WASHINGTON, D.C. (WUSA) -- It's not just the NSA - local cops
are mining the cell phone data to reveal the location, identity and call
information of hundreds of people at a time -- whether they're suspected of
criminal activity or not.
Police in DC, Fairfax Co., Montgomery Co. buy cellular spy
gear
In a joint investigation with Gannett television stations across
the country and USA Today, WUSA9 obtained documents that show
police in Fairfax County, Montgomery County and the Metropolitan Police in DC
have purchased cell phone spy gear capable of tracking your whereabouts - even
if you're not the one being investigated.
Spy gear called "Cell Site Simulator"
It's called a "Cell Site Simulator," and different
models are manufactured under names like: "Stingray,"
"Kingfish," and "Amberjack".
WUSA9 obtained documents showing area police have spent hundreds
of thousands of dollars on cell site simulator equipment, software updates and
FBI training.
A Stingray device can operate from inside a vehicle and hook up
to a laptop. It mimics the signal that would come from a real cell phone tower,
and tricks nearby devices into communicating with it, which reveals their
locations, and possibly more.
Privacy concerns
Alan Butler works with EPIC, the Electronic Privacy Information
Center, which alerts the public to potential invasions of privacy.
Butler says he's seen, in a number of cases, where police have
been able to triangulate a subject's location within a few feet -- without a
search warrant.
"Where you are at different points in time can reveal a
great deal about what people are doing, their associations," Butler says.
"That can reveal that you're going to the doctor's office. Or it can
reveal whether you're going to church or whether you're going to a
rally."
With few rules now, Congressman Dennis Ross says it will take
legislation and the courts to develop standards.
"Does the data of your location, is that confidential?" asked Ross, a
Republican. "Because you're broadcasting your location as if you're
shouting out something to the public, and I think this is, now the Supreme
Court's going to visit this, I think it's something that we as citizens need to
be concerned about."
Fairfax County Police among mum agencies
Law enforcement agencies are tight-lipped about the use of this
technology. No one from the local police would go on camera with WUSA9.
When we asked the Fairfax County Police whether they own and use
Stingray equipment, their public information officer responded, via email,
"I do not believe that we have even acknowledged that we have or use the
device you are asking about."
WUSA9 found Fairfax County documents touting the Stingray's
ability to "locate crime victims, crime suspects, wanted persons, and
those in need of emergency services" and approving over $126,000 to
"enhance the Stingray cell phone tracking system" with a system upgrade.
Stingrays
in DC, Montgomery County
A procurement record from Montgomery County in 2012 shows that
they spent more than $180,000 for "upgrades and enhancements to
Harris Stingray/Kingfish system." Montgomery County officials
ignored our request for comment.
DC's Metropolitan Police denied our requests for an interview,
but WUSA9 found purchase orders from 2009, 2010 and 2013 for Stingray devices
and equipment -- including their contract with the manufacturer of the
products, Harris Corporation. As recently as March of this year, MPDC spent
$107,786 for system upgrades and training on tracking civilian cell
phones.
To locate their targets, the technology scoops up the data of
hundreds of unintended cell users too. There are no known standards requiring
police to erase data collected from those not suspected of criminal activity --
private information from citizens like you.
Butler, from EPIC, tells us that the only foolproof way to keep
your cell phone data secret is to turn your phone off - or stop carrying one
altogether.
Cellphone
data spying: It's not just the NSA
WASHINGTON, DC (USA Today, WUSA9, KUSA)--The National Security
Agency isn't the only government entity secretly collecting data from people's
cellphones. Local police are increasingly scooping it up, too.
Armed with new technologies, including mobile devices that tap
into cellphone data in real time, dozens of local and state police agencies are
capturing information about thousands of cellphone users at a time, whether
they are targets of an investigation or not, according to public records
obtained by USA TODAY and Gannett newspapers and TV stations.
