Stingrays: The Biggest Technological Threat to Cell Phone Privacy You Don't Know About
On Friday, EFF and the ACLU submitted an amicus brief in United States v. Rigmaiden, a closely-followed case that has enormous consequences for individuals' Fourth Amendment rights in their home and on their cell phone. As the Wall Street Journal explained today, the technology at the heart of the case invades the privacy of countless innocent people that have never even been suspected of a crime.
Rigmaiden centers around a secretive device that federal law enforcement and local police have been using with increased frequency: an International Mobile Subscriber Identity locator, or “IMSI catcher.” These devices allows the government to electronically search large areas for a particular cell phone's signal—sucking down data on potentially thousands of innocent people along the way—while attempting to avoid many of the traditional limitations set forth in the Constitution.
How Stingrays Work
The Stingray is a brand name of an IMSI catcher targeted and sold to law enforcement. A Stingray works by masquerading as a cell phone tower—to which your mobile phone sends signals to every 7 to 15 seconds whether you are on a call or not— and tricks your phone into connecting to it. As a result, the government can figure out who, when and to where you are calling, the precise location of every device within the range, and with some devices, even capture the content of your conversations. (Read the Wall Street Journal’s detailed explanation for more.)
Given the breadth of information that it can stealthily obtain, the government prefers the public and judges alike not know exactly how Stingrays work and they have even argued in court that it should be able to keep its use of the technology secret. The Electronic Privacy Information Center has filed a FOIA request for more information on Stingrays, but the FBI is dragging its feet and is sitting on 25,000 pages of documents explaining the device.
The Rigmaiden Case: An Illusory Warrant
In Rigmaiden, the government asked a federal judge in Northern California to order Verizon to assist in locating the defendant, who was a suspect in a tax fraud scheme. But after they received an order telling Verizon to provide the location information of an Aircard they thought to be the defendant’s, the government took matters into their own hands: they claimed this authorization somehow permitted its own use of a Stingray.
Not only did the Stringray find the suspect, Rigmaiden, but it also got the records of every other innocent cell phone user nearby.
The government now concedes that the use of the device was a “search” under the Fourth Amendment and claims it had a warrant, despite the fact that, as we explain in our brief, “the Order directs Verizon to provide the government with information and assistance, but nowhere authorizes the government to search or seize anything.”
In fact, the government's application made no mention of an IMSI catcher or a Stingray, and only has a brief sentence about its plans buried at the end of an 18-page declaration: “the mobile tracking equipment ultimately generate[s] a signal that fixes the geographic position of the Target Broadband Access Card/Cellular Telephone.”
A judge initially signed off on this order, but clearly, the government did not accurately and adequately explain what it was really up to.
General Warrants: Unconstitutional, All You Can Eat Data Buffets
Beyond the government's conduct in this specific case, there is an even broader danger in law enforcement using these devices to locate suspects regardless of whether they explain the technology to judges: these devices allow the government to conduct broad searches amounting to “general warrants,” the exact type of search the Fourth Amendment was written to prevent.
A Stingray—which could potentially be beamed into all the houses in one neighborhood looking for a particular signal—is the digital version of the pre-Revolutionary war practice of British soldiers going door-to-door, searching Americans’ homes without rationale or suspicion, let alone judicial approval. The Fourth Amendment was enacted to prevent these general fishing expeditions. As the Supreme Court has explained, a warrant requires probable cause for all places searched, and is supposed to detail the scope of the search to ensure “nothing is left to the discretion of the officer executing the warrant”.
But if uninformed courts approve the unregulated use of Stingrays, they are essentially allowing the government to enter into the home via a cellular signal at law enforcement’s discretion and rummage at will without any supervision. The government can’t simply use technology to upend centuries of Constitutional law to conduct a search they would be prevented from doing physically.
Stingrays Collect Data on Hundreds of Innocent People
And when police use a Stingray, it’s not just the suspects’ phone information the device sucks up, but all the innocent people around such suspect as well. Some devices have a range of “several kilometers,” meaning potentially thousands of people could have their privacy violated despite not being suspected of any crime. This is another fact the government didn’t fully explain to the magistrate judge in Rigmaiden.
The government now claims it protected privacy by deleting all third-party data on its own after it collected it. But the government’s unilateral decision to binge and purge comes with its own consequences. Now there’s no way to know what exactly the government obtained when it used the device.
Had the government told the court what it really was planning on doing and the amount of information it would obtain, the court may have exercised its constitutional role of ensuring the government narrowed its search. After all, it was for the court, not the government, to decide how best to balance the government’s need for information with third-party privacy, and any suspect’s future interest in access to potentially exculpatory information.
Enough Warrantless Excursions
Unfortunately, US government excuses for conducting warrantless searches are becoming all too familiar. Whether it’s the hundreds of thousands of searches for cell phone location information, the skyrocketing of warrantless surveillance of who and when you’re calling, or the NSA’s still-active warrantless wiretapping program, Americans are seeing their Fourth Amendment privacy rights under attack from all angles. We hope in this case and others like it, the court will prevent such violations of privacy from occuring again.
Recent DeepLinks Posts
Jul 22, 2016
Jul 21, 2016
Jul 21, 2016
Jul 21, 2016
Jul 21, 2016
- Abortion Reporting
- Analog Hole
- Anti-Counterfeiting Trade Agreement
- Bloggers' Rights
- Broadcast Flag
- Broadcasting Treaty
- Cell Tracking
- Coders' Rights Project
- Computer Fraud And Abuse Act Reform
- Content Blocking
- Copyright Trolls
- Council of Europe
- Cyber Security Legislation
- Defend Your Right to Repair!
- Development Agenda
- Digital Books
- Digital Radio
- Digital Video
- DMCA Rulemaking
- Do Not Track
- E-Voting Rights
- EFF Europe
- Electronic Frontier Alliance
- Encrypting the Web
- Export Controls
- Fair Use and Intellectual Property: Defending the Balance
- FAQs for Lodsys Targets
- File Sharing
- Fixing Copyright? The 2013-2016 Copyright Review Process
- Free Speech
- Genetic Information Privacy
- Government Sabotage of Digital Security
- Hollywood v. DVD
- How Patents Hinder Innovation (Graphic)
- International Privacy Standards
- Internet Governance Forum
- Know Your Rights
- Law Enforcement Access
- Legislative Solutions for Patent Reform
- Locational Privacy
- Mandatory Data Retention
- Mandatory National IDs and Biometric Databases
- Mass Surveillance Technologies
- Medical Privacy
- Mobile devices
- National Security and Medical Information
- National Security Letters
- Net Neutrality
- No Downtime for Free Speech
- NSA Spying
- Offline : Imprisoned Bloggers and Technologists
- Online Behavioral Tracking
- Open Access
- Open Wireless
- Patent Busting Project
- Patent Trolls
- PATRIOT Act
- Pen Trap
- Policy Analysis
- Public Health Reporting and Hospital Discharge Data
- Reading Accessibility
- Real ID
- Search Engines
- Search Incident to Arrest
- Section 230 of the Communications Decency Act
- Social Networks
- SOPA/PIPA: Internet Blacklist Legislation
- State-Sponsored Malware
- Student Privacy
- Stupid Patent of the Month
- Surveillance and Human Rights
- Surveillance Drones
- Terms Of (Ab)Use
- Test Your ISP
- The "Six Strikes" Copyright Surveillance Machine
- The Global Network Initiative
- The Law and Medical Privacy
- TPP's Copyright Trap
- Trade Agreements and Digital Rights
- Trans-Pacific Partnership Agreement
- Travel Screening
- Trusted Computing
- UK Investigatory Powers Bill
- Video Games