![\"\"](\"\/wp-content\/uploads\/2015\/06\/_d_improd_\/2680257100_69b12c6e7d_q_f_improf_377x377.jpg\")
<\/p>\n<\/p>\n
image courtesy of Seattle Municipal Archives<\/a><\/p>\n <\/p>\n In the United States, there are somewhere in the neighborhood of 325 million cellular devices in use (15), comprising phones, tablets, notebooks, hotspots, and, most recently, vehicles. We are generating a lot of data on these devices, and these devices are generating a lot of data\u2014about us. At any given point in time and geography, there is a chance that that data generated by your devices is being captured and analyzed. How much of a chance? We don\u2019t know.<\/p>\n <\/p>\n THE BASICS<\/p>\n The process is made possible using a device most commonly called a StingRay, sold by Harris Corporation headquarted in Melbourne, Florida. (Some names of the company\u2019s similar devices are AmberJack, KingFish, Harpoon, and RayFish; for simplicity, I\u2019ll refer to all of them as StingRay, because the purpose of each device is the same: to capture data about mobile device and their users.) The StingRay is a mobile device that presents itself to cellular devices as a cell tower. Today most of these devices are used in a police surveillance vehicle, but that\u2019s starting to change, as you\u2019ll see later. The device inside the vehicle communicates with antennas on the police vehicle, which determine the distance and direction of the targeted device in relation to the StingRay and in relation to other cell towers. (1)<\/p>\n image courtesy of Pug50<\/a><\/p>\n You would expect that when a call is active on your phone, it would be constantly seeking out the nearest tower. However, in anticipation of activity, mobile devices are doing that constantly. Because the StingRay presents itself as a cell tower, your phone will connect to it when it is nearby, and certain data will be routed through the StingRay just as it would a cell tower. The device and its associated software collect data from all the cellular devices that connect to it. The data is then relayed to a connected computer, which displays the collected data and translates it for the operators of the device. At that point, the traffic is passed on to the cell tower, and the user of the phone never knows. (1)<\/p>\n image courtesy of miheco<\/a><\/p>\n When I spoke of the data collected, what exactly would that be? Specifically, your phone has an identifier, but I was not able to find out if that would be the phone\u2019s serial number or its MAC address; both of those are unique identifiers. Whichever it is, it is collected, along with the telephone number for all connecting devices, and all telephone numbers dialed out to other devices, including those for text messages. The approximate location of the phone as determined using the antennas on the vehicle is also captured. At this time, law enforcement sources have said that the StingRay device as sold to law enforcement (police departments) is not configured to intercept the contents of calls and text messages.<\/p>\n <\/p>\n THE TECHNOLOGY<\/p>\n At the Black Hat conference in 2011, Mike Tassey and Richard Perkins demonstrated their Wireless Areal Surveillance Platform (WASP). As far as we know, it was a proof-of-concept exercise that has not been mass-replicated. It was a prototype of a device that is capable of quite a bit of data mining. It is very significant that a device that cost no more to build than $6,200 was proven capable of wireless network sniffing and cracking, cell tower spoofing, cell phone tracking and call interception, data exfiltration (taking data out of its intended environment), and video surveillance. (10)<\/p>\n Harris\u2019s StingRay costs considerably more than that, so it is reasonable to assume that the device build by Tassey and Perkins lacked some important capability or durability that exists in the StingRay. Some of Harris\u2019s other devices can be used to conduct Denial-of-Service attacks on cell phones, monitor voice traffic, and amplify the range and power of the activity of the StingRays (7).<\/p>\n image courtesy of olympiacopwatch<\/a><\/p>\n Your cell phone will communicate with the tower using the latest and best protocol of which it is capable. Most current phones sold in the United States use at least 3G signals, and of course the newest ones use 4G. 3G and 4G communications are much more secure than the older 2G (EDGE network and networks that emerged around the same timeframe). When you are traveling and your phone can\u2019t find a 3G or 4G network, if there is a 2G signal available, it will drop to the 2G network signal. On that signal, your handset or device will readily accept communication from some other device that is calling itself a cell tower (4). Carrier cell towers have certain names that your phone or other mobile devices recognize; rogue towers don\u2019t have names in the range of recognizeability (14). The StingRay jams 3G and 4G signals, forcing nearby phones to use the less-secure 2G signal. Law enforcement agencies are beginning to get a little nervous because mobile carriers are planning shutdowns of the 2G network; AT&T is planning to shut its 2G network down in 2017 (4). I was unable to find out how exactly this will affect StingRay devices. Unless the phone receives some firmware update, it may still accept the 2G drop if the 3G and 4G signals are jammed, but as the agencies are scrambling to acquire updated hardware to replace the existing StingRay devices, there must be something that will stop working as these networks get shut down. Newer networks are still susceptible to location tracking, but not to the other forms of interception and data collection (4).