FBI now says StingRay surveillance can be disclosed
Local law enforcement is not prohibited by the FBI from disclosing use of StingRay surveillance technology that can mimic the behavior of mobile phone towers, the agency says in contradiction with previous interpretations.
The Federal Bureau of Investigation told The Washington Post that its non-disclosure agreement (NDA) with local law enforcement agencies regarding StingRays, or “cell site simulators,” is actually not intended to shield the technology's use.
"The NDA should not be construed to prevent a law enforcement officer from disclosing to the court or a prosecutor the fact that this technology was used in a particular case," the FBI statement, first published in full by Ars Technica, reads.
"Defendants have a legal right to challenge the use of electronic surveillance devices, and not disclosing their use could inappropriately and adversely affect a defendant’s right to challenge the use of the equipment."
Dozens of law enforcement agencies across the United States rely on simulators like these that are branded as “Stingrays” by Harris Corp., a Florida-based manufacturer, to try to locate persons of interest or intercept calls and text messages through cell phone signal triangulation. Law enforcement departments nationwide have long attempted to hide Stingray use, going so far as to drop cases rather than disclose that the technology was used, according to documents obtained through Freedom of Information Act requests.
The FBI's statement said the agency has never employed this provision.
"The FBI’s concern is with protecting the law enforcement sensitive details regarding the tradecraft and capabilities of the device," FBI spokesman Christopher Allen said in the statement.
Revelations concerning both the technology behind the tools and the rules for using StingRays have emerged in recent months, however, and in turn attracted criticism from privacy advocates and transparency proponents alike.
This week, Washington state authorized an anti-surveillance bill that will require police agencies to obtain a search warrant before using cell site simulators.
The technology behind the Stingray allows authorities to collect information about upwards of thousands of mobile devices within a given area by emulating the legitimate signals sent by cell towers like those run by phone companies. Phones will automatically try to connect to a “cell site simulator” when within range, and police can then use the data sent by those devices to attempt to pinpoint the location of a suspect.
Since simulators like the StingRay gather data on more than just the targeted device, privacy proponents have cried foul as more details surface about a technology that until recently was shrouded in secrecy. Reports have indicated that the Baltimore Police Department in Maryland used Stingrays thousands of times during the last decade without search warrants.
Amid increased scrutiny, the US Department of Justice said earlier this month that it would be undertaking a federal investigation on the use of cell site simulators, and many jurisdictions have weighed in and in some instances approved restrictions on the tools.
READ MORE: FBI forces police departments across the US to keep quiet about cellphone spying gear
The FBI have previously justified the secretive aura around Stingrays based on the possible ability of criminals to thwart FBI tactics. The public cannot know about Stingrays because criminals are part of the public, the FBI suggested.
"The FBI routinely asserts the law enforcement sensitive privilege over cell site simulator equipment because discussion of the capabilities and use of the equipment in court would allow criminal defendants, criminal enterprises or foreign powers, should they gain access to the items, to determine the FBI’s techniques, procedures, limitations and capabilities in this area," Bradley Morrison, chief of the tracking technology unit at the FBI, wrote in an affidavit offered to Ars Technica last year.
"This knowledge could easily lead to the development and employment of countermeasures to FBI tools and investigative techniques by subjects of investigations and completely disarm law enforcement’s ability to obtain technology-based surveillance data in criminal investigations," Morrison added.
The Harris Corporation's own NDA with its StingRays clients has received pushback of late. Santa Clara County in California recently refused the company's NDA, effectively scuttling contract negotiations.
“StingRays are very invasive surveillance tracking technology and Santa Clara County was right to bring the issue of its acquisition to the Board of Supervisors and thoroughly consider the legal issues,” the American Civil Liberties Union of North California said in a release on Wednesday.
The ACLU has identified 51 agencies in 21 states, plus the District of Columbia, as owning Stingray surveillance devices. Civil liberties groups that have been making public records requests in order to learn more about the technology have discovered that non-disclosure agreements exist between governments and companies like Harris.
The ACLU has filed public records requests with more than 30 Florida law enforcement agencies, while the New York Civil Liberties Union has filed one with the sheriff’s office in Erie County, New York.
What is known is that these cell-site simulators trick phones into connecting to them by posing as cell phone towers – they can block or drop phone calls, and disrupt other mobile devices that use the same cell network, according to recent court disclosures. The ACLU said that law enforcement officials in Florida have used Stingray surveillance to track cell phone locations on more than 1,800 occasions, all without warrants.
The ACLU’s recent disclosure included a court filing that uncovered the ability of a StingRay to negate cell phone calls by either downgrading mobile devices from 3G or 4G connectivity to 2G – enabling them to access identification and location information – or by using the devices’ “catch-and-release” functions.
