Aug. 29, 2014 (TSR) – More than 40 law enforcement agencies and 18 states have been identified that ventured into NSA territory’s “Collect It All, Know It All” private data collection on U.S. soil using invasive surveillance equipment on anyone’s mobile phone.
The Federal Bureau of Investigations (FBI), Drug Enforcement Administration (DEA), U.S. Secret Service, Immigration and Customs Enforcement (ICE), U.S. Marshals Service, Bureau of Alcohol, Tobacco, Firearms and Explosives (BATFE), U.S. Army, U.S.Navy, U.S. Marine Corps, U.S. National Guard, U.S. Special Operations Command and National Security Agency (NSA) – are federal agencies known to use the mobile spying technology, in addition to license plate recognition, biometrics, predictive policing algorithms and drones, throughout the United States according to American Civil Liberties Union (ACLU) List.
Known as “cell site simulators” or “IMSI catchers”, these 43 agencies mass-compile data, sweep up records of every mobile telephone call, text message, and data transfer up to a half-mile from the device.
But that is a just tip of the iceberg.
Usually, U.S. Law enforcement agencies request permission from a judge to acquire mobile phone records.
When investigators want to learn the location of a suspect, they routinely pay a mobile phone company a fee to find the person’s mobile phone — but only after a judge has signed off on the request for what’s known as a “pen register.”
However, some agencies have used these pen registers as permission to deploy spying equipment nationwide. Unfortunately, it often is unclear whether judges approving the orders were told that officers would be privy to information about a whole neighborhood, not just the subjects they said they would be monitoring.
The fact that ACLU complained that enforcement agencies deliberately conceal the practice from judges during criminal investigations, we can deduct that disclosure is at the minimum when requesting for a pen register.
Initially the domain of the National Security Agency (NSA) and other intelligence agencies, the use of invasive surveillance equipment has now trickled down to federal, state and local law enforcement.
Apart from signing mandatory non-disclosure agreements with manufacturers like Harris Corporation, the U.S. federal government who loans out the surveillance equipment to spy on people practically demands agencies to hide or suppress the information by claiming that it came from a “confidential source” and seal any affidavits that accidentally mention the use of the equipment.
Everything has been behind the shroud of secrecy. Until now.
In perhaps the most explosive evidence so far, the ACLU released a set of internal police emails showing that the US Marshals have been instructing police to lie to courts about the use of such devices in Florida. According the fully documented emails here, the police are told to submit a new affidavit after the fact without mentioning the Harris Corporation’s Stingray device, and seal the old affidavit, so that it never becomes public. The key parts of the email are highlighted below:
A tricky Shipp sets sale in Tacoma
The latest bombshell is the Police Department of Tacoma, Washington, who bought and quietly used Stingray for six years now.
Police in Oakland, California, has also been using Stingray since 2007, when an annual report cited 21 electronic surveillance arrest, according to ACLU.
Earlier this month, Tacoma city officials blacked out portions of relevant purchase documents requested by The News Tribune, and the unredacted portions of those public records as well as other documents indicate that the Tacoma Police Department has had the ability to wirelessly search neighborhoods since as early as 2008.
Deputy City Attorney Michael Smith redacted much of the identifying information on a May 2013 invoice for the equipment, saying disclosure “would allow the identification of confidential pieces of technology,” according to local reports.
It also appears that the department has updated its equipment last year with money authorized by a City Council whose members now claim they didn’t know what they were buying.
Federal grants, including one from the Department of Homeland Security, were also used to buy the equipment, according to public records News Tribune obtained.
A city memo from last year shows the Tacoma Police Department sought to bypass competitive bidding requirements.
The memo cites the need to update equipment “utilized by Special Investigations in support of field operations for criminal investigations” and states that “current Harris Corporation technology owned by TPD was received through a Department of Justice (DOJ) Law Enforcement Grant Award in 2007.”
A few months later in 2008, the federal government sent the city via FedEx overnight a Stingray and a similar Harris Corp. device, called a Kingfish, according to documents posted this month on Muckrock, a website that helps people file public records requests.
The equipment was given under a federal program — the Counterdrug Technology Assessment Center, Technology Transfer Program — that provides equipment to local law enforcement agencies to fight the drug trade. It was shipped to police Detective Jeffrey Shipp according to the invoice.
In 2008, the city named Shipp an employee of the month in another apparent indication of the city’s pursuit of Stingray technology.
Shipp was praised in an employee newsletter “for his work in procuring a $450,000 training and equipment grant for a cellular phone tracking system — one of only five awarded across the country. Great job!”
The detective’s name showed up yet again in a March 2013 Police Department request to spend $251,752 to upgrade its Harris Corp. equipment. Most of the money — $188,814 — came from a federal port security grant through the Department of Homeland Security.
Shipp and Chief Ramsdell sold the purchase to the City Council as a boon to Tacoma’s bomb squad.