<\/p>\n Harris isn\u2019t the only company in this space. Other firms producing devices of this type include Verint, View Systems, Altron, Neo Soft, MMI, Ability, and Meganet (23). Meganet\u2019s VME Dominator\u2014available for sale only to government agencies\u2014can capture calls and texts, can send text messages, and can even control the phone (14).<\/p>\n However, these companies\u2019 offerings can only trace GSM\/UMTS-based communications. The Harris devices can track CDMA2000, GSM, iDEN, and UMTS-based signals. Harris\u2019s StingRay and KingFish can support up to three different signal types without requiring reconfiguration. (23)<\/p>\n If land-based collection isn\u2019t getting the job done, Boeing\u2019s Digital Receiver Technology (DRT for short) division is putting similar capability in the air. They\u2019re called DiRTboxes, and they are very similar to the StingRay devices, mounted in Cessna planes. However, because planes move faster, the signal strength is greater and more data from untargeted phones as well as targeted phones can be collected. (24) A single flight might provide data and general location information on tens of thousands of phones. Unlike StingRays, DiRTboxes can interrupt calls, and the newer versions of the devices can even also jam signals and even scrape rich data like text messages and photos. (1)<\/p>\n All of these boxes work by exploiting the fundamental structure shared by all cell networks, and, most disturbing of all, no level of encryption is able to prevent collection at the 2G level. (1)<\/p>\n <\/p>\n WHO USES THESE DEVICES?<\/p>\n There is no shortage of agencies interested in gaining this type of information. We know the FBI is using it, and sources suspect all of the three-letter federal-level investigative agencies are as well. Documentation confirms that at least 25 different local and state police departments from Florida to Alaska are using it. Many of these purchases have been made with federal grants from the Department of Homeland Security aimed at protecting cities from terror attacks, but we are finding that they are being used for far broader police work. (1)<\/p>\n The ACLU has produced a map showing which states have agencies using StingRay devices. Right-click on this link and select \u201cOpen in a new tab<\/a>.\u201d (18)<\/p>\n The city of Tacoma, Washington is seeking to upgrade its StingRay device to Harris\u2019s newer and more capable HailStorm, which will be combined with data analysis software from various vendors. The HailStorm enables 4G LTE phone tracking (12). It also reportedly has the capability to capture cellphone conversations, but Harris says it does not include that functionality in the units it sells to local law enforcement agencies. Tacoma\u2019s purchase and use seems to have had both positives and negatives. City Council members were not really aware of the technology they were approving. However, it does appear that the city is taking care to follow the rules of engagement when deploying the device. The police department was asked to produce documentation showing how the device has been used. Since 2009, they showed 168 cases where police sought judicial permission for surveillance using StingRays. In that same period of time, it was used 10 times under Emergency Orders, which do not require a court order or a search warrant. In those cases, StingRays were used to find people involved in the killing of four police officers, kidnappings, and people suspected of child prostitution (12).<\/p>\n Chesterfield, Virginia, has units that were purchased through grants to law enforcement agencies that were made possible by a multi-million-dollar settlement with Abbot Labs for Medicaid fraud. City officials say that their devices are only ever used with judicial oversight\u2014that is, search warrants or court orders. They also state that they never record, keep, or share the information regarding non-targeted devices. The city was warned previously about possible repercussions for using license plate readers carelessly, so it appears they are following the letter of the law on this technology (6).<\/p>\n Baltimore, Maryland has used HailStorm devices 4,300 times since 2007. 