Stingrays: The Biggest Technological Threat to Cell Phone Privacy You Don't Know About

BY HANNI FAKHOURY AND TREVOR TIMM, Electronic Frontier Foundation
EFF.org
Oct. 23, 2012

On Friday, EFF and the ACLU submitted an amicus brief in United States v. Rigmaiden, a closely-followed case that has enormous consequences for individuals' Fourth Amendment rights in their home and on their cell phone. As the Wall Street Journal explained today, the technology at the heart of the case invades the privacy of countless innocent people that have never even been suspected of a crime.

Rigmaiden centers around a secretive device that federal law enforcement and local police have been using with increased frequency: an International Mobile Subscriber Identity locator, or "IMSI catcher." These devices allows the government to electronically search large areas for a particular cell phone's signal--sucking down data on potentially thousands of innocent people along the way--while attempting to avoid many of the traditional limitations set forth in the Constitution.

How Stingrays Work The Stingray is a brand name of an IMSI catcher targeted and sold to law enforcement. A Stingray works by masquerading as a cell phone tower--to which your mobile phone sends signals to every 7 to 15 seconds whether you are on a call or not-- and tricks your phone into connecting to it. As a result, the government can figure out who, when and to where you are calling, the precise location of every device within the range, and with some devices, even capture the content of your conversations. (Read the Wall Street Journal's detailed explanation for more.)

Given the breadth of information that it can stealthily obtain, the government prefers the public and judges alike not know exactly how Stingrays work and they have even argued in court that it should be able to keep its use of the technology secret. The Electronic Privacy Information Center has filed a FOIA request for more information on Stingrays, but the FBI is dragging its feet and is sitting on 25,000 pages of documents explaining the device.

The Rigmaiden Case: An Illusory Warrant In Rigmaiden, the government asked a federal judge in Northern California to order Verizon to assist in locating the defendant, who was a suspect in a tax fraud scheme. But after they received an order telling Verizon to provide the location information of an Aircard they thought to be the defendant's, the government took matters into their own hands: they claimed this authorization somehow permitted its own use of a Stingray.

Not only did the Stringray find the suspect, Rigmaiden, but it also got the records of every other innocent cell phone user nearby.

The government now concedes that the use of the device was a "search" under the Fourth Amendment and claims it had a warrant, despite the fact that, as we explain in our brief, "the Order directs Verizon to provide the government with information and assistance, but nowhere authorizes the government to search or seize anything."

In fact, the government's application made no mention of an IMSI catcher or a Stingray, and only has a brief sentence about its plans buried at the end of an 18-page declaration: "the mobile tracking equipment ultimately generate[s] a signal that fixes the geographic position of the Target Broadband Access Card/Cellular Telephone."

A judge initially signed off on this order, but clearly, the government did not accurately and adequately explain what it was really up to.

General Warrants: Unconstitutional, All You Can Eat Data Buffets Beyond the government's conduct in this specific case, there is an even broader danger in law enforcement using these devices to locate suspects regardless of whether they explain the technology to judges: these devices allow the government to conduct broad searches amounting to "general warrants," the exact type of search the Fourth Amendment was written to prevent.

A Stingray--which could potentially be beamed into all the houses in one neighborhood looking for a particular signal--is the digital version of the pre-Revolutionary war practice of British soldiers going door-to-door, searching Americans' homes without rationale or suspicion, let alone judicial approval. The Fourth Amendment was enacted to prevent these general fishing expeditions. As the Supreme Court has explained, a warrant requires probable cause for all places searched, and is supposed to detail the scope of the search to ensure "nothing is left to the discretion of the officer executing the warrant".

But if uninformed courts approve the unregulated use of Stingrays, they are essentially allowing the government to enter into the home via a cellular signal at law enforcement's discretion and rummage at will without any supervision. The government can't simply use technology to upend centuries of Constitutional law to conduct a search they would be prevented from doing physically.

Stingrays Collect Data on Hundreds of Innocent People And when police use a Stingray, it's not just the suspects' phone information the device sucks up, but all the innocent people around such suspect as well. Some devices have a range of "several kilometers," meaning potentially thousands of people could have their privacy violated despite not being suspected of any crime. This is another fact the government didn't fully explain to the magistrate judge in Rigmaiden.

The government now claims it protected privacy by deleting all third-party data on its own after it collected it. But the government's unilateral decision to binge and purge comes with its own consequences. Now there's no way to know what exactly the government obtained when it used the device.

Had the government told the court what it really was planning on doing and the amount of information it would obtain, the court may have exercised its constitutional role of ensuring the government narrowed its search. After all, it was for the court, not the government, to decide how best to balance the government's need for information with third-party privacy, and any suspect's future interest in access to potentially exculpatory information.

Enough Warrantless Excursions Unfortunately, US government excuses for conducting warrantless searches are becoming all too familiar. Whether it's the hundreds of thousands of searches for cell phone location information, the skyrocketing of warrantless surveillance of who and when you're calling, or the NSA's still-active warrantless wiretapping program, Americans are seeing their Fourth Amendment privacy rights under attack from all angles. We hope in this case and others like it, the court will prevent such violations of privacy from occuring again.