A demonstration against NSA mass surveillance in Washington, DC, in October 2013. Photo by Elvert Barnes Photography
In a move that has alarmed civil-liberties groups and transparency advocates, the Department of Justice has been working with local police departments across the country to squelch public-records requests on controversial cell-phone surveillance technology.
In December, USA Today reported that cell-phone surveillance technology originally designed for the US military was finding its way into state and local police departments across the country.
Since the USA Today report, public-records requests have unearthed documents showing state and local police departments in 15 states using so-called “International Mobile Subscriber Identity" (IMSI) catchers such as Stingray, Kingfish, Harpoon, Amberjack, and Hailstorm.
The Electronic Frontier Foundation’s Hanni Fakhoury said that Stingrays act as a “man-in-the-middle” device, intercepting data by emulating a cell-phone tower. With the briefcase-size technology, police can identify and locate cell-phone users in a general area or search for a specific individual. It also vacuums up metadata from phones.
Law enforcement agencies purchase the devices through federal grants under the auspices of anti-terrorism operations. Police say the technology can also be used for search-and-rescue operations, kidnappings, and mass-casualty events.
However, the full details of how police departments are using military-grade surveillance technology—often without warrants—are being blocked from release by an aggressive effort from the federal government and the corporation that sells the devices.
In separate cases in at least three states, federal agents under the Department of Justice worked with local police to keep records on IMSI catchers secret.
Civil-liberties groups say the Obama administration’s effort to suppress state public-records requests, given the controversial nature of the IMSI devices, undermines the president’s claims to transparency, especially following the NSA spying scandal.
"The 'most transparent administration in history' should not be in the business of undermining state open-government laws,” said Ginger McCall, the general counsel of the Electronic Privacy Information Center (EPIC).
"Cell-site simulators are very invasive devices that sweep in vast amounts of private information unrelated to any investigation,” McCall continued. “The public deserves to know if Stingray devices are being used by local law enforcement, how frequently, and what protocols are being put in place to protect ordinary people's data."
This cell-phone tower thinks it's a palm tree. Photo via Flickr user J. N. Stuart
Last week, activist Freddie Martinez sued the Chicago Police Department for records on Stingrays after the department ignored his Freedom of Information request.
In a phone interview, Martinez said that he first suspected the Chicago Police Department was using Stingrays during a 2012 NATO summit in the city. Martinez said protesters began noticing their cell phones behaving strangely: batteries draining too fast, text messages not sending, etc.
Similar lawsuits have popped up around the country. In March, a local independent journalist sued the Tucson Police Department for records on the Stingray device it had bought in 2010 for more than $400,000.
Oakland County, Michigan, officials denied a Freedom of Information request from the Detroit News in April seeking information on the county’s use of Hailstorm, a more advanced version of the Stingray technology. The county claimed the records were protected by anti-terror laws—a justification that has appeared in several other cases.
“So little is known about Hailstorm that even national experts will only speculate about its capabilities,” the News wrote.
Nathan Wessler, a staff attorney with the ACLU, said the town of Sunrise, Florida, wouldn’t even confirm or deny it had any records on Stingray technology—the sort of response more often given by the CIA than small towns—until the ACLU found a purchase order for a Stingray unit on the city’s website.
But the most interesting case occurred in Sarasota, Florida, where the US Marshals Service confiscated records on Stingray surveillance from a courthouse just hours before the records were due to be handed over to the ACLU.
The Marshals Service said it deputized one of the local police officers as a federal agent, making the documents property of the Marshals and exempt from state open-records laws.
"This idea that the feds can swoop in and claim records is a real significant problem," Fakhoury said. “Once state officers get these devices, they belong to the state.”
Wessler said the ACLU is now challenging the confiscation in court.
The US Marshals directed a request for comment to the Department of Justice. A Justice Department spokesperson said in an emailed statement: “The US Marshals Service declines to comment due to pending litigation.”
What links several of these cases together is an unusual amount of meddling from the federal government in state public-record disputes. The FBI has coordinated responses and crafted legal arguments for police departments to keep Stingray records under wrap.
The court case in Tucson includes an affidavit from an FBI special agent who said the disclosure would "result in the FBI's inability to protect the public from terrorism and other criminal activity, because, through public disclosures, this technology has been rendered essentially useless for future investigations."
In Tallahassee, Florida, prosecutors in a criminal case coordinated with the FBI to keep key portions of testimony involving IMSI catchers sealed. In the case, police tracked a stolen cell phone to a man’s apartment using an IMSI catcher, and after being denied entry, forced their way inside—all without a warrant. The government refused to explain how it had located the suspect until the judge agreed to close the courtroom and seal the transcript.
The FBI did not immediately return requests for comment for this article.
Anne Weismann, the chief counsel of Citizens for Responsibility and Ethics in Washington, said the Justice Department’s interference in state public-records requests "is extremely troubling and cannot be reconciled with the President’s purported commitment to transparency and willingness to engage in a greater public discussion about the metes and bounds of government surveillance.
