in the form of FBI affidavits and consultation in local criminal cases.

Harris, the largest manufacturer of cell tower spoofers, specifically directs law enforcement to consult with the FBI during the purchase process, as well as before deploying the devices. The company claims this is all above board because it's "regulated" by its status as a government contractor. That might mean something if it wasn't so closely aligned with these government agencies' desire to keep the technology secret.

And, of course, the government has used its go-to defenses to justify its secrecy efforts. Above, it mentioned "security." A supporting affadavit filed by an FBI agent in a Freedom of Information lawsuit adds another:

A court case challenging the public release of information from the Tucson Police Department includes an affidavit from an FBI special agent, Bradley Morrison, who said the disclosure would "result in the FBI’s inability to protect the public from terrorism and other criminal activity because through public disclosures, this technology has been rendered essentially useless for future investigations."

Morrison said revealing any information about the technology would violate a federal homeland security law about information-sharing and arms-control laws…

Once you strip out all the panicky trappings, the FBI is basically asserting that it, and the law enforcement agencies it's speaking in support of, should be allowed to do what they like with zero accountability. These agencies want to have the ability to collect massive amounts of data without being slowed by warrant requests or minimization processes.

These exposure fears are unfounded, and those using them to justify withholding information know this. This secrecy has been used to seal returned warrants and court orders on closed investigations, giving lie to the claim that these agencies are concerned about damaging current and future investigatons. And, realistically, the only way terrorists or criminals are going to be able to completely avoid Stingray surveillance is to not use or carry cell phones, something that seems highly unlikely. For this to be any use to them, they would have to know in advance where it's being deployed and when.

The real reason behind the collaborative burial of information is the agencies' desire to do what they want without limitations or paper trails. This sort of behavior should be an indicator of a law enforcement agency that's gone rogue, rather than an all-too-common collaborative effort between local and national government agencies.

Filed Under: cell phones, cell tower spoofing, doj, federal government, freedom of information, spoofing, stingray, transparency, us marshals
Companies: harris

Michigan State Politicians Looking Into Sheriff Department's Use Of A Cell Tower Spoofer

from the 'we-haven't-discussed-it-because-9/11' dept

More news has surfaced of cell tower spoofers being deployed without the public's knowledge. This time it's the Oakland County (Michigan) Sheriff's Department rolling out an upgraded Stingray device from Harris Manufacturing, known as "Hailstorm." The sad thing here is that the opportunity for public input presented itself pre-rollout but local politicians slept on the issue.

Oakland County commissioners asked no questions last March before unanimously approving a cellphone tracking device so powerful it was used by the military to fight terrorists.

Now, though, some privacy advocates question why one of the safest counties in Michigan needs the super-secretive Hailstorm device that is believed to be able to collect large amounts of cellphone data, including the locations of users, by masquerading as a cell tower.

“I don’t like not knowing what it’s capable of,” said county Commissioner Jim Runestad, R-White Lake Township, who has met in recent weeks with sheriff’s officials about his concerns.

Harris, as it has been noted, heads off criticism and the impertinent questions of the public by tying up law enforcement officials with restrictive non-disclosure agreements. These NDAs have proven handy for some LEOs -- particularly in Florida where officials made the case that the restrictions of the contract prevented them from seeking warrants before using the cell tower spoofer.

State politicians are now attempting to have a belated discussion of the technology's privacy implications, thanks in part to prompting by local journalists. The Michigan House Oversight Committee brought in Christopher Soghoian, policy analyst from the ACLU and former magistrate judge Brian Owsley. (Recording embedded below.)

Soghoian's concerns aren't simply about the privacy implications or the secrecy Harris has shrouded its technology in, but also the fact that there's no way to track misuse of the equipment.

What’s particularly worrisome is there is no telltale sign they’ve been used, Soghoian said: “It doesn’t leave a trace. No one would ever catch you.” That means no one would know if police misused the device or activated it without a warrant, Soghoian said.

Owsley, in his statement to the committee, noted that the first time discussion of this technology occurred in his courtroom, it was presented by law enforcement as something along the lines of a pen register. As Owsley points, all it takes in most cases to get a pen register granted is a pulse. As long as both the magistrate judge and the law enforcement official are technically alive, the pen register will be signed off on.

That law enforcement portrayed cell tower spoofing in this fashion is no surprise, since it gives them the greatest chance of securing permission to deploy it. (The NSA/FBI did the same thing in order to push through its bulk phone metadata program.) Unlike regular pen registers, however, Stingrays/Hailstorms are deployed in cases where law enforcement may not even have a known phone number. Instead, they may be working off a list of numbers potentially tied to the subject of their investigation, or are just waiting for communications to originate from a certain location.

Now that the technology is finally being questioned, representatives of the Oakland County Sheriff's Department are stepping up to defend their acquisition.

Undersheriff Michael McCabe said, “Hailstorm helps us capture fugitives from the law, people wanted for murder and rape” and can be used only with a search warrant. He said the federal Homeland Security Act bars him from discussing Hailstorm, but he elaborated at length about what it doesn’t do.

Interestingly, McCabe cites the Homeland Security Act as prohibiting discussion, rather than the manufacturer's restrictive NDA. The county also cited "homeland security" terminology in its refusal to release requested documents about the Hailstorm device.

The county denied The News’ Freedom of Information Act request, saying the information is protected by anti-terror laws and includes “investigating records compiled for law enforcement purposes that would disclose law enforcement investigative techniques or procedures.”

Law enforcement officials in one of the safest counties in Michigan are conjuring up terrorism as an excuse for deploying a questionable device, as well as to avoid having to answer any tough questions about its capabilities or usage.

Undersheriff McCabe claims the device is used to go after "people wanted for murder and rape," while simultaneously claiming the DHS won't allow the department to talk about its non-terrorist-related use. He also claims it's not used without a warrant, a statement the county itself isn't allowing anyone to verify. (Among the documents requested were returned warrants on closed cases.) The Sheriff's Department refuses to discuss the technology (other than to highlight how great it is at catching bad guys) or back up its statements with documentation and somehow expects the public to be just fine with all of this. With state politicians now looking into its Hailstorm usage, the normal combination of obfuscation and bluster likely won't keep these details secret for much longer.

Filed Under: hailstorm, michigan, mobile phones, oakland county, privacy, spoofing, stingray
Companies: harris manufacturing