Judge Releases Information about Police Use of Stingray Cell Phone Trackers

https://www.aclu.org/blog/national-security-technology-and-liberty/victory-judge-releases-information-about-police-use

by wglb • 12 years ago

251 99 12 years ago

declan• 12 years ago

This is great news. Kudos to the ACLU. And I'm happy to say it came about as a result of a note I posted on Twitter in January:

https://twitter.com/declanm/status/429292173083688960

https://twitter.com/NateWessler/status/473990510902640640

greenyoda2• 12 years ago

Kudos to you, too!

Here's the link from declan's tweet:

http://caselaw.findlaw.com/fl-district-court-of-appeal/16502...

"James L. Thomas appeals convictions and sentences for sexual battery and petit theft, contending that evidence obtained in violation of the Fourth Amendment, and article I, section 12 of the Florida Constitution, was introduced against him at trial. We reverse and remand for a new trial."

So, because the police wanted to keep their use of the Stingray secret, they entered the accused rapist's apartment without obtaining a warrant, which caused the evidence they gathered, including the victim's phone, to fall under the exclusionary rule. The defendant will get a new trial, and may go free and commit other crimes, because of the police's preference for secrecy over the rule of law.

deciplex7• 12 years ago

You forgot the next step:

"Thereby helping, in some small way, to (further?) turn the public against the doctrine of Fruit of the Poisonous Tree."

eyeareque• 12 years ago

This is great. I wonder if by making the stingray'd phones transmit at full power, it allows them to find the phone quicker/easier.

How quickly can someone create a phone widget that shows when your cell "tower" has asked your phone to transmit at full power?

greenyoda2• 12 years ago

Transmitting at full power probably isn't that rare. It could mean you're far away from the tower you're talking to, and that could even happen if a tower nearby is overloaded and you've been handed off to a more distant one to balance the load. It could also be due to noise on the channel, being in a building that blocks the signal, etc.

Also, information from the baseband processor in your phone (the processor that handles the radio transceiver, and would know what power you were transmitting at) may not be easily available to the processor that runs the apps.

Hello71• 12 years ago

an attempt could probably be made to calculate the power usage assuming it is the main power consumer by subtracting other major users of power like CPU, screen brightness, wifi, etc.

actually, scratch that. most android phones have per-component power consumption readings, so while you couldn't get the actual tx power, you could just base it off of the baseband power usage.

MAGZine• 12 years ago

Depending on what information is available, you might be able to get a good idea if it's fake or legit by looking at signal strength, jitter, latency when communicating with that tower.

If the phone is mostly stationary, then there could be a cause for concern on the phone's behalf.

RankingMember3• 12 years ago

Pie in the sky idea: App that indexes cell towers to a central database. When a new tower goes up, it undergoes a confirmation process that verifies its presence for some given amount of time before adding it to the list of confirmed cell towers. The software would then give you the ability to choose to only engage with/respond to registered towers.

This would only work if a good amount of people adopted it (and various other contingencies were satisfied).

bdonlan• 12 years ago

There are legitimate uses for temporary base stations - often at large sports events cellular providers will install portable temporary stations for example.

aaronsnoswell• 12 years ago

In Australia this information is freely available in public databases anyway. Obviously temporary towers might not be present in these records though.

toomuchtodo• 12 years ago

OpenSignal already has a database of towers, with their associated FCC ID info. It would be trivial to crowdsource rouge/out of place "towers".

tombrossman• 12 years ago

The closest thing to this is an Android app called 'Antennas' which looks like it is no longer being developed.

https://play.google.com/store/apps/details?id=com.technolatr...

RankingMember3• 12 years ago

To reply to my own comment, I realized that this could potentially be done more simply by just attempting to place a dummy call to an un-indexed tower when encountered (my understanding is that a Stingray isn't actually capable of handling calls). If >99% of calls failed (basically 100% with room for error), the tower could be confirmed bad and blacklisted.

pmorici• 12 years ago

http://en.wikipedia.org/wiki/Mobile_phone_charm

I think one of the ones that "flash and light up when the phone rings" would do the trick for you. At least that is urban legend among people who need that kind of warning as I understand it.

Edit: ThinkGeek sells one... http://www.thinkgeek.com/product/a150/

ipsin• 12 years ago

It's great news. I'm still stunned by the Florida case, also linked to in this page:

https://www.aclu.org/blog/national-security-technology-and-l...

Can Federal Marshals really deputize state and local officers and retroactively seize their work product? Can these officers be involuntarily deputized?

