Stingray and the mass surveillance programs

Mass surveillance programs operated by an alphabet soup of three- and four-letter government agencies are an undeniable fact in today’s post-Snowden era. Whether or not most Americans are aware of the wide-ranging surveillance programs is another question, but the fact remains that the U.S. government has been monitoring communications in the United States and abroad for at least two decades.

While past efforts typically involved federal government agencies, a new generation of products known as cell site simulators are being used by a growing number of local police departments and federal agencies. The most popular brand of simulators is made by the Florida-based Harris Corporation and sold under the brandname “Stingray” or “Stingray II.” Newer models are also being sold under the name Hailstorm.

Reports about Stingrays first began to surface in 2011, but details on the devices have only recently been revealed to the public. Just last month, a New York Supreme Court judge ruled that the Erie County Sheriff’s Office must comply with public records requests regarding the devices. The ACLU of New York sued the Sheriff’s Office after it failed to respond to requests for information on how the devices are used. Justice Patrick NeMoyer sided with the NYCLU and ruled that the Sheriff’s Office must hand over the data. NYCLU Staff Attorney Mariko Hirose, lead counsel on the case, said the decision “confirmed that law enforcement cannot hide behind a shroud of secrecy while it is invading the privacy of those it has sworn to protect and serve.”

The documents released by the Erie County Sheriff’s Office earlier this month include purchase orders, a letter from Harris Corp., a confidentiality agreement between the Sheriff’s Office and the FBI, a procedural manual, and summary reports of instances in which the device was used. The records show the department used the device 47 times from 2010 to 2014, obtaining a court order just once. This contradicts the department’s previous assurances that it would always obtain a court order or warrant to use the device.

The documents also highlight problems with non-disclosure agreements (NDAs) between the FBI and police, which often explicitly forbid police from discussing Stingrays in court orders unless given the specific written consent of the FBI.

What is a Stingray?

According to the Electronic Frontier Foundation:

    “The Stingray is a brand name of an IMSI [international mobile subscriber identity] catcher targeted and sold to law enforcement. A Stingray works by masquerading as a cell phone tower—to which your mobile phone sends signals to every 7 to 15 seconds whether you are on a call or not— and tricks your phone into connecting to it. As a result, the government can figure out who, when and to where you are calling, the precise location of every device within the range, and with some devices, even capture the content of your conversations.”

It is not known whether the data is being stored, and if so, for how long and which agencies have access to it. Few of the device’s capabilities are acknowledged by law enforcement, but how it works is fairly well-known: As long as a cellphone is emitting a signal to a cell tower, a Stingray can find it.  It has also been revealed that Stingrays force cellphones to send data back to the device “at full signal, consuming battery faster.” Thus, a constantly dying battery could be a sign that a user is being tracked.