4,300 times!! However, unlike Tacoma and Chesterfield, the Baltimore PD has been encouraged to dismiss charges rather than divulge details about the program. (5)<\/p>\n In Harris\u2019s home state, the American Civil Liberties Union has suspected for a long while that Harris has been loaning its products to police departments for promotion and testing. Court documents in a 2008 case show that \u201cthe Tallahassee Police Department is not the owner of the equipment.\u201d<\/p>\n Pontiac, Oakland County, Michigan has the only device in Michigan, and it was purchased with Homeland Security money (11).<\/p>\n The DRT planes are operated by the US Marshals Service, which often loans them out to local law enforcement and other agencies (19).<\/p>\n <\/p>\n WHY IS IT BEING USED\/HOW IS IT JUSTIFIED?<\/p>\n It\u2019s not difficult to understand why law enforcement and other agencies would want these devices, and how they could be very useful in solving crimes, tracking fugitives or abducted children, and possibly foil terror attacks (the most common reason for DHS grants to local police agencies). (1) As reporter Joel Hruska described it, \u201cSay a murder occurs on a particular street with an estimated time of death between 2 and 4 am. Local law enforcement would have an obvious interest in compelling cell phone companies to turn over the records of every cell phone that moved in and out of the area between those two time periods. [Author\u2019s note: this is called a \u201ccell tower dump, and it\u2019s quite common, but requires a court order or a search warrant.] At rush hour, this kind of information would be useless \u2013 but if the cell phone network data shows a device in the same approximate area as the murder suddenly leaving the area at a high rate of speed, that cell phone owner is a potential suspect.\u201d (7) I can see, certainly how that would be true; but in order for the device to be useful in this case, the StingRay would already need to be in place.<\/p>\n When Miami-Dade Police bought their StingRay, they told the City Council they needed it to monitor protestors at an upcoming World Trade conference (6), and that purpose is in itself problematic.<\/p>\n When Tacoma made its purchase, it was mostly funded with a Homeland Security grant. The police department indicated that the technology would be useful to its Explosive Ordinance detail. But the department\u2019s records offer no indication as to how many explosive devices were disarmed, or even detected, using it. (3)<\/p>\n <\/p>\n THE THORNS<\/p>\n If you\u2019ve never heard of StingRays or HailStorms or KingFish, that\u2019s by design. These devices were originally developed for use by the military and by spy agencies. Harris Corp. itself does not answer any questions about the devices, but refers reporters to police agencies. That is not very useful, as Harris requires its customers to sign a non-disclosure agreement. (1) Agreements of that type are not uncommon, but they are usually required when a product is placed for testing or during the development process.<\/p>\n You can read one example of this agreement by clicking on this link and selecting \u201cOpen link in new tab.\u201d<\/a><\/p>\n Law enforcement agencies have fought hard to keep from talking about the devices, and it was almost by accident that word is starting to get out. In a case of sexual battery and petit theft, the victim\u2019s purse was stolen. Her purse contained her cell phone. Using a StingRay, and without a warrant, investigators were able to track the phone to a particular apartment. They forced their way inside, searched, and found the purse\u2014and the phone. The device was not mentioned during discovery, and when pressed by the defendant\u2019s attorney during the trial, the investigators refused to disclose the method used to track the defendant to the apartment. The judge finally forced the disclosure of the surveillance technique, but only after the law enforcement agency insisted that the court be closed, and that the proceedings of the case be closed as well. The defendant appealed his conviction based on the legality of the surveillance and the search. The appellate case and the resulting opinion were not sealed, and that\u2019s how we finally found out about StingRays. (22)<\/p>\n Freedom of Information Act requests on these devices and activities surrounding them has proved mostly fruitless. Much of the useful information gets redacted prior to release. The ACLU has been digging into a particular set of uses in Sarasota, Florida and found itself brickwalled by the US Marshalls Service. The ACLU had set up a meeting with the Sarasota Police Department to view its StingRay files, as is required by Florida law. An assistant city attorney sent an email to the ACLU cancelling the meeting. He stated that the USMS had deputized the local officer; therefore, the records generated by that officer were the property of the federal government, and the Sarasota PD had not the authority to release them (2).