Have you heard of the Stingray? Not the sleek, underwater fish that are
related to sharks, but the cellular intercept system? These things do
not make the news often,
and law enforcement is just fine with that. In fact, you can almost
hear the officials thinking, “Move along, nothing to see here.”
News
10, the ABC affiliate based in Sacramento, California, has been
conducting an investigation into law enforcement agencies in California
and how many of them have equipped themselves and have been using
Stingray mobile surveillance gear.
For several months, News 10
has been making formal public records requests to obtain data that shows
where these Stingrays are being procured. While several agencies
provided documentation (albeit heavily redacted), none of them would
acknowledge even owning the devices, let alone how they work.
There
is more than one company that makes this kind of equipment, but the big
player in this space is Harris Corporation, a major industrial and
defense systems company. Based in Florida, Harris provides products and
services for everything from air traffic control systems and
communications technology to advanced space-based solutions. In other
words: über high-tech.
The Stingray (along with other names it is
sold under in a variety of configurations) literally poses as a cell
tower. When our phones hand-off from one cell to another, a Stingray
takes its place and acts like a man-in-the-middle. Functionality is
apparently seamless enough that the cell phone user will never know the
difference.
|
|
The Stingray and the Stingray II, tools used by law enforcement to capture cell phone data |
These
systems cost hundreds of thousands of dollars and many of them are
provided through grants given to the police agencies (read as: taxpayer
money from the federal government). The San Jose Police Department, in
the heart of Silicon Valley, while preparing its grant application,
sought feedback from other entities that were known to use the Stingray
and got responses from the City of Oakland, City of San Francisco,
Sacramento County, San Diego County, the City of and the County of Los
Angeles.
The justifications being provided by these police and
sheriff departments on grant applications is in the pursuit of, and to
disrupt terrorist plots to protect civilians and critical
infrastructure. While that is a worthwhile cause, News 10’s acquisition
of arrest records from Los Angeles and Oakland show that Stingrays are
being used on routine enforcement action. This is called “mission
creep” and it is something that is apparently quite common with tools
used in law enforcement.
News 10 was able to gather information
related to the Sacramento County Sheriff’s Office which has confirmed
the department does actually own a Stingray, and that they use it.
However, beyond that, the Sheriff’s office has refused to answer any
additional questions, due, in part, to a non-disclosure agreement, which
apparently all the police departments need to sign with Harris.
Moreover, the department has also refused to state whether surveillance,
searches and data gathered by the Stingray was conducted under
authorization of a search warrant.
The department did state that
its “cell site simulator” was used infrequently enough to locate
suspected felons or kidnapped individuals. Sacramento Sheriff’s Office
also stated that it does not retain any data gathered from people whose
devices may have been picked up by Stingray, but not the target of any
investigation.
Therein lies the rub, when outdoors, in public,
and using your device, there is arguably a reduced expectation of
privacy per se. However,
recent Supreme Court rulings definitely set that expectation
when it comes to mobile devices like smartphones, a warrant is required
for police to search mobile devices as part of an investigation or even
during a routine arrest. Furthermore, because of the range a cell-site
has, people in their residences may be scooped up in the data net.
Many people no longer use land-lines for phone service, preferring their
mobile phones. In one’s residence, there is most definitely an
expectation of privacy.
|
From this visual, it is easy to see that Stingray can capture activity where there is an expectation and requirement of privacy |
As
for what Stingray can or cannot do, the most common configuration
allows the identification of the mobile phone, numbers of calls sent and
received, numbers of SMS messages sent or received, and GPS data. It
is not set up to provide active intercept abilities of phone calls or
texts, however, the terminology of “set up” certainly means the ability
is there.
For what it is worth, the arrest records that News 10
reviewed showed that while Stingray was being used in routine
enforcement actions, it was not for stuff like speeding tickets. In
Oakland, 38 people were arrested during a two-year period where the
crimes were homicide, attempted murder, kidnapping, and robbery.
Does
that mean Stingray is being used as judiciously at the 25-plus other
agencies across the country that are known to use it? That answer is
not certain. Nine states have passed legislation which placed legal
limitations on the use of the Stingray, but the technology itself does
not know such limitations. What is certain is that the Stingray is
enough of a guarded secret that police departments and other law
enforcement agencies, and the manufacturer, would prefer you do not know
anything more about them. Privacy advocates are not encouraged.
Below are scanned images of procurement records from the San Jose
Police Department. There are several more records of Stingray
procurements via the second News 10 source link below.
San Jose Police Department StingRay by Kxtvweb