It seems like simple theft of state records to me.

icambron• 12 years ago

I'm not sure to what degree it was involuntary, but regardless, no, they don't stop being state records because the government handed him a title. I'm not a lawyer, but I'd be pretty shocked if the ACLU didn't win that one.

jauer• 12 years ago

I'm curious about the regulatory side of this.

Did the FCC grant these police departments a license to transmit on frequencies assigned to cell companies? Did the cell companies in question allow the police to use their frequencies?

The FCC is usually quite particular about interference with cell phones. For example, it's illegal for prisons to run a cell phone jammer but they can coordinate with call companies to run a fancy repeater that MITMs calls in the area and only allows authorized handsets.

eli2• 12 years ago

The FCC is clearly aware of what's going on and the FOIA denial suggests that at least someone somewhere has been authorized to use them: http://files.cloudprivacy.net/FOIA/FCC/fcc-stingray-reply.pd...

eitally• 12 years ago

The attached letters from the municipalities of Houston, Anne Arundel County, etc... indicate -- to me, at least -- that the authorization was granted. If they hadn't been, I don't see the FOIA officer bothering to attach them, but who knows.

ekianjo6• 12 years ago

In this case, police used two versions of the stingray — one mounted on a police vehicle, and the other carried by hand. Police drove through the area using the vehicle-based device until they found the apartment complex in which the target phone was located, and then they walked around with the handheld device and stood “at every door and every window in that complex” until they figured out which apartment the phone was located in. In other words, police were lurking outside people’s windows and sending powerful electronic signals into their private homes in order to collect information from within.

Seriously ? And no police officer was ashamed of what they were doing during that whole time ?

eli2• 12 years ago

Well, sure, it sounds bad when you phrase it like that.

Smushman• 12 years ago

anything sounds bad when you say it like that...

deciplex7• 12 years ago

What makes you think agents of the American state have any more shame than various other examples of thugs run amok throughout history?

adventured• 12 years ago

There is still a wide-spread belief that the agents of the burgeoning US police state are 'just people like everyone else,' that are 'just trying to do their jobs.'

kareemm• 12 years ago

Perhaps you're forgetting that the police likely believed they were doing the right thing and attempting to bring a bad guy to justice.

It's not a popular sentiment on HN, but not all police officers are part of the shoot / oppress first, ask questions later school of policing.

ekianjo6• 12 years ago

the police likely believed they were doing the right thing

You mean, just like TSA officers who believe that X-raying everyone who boards a plane is the right thing if we want to catch these darn terrorists?

pessimizer• 12 years ago

not all police officers are part of the shoot / oppress first, ask questions later school of policing.

But these were. You're creating a false dichotomy between cops who violate people's rights and cops who think that they're doing the right thing.

scarecrowbob• 12 years ago

"It's not a popular sentiment on HN, but not all police officers are part of the shoot / oppress first, ask questions later school of policing."

To be fair, even those of that school like believe "they [are] doing the right thing and attempting to bring a bad guy to justice."

deciplex7• 12 years ago

Literally everyone believes they are doing the right thing. Everyone justifies their actions, at least to themselves.

bediger4000• 12 years ago

Law enforcement officers, of all people, should know and respect The Law, shouldn't they? I mean, "ignorance of the law is no excuse", and they are doing a special job which requires special knowledge, skills and care. So, I think that we can assume they knew they weren't doing "the right thing". Stingrays are pretty clearly against the spirit of American Democracy and Law Enforcement, as traditionally held.

Beyond that, the ends rarely justify the means, even legally. There are supposed to be limits to how the police find stuff out. See 4th Amendment. Traditional sense of fair play, decency, etc.

ollyfg• 12 years ago

police were lurking outside people’s windows and sending powerful electronic signals into their private homes in order to collect information from within.

Is it just me or does this not sound terribly terrible? My neighbours wifi router sends "powerful electronic signals" into my private home every day.

ekianjo6• 12 years ago

My neighbours wifi router sends "powerful electronic signals" into my private home every day.

Making your phone use max power to emit information is nothing like the wifi radiation you get from your neighbors.

pyre3• 12 years ago

Police aren't allowed to troll through neighborhoods with heat sensors looking for pot-growers, so how is this that different?

The idea is that they are probing the contents of private homes without a warrant, no? What's the purpose of a warrant if the police can just scan the contents of your house from the street?

dragonwriter2• 12 years ago

My neighbours wifi router sends "powerful electronic signals" into my private home every day.

