Stingrays are nothing new, but their use by law enforcement is still shrouded in secrecy, even after numerous attempts to regulate them. Civil right advocates have long called for more transparency on the matter, but after seeing how difficult it is to get access to public records pertaining to the use of cell site simulators by CBP and ICE, the American Civil Liberties Union are suing the two government agencies in an effort to bring that information to light.
Privacy seems to be at a premium these days, and even big tech companies that are the biggest proponents of more stringent rules don’t always practice what they preach. Just this past week Apple inadvertently revealed through a lawsuit that it is routinely collecting phone calls and messages of its employees.
The Immigration Customs Enforcement (ICE) and Customs and Border Protection (CBP) have been involved in numerous privacy debacles over the last few years, but now the American Civil Liberties Union (ACLU) is suing them for failing to produce public materials that disclose how they use “stingrays.”
Stingrays are essentially cell sites that act like the real ones used by wireless carriers, so they can be used to trick phones into connecting to them. Law enforcement agencies can then identify, locate, and track those phones, but in the process they also get information about phones of innocent people, which introduces the potential for abuse and mishandling of the collected data.
According to a 2016 report from the House Committee on Oversight and Government Reform, ICE and CBP had already spent $13 billion on 92 stingrays. Keep in mind that these are also able to observe call records and text messages, and history shows the two agencies aren’t doing their best job to protect the data they collect.
How is it being used?
For a device that started selling in 1996, there was surprisingly little public mention of it in the U.S. for more than a decade after documents suggest they were in use. (A Stanford student newspaper noted the existence of the tech in 2006.) In 2010, former Reuters reporter Jim Finkle attended the DefCon hacker conference and wrote about security consultant Chris Paget’s construction of an IMSI catcher that cost about $1,500, saying “law enforcement has long had access to expensive cell-phone tapping equipment.”
In 2011, convicted felon Daniel Rigmaiden, who was serving a prison sentence for filing more than 2,500 fraudulent tax refunds, sent an eye-opening 200-page report on the secretive tool to the American Civil Liberties Union (ACLU). As he described on the WNYC radio show Note To Self, Rigmaiden had been living off the grid in the California forests when he was arrested, and suspected an unknown device had been used to track him down via his cellular-connected Internet air card. His case was the subject of several stories, and lawmakers and journalists began asking questions about the purchase of these devices, which often come with strict non-disclosure agreements that bar purchasers from discussing their use even in sworn testimony in court.
In 2014, Rigmaiden was released from prison after a years-long effort – involving 1,130 court motions filed – in which he charged that the federal government had concealed their use of the IMSI catcher during his trial. Google Trends show an increased volume of searches for IMSI catchers around the time of Rigmaiden’s release.
The ACLU has compiled a map that shows 61 local or state police departments in 23 states that are known to use IMSI catchers, and there are reports of Russian and Chinese authorities using the devices. As reporters Colin Freeze and Matthew Braga wrote in The Globe and Mail this week, Canadians are finally getting some answers about how the technology has been used here.
Why its called a stingray?
The first trademark for the “StingRay” brand of IMSI catcher was filed in 2001 by Harris Corporation. It’s a non-descript rectangular box with a variety of input and output ports, and looks like a box you’d slide into a server room rack or a control booth at a radio or TV station. That same year, Harris also filed trademarks on an array of complimentary devices like the Amberjack (a mobile range-boosting antenna), Kingfish (a more portable, cheaper StingRay) and Triggerfish (a device designed to record the conversations of nearby cell-phone users).
Because the StingRay brand name has been identified in several freedom of information requests and lawsuits by civil society organizations in the U.S. (including the ACLU, the Electronic Frontier Foundation, and the Electronic Privacy Information Center) it has stuck as a catch-all term to describe an array of devices, sometimes from different manufacturers. For instance, the so-called DRTBOX is an IMSI catcher used by the U.S. Marshals Service, made by Boeing subsidiary Digital Receiver Technology Inc. The FBI, which has spent millions of dollars to acquire these technologies, often refers to them in internal documents as “digital analyzers” or “cell-site simulators.”
An ACLU spokesperson notes “the public has a right to know if and how often ICE and CBP are using Stingrays, which were originally intended for use by the military and intelligence agencies, for civil immigration enforcement operations.” The civil liberties group is asking the two agencies to sound off on what steps they have taken to ensure stingrays aren’t used against innocent bystanders, and whether they disclose their use in immigration court proceedings.
As we know, Stingrays have been in use by law enforcement around the country to conduct surveillance operations, but this could quickly turn into a national security issue. Last year, the Department of Homeland Security said it had knowledge of several unauthorized stingrays operating in Washington, DC, leading to speculation that they may have been used by foreign spies.