​Everything We Know About the Stingray, the Cops' Favorite Cell Phone Tracking Tool

While Edward Snowden gives interviews to John Oliver and the NSA continues to gobble up our data, local police departments are quietly spying on people without public oversight, often thanks to a little device known as a Stingray.

The use of these surveillance tools is apparently widespread, but it's only recently that the general public is becoming aware of it. Last month, a judge ruled that the Erie County, New York, Sheriff's Department had to release unredacted documents about its Stingray use. Last Tuesday, after receiving those documents, the New York Civil Liberties Union (NYCLU) reported that the department used Stingrays some 47 times, and seemingly on just one of those occasions got a court order for the subsequent surveillance.

On Friday, the Guardian published the results of the paper's own Stingray investigation. Thanks to some unredacted documents from the Hillsborough County, Florida, Sheriff's Department, the paper concluded that the FBI is directly involved in preventing police departments from sharing any information about their Stingray use and orders them to tell the Feds when requests for information on them are made so that they have time to "prevent disclosure." Worse still, Stingrays are not to be discussed by Florida law enforcement in warrants, testimony, or anywhere in court ever—even at the cost of dropping a case against a defendant.

These revelations are just the latest pieces of concrete proof that spying is being conducted by police departments around the country—and that the federal government has a firm hand in keeping evidence of it far away from the public eye.

Stingrays work by tricking cell phones into contacting them as if they were cell towers. This makes it easy for law enforcement to snag metadata, such as numbers dialed and how long conversations were, as well as the location of the phone itself. Stingrays do this indiscriminately to phones in an area, such as an apartment block. They also disrupt phone service for large numbers of people. US Marshals have even taken Stingrays (or devices that achieve a similar effect) to the air, which involves still more indiscriminate data being sucked up. (The CIA played a role in setting that one up.) Privacy advocates at the Electronic Frontier Foundation (EFF) call Stingray-style searches general warrants for the digital age, meaning they are at their core unconstitutional.

Almost invariably described as "suitcase-sized" in media accounts, Stingrays costs tens of thousands of dollars each and are sometimes bought with war on terror grants, or borrowed from the Feds by local law enforcement. In both Florida and New York, cops had an agreement with the FBI to keep Stingray use secret, even the cost of losing an investigation. That's alarming for privacy advocates as well as attorneys for defendants who want to know everything they can about the case against them.

The devices have been around in various forms since the 1990s, and Harris Corporation—which manufactures Stingrays, the name brand generally used to refer to International Mobile Subscriber Identity catchers (IMSIs)— registered a trademark on the device in 2001.

Domestic stingrays reportedly do not have the capacity for intercepting actual cell conversations. However, a related Harris device called a Triggerfish—which may or may not be in use today—can do just that. And other documents suggest that with some modifications, Stingrays could also listen in on calls.

So we more or less know what these things do. The question of who has them, and how exactly they are being used, remains murky because police departments, federal authorities, and the manufacturers kick and scream at every attempt to shed light on the technology. As confirmed by the Erie Sheriff's Department, the FBI requires a non-disclosure agreement from local law enforcement agencies before they purchase or use a Stingray.

Subsequently, law enforcement officials have lied in court and attempted to hide the use of Stingrays in investigations. Perhaps most memorably, in response to an ACLU lawsuit last year that instructed Sarasota, Florida, police to reveal their Stingray use, federal marshals deputized a police officer and then took possession of the requested files in order to evade state sunshine laws. US Marshals have also denied Freedom of Information Act (FOIA) requests for Stingray information, some of which was already public.

The more we learn, the worse this looks. Last Wednesday, it was reported that Baltimore law enforcement has used Stingrays thousands of times since 2007, and concealed that fact from prosecutors and judges the direction of the FBI. Previously, law enforcement there simply argued that Stingray use was already legal under existing wiretapping laws—something privacy advocates dispute. Tracking a phone without a warrant was ruled to be a violation of the Fourth Amendment by the Florida Supreme Court last year. The ACLU has repeatedly argued that Stingrays are an unprecedented violation of privacy rights.

But in most places, without a precedent for the use of this technology, law enforcement organizations—like Chicago cops—have managed to get away with it. The FBI basically argues that since they deploy Stingrays in public places, there is no reasonable expectation of privacy for suspects—even though the devices reach them in their private homes—thereby ostensibly giving the Bureau free reign to deploy them from the streets or air.

In 2013, a USA Today investigation showed that more than 25 police departments have Stingrays. Last October, Motherboard's Jason Koebler wrote that "at least 45 branches of law enforcement" use the gizmos. Numerous federal agencies and the Army and the Navy have also purchased them, spending a total of $30 million on the gadgets since 2004.

Alarmingly, law enforcement always seems to turn to the Harris Corporation's non-disclosure agreement as a means to evade FOIA Requests. Unfortunately, FOIA Exemption number 4 protects" trade secrets and commercial or financial information obtained from a person [that is] privileged or confidential."

On March 26, journalist Matthew Keys seemingly scored a victory with a FOIA request for an operating manual for Stingray devices and the similar, cheaper Kingfish, which tracks communications between cell numbers. The whole procedure took six months and many excruciating emails. At one point, Keys was told by an FCC official that it would be take longer so that Harris Corporation could be given "the opportunity to defend the continued confidentiality of the owners' manual for the products at issue in [Keys'] FOIA request."

In its response, Harris justified its foot-dragging by stating that "disclosure of certain materials… could reasonably put public safety officials at risk, jeopardize the integrity and value of investigative techniques and procedures." (These are all official disclosure exemptions, though the ACLU and other privacy groups have argued that enough information now exists about Stingrays that some of them may no longer apply.)

Just reading the email exchanges show that this was a tedious exercise, but Keys's patience paid off, and we know what an operating manual circa 2010 looks like—sans "trade secret" redactions—for the Stingray, Stingray II, and Kingfish devices.

Unfortunately, there's almost nothing that was left unredacted. The very first page of the manual says it is exempt from FOIA requests. Every successive page says "WARNING ITAR [International Traffic in Arms Regulations) CONTROLLED" and "CONFIDENTIAL, NOT FOR PUBLIC INSPECTION." Each "chapter" of the 58 page manual contains redactions, and the entirely of chapter 5 is redacted under the trade secrets FOIA exemption number 4. That appears to be the only excuse that was needed to exclude nearly every word from this document.

Finally, the 2010 manual has an appendix that is redacted, though most of the devices' warranty terms are helpfully left in. That's all there is. Six months of struggles with the FCC and Harris resulted in no useful information.

According to the Justice Department, "The very existence of [FOIA's] Exemption 4 encourages submitters to voluntarily furnish useful commercial or financial information to the government and provides the government with an assurance that required submissions will be reliable."

(When asked to comment on their non-disclosure agreements with law enforcement, Harris' Vice President of Global Communications Jim Burke said he had none.)

But if there's one thing that the past couple years of revelations about the depth and breadth of government surveillance tactics have shown, it's that secrecy invites abuses, and if Stingrays are being used to help spy on people en masse, the public has the right to know about them.

Follow Lucy Steigerwald on Twitter.