Stingray Technology: Do We Own Our Locations?

Stingrays, a technology that can track a cellphone's location to startling accuracy, have become a staple in the arsenal of American law enforcement. Recent court decisions and law enforcement secrecy have made it difficult to ascertain the extent to which these devices are used and under what situations they are legal. This paper seeks to examine the legal background behind Stingrays, their use, and possible defenses for the average citizen.

Whose Data is it?

In 2014, the 11th Circuit in its decision in U.S. v. Davis ruled that law enforcement could not collect cell phone data to track an individual without a warrant. In a sudden reversal of that decision, the 11th circuit ruled that because phone location data is the property of the phone carrier, not the owner of the phone, no warrant is necessary to collect that data. Any remaining rules regarding location collection are limited to state legislative and court decisions. Recently, International Mobile Subscriber Identity (IMSI) catchers, also known as Stingray technology, have caused concern. Using this device, law enforcement can mimic cell phone towers, forcing all mobile devices within a specific area to connect to the Stingray. This allows investigators to collect, among other things, the location of a device. In one instance, Florida police were able to recover a stolen phone by using an IMSI-catcher. The device was so precise, that it alerted police not only to the location of the missing phone, but to exactly where in an apartment the phone was. Recent outcry has prompted a Department of Justice (DOJ) review of the standards employed by different agencies when using these devices. With the recent reversal of U.S. v. Davis though, it remains to be seen if the DOJ will make any real effort to piece together the various local rules into a coherent set of regulations that protect citizen privacy.

Local Governments React

ACLU investigations have revealed that IMSI-catchers are widely distributed amongst local law enforcement. How widely they are being utilized though, is a harder question to answer. Agencies that utilize Stingray technology have been markedly unwilling to disclose how often these devices are being used and under what circumstances. For instance, multiple charges were dropped against defendants in a case in St. Louis when it was revealed that officers would have to testify about IMSI-catchers. In another case, officers in Florida cited a non-disclosure agreement with the device manufacturer to justify not seeking a search warrant before using the technology. Luckily, local governments are taking notice and action. At least eight states have passed local laws that restrict IMSI-catcher use to situations with a warrant. While these policies are welcome, this state by state approach has resulted in a patchwork of approaches. For instance, a judge in Baltimore recently ruled that law enforcement did not need a warrant to deploy Stingrays in "urgent" situations.

The Federal Response

The government response has been inconsistent and vague at best. Growing publicity and legislative pressure has prompted the Federal Communications Commission (FCC) to announce that it plans to investigate the standards and practices of Stingray use. The Department of Justice (DOJ) likewise announced that it would review the use of the technology, but many have called for limited disclosure for fear that criminals may learn how to thwart the system. But is the federal response too little, too late? Many of the developments that lead the FCC to begin its investigation in the first place smell heavily of deceit and obfuscation. For instance the American Civil Liberties Union (ACLU) alleges that the FCC was duped by the manufacturer of IMSI devices as to their intended uses. In another instance, the ACLU claims that documents regarding local police IMSI-catcher use were seized before they could be inspected per a Freedom of Information Act (FOIA) request. The ACLU's experience appears to be the norm rather than the exception. For instance, the Minnesota Bureau of Criminal Apprehension received a memo from the FBI instructing it to route all FOIA request through the FBI in order to prevent disclosure. Further documents appear to show U.S. Marshalls instructing local law enforcement to lie about their use of Stingrays.

Civilian Defenses

With government ineptitude and secrecy making it difficult to understand the impact IMSI-catchers, what solutions do lay people have? One obvious answer would be to ditch cellular devices altogether. While this would probably improve the quality of privacy enjoyed by citizens exponentially, it is difficult to see Americans throwing away their smart phones en masse just yet. Some groups are actively looking to develop hardware that alerts the user to fake cellphone towers in the area. Most useful have been the emergence of smart phone applications that perform this function. Unfortunately, these pursuits have not yet yielded away to block or elude the reach of IMSI-catchers, only how to detect them. As the innovative process moves along,less technologically savvy citizens could turn to the legislative process. Citizens should pressure representatives to pass reforms against abuse of the technology. While getting a bill passed can be a tedious ordeal, it is not totally fruitless. In fact it was pressure from Congressman Alan Grayson that pressured the FCC into conducting a review in the first place.

Conclusion

Overall, it seems that for now, other than leaving your phone at home, it is difficult to block IMSI-catchers from detecting your location. Some might argue that as long as they are not committing criminal acts, they have nothing to worry about. That is not necessarily true because the device does not conduct targeted attacks, but rather sweeps areas, scooping up data until it finds a match. What makes this even more worrisome is that the US government is not the only entity employing these devices on American soil. Multiple unidentified IMSI-catchers have been located with some speculating that they are being deployed by foreign entities. It appears that unless one is willing to cycle through burner phones, there is little recourse in fighting cellphone location surveillance.