Stingray cell surveillance can record conversations, bug phones

Stingrays, or cell site simulators, controversial cellphone surveillance devices, can obtain the content of voice and text communications of cellphone users in the vicinity and listen to conversations by using a person’s phone as a bug to listen in on conversations, according to documents recently obtained by the ACLU.

A stingray functions by imitating a cell tower and fooling cellphones in the area into connecting to and transmitting signals to the device in the same way they would with a networked tower. Stingrays are controversial because they allow officials to carry out warrantless phone searches — a violation of the Fourth Amendment — and conduct indiscriminate surveillance on all devices in the vicinity, civil rights advocates say.

The ACLU reported last year that stingrays are capable of locating and tracking the movement of any cellular devices that connected to them as well as indiscriminately collecting phone calls and text data of cellphones in the vicinity.

The new Department of Justice (DOJ) documents obtained by the ACLU, via a Freedom of Information Act request, revealed the device “may be capable of intercepting the contents of communications.“ To disable that capability, law enforcement agencies must configure the device to that end, the documents said.

The new details “confirm concerns about the federal government’s use of stingrays … and underscore the need for transparency,” the ACLU said in a press release on Monday. The ACLU called on the government to be up front about what the device is capable of, to the public as well as courts when obtaining warrants for searches using stingrays.

Jim Burke, a spokesman for the Harris Corp., the Melbourne, Florida, company that manufactures the StingRay brand of cell site simulators, declined to comment on the ACLU’s report.

The DOJ mandates that the device be used “in a manner consistent with the requirements and protections of the Constitution, including the Fourth Amendment,” in policy guidelines released in September for legal use of stingrays.

The ACLU has identified at least 43 police departments in 18 states that use stingrays but said it believes the actual number is far higher.

When asked for more details on the police departments using the device, DOJ spokesman Patrick Rodenbush told Al Jazeera it did not have that data.

To ensure that guidelines are followed, police department personnel must be trained and supervised “appropriately,” and an executive-level point of contact must be designated at each office to ensure compliance with DOJ policies, its guidelines said. 

“Agencies within the Department of Justice are required to follow this policy, and there are management protocols and accountability built into the policy,” Rodenbush said.

“The policy also applies to instances in which department components are assisting state or local law enforcement agencies. It would not apply to instances in which state or local agencies are acting independently with their own technology,” he said.

The documents — including memos and templates for applications by law enforcement agencies to get court orders to use the device — reveal new details about stingrays’ surveillance capabilities.

For example, it allows police to use a suspect’s phone as a bug to record conversations. “It may also be possible to flash the firmware of a cellphone so that you can intercept conversations using a suspect’s cellphone as the bug,” the documents said.

Stingrays also collect phone numbers associated with the cellphone, details on whether a call was incoming or outgoing, the duration of calls and the phone’s location when the call was connected, according to the documents.

The device is supposed to be used to locate or obtain data from cellphones of known suspects or to learn more about a specific, unknown cellphone by collecting information on all phones in the devices’ vicinity, the DOJ policy states.

In theory, it could provide useful information about kidnappings or investigations into organized crime. As soon as the known or unknown cellphone is identified, all data obtained by the stingray on it and other cellphones in the vicinity must be deleted, according to the DOJ guidelines.

Before using stingrays to spy on known or unknown phones, law enforcement agencies are “usually” required to obtain a warrant, the DOJ guidelines said. The exception is in cases in which there is an imminent threat to human life.

Otherwise, agents or officers must first obtain a pen register or trap and trace court order to use the device. Pen registers are traditionally used to obtain phone numbers called or the email addresses to which a person sends messages, and trap and trace orders are used to collect information on received calls or e-mail addresses for messages that a person receives.

A federal wiretapping law allows law enforcement to obtain the contents of calls or texts with a court order to intercept those communications, the DOJ guidelines said. 

In emergency circumstances, law enforcement is allowed to use stingrays to collect data without a court order and then apply for an order within 48 hours, according to the DOJ. Each agency must keep track of how many times it uses a stingray under emergency circumstances, it added.