The records, from more than 125 police agencies in 33 states,
reveal:
About one in four law-enforcement agencies have used a tactic
known as a "tower dump," which gives police data about the identity,
activity and location of any phone that connects to the targeted cellphone
towers over a set span of time, usually an hour or two.
A typical dump covers multiple towers, and wireless providers,
and can net information from thousands of phones.
At least 25 police departments own a Stingray, a suitcase-size
device that costs as much as $400,000 and acts as a fake cell tower. The
system, typically installed in a vehicle so it can be moved into any
neighborhood, tricks all nearby phones into connecting to it and feeding data
to police.
In some states, the devices are available to any local police
department via state surveillance units. The federal government funds most of
the purchases, via anti-terror grants.
Thirty-six more police agencies refused to say whether they've
used either tactic. Most denied public records requests, arguing that criminals
or terrorists could use the information to thwart important crime-fighting and
surveillance techniques.Police maintain that cellphone data can help solve
crimes, track fugitives or abducted children or even foil a terror attack.
Organizations such as the American Civil Liberties Union and
Electronic Privacy Information Center say the swelling ability by even
small-town police departments to easily and quickly obtain large amounts of
cellphone data raises questions about the erosion of people's privacy as well
as their Fourth Amendment protections against unreasonable search and seizure.
"I don't think that these devices should never be used, but
at the same time, you should clearly be getting a warrant," said Alan
Butler of EPIC.
In most states, police can get many kinds of cellphone data
without obtaining a warrant, which they'd need to search someone's house or
car. Privacy advocates, legislators and courts are debating the legal standards
with increasing intensity as technology - and the amount of sensitive
information people entrust to their devices - evolves.
Vast data net
Many people aren't aware that a smartphone is an adept
location-tracking device. It's constantly sending signals to nearby cell
towers, even when it's not being used. And wireless carriers store data about
your device, from where it's been to whom you've called and texted, some of it
for years.
The power for police is alluring: a vast data net that can be a
cutting-edge crime-fighting tool.
Last fall, in Colorado, a 10-year-old girl vanished while she walked
to school. Volunteers scoured Westminster looking for Jessica Ridgeway. Local
police took a clandestine tack. They got a court order for data about every
cellphone that connected to five providers' towers on the girl's route. Later,
they asked for 15 more cellphone site data dumps.
Colorado authorities won't divulge how many people's data they
obtained, but testimony in other cases indicates it was at least several
thousand people's phones.
The court orders in the Colorado case show police got
"cellular telephone numbers, including the date, time and duration of any
calls" as well as numbers and location data for all phones that connected
to the towers searched, whether calls were being made or not. Police and court
records obtained by USA TODAY about cases across the country show that's
standard for a tower dump.
The tower dump data helped police choose about 500 people who
were asked to submit DNA samples. The broad cell-data sweep and DNA samples
didn't solve the crime, though the information aided in the prosecution.
A 17-year-old man's mother tipped off the cops, and the man
confessed to kidnapping and dismembering the girl, hiding some of her remains
in a crawl space in his mother's house. He pleaded guilty and last month was
sentenced to more than 100 years in prison.
Not every use of the tower dumps involved stakes so high.
A South Carolina sheriff ordered up four cell-data dumps from
two towers in a 2011 investigation into a rash of car break-ins near Columbia,
including the theft of Richland County Sheriff Leon Lott's collection of guns
and rifles from his police-issued SUV, parked at his home.
"We were looking at someone who was breaking into a lot of
vehicles and was not going to stop," the sheriff said. "So, we had to
find out as much information as we could."
The sheriff's office says it has used a tower dump in at least
one prior case, to help solve a murder.
Law-enforcement records show police can use initial data from a
tower dump to ask for another court order for more information, including
addresses, billing records and logs of calls, texts and locations.
Cellphone data sweeps fit into a broadening effort by police to
collect and mine information about people's activities and movements.
Police can harvest data about motorists by mining toll-road
payments, red-light cameras and license-plate readers. Cities are installing
cameras in public areas, some with facial-recognition capabilities, as well as
Wi-Fi networks that can record the location and other details about any
connecting device.
