Agencies Spending Millions on 'Crossbow' Spy Tech, an Upgraded Stingray

Multiple federal agencies and parts of the military have purchased a surveillance device called a 'Crossbow,' an upgrade to the well-known Stingray brand of IMSI-catchers which appears to target 4G devices, according to procurement records reviewed by Motherboard.

The devices are made by Harris, which also makes Stingrays. Stingrays and IMSI-catchers in general are designed to track cellphones. The finding comes after the American Civil Liberties Union (ACLU) published documents last month showing that Immigration and Customs Enforcement (ICE) had previously purchased the Crossbow devices. Now, Motherboard has found other federal Crossbow purchasers and more information about its capabilities.

"The public, judges, and lawmakers cannot provide effective oversight without basic information about the capabilities of this new military-grade equipment," Alexia Ramirez, fellow with the ACLU’s Speech, Privacy, and Technology Project, told Motherboard in an emailed statement.

The Department of the Army, the Department of the Navy, and U.S. Special Operations Command have all bought Crossbows according to the public records. The U.S. Marshals has also bought the equipment, the records show.

"Harris purchases for both Stingray II and Crossbow," one of the U.S. Marshals' procurement records reads. One U.S. Marshals purchase marked as "Crossbow order" totalled $1.7 million, the records add. Some orders from the Navy and Army simply marked "Crossbow" came in at around $370,000 to $390,000, the records show.

Little is publicly known about the Crossbow device itself. In one email written by an ICE employee and obtained by the ACLU via the Freedom of Information Act, the employee wrote, "Harris's Crossbows were the upgrade to Harris's Stingrays." The emails obtained by the ACLU are heavily redacted.

Judging by that email, the Crossbow is an IMSI-catcher, a device that pretends to be a cellphone tower and tricks phones into connecting to it. From here, the device can capture a SIM card's unique identifier—the IMSI—and some models can intercept text messages and phone calls. It can also be used to track the physical location of a device, and by extension, its owner. The devices can indiscriminately sweep up personal information of innocent people who happen to be in the vicinity of the device, and IMSI-catchers can also interfere with devices' abilities to make emergency 911 calls.

One online description suggests that the Crossbow device can target phones using the 4G network.

"Crossbow is a compact, multi-transmit, cellular transceiver platform for 2G, 3G, and 4G. kit includes: crossbow main unit, cabling, antennas, laptop, laptop battery pack, charger, external usb drive, external band selector, and software," it reads.

Drew J. Wade, chief of the office of public affairs at the U.S. Marshals, told Motherboard in an email, "We cannot confirm the use of any specific, sensitive equipment and techniques that may be deployed by law enforcement. To do so would allow criminal defendants to determine our capabilities and limitations in this area."

"With that said, it is the case that U.S. Marshals use various investigative techniques to pursue and arrest violent felony fugitives based on pre-established probable cause in arrest warrants issued for crimes such as murder, sex offenders, robbery, drug offenses, kidnapping, escape and other criminal activities which negatively impact public safety. These techniques are carried out consistent with federal law, and are subject to court approval. Any investigative techniques which the Marshals Service uses are deployed only in furtherance of ordinary law enforcement operations, such as the apprehension of wanted individuals, and not to conduct domestic surveillance, intelligence-gathering, or any type of bulk data collection," he added. The Army and Navy did not provide a statement.

Harris did not respond to a request for comment.

IMSI-catchers are popular with law enforcement in the U.S., with agencies for years trying to keep their existence secret, even to the point of dropping court cases that threatened to disclose details of the equipment. Multiple courts have ruled that law enforcement need to obtain a warrant before deploying such a device, and civil liberties experts have said that it is difficult to use an IMSI-catcher without sweeping up data from all cell phone devices in a given area.

Originally a product geared for military-use, law enforcement agencies have used IMSI-catchers to investigate all sorts of crime domestically, from petty crime like the theft of chicken wings right up to the attempted purchase of explosives on the dark web. As the ACLU found, as of January of this year, ICE was still using Crossbows.

In a statement last week, Attorney General William Barr said a number of federal agencies, including the U.S. Marshals, would be "deployed to support local efforts to enforce federal law" in the ongoing George Floyd and police brutality protests.

Subscribe to our cybersecurity podcast, CYBER.