Tuesday, November 3, 2015

“Stingray Devices” — Why Nothing is Secret on Your Phone

It was announced today that the Internal Revenue Service’s newly revealed use of controversial “Stingray” cellphone trackers has triggered a fact finding inquiry by Senate Judiciary Committee leaders. These leaders want to know how and why the controversial “Stingray” devices are being used.
Earlier, on October 21, 2015, there was an Oversight Committee hearing about Stingray devices, policies and procedures and their use in Washington, DC. As of this writing, most videos of this hearing have been scrubbed from the internet and there are no available transcripts. One video begins the initial proceedings at one hour and fifteen minutes into the video.
The Department of Justice and the Department of Homeland Security both announced that they have developed new policies regarding the use of these devices and have implemented these rules as of September 1, 2015. These policies do not apply to CIA, FBI, NSA and other high level intelligence agencies.
Elana Tyrangiel, the Principal Deputy Assistant Attorney General spoke for the Department of Justice and Seth M. Stodder, the Assistant Secretary of Threat Prevention and Security Policy spoke for the Department of Homeland Security at the hearing.
What Are Stingrays And What Can They Do?
This suitcase sized device that is currently in use to spy on all of us is called the Stingray, “Dirtbox,” “Wolfpack Gossamer,” “Hailstorm (an upgraded, new generation version),” “Cell Site Simulator,” “Triggerfish” or the “IMSI Catcher.”
The device masquerades as a miniature cell phone tower and can bounce off of any cell phones within its reach to give the user or the agency that is doing the monitoring all of the personal information on anyone with a cell phone. The information can be gathered on a targeted or non-targeted person or persons. Even when in use against a targeted individual or suspect, the Stingray can still capture personal data from all other cell phones in the vicinity of the target. This is called a “tower dump.”
Programming the devices and specific configuring can also track phone locations, record calls, lock onto a phone, target, track and map. While the device has all these capabilities, Stodder stated that the device is not used for Global Positioning System (GPS) purposes. (NOTE: If the device is being used to locate, map and track then technically it is already being used as a GPS device.) The device also has the ability to be used as a “bug” by modifying the “firmware” of a targeted phone remotely and then it can intercept the conversations.
So, who has them?
Many agencies across the country use these devices, but the details on exactly who has them remain murky as do the rules and standard operating procedures on their use. According to the most recent reports Michigan State Police are using them and California has banned their use without a warrant (Utah, Minnesota and Virginia have adopted similar laws).
It is said that these devices have been routinely and covertly used since 2006 by law enforcement agencies; perhaps earlier. So far 13 Federal agencieshave these devices including the Internal Revenue Service and through the latest reports by the ACLU, many state, county and local law enforcement agencies are using them, including Florida.
Russia Today says, “… 56 state or local police departments in 22 states and the District of Columbia own Stingrays, the American Civil Liberties Union says, but a lack of transparency in the use and ownership makes it impossible to know the scale of the surveillance that the devices facilitate.”
How does one get a “Stingray?”
These devices can cost local police or sheriff departments up to $400,000 each. The Federal Government makes it easier for local agencies to fund these purchases through the use of anti-terrorism grants through FEMA and other agencies.
But now, smaller companies are starting to manufacture cheap knock-offs that can be purchased at much lower prices. Some as low as $1,000.
As more of the devices enter the market, who will monitor the people buying them? And, will any new laws, procedures, and standards apply to the individuals purchasing these knock-offs? Probably not as there are no checks and balances with any of these devices that are not through a government contract.
Currently, the Stingray devices are purchased and acquired through theHarris Corporation of Melbourne, Florida and are manufactured in Europe.
More Legalese
Local law enforcement agencies are not bound by DOJ or DHS standards. Non-disclosure agreements with local law enforcement and the FBI protect the use of the technology and sensitive information gathering procedures and content.
There are indications that the Stingray is being used to collect personal data without probable cause and without issuing or the use of warrants. This brings up important legal ramifications; does the use of the Stingray device violate someone’s Fourth and Fourteenth Amendment rights under the Constitution? The new laws require three levels of sign off before the use of the Stingray without a warrant. Exceptions would be for Secret Service operations.
Regarding privacy rights, data captured by the agencies using the Stingray must be deleted either after the mission/operation is completed or at the end of a 30-day period.
There is no data on how this device is used privately and the rules and regulations governing that use.
In the past, when media has asked for more information or filed Freedom of Information Act (FOIA) requests, the agencies using the Stingray have hidden behind their non-disclosure agreements.
According to the Associated press (AP), David Cuillier, the director of the University of Arizona’s journalism school and a national expert on public-records laws said: “I don’t see how public agencies can make up an agreement with a private company that breaks state law. We can’t have the commercial sector running our governments for us. These public agencies need to be forthright and transparent.”
It is suspected that since there is not a lot of information on their use that the Stingrays are first and foremost used to apprehend a suspect. Nathan Wessler, an American Civil Liberties Union (ACLU) attorney said: “If police departments are going to use this kind of powerful surveillance technology, they need clear rules in place so they aren’t collecting private information.” Wessler also noted the rules on Stingray use should be in accordance with the Constitution.
“This is technology initially designed for military and intelligence agencies and now it’s being used in residential streets across the United States and Michigan, and it’s being done in secrecy,” said Wessler. “It’s tricking every phone in broad areas and sweeping information about every innocent bystander nearby and reaching through walls.”
The ACLU is continuing to make the case for citizen’s rights under the law and is attempting to acquire more information on these devices and how they are used.
What We Know and Don’t Know
Tyrangial and Stodder both stated that only a fraction of cases were without warrants before the implementation of the new policies in September 2015 but had no numbers available and no other data to back that up.
The Stingray is configured to not collect content but it could collect content (before these new policies were implemented on September 1, 2015). Asked if the agencies using it had collected content before this date, Tyrangial did not answer and said she would get back to the Oversight Committee. Stodder said the Stingray was not configured by the vendor to collect content.
In the circumstances with exceptions, i.e., no time to acquire a warrant, the Stingray was deployed rarely making a safety valve no problem under 4rth Amendment since three high level sign offs were required before the Stingray could be used. Again, there was no data and no numbers or specific information to back up that claim.
If local law enforcement is using the Stingray, then are they bound by the DOJ laws? Again, there was no information. Is any operation conducted by the Secret Service a blanket exception? Yes, Stodder replied that it is an exception within the DHS policy.
Will This Technology Be Used Against Ordinary Citizens?
This device was created and supposed to be used to combat terrorism. Instead, we the people are now the “terrorists” being spied on in our own communities. We are entering a brave new world where even our simplest communications, conversations, texts, calls, contacts and more can be visible to third parties and to government agencies with oversight granted by the government but not to us in the form of transparency. This is not about protection against terrorism. It’s all about spying on citizens.
Say “Hello” to Orwell’s nightmare. It’s called “Stingray.”