Warrantless Collection Of Cellphone Data By Law Enforcement On The Rise, As Is The Use Of Stingray Tower Spoofers

from the millions-of-'incidental'-records dept

As we covered last week, cellphone tower "dumps" are increasingly being used by law enforcement to track criminals. These "dumps" provide LEOs with the information gathered every time someone's cell phone contacts the tower, whether it's to make a call, send a text or email or access the web.

This vast amount of data being sought is obtained with a court order, which has a much lower bar than a search warrant, which requires probable cause. The ease in which this data is obtained is one concern. The other concern is that many law enforcement agencies have little to nothing in the way of guidelines for dealing with this collected data -- often allowing it to be stored for years, completely unmiminized. Agencies also are under no obligation to inform citizens that their data has been collected.

USA Today has compiled some more information about how these tower dumps are used, as well as on how common they are becoming. As was noted in our original article, requests for these data dumps has jumped over 75% over the last five years (according to Verizon) and more than 1.3 million requests were made in 2011 alone (Verizon and AT&T combined).

Here's how one particular case utilized data dumps to search for a suspect.
In October 2012, in Colorado, a 10-year-old girl vanished while she walked to school. Volunteers scoured Westminster looking for Jessica Ridgeway.

Local police took a clandestine tack. They got a court order for data about every cellphone that connected to five providers' towers on the girl's route. Later, they asked for 15 more cellphone site data dumps...

The tower dump data helped police choose about 500 people who were asked to submit DNA samples. The broad cell-data sweep and DNA samples didn't solve the crime, though the information aided in the prosecution. A 17-year-old man's mother tipped off the cops, and the man confessed to kidnapping and dismembering the girl, hiding some of her remains in a crawl space in his mother's house. He pleaded guilty and last month was sentenced to more than 100 years in prison.
To sum up, tons of data was collected, resulting in a broad sampling of 500 people's DNA, and yet it was an old-fashioned tip that resulted in the arrest and indictment of the suspect. What should be considered a troubling incursion on our civil liberties is viewed by law enforcement as just another tool in the toolset, albeit one that goes long on data and comes up short on results.

From this lowered bar (court orders), police use previously obtained cellphone tower dumps as justification for even more tower dumps, along with any other information that they can gather without having to obtain a warrant: home addresses, call records, locations and the content of texts. This data is combined with the info gathered by other surveillance technology, including plate readers and traffic cams, to generate very precise recreations of a person's actions and movements -- all without a warrant or any concern for the amount of unrelated data gathered.

The intrusion goes even deeper than bulk data dumps, though.
Local and state police, from Florida to Alaska, are buying Stingrays with federal grants aimed at protecting cities from terror attacks, but using them for far broader police work…

Typically used to hunt a single phone's location, the system intercepts data from all phones within a mile, or farther, depending on terrain and antennas.
Stingray devices give law enforcement agencies roaming cell tower impersonators to grab even more data with, bypassing both search warrants and the wireless providers themselves.

Law enforcement agencies don't want to talk about these devices, something the manufacturer has an active hand in.
Initially developed for military and spy agencies, the Stingrays remain a guarded secret by law enforcement and the manufacturer, Harris Corp. of Melbourne, Fla. The company would not answer questions about the systems, referring reporters to police agencies. Most police aren't talking, either, partly because Harris requires buyers to sign a non-disclosure agreement.
Beyond not wanting to talk about the devices, agencies are also reluctant to discuss what guidelines (if any) they have in place to help safeguard civil liberties. As it stands now, most of these devices are deployed covertly, with citizens having no idea their local law enforcement even possesses this capability.

Documents obtained by Indianapolis Star indicate the Indiana state police own a Stingray device valued at nearly $375,000. Unsurprisingly, the state police have no interest in discussing this purchase.
[O]fficials at Indiana’s largest police agency aren’t saying what they do with the technology; they’re mum on whose data they’ve collected so far; and they’re not talking about what steps they take to safeguard the data.