<\/p>\n At issue is not whether the devices should exist, or even whether they should be used, but under what conditions, and how they should be used. The largest question that needs addressed is one of Due Process. In a case in Arizona, the legality of a search was questioned because civil liberties advocates say that the government was not honest in its explanation to the judge regarding the StingRay\u2019s true capabilities.(17) The Justice Department contends that the tracking warrant was nothing out of the ordinary (17), and that argument gets a lot of mileage. But that argument is based on a comparison of StingRay and similar devices to pen-register and trap-and-trace devices (23), and to see the differences, I\u2019m going to quote directly from legal dictionaries for the definitions of those two technologies:<\/p>\n Pen register \u2013 a device that decodes or records electronic impulses, allowing outgoing numbers from a telephone to be identified.<\/em><\/p>\n Trap device \u2013 used to identify originating number from which the wire or electronic communications were transmitted.<\/em><\/p>\n Neither device enables recording or listening of actual communication. (13)<\/em><\/p>\n You\u2019ve seen these technologies used in the movies, where they\u2019re trying to find out who the mobster is calling, or when they\u2019re tracing a kidnapper\u2019s incoming call. Case law \u2013 Smith v. Maryland \u2013 holds that it is not unconstitutional to install a pen register without a warrant. However, federal law now requires a court order for it, based on an investigating offer\u2019s declaration that the information is relevant to an ongoing investigation (13).<\/p>\n The FBI says a warrant is not required for the use of StingRay and similar devices, because they don\u2019t collect the content of phone calls and text messages and operate like pen-registers and trap-and traces, collecting the equivalent of header information. Additionally, the US government and other law enforcement agency spokesmen have asserted that the use of StingRay devices does not violate Fourth Amendment rights, and Americans don\u2019t have a legitimate expectation of privacy for data sent from their mobile phones and other wireless devices to a cell tower. (21) \u201cWe\u2019re not infringing on their rights, \u201c[Richland, SC Sheriff Leon] Lott said, \u201cWhen they use that phone, they understand that information is going to a tower.\u201d (1) What we understand, though, is that the information is going to a tower owned and operated by a carrier with whom we have a contract for service.<\/em> That information is not going out onto public airwaves to be picked up by the general population. An appropriate comparison is an agency setting up a blue box with the Postal Service logo on it, and a lot of people drop their mail into it. By monitoring the box and its contents over time they can determine if their target is in the immediate area during a given point in time. The agency looks at all the senders and recipients on each piece of mail, hoping to find one sent by their target. The agency\u2019s fake box is also collecting pieces of mail being sent by people other than their target, and the agency has the capability to record or note non-targets sending mail to other recipients. Senders are not tossing their mail up into the air or leaving it out in the open for anyone to look at, they are depositing it into a receptacle that is trusted and chartered to deliver mail, and we all understand that tampering with the mail is a punishable offense.<\/p>\n It seems, also, that the city officers in Tacoma do not see the need for oversight of the police department\u2019s actions. City Manger TC Broadnax told reporters, \u201cI\u2019m not in law enforcement, but it\u2019s my impression that it assists them in doing their job more effectively, and that\u2019s to protect the public.\u201d Mayor Marilyn Strickland said, \u201cIf our law enforcement needs access to information to prevent crime or keep us safe, that\u2019s a legitimate use of the technology. We are more focused on preventing crime and keeping our community safe than getting in people\u2019s business.\u201d The problem with that position is that these devices do not have the capacity to prevent crime or keep the community safe. They can catch the bad guys after the fact, but only well-known, widespread, real-time surveillance would have the effect the Mayor is hoping for. It also appears full disclosure of the equipment purchase was not part of Tacoma\u2019s purchasing process. As Councilman David Boe put it, \u201cI\u2019ve got to find out what I voted on before I comment.