Ramsdell wrote in a memo to the city’s purchasing department: “This new equipment offers enhanced technological capabilities for the Tacoma Police Department Explosives Ordinance Detail (EOD) with IED (improvised explosive device) prevention, protection, response and recovery measures.”
The city was getting a laptop free of charge according to the unredacted May 2013 invoice: “This $3,500 valued Laptop PC is included in the cost of the Stingray II Enhancement.”
The City Council, who unanimously approved buying the equipment March 19, 2013, apparently did not know that the technology was not created to detect bombs.
Councilman Ryan Mello said he recalls talking with police about a grant relating to port security and improvised explosive devices, but not about cellphone surveillance.
“This is the first I’m hearing of it,” he said.
The Police Department should have disclosed what the device was really for, Mello added.
Pierce County sheriff’s spokesman Ed Troyer confirmed on Tuesday that the Tacoma Police Department sometimes assists the sheriff’s office with the device according to local media.
Police Chief Don Ramsdell, through a spokeswoman, declined an interview request to talk about the police department’s apparent purchase of a Stingray device and associated technology.
The department also cited a nondisclosure agreement it has with the FBI, Bellingham Herald reported.
Privacy Gone: How Stingray Works
Stingray, which is manufactured by Harris (HRS), a Pentagon contractor based in Melbourne, Fla., is a device small enough to be carried in a car and can be driven around a target location to more accurately pinpoint the location of a subject.
It tricks a mobile phone into thinking it’s a mobile phone tower, drawing information, ACLU said.
By mimicking mobile phone towers and sending out electronic cues, the technology allows the police to enlist mobiles as tracking devices, thus revealing people’s movements with great precision. Stingray gathers the electronic serial numbers and other information about phones, as well as the direction and strength of each phone’s signal, allowing precise location tracking.
Normally, the information from mobile phone companies shows only where a person has been and who the person has called or texted. A Stingray shows where the person is and who he or she is calling or texting in real time. Because we carry our mobiles with us virtually everywhere we go, stingrays can paint a precise profile picture of where we are and who we spend time with, including our location in a lover’s house, in a psychologist’s office or at a political protest.
The equipment also sends intrusive electronic signals through the walls of private homes and offices, learning information about the locations and identities of phones inside. In one Florida case, a police officer explained in court that he “quite literally stood in front of every door and window” with his stingray to track the phones inside a large apartment complex.
In gathering information, a Stingray device exploits a flaw in mobile phone signal security.
Mobile phones seek the strongest tower signal, and a Stingray pretends to be a mobile phone tower with a strong signal.
Soghoian of the ACLU described the process as a high-tech game of “Marco Polo.”
The Stingray sends a signal: “Marco.” All cellphones within range, not just the ones police are seeking, are compelled to respond: “Polo.”
The phones are tricked into passing data through government equipment before going to a legitimate mobile phone tower — and the mobile’s owner has no idea what happened.
Deployed in tandem with analytical software, such mobile surveillance technology could be used by police to analyze massive amounts of metadata — who you call or text, when you contact them and for how long you talk — to determine associations between groups of people.
One maker of such software is Pen-Link of Lincoln, Nebraska. Purchasing records show Pierce County paid $8,400 for a year’s access to Pen-Link software as recently as 2012.
“Software is installed on Tacoma Police Department network for regional intelligence group,” the entry reads.
Sheriff’s spokesman Troyer said the county first bought the software in 2005 as part of a terrorism prevention program. The department uses the software as an investigative tool by analyzing data lawfully obtained through a warrant, he said.
In February, the Tacoma police bought software from another data-analysis company, Verint of Melville, New York, for $51,727, purchasing records show.
The Tacoma Police’s purchase last year of updated Stingray technology appears to have ensured it can continue to track mobiles in the years ahead.
A 2013 invoice indicates the city bought Harris Corp. equipment under a federal General Services Administration contract. The city paid $109,421 — exactly the price the federal contract specified as the cost of a Stingray upgrade called Hailstorm.
Hailstorm is aimed at keeping mobile surveillance equipment up to date.
“We don’t know everything about what the Hailstorm does,” said Soghoian of the ACLU. “… It’s not surprising that law enforcement agencies are seeking this equipment. It’s definitely not cheap.”
A March 2014 purchase order from the DEA states: “The Hailstorm upgrade is necessary for the Stingray system to track 4G LTE phones.”
The 4G LTE standard allows rapid data transfer over a wireless network and is becoming the standard in cell phone technology.
Stingrays can tap these phones, but only because the current generation of 4G LTE phones is compatible with the older 2G standard, Soghoian said. That won’t always be the case — and law enforcement agencies know this, he said.
Concealing the use of stingrays deprives defendants of their right to challenge unconstitutional surveillance and keeps the public in the dark about invasive monitoring by local police. And local and federal law enforcement should certainly not be colluding to hide basic and accurate information about their practices from the public and the courts, ACLU emphasized.