Secret Stingrays
Local and state police, from Florida to Alaska, are buying Stingrays
with federal grants aimed at protecting cities from terror attacks, but using
them for far broader police work.
With the mobile Stingray, police can get a court order to grab
some of the same data available via a tower dump with two added benefits. The
Stingray can grab some data from cellphones in real time and without going
through the wireless service providers involved. Neither tactic - tower dumps
or the Stingray devices - captures the content of calls or other communication,
according to police.
Typically used to hunt a single phone's location, the system
intercepts data from all phones within a mile, or farther, depending on terrain
and antennas. The cell-tracking systems cost as much as $400,000, depending on
when they were bought and what add-ons they have. The latest upgrade,
code-named "Hailstorm," is spurring a wave of upgrade requests.
Initially developed for military and spy agencies, the Stingrays
remain a guarded secret by law enforcement and the manufacturer, Harris Corp.
of Melbourne, Fla. The company would not answer questions about the systems,
referring reporters to police agencies. Most police aren't talking, either,
partly because Harris requires buyers to sign a non-disclosure agreement.
"Any idea of having adequate oversight of the use of these
devices is hampered by secrecy," says Butler, who sued the FBI for records
about its Stingray systems. Under court order, the FBI released thousands of
pages, though most of the text is blacked out.
"When this technology disseminates down to local government
and local police, there are not the same accountability mechanisms in place.
You can see incredible potential for abuses," American Civil Liberties
Union lawyer Catherine Crump says.
Privacy, oversight concerns
Crump and other privacy advocates pose questions such as
"Is data about people who are not police targets saved or shared with
other government agencies?" and "What if a tower dump or Stingray
swept up cell numbers and identities of people at a political protest?"
When Miami-Dade police bought their Stingray device, they told
the City Council the agency needed to monitor protesters at an upcoming world
trade conference, according to purchasing records.
Most of the police agencies that would talk about the tactics
said they're not being used for intelligence gathering, only in search of
specific targets.
Lott, the sheriff in the South Carolina gun-theft case, said
police weren't interested in seeing data about the other residents whose
information was collected as a byproduct of his agency's tower dumps.
"We're not infringing on their rights," Lott said.
"When they use that phone they understand that information is going to go
to a tower. We're not taking that information and using it for any means
whatsoever, unless they're the bad guy or unless they're the victim."
Brian Owsley, a former magistrate who reviewed many police
requests for bulk cellphone data, grew skeptical because authorities were not
always forthcoming about the technology or what happened with "collateral
data" of innocent bystanders.
"What is the government doing with the data?" asks
Owsley, now a law professor at Texas Tech University.
Surveillance regulation is being tinkered with piecemeal by
courts and legislators. This year, Montana and Maine passed laws requiring
police to show probable cause and get a search warrant to access some cellphone
data, as they would to search a car or home. State and federal courts have
handed down seemingly contradictory rulings about which cellphone data is
private or not. Seattle's City Council requires police to notify the council of
new surveillance technology deployed in the city.
"We have to be careful because Americans deserve an
expectation of privacy, and the courts are mixed right now as to what is an
expectation of privacy when using a cellphone," says U.S. Rep. Dennis
Ross, R-Fla., who says Congress needs to clarify the law. "More and more,
we're seeing an invasion of what we would expect to be private parts of our
lives."
Legislative and judicial guidance is needed to match police
surveillance rules to today's technology, says Wayne Holmes, a prosecutor for
two Central Florida counties. He has weighed frequent local police requests for
tower dumps and Stingray surveillance.
"The clearer the law, the better the law is."
Americans "are sensitized right now" to cellphone surveillance
because of reports about potential abuses by the NSA, said Washoe County
Sheriff Michael Haley of Reno. He's is opting not to use the Stingray.
"I'm being cautious about how I access information, because
at the end of the day I know that I will be in court if I access information
using systems and techniques that are not constitutionally vetted," Haley
said.