Citing concerns that releasing any information would endanger public safety by hindering the agency’s ability to fight crime and combat terrorism, they won’t even say whether they ask a judge for a search warrant before they turn the equipment on.
There it is again -- concerns about intrusive technology and untargeted data hauls being waved away by throwing out the word "terrorism" and claiming that revealing any information would "endanger public safety." It's a cop-out -- one that dodges every potential issue by appealing to fear.

The reality is that very few people know how these are being deployed. The power of the device lends itself to abuse, or at the very least, overuse. As the article points out, police in South Carolina used tower dumps to investigate items being stolen from vehicles and in Miami, the police department deployed a Stingray to spy on protesters at a world trade conference.

According to the documents, 25 police departments around the country have contracts with Harris Corp. These devices may be expensive, but utilizing the word "terrorism" when applying for a grant from the DHS generally makes the tech more affordable. These devices also appear to be loaned out freely to other agencies, meaning the actual count of law enforcement agencies with access to this technology is considerably higher than the 25 listed.

This unofficial sharing program vastly increases the amount of data gathered -- as well as the potential for the civil liberties violations. While one agency may have guidelines affecting use and destruction of gathered data, the agency borrowing it may have nothing in place at all. And, considering the fact that no agency wants to talk about their usage of Stingrays, it's safe to assume whatever safeguards are in place are lax and full of loopholes.

Outdated laws have combined with expansive readings of the Third Party Doctrine to give law enforcement agencies nearly unlimited access to vast amounts of data. The rise of cellphones has been fortuitous for agencies with unquenchable thirsts for data, providing millions of metadata points for millions of users. And, like our intelligence agencies, these law enforcement agencies are operating largely under the cover of "darkness," actively avoiding (or directly thwarting) any attempts at oversight.


Reader Comments (rss)

(Flattened / Threaded)

  1.  
    icon
    silverscarcat (profile), Dec 10th, 2013 @ 8:19am

    Third Party Doctrine...

    Is total bullshit.

    Unless someone is listening in on your phone call and can hear both sides of the conversation, that 3rd Party Doctrine should NOT FUCKING APPLY!

     

    reply to this | link to this | view in thread ]

  2.  
    icon
    Ninja (profile), Dec 10th, 2013 @ 8:27am

    Good times for cyber crime, human trafficking, drug dealing, child pornography and hit man rentals have come. All thanks to mr Snowden.

    That's what I read in one of the comments in an article from Mr Falkvinge. That's one typical reaction from those who support this type of abuse. Fact free, fear (or interest) riddled.

    And yet there is no evidence that these violations prevent such activities. Specially terrorism, the much touted bogey man that justifies everything. The stingrays, the tower dumps.. They are nothing more than another chapter in this twisted book that keeps developing thanks to a dangerous mixture between gullible people and "greater" interests.

    It's way past time the Americans took action. And yet there they are in their lethargic slumber. Actually most of the world is still sleeping while having their rights horribly violated.

     

    reply to this | link to this | view in thread ]

  3.  
    identicon
    Mark Wing, Dec 10th, 2013 @ 10:07am

    All FUD aside, I wonder if we'll ever see an Android app which maps out those spoofed towers and shows you on Google maps where they all are. Not much different from an app that shows you all the speed traps. There's probably a way for your phone to detect those spoofed towers.

     

    reply to this | link to this | view in thread ]

  4.  
    identicon
    teka, Dec 10th, 2013 @ 10:18am

    Re:

    as far as I know, that would be very tricky. The devices themselves are mobile and interact with your phone at a core level. If a phone gets a stronger signal that declares itself to be the proper kind of tower, it will swap to that tower without prompt and probably with little or nothing in the way of accessible logging in the phone itself.

    One of the mysteries and troubles with this tech is that invisible nature, making it impossible to tell that the police were digitally riffling through your pockets and flagging you into a database to draw out further data at their whim.

