By Cora Van Olson
It’s called Stingray, and though not all police forces have started using it, those that have claim it helps their investigations. The ACLU say the device raises serious privacy concerns. We take a look at Stingray, how it works and who uses it, and who denies using it.
What does it do?
Earlier versions of the technology were sold as Amberjack, Kingfish, Harpoon and Rayfish. The Stingray is smaller than a suitcase, costs about $400,000, and its function is pretty straight forward. Basically, it tricks all nearby cell phone traffic into sending data to the Stingray as if it were a cell tower. It then downloads all that data to a computer program that translates it for whoever is operating the Stingray. All the traffic is then passed to the nearest cell tower, with no one the wiser.
All cellphones send out a radio signal to keep tabs on the nearest cell tower, even when the user is not making a call. Stingray takes advantage of this fact. Not only does it intercept and download all the data passing through the cell tower, but with the help of antennae can be used to pinpoint the exact location of any phone to which it is connected. Usually the Stingray is loaded on to a surveillance van so it can be moved around to follow the target of the investigation. Taking down and making all the data from every tower it impersonates available to whoever is operating it.
Who is using it?
At first Stingray technology was only accessible to federal agents, who used it to catch such famous criminals as the “the Hacker,” aka Daniel David Rigmaiden, who was wanted for filing fraudulent tax returns and getting millions of dollars in rebates. He is currently trying to get the feds to release to his defense team the nature of the technology used to catch him, so he can attack it as unconstitutional in his defense.
Now, however, it seems that as many as 25 different state and local police forces may be using it too. The rumor is that they are only allowed to get a paired-down version, “Stingray lite” if you will, that cannot intercept the content of texts or calls, but only the following information:
- Identification/telephone numbers of all connected cellphones, as well as text and call history, location data and subscriber’s payment records.
- Numbers dialed while connected to the Stingray, as well as outgoing calls and texts.
- The exact physical locations of all connected phones.
Police have long been able to simply request this data from the phone company in the form of a “tower dump.” The above-listed data from one or more cell phone towers can be downloaded, usually in two-hour time frames. It can cover multiple wireless providers and thousands of users. The difference is that with Stingray they get that data in real time.
The tower dumping technique was reportedly used by local law enforcement in Colorado during the search for Jessica Ridgeway in 2012. They reportedly got a court orders for more than 15 tower dumps. Using the information obtained from the dumps — we don’t know how many thousands of people’s data was compromised — police were able to single out 500 people to get a DNA test for exclusion in the investigation. Prosecutors were ultimately able to use some of the data against Austin Sigg, then 17, who later pleaded guilty and received a 100-year sentenced for killing and dismembering the 10 year old.
It may be noted that many states don’t require a warrant to obtain such cellphone data, which police like because the existence of their investigations, as well as specific tech and techniques can be kept from the subjects of their investigations.
Will everyone use it?
USA Today and Gannett newspapers and TV stations polled 125 police stations in 33 states and found that about one in four have used a tower dump, 25 own Stingray, 36 refused to say, and most refused public records requests.
An unmarked black van.
The ACLU has also been trying to raise awareness about the use of this technology by state and local law enforcement agencies. Recently the ACLU sent records requests to 36 state and law enforcement offices in Florida. Most reportedly ignored the request; One town, Sunrise, had its lawyers respond, ”The City cannot and will not acknowledge whether any records responsive to the Request exist and, if any responsive records do exist, cannot and will not publicly disclose those records. … Not only would the mere production of a single record responsive to these requests, even if entirely redacted, reveal the existence of confidential surveillance techniques, but it would also compromise both active and future criminal investigations.”
That police department, however, seems to have outsmarted themselves. Nathan Freed Wessler of the ACLU blogged that a document on Sunrise’s public website shows that the police department bought a $65,000 upgrade to its Stingray device in 2013.
A statement recently released by the ACLU of Northern California says that San Jose, Fremont, and Oakland police are using Stingray, as well as the Alameda County District Attorney’s Office. Oakland confirmed that they have one. It is not known whether warrants were obtained before the Stingray was used.
Can the data be used for evil as well as for good?
Needless to say this is a legal grey area that is just now coming into the national spotlight, and which poses some provocative questions. Whether cell phone data inadvertently obtained in one investigation, can be used against another party in an unrelated investigation is not clear. Nor is what happens to the massive amounts of data once the investigation is over. Is the data deleted or is it archived, and if it’s archived is it secure?
Sheriff Leon Lott of Richland County, South Carolina, reportedly expressed law enforcement’s view of the privacy issue pretty succinctly, ”We’re not infringing on their rights. When they use that phone, they understand that information is going to go to a tower. We’re not taking that information and using it for any means whatsoever, unless they’re the bad guy or unless they’re the victim.”