‘Stingray’ phone trackers facing more scrutiny

No one can say for certain how many police departments around the country have the ability to scoop up cellphone data during criminal investigations, and a mix of federal law enforcement agencies wants to keep it that way.

“You can’t make me tell you that,” FBI Director James Comey told a group of Seattle reporters in September when asked how many cellphone-tracking devices his agency controlled, according to an account in The Stranger.

Comey won’t say how many machines are out there, but communities from Anchorage, Alaska, to Sarasota, Florida, are starting to figure out which agencies have cellphone tracking equipment and how it is being employed to find criminals.

At the same time, state and local governments are taking steps to regulate a technology that has the potential to gather data about innocent bystanders as it hones in on the cellphones of criminal suspects.

So far, 11 states have passed laws requiring police to obtain a warrant before they use a cellphone-tracking device known as a cell site simulator.

Washington state could be next.

A report by The News Tribune in August revealing the Tacoma Police Department’s use of a cell site simulator known as a “Stingray” since 2008 convinced one state lawmaker that it’s for time the Legislature to set boundaries for local agencies.

“I fully anticipate there will be legislation,” said Rep. David Taylor, R-Moxee.

He is concerned that police will gather data on innocent people when they use cellphone-tracking equipment.

“These fishing expeditions that law enforcement appears to want to go on are unacceptable, and they are unconstitutional,” he said.

Taylor, one of the Legislature’s chief critics of government surveillance, doesn’t know how many law enforcement agencies in the state have cell site simulators or whether they ask a judge before they use one.

He wants a law that ensures local agencies have clear standards for the use of the new technology.

“I want to have the most specificity so there is no wiggle room” for officers to use cell site simulators on broad searches, he said.

It’s hard to say how many state and local law enforcement agencies in the United States have access to Stingrays because of the efforts by the Justice Department and FBI to keep them secret.

Using a federal grant, the Tacoma Police Department acquired a Stingray in 2008 and persuaded the City Council fund an upgrade in 2013.

Department officials have said the device is used rarely in emergencies or only after getting a court order and that investigators do not collect the content of voice calls, texts or data transfers captured by the Stingray.

In addition to their device, Tacoma police officials have said, other local police agencies had access to a cell site simulator that belonged to a different law enforcement agency they would not identify.

The federal agencies often require local governments to sign nondisclosure agreements compelling police departments to conceal information about cell site simulators. Tacoma police have said they have such an agreement with the FBI

Nonetheless, the ACLU has cataloged reports from 18 states showing that at least 46 law enforcement agencies use cellphone-surveillance devices. ACLU attorneys look for news reports about the devices or for notices in local government bulletins that mention Florida-based Stingray manufacturer the Harris Corp.

They’re working to bring the devices into the open to determine what police departments are telling judges when they seek orders allowing them to use a Stingray. They also hope to figure out what local law enforcement agencies are doing with data they collect about people who are not suspected of criminal wrongdoing.

“When police are tracking people using their cellphones, it’s very easy to learn some of the most sensitive information about a person, whether they go to Alcoholics Anonymous, where they spend the night, who they spend it with,” said ACLU attorney Nathan Freed Wessler.

“When you’re using devices that can put together an intimate picture of a person’s life, a warrant is required.”

The FBI contends the secrecy about the devices is necessary to prevent criminal networks from figuring out how to subvert the technology, which mimics signals emitted by a cellphone tower to gather information from nearby cellphone users.

Court records submitted by the agency show the FBI has been using the devices for “more than a decade.”

In Tucson earlier this year, an FBI agent filed a brief in a lawsuit arguing that disclosing “even minor details” about the devices could endanger the agency’s ability to protect the public against terrorism because criminals could “develop defensive technology” or change their patterns to render the devices useless.

In June, the U.S. Marshals Service took the unusual step of seizing documents describing the Sarasota use of a Stingray device after the ACLU filed a series of public records requests to assess the use of cellphone tracking devices among Florida law enforcement agencies.

The city withheld the documents, contending they belonged to the marshals.

But the ACLU and other privacy advocates say local police departments with Stingrays are not using them to root out terrorists. They’re employing them to target drug dealers and everyday street criminals.

“Federal agencies try to justify secrecy on counterterrorism grounds, which is a total mismatch of how these devices are used,” said Wessler, who is challenging the seizure by the Marshals Service of Stingray records in Sarasota. “Local police are just going to use these devices for the whole range of criminal investigations.”

For example, the Tacoma Police Department initially told the City Council it would use the device to find bombs.

Assistant Police Chief Kathy McAlpine has said police have never used its cell site simulator to find an improvised explosive device. It’s been used, she said, “in felony-level crimes to locate suspects wanted for crimes such as homicide, rape, robbery, kidnapping and narcotics trafficking."

The technology is not foolproof.

A lawsuit in Sarasota alleges that U.S. marshals searching for a sexual battery suspect misidentified their target and raided the home of a 59-year-old nurse, according to a report in The Sarasota Herald-Tribune.

The problem might have been that the Stingray led officers to the right apartment building, but the wrong apartment.

“[They] came in here and searched without a warrant, without probable cause,” Louise Goldberry, the nurse, told WFLA after she filed the lawsuit. “I hadn’t done anything. It just blew my mind.”

Congress so far has not shown much interest in setting national standards for the use of cell site simulators, aside from a bill submitted by U.S. Sen. Ron Wyden, D-Ore., and U.S. Rep. Jason Chaffetz, R-Utah.

Their measure would explicitly require law enforcement agencies to obtain warrants before using cellphone trackers or geolocation devices in searches. The bill has 19 co-sponsors in the House and one in the Senate.

In July, U.S. Rep. Alan Grayson, D-Fla., grew alarmed by press reports showing that Stingrays had grown so inexpensive that criminal networks or foreign networks could buy their own to spy on U.S. agencies.

All cell site simulators exploit the same vulnerabilities in cellular networks to trick cellphones into responding to the devices instead of an established cellphone tower. Grayson wanted the Federal Communications Commission, which regulates cellular communications, to investigate whether those weaknesses should be secured.

“It is extremely troubling to learn that cellular communications are so poorly secured and that is so easy to track people’s phones,” he wrote.

In August, FCC Chairman Tom Wheeler replied with a letter announcing the creation of a task force to study the illegal use of cell site simulators. It’s focusing on crooks and foreign spies, not rules for local law enforcement agencies.

The trouble is that better security for American cellular networks could wind up limiting law enforcement agencies’ use of Stingrays, too, said experts following the issue.

“It’s cheap. People can build it. Criminals can buy it,” said Stephanie Pell, an assistant professor at the U.S. Military Academy’s Army Cyber Institute

“Maybe not the latest and greatest model, but as technology gets cheaper, not only does it get cheaper to states and local governments, but it also can trickle down to a vast array of others.”