But it isn't sent by government agents "in order to collect information from within", which is a key factor in the description.

chiph• 12 years ago

How is this not an illegal search in the same way that the use of infrared cameras has been shown to be?

http://abcnews.go.com/US/story?id=93127

gscott• 12 years ago

Infrared cameras look into your domicile while the StingRay looks for signals being sent out. They are not looking in to see what is there, they are capturing what is coming out. It is different enough to be litigated up to the Supreme Court.

That being said, I in no way support this. I have no choice but to use my phone which makes me into a tracking target.

In America it turns out we are all targets in order to exclude each one of us from being Terrorists. Police cars now capture license plates and upload them to a central database (plantir), the whole Internet is being captured and held for 3 days at a time while parts are being kept for longer, the outside of mail is being scanned and captured by the USPS, every major mail facility (fedex, ups, etc) are mandated to have federal agents who open mail and then re-seal it so you never know, etc and so on. I have had to double the tin foil on my hat because one layer is just not enough! It is getting crazy.

coldcode• 12 years ago

I can't see how this is constitutional without a warrant. How is this different than using an infrared detector outside someones home?

forrestthewoods• 12 years ago

There's no way it's constitutional. These days that doesn't seem to be of much importance.

ekianjo6• 12 years ago

These days that doesn't seem to be of much importance.

It's not of much importance because nobody is outraged by it and nobody is fighting it (apart from a few organizations whose only action is to complain through their websites).

TwoBit• 12 years ago

I wonder, can you make a device that's an anti-stingray? I mean a device that detects a stingray is present and compromises it somehow.

dmitrygr• 12 years ago

with access to the radio firmware if your phone you can

good luck getting it though

peterwwillis• 12 years ago

Well you could detect if your cell tower(s) changed strength or location for no reason, and then spam the relevant radio frequencies with noise, or a clear signal. In general the co-channel interference is bad enough that most clients can't talk if they've got two or more radios broadcasting on the same frequency in the same cell at the same power. But increased noise is a sure-fire way to corrupt signal.

You could also take up too many channels to keep it from servicing more clients. Or broadcast too many handset identifiers, flooding them with random traffic so it's hard to tell if they've actually found their handset or it just came up randomly.

theA91• 12 years ago

Currently designing a device to do that it will use the same signal as the stingray under a tesla design it will reroute a fake signal to send a high electrical pulse safe to humans to the stingray causing it to become a receptor of the signal and frying it under electrical load kind of like a solar storms effects on electrical devices in space

link15• 12 years ago

Honestly, this is all being done over public airwaves. It may be an FCC violation (cell phone jammers?), but I don't think that's what the ACLU is upset about here.

The part that seems shady to me is that Verizon appears to think it is OK to give out customer information to law enforcement without a warrant. Without being able to tie a device ID to a person, its all just a bunch of numbers.

nness2• 12 years ago

I don't quite understand how this is a constitution issue?

I get that the Fourth Amendment protects against warrantless entry, but if you're using a device that is producing a signal that leaves the boundaries of your property, is capturing that signal considered warrantless?

I don't see the nuance between the Stingray device and Wifi networks. If a police officer were to identify your home via a wifi network SSID, would that be warrantless entry?

throwaway0010• 12 years ago

There's a good deal of nuance to these sorts of questions. For example, police may look at your house from the street in the visible spectrum, but may not look at your house from the street in the infra-red spectrum without a warrant.

dpeck• 12 years ago

I seem to remember some interesting stuff about wireless in the US during the Google mapcar fiasco. Something about its not whether its in the clear and broadcast but if people think that it is determining a lot of the law around it.

Memory is fuzzy and my searches aren't turning up the results I'm looking for. Does anyone else remember this?

Terr_• 12 years ago

Technically speaking, EVERYTHING in your house is giving off some kind of indication that could theoretically be captured and re-assembled.

IMO the only reasonable interpretation is that the 4th Amendment protects you from anything beyond whatever passes for ordinary observation by normal people.

crusso2• 12 years ago

And that's what the supreme court basically said. It's one thing for the police to look in an open window - but quite another for them to scan your home with a thermal imager.

http://abcnews.go.com/US/story?id=93127

chmars2• 12 years ago

Stingray? Is that American slang? In the rest of the world, the device is called IMSI catcher:

https://en.wikipedia.org/wiki/IMSI-catcher

pyre3• 12 years ago

From another ALCU link elsewhere in the comments:

cell phone tracking devices known as “stingrays.” (The devices are also known as “cell site simulators” or “IMSI catchers.”)

chmars2• 12 years ago

It seems that 'Stingway' is a manufacturer's brand name, thanks!

mysteriousllama• 12 years ago

Tasker for Android can help notify you if this is happening to you.