     

    reply to this | link to this | view in thread ]

  5.  
    icon
    John Fenderson (profile), Dec 10th, 2013 @ 10:22am

    Re:

    There are a number of apps that show you the physical location of all the towers your phone can see (they use the same triangulation that's used to locate cell phones, but in reverse). It'd be trivial to keep track of the fixed towers so you could notice when a new one suddenly appears...

     

    reply to this | link to this | view in thread ]

  6.  
    icon
    John Fenderson (profile), Dec 10th, 2013 @ 10:23am

    I wonder...

    The tower dump data helped police choose about 500 people who were asked to submit DNA samples.


    I would absolutely refuse to provide such a DNA sample if I were asked. I wonder what the retaliation against me would be.

     

    reply to this | link to this | view in thread ]

  7.  
    identicon
    Baron von Robber, Dec 10th, 2013 @ 10:32am

    Think I'll just regress...

    ...and start using the post office by sending letters with wax sealed envelopes. :(

    Or are they now opening our letters now too!?

     

    reply to this | link to this | view in thread ]

  8.  
    icon
    John Fenderson (profile), Dec 10th, 2013 @ 10:36am

    Re: Think I'll just regress...

    You're not allowed to use wax-sealed envelopes. It gums up the machinery.

     

    reply to this | link to this | view in thread ]

  9.  
    identicon
    Anonymous Coward, Dec 10th, 2013 @ 10:42am

    Tim, I'm surprised you as much as anyone would make the mistake of calling people who are tracked by police surveillance "criminals". Like it's a guarantee that the people caught up in the net are doing something wrong and that's why the police invaded their privacy.

     

    reply to this | link to this | view in thread ]

  10.  
    identicon
    Anonymous Coward, Dec 10th, 2013 @ 10:42am

    Re: I wonder...

    Based on other recent articles, they will shoot your dog and tear your house apart when they come back with a warrant...

    The warrant will be granted due to your refusal to "volunteer" your DNA when asked, which obviously makes you a low down dirty rotten criminal up to no good, they just have to find (or create) the proof they need when ransacking your house.

    But of course our wonderful law enforcement agents would never do anything like this... /s

     

    reply to this | link to this | view in thread ]

  11.  
    identicon
    Anonymous Coward, Dec 10th, 2013 @ 11:29am

    DNA of 500 people helps them how exactly?

    Seriously, what were the cops thinking when getting DNA from 500 random people before they even had the body of the missing girl?

    If you have nothing to compare the DNA against in the crime, then you're just wasting your time. Or simply trying to create a database of DNA to solve other crimes you do have DNA evidence for. But really, gathering someone's DNA in an unrelated case when their DNA couldn't even help even if they were the criminal, that's just dumb and asking for an appeal if the DNA is ever used to file any charges.

     

    reply to this | link to this | view in thread ]

  12.  
    identicon
    Anonymous Coward, Dec 10th, 2013 @ 11:59am

    Re:

    If we need a war on terror then we also need a war on police officers who are 8 times more likely to kill you than a terrorist.


    http://www.washingtonsblog.com/2013/08/president-obama-the-odds-of-dying-in-a-terrorist-at tack-are-a-lot-lower-than-they-are-of-dying-in-a-car-accident.html

     

    reply to this | link to this | view in thread ]

  13.  
    identicon
    Anonymous Coward, Dec 10th, 2013 @ 12:07pm

    Re:

    The location of Cell towers appears to be public information.
    http://wireless.fcc.gov/geographic/index.htm?job=home

    If you know the location of the real towers, should be easy to pick out the fake stingray towers. Seems like someone could easily make an app to alert you to the presence of a stingray.

    But only terrorists, paedophiles, drug dealers and criminals would think of creating such and app......

     

    reply to this | link to this | view in thread ]

  14.  
    icon
    ltlw0lf (profile), Dec 10th, 2013 @ 12:19pm

    Re: DNA of 500 people helps them how exactly?

    If you have nothing to compare the DNA against in the crime, then you're just wasting your time. Or simply trying to create a database of DNA to solve other crimes you do have DNA evidence for.