“I question what possible legitimate federal interest could the FBI and US Marshals have in preventing the public from learning how local law enforcement authorities conduct surveillance,” she continued.
Part of those federal interests was revealed earlier this month, when the ACLU persuaded a judge to unseal the Tallahassee transcript. According to testimony, Tallahassee police had used stingrays at least 200 times without ever seeking a warrant from a judge.
Sealing court records has become another favorite tool of the federal government for hiding surveillance activities from the public. The Wall Street Journal recentlyreported that requests to seal court orders for electronic surveillance have spiked across the US. In most cases those orders stay sealed indefinitely.
According to a Journal analysis, requests for cell-phone location data and electronic tracking more than quadrupled in the Southern District of Florida over the last decade.
‘Technology We May or May Not Provide’
Florida also happens to be the home of Harris Corporation, the defense contractor that manufactures IMSI technologies such as Stingray and Hailstorm.
Harris spent $3.5 million lobbying the federal government in 2013, including on such bills as the Department of Homeland Security Authorization Act and the National Defense Authorization Act (NDAA).
Harris gets a lot of bang for its buck. The Department of Homeland Security has awarded Harris a sole-source contract for its IMSI catchers, meaning DHS did not go through a competitive-bid process. When a state or local police department gets a DHS grant for cell-phone tracking technology, it buys a Harris product.
The AP reported that government sales of IMSI systems like Stingray accounted for almost one third of Harris’s $5 billion in revenue.
DHS has said that Harris is the only provider of IMSI technology, but the ACLU disputes that claim.
Harris also requires police departments buying Stingray devices to sign non-disclosure agreements, forbidding them from revealing details about the devices.
For example, Sacramento declined to provide documents or comment to the ACLU, claiming it would be inappropriate because “the acquisition or use of this technology comes with a strict non-disclosure requirement.”
The NDA that Tucson agreed to, revealed through public-records requests, says that the city “shall not discuss, publish, release, or disclose any information pertaining to the Products covered under this NDA to any third party individual, corporation, or other entity, including any affiliated or unaffiliated State, County, City, Town, or Village or other governmental entity without the prior written consent of Harris.”
The agreement also says that the city should not release any information Harris deems confidential and should let the company challenge public-records requests in court.
“In the event that the City receives a Public Records request from a third party relating to any Protected Product, or other information Harris deems confidential, the City will notify Harris of such a request and allow Harris to challenge any such request in court. The City will not take a position with respect to the release of such material, beyond its contractual duties, but will assist Harris in any such challenge.”
The idea that an NDA could trump public-record law is troubling to many transparency advocates.
“It is just not permissible under state public-records law to exempt yourself from the law by signing a secret agreement with a corporation,” Wessler said. “That's just out of bounds.”
In an emailed statement, a Harris spokesperson said: “We are unable to comment on classified DOD or law enforcement technology we may or may not provide.”
Photo via Flickr user J. N. Stuart
‘A Far Cry from Anti-Terrorism’
State and local police departments mostly appear to obtain Stingray devices through federal grants under the Department of Homeland Security’s Urban Areas Security Initiative.
For example, Oakland County, Michigan, received a $258,370 federal grant for its IMSI catcher, according to records obtained by the Detroit News.
When it applied for AUSI funding in 2011, the San Jose police said the money would “assist regional law enforcement in countering terrorism and investigating and apprehending terrorists.” Yet the devices often end up being used in regular criminal investigations.
“When it's being used by state and local law enforcement, it's overwhelmingly being used for regular police activities,” Wessler said. “In Tallahassee, not one use was for counter-terrorism. I expect that's true everywhere else. It demonstrates how easy it is to get these DHS grants and how little oversight there is once the money goes through.”
Annual reports from the Oakland Police Department cite about 20 Stingray arrests a year. The division deploying the devices is focused on “guns, drugs, and gangs,” according to internal reports obtained by the ACLU
Fakhoury said he knew of one instance in which a Stingray device was used for a tax-fraud investigation. “I'm not saying tax fraud isn't a serious deal, but it's a very far cry from anti-terrorism,” he said.
Despite the best efforts of the Feds, more and more information on IMSI systems has been leaking out. Since USA Today’s original story in December, news outlets and transparency advocates have identified nearly a dozen more cities using Stingrays.
Last week, the ACLU published an interactive map of where the technology is deployed, and news outlet Muckrock recently launched a crowd-funded project to investigate the use of Stingrays nationwide. Additionally, nine states have passed laws this year tightening the use of IMSI catchers.
The ACLU also won a major victory last week when the 11th Circuit Court of Appeals ruled that police must acquire a warrant to obtain stored cell-phone-tower information. But IMSI catchers are so new and, until recently, so unknown that no major court case has specifically examined their use and whether they violate citizens’ privacy rights under the Fourth Amendment.
“This is the million-dollar question,” Fakhoury said.
For Harris Corporation, it could be worth much, much more.
Follow CJ Ciaramella on Twitter.