Investigation: Law enforcement use secret 'Stingray' devices to track cell phone signals
Law enforcement agencies across the U.S. and in Southern California are using a device so secret that agencies are required to sign a non-disclosure agreement before they can buy or use it.
The device is commonly referred to as a "Stingray," although several companies manufacture models under various brand names, including "Kingfish" and "Hailstorm."
"Local law enforcement can do things now that we used to relegate to the realm of spies and espionage," ABC7 intelligence expert Hal Kempfer tells Eyewitness News.
Stingray-type devices trick a target's cell phone into connecting to it by masquerading as the strongest cell phone tower in the area -- one phones think belongs to a phone carrier like Verizon or AT&T.
The tracking device pinpoints a cell phone's location down to about three yards and extracts the numbers of all incoming and outgoing calls.
Kempfer, CEO of the Homeland Security firm KIPP Intelligence, says the tool can be a valuable tool in tracking down anyone from terrorists to drug kingpins.
"Just as we visually scan the area, we electronically scan the area," says Kempfer. "If there's a phone number that's associated with a terrorist, we would certainly like to know if that terrorist is showing up in the vicinity of a major airport or someplace where there's a major sporting event."
But critics see the increasing use of Stingrays as a form of "dragnet surveillance" that raises tricky questions about the 4th Amendment's prohibition against overly broad or "general searches."
That's because Stingrays sweep up personal cell phone and location information from more than just the target's cell phone. Stingrays collect data from hundreds, thousands or even tens of thousands of innocent bystanders, all at the same time.
"It's not just one phone that responds, it's any phone within the area. So police are unquestionably collecting location information on innocent Americans," says ACLU attorney and privacy expert Peter Bibring.
Stingrays are suitcase-sized and portable. They can be driven into a target area in search of a suspect or flown over a wider area on board a plane or even a drone.
The U.S. Marshals Service flies so-called "stingrays on a plane" out of five key airports across the nation, including Whiteman Airport in Pacoima. That device, used by the Marshals to track down fugitives and other suspects, is known as a "dirtbox" because of the initials of Boeing subsidiary that manufactures it - Digital Receiver Technology.
The signals sent by Stingray-type devices penetrate the walls of peoples' homes, forcing a phone to connect to it, in a sort of digital "search and seizure."
"When interpreting the 4th Amendment, the courts have always drawn a bright line at the entrance to the home," says the ACLU's Bibring. "The concern about Stingrays is that they effectively allow police to conduct searches inside your home."
If police obtain a search warrant from a judge, then that's legal. But critics say that's not always the case and wonder if judges really know what they're signing off on.
"If an agency doesn't explain the technology that's used, the kind of information it collects, a judge's order is essentially meaningless," Bibring says.
LAPD
The LAPD's Major Crimes Unit has been using this type of technology since about 2006. In 2005, the Los Angeles City Council approved a request by the LAPD to expedite the "sole source" purchase of a "Cell Phone Tracking System" from Digital Receiver Technology with $260,000 in funding from a Homeland Security Grant Program.
In 2010, the Los Angeles Police Foundation reported a grant of $347,550 to the LAPD's Major Crimes Unit for an upgrade to its tracking equipment. The Los Angeles Police Foundation's 990 tax form credits the technology with helping to solve "priority homicides, high-profile cases involving armed suspects, kidnapping, terrorist threats and other heinous crimes."
In 2012, the Los Angeles Police Foundation reported a grant of $23,925 to upgrade the software for the Major Crimes Technical Support Unit that "provides cell phone tracking to all department entities."
Eyewitness News obtained information under the California Public Records Act that shows the LAPD used this type of technology 28 times between Jan. 1, 2014 and Aug. 1, 2014.
LOS ANGELES COUNTY SHERIFF'S DEPARTMENT
Records obtained by Eyewitness News from the Los Angeles County Sheriff's Department show the technology was deployed 66 times between Jan. 1, 2014 and Aug. 1, 2014.
Purchase orders and invoices between the LASD and Florida-based Harris Corporation date back to 2003. More recent records show purchases ranging from $191,513 in 2009 to $301,705 in 2012.
The ACLU of Southern California obtained documents showing the LASD is funding at least some of these purchases with "asset forfeiture funds," meaning money that is confiscated in connection with a crime, rather than taxpayer dollars.
NO EAVESDROPPING?
"The fear would be that they would use the technology for something beyond what it's intended to do," says Kempfer. "For example, just listen to any type of phone conversation."
Both the LASD and the LAPD emphasize that the technology is not used for eavesdropping on phone conversations or reading emails or text messages.
The LASD tells Eyewitness News, "the system utilized by the Sheriff's Department is not capable of collecting or intercepting communications content, including voice and data."
The LAPD tells Eyewitness News, "... there are no uses of an IMSI device that involved the eavesdropping of conversations."
IMSI refers to the type of technology as a whole, because it captures the "International Mobile Subscriber Identity" - a sort of serial number attached to each cellular device.
"Technology is technology, there's always the opportunity for abuse," says Kempfer.