From the documentation I've gathered stingray devices appear to impersonate a cell tower with a stronger signal than the real one in order to get the device to associate. This means that stingray devices likely have their own cell ID so as not to trample the real one. If it didn't, it'd be a jammer not an interception device.

A simple PoC Tasker script (I wish it had an actual text-based language..): Add a new state, "Cell Near", Scan and pick the tower with highest signal. Invert the action. Tie it to a Notification task.

Whenever your phone associates with anything other than that tower you will get a notification. If you're good with Tasker it can be expanded to use GPS/Expected-tower pairs and alert you if something strange is going on.

Yes, someone should write an app for the general public. Maybe even see if the EFF can help promote it!

genericacct• 12 years ago

https://github.com/SecUpwN/Android-IMSI-Catcher-Detector

atmosx• 12 years ago

Hm, impressive. Nothing for iOs right? Android might not be as polished, but gets all the cool stuff.

andyjohnson0• 12 years ago

From https://en.wikipedia.org/wiki/IMSI-catcher:

"The IMSI catcher masquerades as a base station and logs the IMSI numbers of all the mobile stations in the area, as they attempt to attach to the IMSI-catcher. It allows forcing the mobile phone connected to it to use no call encryption (i.e., it is forced into A5/0 mode), making the call data easy to intercept and convert to audio."

If it is possible for an Android/iOS app to detect when a GSM call is initiated without encryption then it should be possible to warn the user. Does anyone know if the encryption level is available to the OS, or is it restricted to the baseband processor?

WillKirkby2• 12 years ago

I think it's restricted to the baseband, but I'm not an expert. Fun fact: SIM cards actually have a flag which tells the handset to display a warning to the user if they are using an unencrypted connection. Basically no commercial SIM cards have this flag enabled.

Source: https://www.youtube.com/watch?v=xKihq1fClQg

BuildTheRobots• 12 years ago

I believe you have to enable a bit to _disable_ the warning (eg, it should be there as default). On my own network with my own sim cards, I've yet to find a modern handset that actually alerts me, though :(

revelation3• 12 years ago

As usual, everything interesting happens on the baseband processor. It would be trivial to detect that an IMSI catcher is used, even when it has support for encryption (unlikely given the age of the Stingray system and the need to communicate back with the mobile provider).

But alas, all the baseband processors are propietary software designed by companies that will happily compromise your privacy.

revelation3• 12 years ago

If you want to detect the presence of an IMSI catcher such as the Stingray system, you won't be able to do that on Android, iPhone or basically any phone out there you can buy today. What you need is a phone that has been hacked to run the osmocomBB firmware and baseband software:

http://bb.osmocom.org/trac/wiki/Hardware/Phones

You can then use the CatcherCatcher software from SRLabs who have been working on this GSM/mobile security stuff since forever:

https://opensource.srlabs.de/projects/mobile-network-assessm...

jacquesm3• 12 years ago

First I heard about this:

http://michiganmedicalmarijuana.org/topic/45943-police-depar...

What is the legal status of using something like CatcherCatcher? (in other words, could you get in trouble for using it in the same way that you can get in trouble in many places for having a radar detector?)

exhilaration• 12 years ago

Only if CatcherCatcher is made explicitly illegal, like the legislature of Virginia and the city council of Washington D.C. have made radar detectors illegal. Those are the only two places (and military bases) that radar detectors are illegal for passenger cars in the United States.

joekrill• 12 years ago

Does that mean this comment is incorrect? https://news.ycombinator.com/item?id=7844350

revelation3• 12 years ago

Checking the cell ID can be used to detect an IMSI catcher, but it requires knowing which cell IDs can be trusted. That requires some kind of cell ID whitelist and can be a pain to maintain / prone to false positives.

Notice however that CatcherCatcher does a lot more than just detecting IMSI catchers. It also detects when you receive a "silent text message". Law enforcement works with mobile network operators to continously send these text messages to a mobile device. The baseband in the device then wakes, communicates with the nearest cell and thereby reveals its proximate location, without ever notifying the application processor that anything of note has happened. This allows for tracking a persons movement around cells at pretty much zero cost and can be done from any point in the world, unlike the IMSI catcher that requires you to be close to the target for it to pickup on the fake network.

Judge Releases Information about Police Use of Stingray Cell Phone Trackers

Related Stories