Stingray use lacks transparency and meaningful oversight
Cell-site simulators – aka Stingrays, aka IMSI catchers – are widely used by US law enforcement, usually without a warrant that such type of surveillance should require.
Stingrays are capable of posing as legitimate cell phone towers and tricking nearby phones into connecting to them so that those who deployed them could indiscriminately capture the metadata and content of communications made by the phone users. But details about these devices are scarse, as vendors have been trying hard to keep them from the wider public.
The vendors are ostensibly worried about terrorists and criminals knowing too much about them and finding a way to make them ineffective, and apparently this is also why law enforcement agents are advised never to mention Stingrays as the tool that they are asking a judge to allow them to use to perform surveillance.
Instead, the requests usually say that its a device that “detects radio signals emitted from wireless cellular telephones in the vicinity of the Subject that identify the telephones,” or a generic pen register/trap and trace device.
For years, digital and civil liberties advocates have been trying to uncover just how widespread the use of Stingrays by the US police is, have been trying to jumpstart a public debate about the legality of their use, as well as urging the government to impose limits on and checks and balances for their use.
A month ago, the Center for Media Justice, Color Of Change, and the New America’s Open Technology Institute filed a complaint with the US Federal Communications Commission (FCC), saying that various US law enforcement agencies are violating the Federal Communications Act by using Stingrays without the required broadcast licenses.
The complaint was backed by the American Civil Liberties Union and the Electronic Frontier Foundation, who asked the FCC to order and enforce “the immediate cessation of operation of cell site simulators by state and local law enforcement agencies, at least until a proper licensing procedure that provides for necessary oversight and safeguards is put in place.”
“Moreover, any licensing scheme put in place by the FCC to allow state and local agencies to operate cell site simulators must be predicated on strong protections to minimize interference with cellular communications,to facilitate proper oversightfrom local elected lawmakers and from courts, and to ensure transparency to the public,” they noted.
On Monday, the Intercept published leaked manuals for Stingrays and similar cellular surveillance devices sold by Florida-based Harris Corporation, which detail how the devices are extremely easy to use, and their surveillance capabilities.
On Tuesday, the University of Toronto’s Citizen Lab and the Samuelson-Glushko Canadian Internet Policy & Public Interest Clinic (CIPPIC) have published a report on their own. In it they examined the use of cell-site simulators in Canada, the US and Germany, the current regulation regarding their use, and offered advice on best practices that should be incorporated into a framework governing IMSI catcher use.