    This, x1000. It may be proactive because you know DNA evidence is forthcoming, but it still isn't right and is an absolute waste of everyone's time. It is amazing that anyone, with a straight face, would suggest this as an option. You are wasting the time of 500 people who pay your paycheck just so it will allow you to be a little quicker in matching the data after the fact, especially since it doesn't take very long to get the DNA evidence and compare it to the suspect you have a warrant for (since you have already been able to determine, through actual police work, and with the help of the citizenry, who the target is.) The case wasn't even cold yet.

     

    reply to this | link to this | view in thread ]

  15.  
    identicon
    Anonymous Coward, Dec 10th, 2013 @ 12:21pm

    Re: Think I'll just regress...

     

    reply to this | link to this | view in thread ]

  16.  
    icon
    Geno0wl (profile), Dec 10th, 2013 @ 1:42pm

    Stingray

    I actually work for one of the agencies that have access to a stingray device. Talking to people who know about it state that it either doesn't generate a "dump" of data like you would imagine a cell tower would, OR that "we" don't use it for that capability if it does have it.
    Basically it is used for two reasons. Either it can give you a list of all numbers that are currently pinging the device or you can give it a specific number and "locate" that number. Officers have stated that if they know a number to look for it is accurate enough to pinpoint you practically within 5 feet. They have used it to stand outside an apartment complex while looking for a felon and pinpoint exactly which apartment in the complex he was currently located in.

     

    reply to this | link to this | view in thread ]

  17.  
    identicon
    Anonymous Coward, Dec 10th, 2013 @ 2:06pm

    Re: I wonder...

    I expect you would instantly become a suspect to the point where they would follow you around and wait for you to throw away some DNA laden material (like chewing gum or a water bottle you drank from or a cigarette).

    These criminals in power don't like to take no for an answer.

     

    reply to this | link to this | view in thread ]

  18.  
    icon
    John Fenderson (profile), Dec 10th, 2013 @ 2:57pm

    Re: Re: I wonder...

    That's the response I would hope for. Really, it would be a rational one and I wouldn't object to the cops doing that in such a situation. Besides, it would give the opportunity for a little bit of fun!

     

    reply to this | link to this | view in thread ]

  19.  
    identicon
    Anonymous, Dec 10th, 2013 @ 4:06pm

    When people willingly carry a tracking device with them, this is what happens.

     

    reply to this | link to this | view in thread ]

  20.  
    icon
    That One Guy (profile), Dec 10th, 2013 @ 4:31pm

    Re: Re:

    Knowing a new 'tower' suddenly appeared is one thing, keeping your phone from connecting to it though, quite another.

    Still, first step is locating the problem, so there would still be worth in such a database of towers.

     

    reply to this | link to this | view in thread ]

  21.  
    icon
    ahow628 (profile), Dec 11th, 2013 @ 6:27am

    Indiana - terrorism hub

    Obviously the Indiana State Police need this device to thwart terrorism in Indiana. Indiana has had, LITERALLY, zero of thousands of terrorist attacks in the past few years. If we don't rein in this problem, many more Hoosiers will be not bothered by anyone.

    Thank goodness we have secret stuff that we don't know about protecting us from things that are really happening.

     

    reply to this | link to this | view in thread ]

  22.  
    icon
    Derek Kerton (profile), Dec 11th, 2013 @ 11:26am

    Because Crime...No Privacy

    So, because of some bad laws, and even worse Law Enforcement practices, we are cornered between two evil forces: The criminals and the crimes they commit, and the justice system and the crimes it commits.

    We're just collateral damage in the crossfire.

    There will always be at least one crazy douche that commits a terrible crime, and so the system will always have their justification to erode our 4th rights. The cops say what the politicians say: never let a good crisis go to waste.