\u201d (3)<\/p>\n In the wake of the Snowden\/Prism revelations, those whom we trust to protect us from overzealous intrusion appear to be taking this pretty seriously. In 2012 a magistrate judge in Texas refused to grant the federal Drug Enforcement Agency permission to use a StingRay, partly because the agency did not explain what the government would do with the cell phone numbers of innocent people and other information recorded on the equipment (12). In an affidavit submitted to court, the FBI disclosed that its policy requires agents to purge all data stored in the surveillance tool at the conclusion of an operation, so that the FBI is not collecting information about individuals who are not the subject of criminal or national security investigations. Government is telling a court for the first time that spoofing a legitimate wireless tower in order to conduct surveillance could be considered a search under the Fourth Amendment in the Arizona case, and that its use was legal, thanks to a court order and warrant that investigators used to get similar location data from Verizon\u2019s own towers. (21) The unsettling part of the FBI policy covering StingRay use is that in addition to regular carve outs\u2014immediate danger or tracking a fugitive\u2014agency policy does not require judicial oversight in cases in which the technology is used in public places or other locations at which the FBI deems that there is no reasonable expectation of privacy (16).<\/p>\n The State Supreme Courts of Florida and Massachusetts have ruled that warrants are necessary for real-time cell phone tracking, and laws for the same have been passed in Colorado, Illinois, Indiana, Maryland, Tennessee, Utah, Virginia, and Wisconsin (9). It\u2019s a start.<\/p>\n <\/p>\n HOW CAN I KNOW IF IT\u2019S BEING USED AROUND ME?<\/p>\n How would you know if this is occurring in your vicinity? ESD America develops and produces a phone called CryptoPhone500. It\u2019s a pricey device (the developer wouldn\u2019t divulge the price, but a third party site indicated around $3,500) and it detects and alerts when the phone\u2019s encryption has been turned off by someone other than the user. According to ESD\u2019s Les Goldsmith, \u201cIf you\u2019ve been intercepted, in some cases it might show at the top that you\u2019ve been forced from 4G down to 2G.\u201d As an alternative to his CryptoPhone, he suggests \u201cburner phones\u201d if you absolutely must not be tracked. (14)<\/p>\n <\/p>\n image courtesy of Jeff Schuler<\/a><\/p>\n MY TAKEAWAY<\/p>\n Several times I have looked down at my phone and noticed that where the 4G LTE should have been, it indicated EDGE. This tells me that I can probably, if I\u2019m diligent, know when my data is being passed to a phony tower. I\u2019m not in the market for a very expensive phone. It is important to pay attention to judicial decisions regarding surveillance. The next generation of these devices is capable of not only capturing the phone\u2019s identifying data, but the contents of those devices. The due process concept so carefully articulated in the Constitution of the United States is to protect us against fishing expeditions of the type made possible by these fish-named technologies. It\u2019s up to us to make sure the people in decision-making capacities know what they\u2019re deciding.<\/p>\n <\/p>\n <\/p>\n WORKS CITED<\/p>\n <\/p>\n image courtesy of Seattle Municipal Archives In the United States, there are somewhere in the neighborhood of 325 million cellular devices in use (15), comprising phones, tablets, notebooks, hotspots, and, most recently, vehicles. We are generating a lot of data on these devices, and these devices are generating a lot of data\u2014about us. At…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"nf_dc_page":"","_kad_post_transparent":"","_kad_post_title":"","_kad_post_layout":"","_kad_post_sidebar_id":"","_kad_post_content_style":"","_kad_post_vertical_padding":"","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"_kad_post_classname":"","_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[11,10],"tags":[62,67,77,78,79,80,83,84,87,91,92,93,100,107,109,110,118,119,120,125,126,132,135,138,150,151,152,153,155,170,185,186,198,208,221,228,232,236,237,246,250,252],"class_list":["post-123","post","type-post","status-publish","format-standard","hentry","category-deep-dives","category-commentary-and-consideration","tag-aclu","tag-amberjack","tag-baltimore","tag-board-of-directors","tag-boeing","tag-boston","tag-bus","tag-business-insider","tag-cdma","tag-cellphone","tag-cellular","tag-chesterfield","tag-computer-program","tag-daily-record-scotland","tag-data","tag-dhs","tag-drt","tag-due-process","tag-eavesdropping","tag-emma-nutt","tag-english-language","tag-fbi","tag-federal-government","tag-florida","tag-gsm","tag-hailstorm","tag-harpoon","tag-harris","tag-iden","tag-kingfish","tag-miami","tag-michigan","tag-nsa","tag-privacy","tag-security","tag-spying","tag-stingray","tag-switchboard-operator","tag-tacoma","tag-united-states","tag-us-marshals-service","tag-washington"],"yoast_head":"\n![\"Cell](\"\/wp-content\/uploads\/2015\/06\/_d_improd_\/4757257615_b19c5b18f7_z-199x300_f_improf_199x300.jpg\")
<\/a><\/p>\n![\"disguised](\"\/wp-content\/uploads\/2015\/06\/_d_improd_\/273942446_d5acc05c84_z-291x300_f_improf_291x300.jpg\")
<\/a><\/p>\n![\"StingRay\"](\"\/wp-content\/uploads\/2015\/06\/_d_improd_\/15139301887_548f61aeab_q_f_improf_288x288.jpg\")
<\/p>\n![\"Uncle](\"\/wp-content\/uploads\/2015\/06\/_d_improd_\/2585181312_8af858825c_q_f_improf_463x463.jpg\")
<\/a><\/p>\n\n