California Police Used Stingrays in Planes to Spy on Smartphones
Tracking of phones by the Government with the use of a controversial invasive technology just got a little more controversial.
In the new documents, the Anaheim Police Department has accepted that on aircraft flying above the Southern California city that is home to Disneyland, one of the most popular tourist destinations in the world, they make use of surveillance devices known as Dirtboxes (plane-mounted stingrays).
The Anaheim Police Department have owned the Dirtbox since 2009 and a ground-based stingray since 2011, according to documents obtained by the American Civil Liberties Union of Northern California. In the nearly seven years that it has possessed the equipment, they may have lent out the equipment to other cities across Orange County.
Matt Cagle, technology and civil liberties policy attorney for ACLU-NC, wrote in a blog post about the new documents, “This cell phone spying program—which potentially affects the privacy of everyone from Orange County’s 3 million residents to the 16 million people who visit Disneyland every year—shows the dangers of allowing law enforcement to secretly acquire surveillance technology.”
Stingrays and Dirtboxes are mobile surveillance systems that fool mobile phones and other mobile devices by copying a legitimate cell phone tower in their vicinity by connecting to them and make them disclose their unique ID and location. In order to force devices to establish a connection with them, Stingrays release a signal that is stronger than that of other cell towers in the vicinity. However, Stingrays not just picks up the IDs of targeted devices, but also every phone that are within range will contact the system and disclose their ID.
Stingrays and Dirtboxes also can disturb phone service for anyone in their vicinity whose phone connects to the devices besides picking up trackable data from phones. In other words, it means that there is a possibility that millions of people in Orange County would have their phones connected to government surveillance devices without knowledge and might have experienced disrupted services as a result. For the first time last year, in a court case involving a Sprint customer, an FBI agent acknowledged the disruption capability.
“Because of the way the Mobile Equipment sometimes operates,” FBI Special Agent Michael A. Scimeca disclosed to a judge, “its use has the potential to intermittently disrupt cellular service to a small fraction of Sprint’s wireless customers within its immediate vicinity. Any potential service disruption will be brief and minimized by reasonably limiting the scope and duration of the use of the Mobile Equipment.”
Even though Stingrays are created to identify 911 calls and allow them to pass to legitimate cell towers without connecting to the surveillance device, the disclosure from the FBI agent raises doubts that other kinds of emergency calls that are not made to 911 may not get through.
No details have been provided by the Anaheim police as to how do they use their Stingray and Dirtbox devices or do they take any measures to ensure that there is minimum service disruption.
For many years, the use of Stingrays by local law enforcement agencies has been predominant. However, the use of the more intrusive Dirtboxes has mainly been restricted to federal law enforcement, though at least two large cities were known before to be using them. For example, in 2014, the Wall Street Journal reported that the US Marshals Service from at least five metropolitan-area airports were operating the Cessna aircraft with Dirtboxes installed on them. The locations of these airports provided authorities with a wide-sweeping flying range that covers cell phones used by most of the US population.
It was disclosed in subsequent news reports that Chicago and Los Angeles local police departments possessed Dirtboxes as well. Anaheim is the smallest city known to have one.
“If a city of this size possesses a Dirtbox it really begs the question what other cities smaller than Los Angeles and Chicago were able to buy these devices in the six years since it has had one,” says Cagle.
There is no clarity to what extent does the Anaheim police use their Stingray and the plane-mounted Dirtbox. The police department bought its Stingray two years after buying the Dirtbox in 2009. An upgrade to the Stingray was approved by the Chief of Police in 2013, which the ACLU believes gave it the ability to keep a check on the modern LTE cellular networks used by millions of smartphones.
“In other words, as cell carriers upgraded their networks to LTE, Anaheim police took steps to exploit that very network which millions of customers would entrust with their private communications,” wrote Cagle.
A policy stating that any federal agency using a stingray or Dirtbox must obtain a warrant was issued by the Justice Department last year. However, that policy left a gap for local law enforcement agencies to continue using them without a court order. To close that gap for police and other local law enforcement agencies in that state, the California lawmakers passed a state legislation last year. That so-called CalECPA law requires that these local agencies also obtain a warrant, as of January this year. The California lawmakers passed another bill that requires any law enforcement agency in the state using such equipment to have established a usage policy for it and to make that policy available freely.
“Without more transparency and an enforceable set of rules, we really don’t know whether these devices are used from the sky to investigate routine crimes or pursuant to a warrant as CalECPA now requires,” Cagle told WIRED. “We look forward to seeing jurisdictions releasing publicly available use policies with a warrant requirement.”
