Virginia cops spying on cell phone data

WASHINGTON, D.C. (WUSA) -- It's not just the NSA - local cops are mining the cell phone data to reveal the location, identity and call information of hundreds of people at a time -- whether they're suspected of criminal activity or not.

Police in DC, Fairfax Co., Montgomery Co. buy cellular spy gear

In a joint investigation with Gannett television stations across the country and USA Today, WUSA9 obtained documents that show police in Fairfax County, Montgomery County and the Metropolitan Police in DC have purchased cell phone spy gear capable of tracking your whereabouts - even if you're not the one being investigated. 

Spy gear called "Cell Site Simulator"

It's called a "Cell Site Simulator," and different models are manufactured under names like: "Stingray," "Kingfish," and "Amberjack". 

WUSA9 obtained documents showing area police have spent hundreds of thousands of dollars on cell site simulator equipment, software updates and FBI training.

A Stingray device can operate from inside a vehicle and hook up to a laptop. It mimics the signal that would come from a real cell phone tower, and tricks  nearby devices into communicating with it, which reveals their locations, and possibly more. 

Privacy concerns

Alan Butler works with EPIC, the Electronic Privacy Information Center, which alerts the public to potential invasions of privacy.

Butler says he's seen, in a number of cases, where police have been able to triangulate a subject's location within a few feet -- without a search warrant. 

"Where you are at different points in time can reveal a great deal about what people are doing, their associations," Butler says. "That can reveal that you're going to the doctor's office. Or it can reveal whether you're going to church or whether you're going to a rally." 

With few rules now, Congressman Dennis Ross says it will take legislation and the courts to develop standards.

"Does the data of your location, is that confidential?" asked Ross, a Republican.  "Because you're broadcasting your location as if you're shouting out something to the public, and I think this is, now the Supreme Court's going to visit this, I think it's something that we as citizens need to be concerned about."

Fairfax County Police among mum agencies

Law enforcement agencies are tight-lipped about the use of this technology. No one from the local police would go on camera with WUSA9.

When we asked the Fairfax County Police whether they own and use Stingray equipment, their public information officer responded, via email, "I do not believe that we have even acknowledged that we have or use the device you are asking about." 

WUSA9 found Fairfax County documents touting the Stingray's ability to "locate crime victims, crime suspects, wanted persons, and those in need of emergency services" and approving over $126,000 to "enhance the Stingray cell phone tracking system" with a system upgrade. 

Stingrays in DC, Montgomery County 

A procurement record from Montgomery County in 2012 shows that they spent more than $180,000 for "upgrades and enhancements to  Harris Stingray/Kingfish system." Montgomery County officials ignored our request for comment. 

DC's Metropolitan Police denied our requests for an interview, but WUSA9 found purchase orders from 2009, 2010 and 2013 for Stingray devices and equipment -- including their contract with the manufacturer of the products, Harris Corporation. As recently as March of this year, MPDC spent $107,786 for system upgrades and training on tracking civilian cell phones. 

To locate their targets, the technology scoops up the data of hundreds of unintended cell users too. There are no known standards requiring police to erase data collected from those not suspected of criminal activity -- private information from citizens like you. 

Butler, from EPIC, tells us that the only foolproof way to keep your cell phone data secret is to turn your phone off - or stop carrying one altogether.

Cellphone data spying: It's not just the NSA

WASHINGTON, DC (USA Today, WUSA9, KUSA)--The National Security Agency isn't the only government entity secretly collecting data from people's cellphones. Local police are increasingly scooping it up, too.

Armed with new technologies, including mobile devices that tap into cellphone data in real time, dozens of local and state police agencies are capturing information about thousands of cellphone users at a time, whether they are targets of an investigation or not, according to public records obtained by USA TODAY and Gannett newspapers and TV stations.

The records, from more than 125 police agencies in 33 states, reveal:

About one in four law-enforcement agencies have used a tactic known as a "tower dump," which gives police data about the identity, activity and location of any phone that connects to the targeted cellphone towers over a set span of time, usually an hour or two.

A typical dump covers multiple towers, and wireless providers, and can net information from thousands of phones.

At least 25 police departments own a Stingray, a suitcase-size device that costs as much as $400,000 and acts as a fake cell tower. The system, typically installed in a vehicle so it can be moved into any neighborhood, tricks all nearby phones into connecting to it and feeding data to police.

In some states, the devices are available to any local police department via state surveillance units. The federal government funds most of the purchases, via anti-terror grants.

Thirty-six more police agencies refused to say whether they've used either tactic. Most denied public records requests, arguing that criminals or terrorists could use the information to thwart important crime-fighting and surveillance techniques.Police maintain that cellphone data can help solve crimes, track fugitives or abducted children or even foil a terror attack.

Organizations such as the American Civil Liberties Union and Electronic Privacy Information Center say the swelling ability by even small-town police departments to easily and quickly obtain large amounts of cellphone data raises questions about the erosion of people's privacy as well as their Fourth Amendment protections against unreasonable search and seizure.

"I don't think that these devices should never be used, but at the same time, you should clearly be getting a warrant," said Alan Butler of EPIC.

In most states, police can get many kinds of cellphone data without obtaining a warrant, which they'd need to search someone's house or car. Privacy advocates, legislators and courts are debating the legal standards with increasing intensity as technology - and the amount of sensitive information people entrust to their devices - evolves.

Vast data net

Many people aren't aware that a smartphone is an adept location-tracking device. It's constantly sending signals to nearby cell towers, even when it's not being used. And wireless carriers store data about your device, from where it's been to whom you've called and texted, some of it for years.

The power for police is alluring: a vast data net that can be a cutting-edge crime-fighting tool.