     

    reply to this | link to this | view in thread ]

  23.  
    icon
    Derek Kerton (profile), Dec 11th, 2013 @ 11:57am

    Re: Re:

    Good luck on that. Wireless telecom is entering an era of "het nets" or heterogeneous networks. The modern network is no longer big towers with wide ranges, but is made up of concentric circles, sectors, micro cells, femtocells, DAS, Wi-fi offload, and more. The public's ability to keep up with every LEGIT cell tower's location is fading.

    Then, there are LEGIT temporary cells, called COWs, or Cells on Wheels, which the carriers move around for special events, etc. Stingray's would look a lot like these.

    It will be a non-trivial matter to identify the Stingrays among all that heterogeneity. Or, to put it in radio terms, you're gonna have a hard time separating the signal from the noise.

    And even then, what if you figure out that the new tower you suspected is not a Stingray...well, you're still susceptible to a tower dump. So, you won't be able to conclude that you are being "bugged", nor that you are not being bugged.

     

    reply to this | link to this | view in thread ]

  24.  
    icon
    Derek Kerton (profile), Dec 11th, 2013 @ 12:04pm

    Re: Re:

    BTW, there is no "triangulation", neither for phones or for towers.

    - phones usually use a combo of nearest tower, nearest wifi, and GPS. Occasionally, they use TDOA (time difference of arrival) which measures signal delay between three or more towers to estimate location. This is not "angulation". It could be called trilateration, but really it's TDOA.

    - the apps do not triangulate towers. They use a database of known tower locations. AFAIK, apps do not have the authority on the phone to use the phone's radio baseband to suss out the nearest towers (although the phone does this). This tech may have evolved, so if you could cite an example of the app you're talking about, I'd love to examine it.

     

    reply to this | link to this | view in thread ]

  25.  
    identicon
    Anonymous Coward, Dec 12th, 2013 @ 7:28am

    Terrorism and "public safety", are words used by totalitarian regimes.

     

    reply to this | link to this | view in thread ]

  26.  
    icon
    John Fenderson (profile), Dec 12th, 2013 @ 9:45am

    Re: Re: Re:

    the apps do not triangulate towers. They use a database of known tower locations. AFAIK, apps do not have the authority on the phone to use the phone's radio baseband to suss out the nearest towers (although the phone does this).


    Funny, the app that I use does both. I know that it located the towers because when I set up my own booster (which mimics being a tower), the app spotted it and correctly located it.

     

    reply to this | link to this | view in thread ]

  27.  
    icon
    Derek Kerton (profile), Dec 12th, 2013 @ 10:06am

    Re: Re: Re: Re:

    Which app, please?

     

    reply to this | link to this | view in thread ]

  28.  
    identicon
    Anonymous Coward, Dec 13th, 2013 @ 1:01am

    Re: Re: Re: Re: Re:

    "Which app, please?"

    You don't really expect an answer, do you?

     

    reply to this | link to this | view in thread ]

  29.  
    identicon
    Lucky Paul, Jan 15th, 2014 @ 2:45pm

    Look Phone Number - Find who own those phone numbers

    The world is never an empty shell. Get out from you own cocoon and give technology and lookphonenumber.com the chance to help you conquer your needs and searches. Whether you are locating your friends and family or would like to make it big with your business, a reverse phone look up facility comes very handy and easy to use.

     

    reply to this | link to this | view in thread ]

  30.  
    identicon
    edwin, Jan 15th, 2014 @ 2:51pm

    We all have this instinct of going online to search for a particular phone number. That number may have appeared in our inboxes and we would like to know who the person is behind the number

     

    reply to this | link to this | view in thread ]


Add Your Comment

Have a Techdirt Account? Sign in now. Want one? Register here
Get Techdirt’s Daily Email
Save me a cookie
  • Note: A CRLF will be replaced by a break tag (<br>), all other allowable HTML will remain intact
  • Allowed HTML Tags: <b> <i> <a> <em> <br> <strong> <blockquote> <hr> <tt>
Follow Techdirt
A word from our sponsors...
Essential Reading
Techdirt Reading List
Techdirt Insider Chat
A word from our sponsors...
Recent Stories
A word from our sponsors...

Close

Email This