Stealing Cell Phone Data Is So Easy, Even Local Police Departments Can Do It

Can an 11th Circuit Court ruling stem the tide of International Mobile Subscriber Identity catchers?

Image: Wikimedia Commons

Warrantless wiretapping is not something new to the American people. The Bush Administration secretly authorized the National Security Agency to spy on citizens and others in the country 15 months after 9/11, a program that was eventually outed in a New York Times story.

Since the Times went to press, a new and perhaps more pervasive threat to Americans’ Fourth Amendment rights has emerged in the hands of local cops. Reports of police officers using International Mobile Subscriber Identity (IMSI) catchers, known by popular brand names such as Trigger Fish and Stingray, have begun popping up across the nation.

Little is known about which police departments have purchased them, and the policy and procedures used to operate the devices, which are capable of tracking the location of a cell phone, as well as intercepting voice, SMS, and data communications. The IMSI catchers that are sold to American law enforcement agencies aren’t supposed to be able to intercept voice and data communications—those functions are disabled—but they can read SMS messages.

But, privacy watchdogs such as the Electronic Frontier Foundation and media organizations have managed to unearth records that indicate police in Arizona, California, and Florida, among others have purchased and repaired Stingrays manufactured by the Harris Corporation. And USA Today has evidence of 25 local police agencies owning one or more.

Harris spokesman Jim Burke declined to comment on the specifics of the technology, but told the me, “Two of our major markets are defense and law enforcement, and for those markets we can’t discuss our products. It’s very heavily restricted, and regulated. We abide by all laws and regulations.”

When I emailed the San Francisco Police Department to simply discuss the use of such devices, the response was nothing short of a legal nuclear option. An SFPD spokeswoman emailed a boilerplate legal paragraph citing state, and federal law—including Presidential Executive Order 13637, which mostly deals with arms control—among other reasons for denying my request for comment.

They even refused to confirm or deny whether the SFPD even owned a Stingray—but they do.

Reached by telephone Tuesday, Linda Lye, staff attorney with the American Civil Liberties Union told me that “It’s a ridiculous argument, as the executive order pertains to the Arms Control Act, specifically referring to the munitions listed,” Stingrays are not subject to regulation under this act, and not covered by these treaties.”

Lye went on to explain that the SFPD’s response is similar, if not identical to numerous other law enforcement agencies’ response to queries across the country, citing the same Executive Order, and federal laws.

In part the lack of publicly available information about such devices is may be due to the Obama administration’s intervention—suppressing information—in public records request cases, and criminal trials where the IMSI catchers are used to obtain evidence and track the movements of suspected crooks, according to an Associated Press report from Thursday.

The news of the Obama presidency suppressing information is especially troubling in the wake of the US District Court of Appeals for the 11th Circuit’s ruling, which stated that in order to track a suspect via their phone, local cops must obtain a court-ordered probable cause warrant. Basically, monitoring a phone without a warrant violates the Fourth Amendment, the judge wrote.

It’s a victory, although not a decisive one. “The 11th Circuit decision is a very strong argument that the police need a search warrant to use a Stingray [IMSI catcher],” EFF staff attorney Hanni Fakhoury told me over email. “The 11th Circuit decision also creates a circuit split with the 5th Circuit, which means we may get the Supreme Court to take up the issue.”

Fakhoury is referring to a 2013 decision in which the Fifth Circuit Court ruled that, in fact, it’s not necessary to obtain a probable cause warrant to conduct this sort of electronic surveillance.

There’s no doubt that IMSI catchers are used to make arrests by the feds as well as by local cops. In 2009, the Oakland Police Department, for example, said in an annual report that it arrested 19 people due to “Electronic Surveillance (Stingray)” and had arrested the same number in 2008. The OPD has since stopped reporting the number of Stingray arrests.

Those tight lips brings the OPD in line with local law enforcement around the country. Local cops don’t often disclose the use of IMSI devices when pursuing suspects, according to my sources in law enforcement. So we really don’t know how widespread their use is.

While it’s not worth breaking out your tinfoil hat—I’ve got one in the closet, just in case, don’t you?—the pervasiveness of cops with IMSI catchers, and the way that they’re being deployed is of immense importance to the public. It’s deeply troubling that the Obama administration has been working secretly to suppress documents and procedures from the public, especially in the wake of a federal magistrate saying quite clearly that judicial oversight is required to track your phone’s location—and not doing so is a clear violation of our Fourth Amendment rights.

Of course, if they hadn't been doing anything wrong, they wouldn't have needed secrecy, right?