The Secrecy Surrounding The Use Of Stingray Tracking Devices

Stingray Mass Surveillance

The police and other government organizations have at their disposal a new tool designed specifically for mass surveillance. This device is designed to duplicate cell phone signals which in turn allows it to break into cellular phones of anyone, intercept data, and even track the phone's location. Surveillance of this type, with such a broad reach, is unlikely to ever qualify for any type of conditional warrant and could ultimately capture private information not associated with any investigation at all. In fact, it’s design almost guarantees this.

This new surveillance hardware is known as a stingray and was designed for use by the American military in foreign theaters of operation. The stingray was intended to capture the communications and data streams of terrorist cells, relay the information to U.S. forces, and ultimately record and store all data to be researched later.

Currently the stingray is being used domestically in at least 23 states as well as the District of Columbia by the National Security Agency, the Federal Bureau of Investigation, the Drug Enforcement Administration, the Bureau of Alcohol, Tobacco, Firearms and Explosives, Immigrations and Customs Enforcement, the Department of Homeland Security, the US Marshals Service and the Internal Revenue Service.

Not surprisingly police agencies are hesitant to discuss the use of the stingray publicly. In fact the federal government requires nondisclosure agreements before allowing state and local governments to access the stingray. These nondisclosure agreements prevent them from discussing any aspect of the technology including its nature, the capabilities of the stingray device, as well as the far-reaching and extensive data that the device can collect. The NDA extends even to trials and empowers the federal government to force cases to be dropped in order to protect the nature of the device.

Consider the stingray with the 4th Amendment in mind,

“The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.”

The power of the stingray brings into question the 4th amendment the very moment it's turned on. When the NDA that state and local governments must sign is brought into play a lack of transparency is also placed over the use of this device. With little transparency, the need for accountability is diminished and it would seem that the moment this device is used someone's rights are being violated by default.

The Technology Behind Stingray

Stingray Tracking Device

In the past, cellular phones were tracked by police using cell tower data collected in cooperation with the wireless carriers. Using a combination of specific warrants including trap and trace orders, local police could force carriers to turn over their data which would empower law enforcement to track specific phones. Essentially the police would triangulate any given phone using multiple carrier cell towers.

Although stingrays are essentially a black box of which the full power is unknown to the public, some information has been collected via trial discovery and civil liberties advocates. It is known that the device has empowered government agencies to track cell phones without the need of cell carrier cooperation thus removing the need for a judicial warrant.

Stingrays are sometimes referred to as cellular-site simulators. Cell phones in the area of the stingray will view it as a cell phone tower. Instead of automatically connecting with whatever the closest tower is the citizen’s phone will use the stingray instead.

Cell phones connect and disconnect with these towers automatically without alerting the user, which of course removes any idea of consent. In fact, most cell phones seek out the strongest signal in a given area. This means even when there are working towers in given service area a stingray operator could theoretically boost its power in order to make itself more attractive. This would essentially allow for local phones to choose the stingray over a legitimate cell tower.

Once any given phone is connected to a stingray device it can be tracked and any information being transmitted can be captured.

Every cell phone is assigned an IMSI, which stands for International Mobile Subscriber Identity. Once this unique number is known by the stingray, the phone can be located without outside assistance.

Previously, the IMSI was a key component often requested by the government from the cell carriers in order to locate users. If carriers were unwilling to reveal that information warrants could be used to compel them to do so. None of this is necessary any longer as the stingray can force phones to connect to it, pull any information it wants out of the phone, and then anyone with access to the device could view personal data or the IMSI for tracking purposes.

Once the IMSI for the target phone is known by the stingray, then all IMSI numbers for the phones in the target's location can be collected.

Although it is unknown to what degree the stingray can capture information from any given device, there is reason to believe that they can access and record SMS, text messages, browser activity, and any phone calls the citizen made. The electronic surveillance manual published by the Department of Justice does allows for broad ranged personal data collection. This excerpt touches on that:

If the cellular telephone was used to make or receive a call, the screen of the cell site simulator would include the cellular telephone number, the calls incoming or outgoing status, the telephone number dialed, the cellular telephones ESN, the date, time, and duration of the call, and the cell site number/sector and similar devices.

The DOJ did release its policy for the use of stingrays domestically:

Cell site simulators used by the department must be configured as pen registers, and may not be used to collect the contents of any communication in accordance with 18 USC 3127 (3)

While it is encouraging that the DOJ is attempting to limit some uses of the stingray with this policy, it is important to note that there was no claim that the current stingray device was unable to rip content from a phone. In fact, by prohibiting the use of the stingray in its policy, the DOJ is suggesting that the device can most certainly do this.

The stingray can definitely provide accurate location data for its targets. In official testimonies law enforcement officials stated that the device gave them the ability to track the cell phone within 6 feet of its actual location and identify a specific phone within a highly populated apartment complex.

Creation, Management and Control

The primary manufacturer of the stingray is the Harris Corporation based in Florida. In 2010, they started negotiating with the FCC to begin licensing stingray technology to state and local law enforcement expanding their market from the U.S. military and federal agencies. The license stipulated that the FBI would manage any domestic acquisition of the stingray by local authorities.

In order to maintain control of the technology, the FBI requires that any state or local authority sign a nondisclosure agreement before it is allowed access to a stingray device. This NDA could be interpreted to mean the prevention of disclosure of the agreement itself.

In 2015, a New York Supreme Court ruled in favor of the New York Civil Liberties Union against the Sheriff's office which compelled disclosure of an unredacted copy of the NDA. The document included provisions that covered a range from training on the device, a requirement that the local agencies keep the device secret from any public information requests, as well as an agreement that allows the FBI the power to drop local criminal cases if they would compromise the secrecy of the stingray technology. Law enforcement agencies are similarly prohibited from releasing any information about the technology through disclosure or any other civil or criminal proceeding.

Now, along with the obvious 4th Amendment questions the stingray raises, the FBI NDA now brings into question a new separation of powers problem. A state uses federal funding and exercises authority to sign a federal NDA that prohibits them from informing local authorities on the use of what the funding is paying for. They then use a potentially illegal technology without the ability to even investigate the legality of the stingray device. The lack of transparency then compels silence on all fronts from anyone involved in the purchase, use, or management of the technology.

Anything shrouded in such secrecy is going to raise flags and the stingray is no exception. With so much power being used to keep the public ignorant, it seems increasingly likely that there have been some abuses made with the technology. Now that the courts and the ACLU are actively pressing the matter, more information will come to light.