Last fall, in Colorado, a 10-year-old girl vanished while she walked to school. Volunteers scoured Westminster looking for Jessica Ridgeway. Local police took a clandestine tack. They got a court order for data about every cellphone that connected to five providers' towers on the girl's route. Later, they asked for 15 more cellphone site data dumps.

Colorado authorities won't divulge how many people's data they obtained, but testimony in other cases indicates it was at least several thousand people's phones.

The court orders in the Colorado case show police got "cellular telephone numbers, including the date, time and duration of any calls" as well as numbers and location data for all phones that connected to the towers searched, whether calls were being made or not. Police and court records obtained by USA TODAY about cases across the country show that's standard for a tower dump.

The tower dump data helped police choose about 500 people who were asked to submit DNA samples. The broad cell-data sweep and DNA samples didn't solve the crime, though the information aided in the prosecution.

A 17-year-old man's mother tipped off the cops, and the man confessed to kidnapping and dismembering the girl, hiding some of her remains in a crawl space in his mother's house. He pleaded guilty and last month was sentenced to more than 100 years in prison.

Not every use of the tower dumps involved stakes so high.

A South Carolina sheriff ordered up four cell-data dumps from two towers in a 2011 investigation into a rash of car break-ins near Columbia, including the theft of Richland County Sheriff Leon Lott's collection of guns and rifles from his police-issued SUV, parked at his home.

"We were looking at someone who was breaking into a lot of vehicles and was not going to stop," the sheriff said. "So, we had to find out as much information as we could."

The sheriff's office says it has used a tower dump in at least one prior case, to help solve a murder.

Law-enforcement records show police can use initial data from a tower dump to ask for another court order for more information, including addresses, billing records and logs of calls, texts and locations.

Cellphone data sweeps fit into a broadening effort by police to collect and mine information about people's activities and movements.

Police can harvest data about motorists by mining toll-road payments, red-light cameras and license-plate readers. Cities are installing cameras in public areas, some with facial-recognition capabilities, as well as Wi-Fi networks that can record the location and other details about any connecting device.

Secret Stingrays

Local and state police, from Florida to Alaska, are buying Stingrays with federal grants aimed at protecting cities from terror attacks, but using them for far broader police work.

With the mobile Stingray, police can get a court order to grab some of the same data available via a tower dump with two added benefits. The Stingray can grab some data from cellphones in real time and without going through the wireless service providers involved. Neither tactic - tower dumps or the Stingray devices - captures the content of calls or other communication, according to police.

Typically used to hunt a single phone's location, the system intercepts data from all phones within a mile, or farther, depending on terrain and antennas. The cell-tracking systems cost as much as $400,000, depending on when they were bought and what add-ons they have. The latest upgrade, code-named "Hailstorm," is spurring a wave of upgrade requests.

Initially developed for military and spy agencies, the Stingrays remain a guarded secret by law enforcement and the manufacturer, Harris Corp. of Melbourne, Fla. The company would not answer questions about the systems, referring reporters to police agencies. Most police aren't talking, either, partly because Harris requires buyers to sign a non-disclosure agreement.

"Any idea of having adequate oversight of the use of these devices is hampered by secrecy," says Butler, who sued the FBI for records about its Stingray systems. Under court order, the FBI released thousands of pages, though most of the text is blacked out.

"When this technology disseminates down to local government and local police, there are not the same accountability mechanisms in place. You can see incredible potential for abuses," American Civil Liberties Union lawyer Catherine Crump says.

Privacy, oversight concerns

Crump and other privacy advocates pose questions such as "Is data about people who are not police targets saved or shared with other government agencies?" and "What if a tower dump or Stingray swept up cell numbers and identities of people at a political protest?"

When Miami-Dade police bought their Stingray device, they told the City Council the agency needed to monitor protesters at an upcoming world trade conference, according to purchasing records.

Most of the police agencies that would talk about the tactics said they're not being used for intelligence gathering, only in search of specific targets.

Lott, the sheriff in the South Carolina gun-theft case, said police weren't interested in seeing data about the other residents whose information was collected as a byproduct of his agency's tower dumps.

"We're not infringing on their rights," Lott said. "When they use that phone they understand that information is going to go to a tower. We're not taking that information and using it for any means whatsoever, unless they're the bad guy or unless they're the victim."

Brian Owsley, a former magistrate who reviewed many police requests for bulk cellphone data, grew skeptical because authorities were not always forthcoming about the technology or what happened with "collateral data" of innocent bystanders.

"What is the government doing with the data?" asks Owsley, now a law professor at Texas Tech University.

Surveillance regulation is being tinkered with piecemeal by courts and legislators. This year, Montana and Maine passed laws requiring police to show probable cause and get a search warrant to access some cellphone data, as they would to search a car or home. State and federal courts have handed down seemingly contradictory rulings about which cellphone data is private or not. Seattle's City Council requires police to notify the council of new surveillance technology deployed in the city.

"We have to be careful because Americans deserve an expectation of privacy, and the courts are mixed right now as to what is an expectation of privacy when using a cellphone," says U.S. Rep. Dennis Ross, R-Fla., who says Congress needs to clarify the law. "More and more, we're seeing an invasion of what we would expect to be private parts of our lives."

Legislative and judicial guidance is needed to match police surveillance rules to today's technology, says Wayne Holmes, a prosecutor for two Central Florida counties. He has weighed frequent local police requests for tower dumps and Stingray surveillance.

"The clearer the law, the better the law is."
Americans "are sensitized right now" to cellphone surveillance because of reports about potential abuses by the NSA, said Washoe County Sheriff Michael Haley of Reno. He's is opting not to use the Stingray.

"I'm being cautious about how I access information, because at the end of the day I know that I will be in court if I access information using systems and techniques that are not constitutionally vetted," Haley said.