The Sacramento County Sheriff’s Department acknowledged this week that it possesses and uses surveillance technology that allows detectives to collect location data from the cellphones of investigative targets, possibly doing so without a court order.
The so-called “Stingray technology” is controversial nationwide, and questions over its use locally parallel a national debate over domestic surveillance. The device has come under fire in part because its focus is not specific: It also collects location data from nearby cellphones unrelated to an investigation, a possible violation of civil liberties, according to some critics. However, Sheriff Scott Jones said in a statement released first to The Sacramento Bee that such “collateral” data is not kept by investigators.
It is the first time that Jones has admitted his agency’s use of the device since inquiries and a series of stories by Sacramento’s KXTV Channel 10 since the spring. He said in the statement that a confidentiality agreement with the federal government, which provided the technology, had prevented him from acknowledging use or ownership of the device despite his “demonstrated commitment to transparency.” However, Jones said he recently received authorization to do so.
The Sheriff’s Department provided limited answers to followup questions submitted by The Bee. Officials would not say whether they are obtaining warrants or any other court orders before using the Stingray, saying only that the department “complies with all legal requirements to operate any equipment as a public safety organization.” They said the department has been using the technology since the mid-2000s.
As the nation continues to debate the constitutionality of domestic surveillance systems, the revelation about the Sheriff’s Department offers a glimpse at how such surveillance is being used not just in the name of national security, but for the purpose of criminal investigations in communities across the country. Some observers say local use has continued to grow without even the limited level of scrutiny that the National Security Agency’s domestic wiretapping program has received.
“This particular technology frankly, up until the past few months ... has arguably been more secret than the (USA Patriot Act Section) 215 business records program that has ... gotten more people interested in privacy and civil liberties,” said Stephanie Pell, assistant professor and cyberethics fellow at the U.S. Military Academy’s Army Cyber Institute.
She said the use of Stingrays and similar devices by local, state and federal law enforcement agencies raises many policy questions reminiscent of the NSA debate, including the issue of oversight.
“Congress can’t do anything about it if they don’t know about it,” she said of police surveillance tactics. “And there isn’t, in my opinion, a reliable system in place so that Congress gets such notice.”
But exactly how local law enforcement agencies are using the technology – how often, in what circumstances, with what kind of permission from judges – remains largely unknown, in part because of those agencies’ refusal to talk publicly about it. The Sheriff’s Department declined to say what agency within the federal government required the nondisclosure agreement Jones signed, but Pell said that she has found evidence in the public record that such agreements are either being required by the FBI or the manufacturer of the device.
Here’s what is known to experts. Stingray is the most well-known brand name in a family of devices more generally called “IMSI catchers,” devices that can identify, track and intercept real-time data from a cellphone according to its unique identifier, or “international mobile subscriber identity.” The device does so by “masquerading” as a tower that cellphones use to transmit data, according to a policy paper authored by Pell, a former federal prosecutor, and Christopher Soghoian, principal technologist for the American Civil Liberties Union.
IMSI catchers have the capability to trap “metadata” – such as a phone’s location, and the numbers of other phones it has been communicating with. But some models also have the power to intercept “content data,” such as verbal communication or text messages. Pell said her research with Soghoian did not find any examples of law enforcement agencies using the device for the latter purpose, which would require a wiretap warrant.
Jones’ statement indicates the Sheriff's Department’s device cannot, or is not being used to, trap content data.
“The capability of this technology does NOT collect content such as voice, text or data, and does not retain ANY data or other information from other than the target device,” Jones wrote. “It is used infrequently in special cases, following department policies and procedures, to locate felony suspects and/or missing or kidnapped persons.”
Police do not need an IMSI catcher to locate and track known cellphone numbers. Detectives can seek a court order to compel a cellphone agency to share that information, both real-time and historical, and it happens often. But experts say a Stingray can at times provide a more precise location than even a cellphone company. And in cases when a suspect has been identified, but their cellphone number has not, a Stingray also could prove useful.
Whether agencies legally should be seeking a warrant or some other court order to use such a device is still a matter of debate, and hasn’t been settled by the courts, Pell said. She and Soghoian are aware of agencies that have sought a court order, but she said they are skeptical that even that process is transparent.
“This is an overbroad and invasive technology,” said Soghoian, speaking from the ACLU’s perspective. “If the government had some device that let them locate just one phone without touching the phones of other people, that would be one thing, but that technology doesn’t exist. ... I would be shocked if most judges realized that’s what they’re being asked to authorize.”
Soghoian said his organization has serious concerns about what he described as the “intrusion on the privacy rights of innocent citizens” and the tremendous level of secrecy surrounding it. In fact, he said, the technology is no longer truly a secret.
“There have been master’s (theses) that have been written. ... You can buy (the devices) from China for $1,800,” he said. “So this idea that somehow this is a supersecret technology that nobody knows about – that fiction of secrecy helps law enforcement agencies to justify withholding (information) ... and keep the public in the dark, and, in many cases, keeping legislators in the dark.”
Pell said she also is concerned that there hasn’t been more discussion about the vulnerabilities of the communication system that allow Stingray devices to work. Those vulnerabilities, she said, put everybody at risk.
And without a more robust public discourse on what this technology is and the legal guidelines that should apply, Pell said it’s difficult to come to any conclusion on whether the devices should be used at all.
“I haven’t myself determined that because we haven’t had a good public policy debate on this,” she said. “I recognize the public safety benefits that this technology provides on the one hand. On the other hand ... the public is not being well-educated enough about how they’re made vulnerable.”