Some models of IMSI/Stingray-type devices are capable of eavesdropping - capturing the content of phone calls and text messages.
"Some of these types of devices have technology that allows police to listen in to phone conversations," Bibring says.
"But because the policies for the use of these devices aren't public, we can't be assured exactly what police are doing or what protections are in place to ensure that constitutional rights are respected."
QUESTIONS ABOUT JUDICIAL AUTHORIZATION
The LASD and LAPD both released templates of the Search Warrant applications used to obtain judicial authorization to deploy the device.
The LASD's Search Warrant application refers to it as a "tracking device."
The LAPD's Search Warrant application contains one line that refers to "cell site simulators."
Critics contend that because the actual applications and orders for such search warrants are routinely sealed, there's no way to know if judges realize the search they're authorizing scoops up personal cell phone and location information from more than just the target.
"In these early days of the technology, judges aren't familiar with what it is, nor are defense attorneys," says Bibring. "So, they may not be tuned into the potential privacy implications."
WHY SO MUCH SECRECY?
Documents suggest that the FBI requires Harris Corporation, which manufactures the Stingray, to execute non-disclosure agreements with law enforcement agencies that purchase its cell phone tracking devices.
An affidavit filed by the FBI's Chief of its Tracking Technology Unit says that disclosure of such "homeland security" information "may constitute a violation of the Arms Control Export Act," a felony punishable by up to 20 years in prison and a fine up to $1 million per occurrence.
"These are extremely close-hold items. We do not want the bad guys to know what we can do," says Kempfer.
Local law enforcement agencies refused all requests by Eyewitness News for on-camera interviews, but are required under the California Public Records Act to produce certain documents if they are not exempt from disclosure.
"This technology is being adopted essentially in secret, with almost no transparency about how it's being used," says Bibring.
SAN BERNARDINO SHERIFF'S DEPARTMENT
Records obtained by Eyewitness News show the San Bernardino County Sheriff's Department first purchased this type of technology back in 2006. A report to the Board of Supervisors authorized a $220,094 payment to Digital Receiver Technology for a "wireless receiving system." The document indicates the device would be "temporarily mounted to any vehicle or aircraft," although an attorney for San Bernardino County tells Eyewitness News the devices have not been deployed on any type of airborne vehicles.
In 2012, the San Bernardino County Sheriff's Department upgraded its equipment, paying $429,613 to the Harris Corporation.
Eyewitness News also asked the SBSD for a template of the form used to obtain judicial authorization to deploy the device. The county says it obtains a court order, rather than a search warrant, which requires a higher standard of proof. The county says a search warrant is only "required when seeking information from a 'tracking device'... and a 'Stingray' device does not track movement."
But experts insist that Stingrays absolutely do track movement and say the county's position is troubling given that a recent U.S. Supreme Court decision held that the electronic tracking of a suspect's location using GPS information requires a warrant.
"There's very little difference between tracking somebody through a GPS device placed on a car and tracking somebody through a cell phone," Bibring says.
The template court order provided by San Bernardino never mentions any of the terms generally used to describe this type of technology; Stingray, IMSI-catcher or cell site simulator. Instead, it refers to a PEN Register/Trap-and-Trace device, a less intrusive technology that captures the phone numbers of the target's incoming and outgoing calls.
The SBSD's template court order goes even further, requiring service providers to turn over data, including GPS location information, from "any and all telephones called or being called by each target, any numbers discovered thru (sic) the investigation."
The SBSD does not keep track of how many times it has deployed its cell-site simulator, but says it's "used in special cases to locate felony suspects and/or missing or kidnapped persons."
Officials emphasize there is no "eavesdropping," and say they do not retain data captured from anyone other than the target.
ORANGE COUNTY SHERIFF'S DEPARTMENT
The Orange County Sheriff's Department tells Eyewitness News it is in the process of purchasing Stingray-type technology from Harris Corporation. A purchasing requisition has been submitted, but "will have to go before the Board of Supervisors before a contract can be issued."
PUSHBACK
Despite the secrecy surrounding this technology, more is being learned about when and how it's being used by law enforcement agencies nationwide. Some judges and defense attorneys are pushing back against the non-disclosure agreements and questioning the use of PEN Register/Trap-and-Trace court orders instead of search warrants that spell out the use of Stingray-type technology.
Prosecutors in Baltimore withdrew evidence in a robbery case last month after a judge threatened a detective with contempt for not revealing details of the cell phone tracking technology used to gather the evidence.
Judges in Pierce County, Washington are now requiring police to ask for specific permission to use a Stingray-type device. That change came after the Tacoma News Tribune reported that judges had unwittingly signed off on 170 court orders that police say authorized them to use the device. However, the plan to use that technology was not disclosed by police to the judges.
Experts say higher courts will eventually have to step in and find the right balance between privacy rights and effective policing.
"We're weighing - should we use this technology? How should we use this technology? Are we infringing on constitutional rights, civil rights, privacy rights? If we use this technology in certain ways, it's a constant balancing act," Kempfer says.
Got a tip? Email Investigative Producer Lisa.Bartley@abc.com
