Harris Corporation's Stingray (photo: U.S. Patent and Trademark Office)
The U.S. Department of Justice (DOJ), responding to protests from civil libertarians over Stingray surveillance technology that mimics cellphone towers to spy on people, took a first step toward controlling their use by requiring its employees to get warrants for deployment in most cases.
The policy change, outlined in a seven-page document (pdf), will not affect federal agencies outside the DOJ or state and local law enforcement. As near as anyone can tell, the cell-site simulator technology is popular in California.
The federal government has given localities grant money for years to buy the equipment, sold primarily by Harris Corporation under a non-disclosure agreement that has effectively cloaked in secrecy their capability and usage. District attorneys have dropped cases rather than disclose how they used a Stingray to gather information.
The feds won’t stop doing that. “The protections shouldn't end just because they've given money to locals to use this instead of using it themselves,” ACLU attorney Nathan Freed Wessler told Ars Technica.
The DOJ will now require its officials to delete data inadvertently gathered from non-targeted phones and report how the devices are used to agency headquarters. But the department does not have to provide an annual cell-simulator report to Congress as it does on wiretapping activities and national security letters.
Stingrays pretend to be cell towers and fool wireless phones into establishing a connection. Once connected, they can determine cell locations and download information of people who are not suspects in an investigation, including text messages, emails and documents, raising all sorts of privacy issues.
Law enforcement officials deny that Stingrays gather information beyond basic tracking data. But the new Justice Department memo indicates they have that capability by way of admonishing the authorities not to use it. The devices “may not be used to collect the contents of any communication. . . . This includes any data contained on the phone itself: the simulator does not remotely capture emails, texts contact lists, images or any other data from the phone.”
Although the memo requires warrants in most cases, the directive has what appears to be a rather large loophole. In addition to granting a warrant waiver in emergency situations, the policy allows one for “exceptional circumstances” that “make obtaining a search warrant impracticable.”
That certainly won’t be abused. In fact, the department has always “in the past, obtained appropriate legal authorizations to use cell-site simulators,” the DOJ said. This memo just tidies up a few loose ends.