‘Stingray’ technology use needs better guidelines, House committee says

The departments of Justice and Homeland Security spent more than $95 million cumulatively over a half-decade on devices that allow law enforcement to track mobile phones in real time, according to a bipartisan congressional report that urges the creation of a nationwide framework for their use.

Known as “stingrays,” cell-site simulators or IMSI-catchers, and used by federal, state and local law enforcement agencies alike, the devices act as fake phone towers and collect mobile-phone data. The House Oversight and Government Reform Committee’s staff report, released Monday, says Congress and the two agencies should work on clarifying appropriate use of the devices by state and local law enforcement and the use of geolocation data in general.

The yearlong investigation began in April 2015 after press reports about federal, state and local law enforcement deployment of stingrays.

“Today’s bipartisan staff report highlights the need for Congress to pass legislation to establish a clear national standard for when and how law enforcement authorities can access cell-site simulators,” Elijah Cummings, D-Md., the House panel’s ranking member, said in a statement. “It is important for law enforcement to have access to these sophisticated surveillance technologies, but it is also important to ensure that appropriate safeguards are in place to protect the privacy rights of American citizens.”

The DOJ has 310 of devices and spent $71 million on them across fiscal 2010-14, while DHS has 124 and spent about $24 million over the same time, the report says. It is unclear how many stingrays are in use by state and local agencies.

The two federal departments have policies that mandate a warrant supported by probable cause to use cell-site simulators. But state and local laws still vary, according to the report.

“In many cases, state and local law enforcement continue to rely on the state equivalent of a pen register/trap and trace order, which only requires law enforcement to meet a ‘relevance based standard’ to use cell-site simulation devices, a standard that is lower than probable cause,” the report says.

Alan Butler, senior counsel at the nonprofit Electronic Privacy Information Center, said that although the devices are primarily used for tracking location, they can do more.

“We know that the devices have a lot more capability than even most agencies are probably using, including the ability to intercept, redirect, spoof, otherwise modify the content of calls,” Butler told FedScoop.

The report, Butler said, “highlights a really critical problem,” around the lack of uniform standards, and recommending those is a step in the right direction. But he said the DOJ and DHS standards, even, need to be more stringent.

“I think for using stingrays there should be more of a super warrant requirement akin to what governs wiretaps and intercepting conversations,” he said. “Because there’s just so much non-target, non-pertinent data that’s being collected by these devices, that I think you need really strict controls and oversight by a court to make sure that that data is being handled properly.”

Similarly, he noted that wiretaps have a “pretty robust” reporting infrastructure around how much was spent on the technology, how wiretaps have been used and if they have been effective, while stingray technology has none.

State and local use

In addition to collecting information about DOJ and DHS stingray use, the committee also surveyed four cities and two states to see how many and what kinds were deployed, as well as what policies those entities were using.

The report recommends that state and local law enforcement should be required to adopt the new policies out of DHS and DOJ on stingray before they can use federal grant money to acquire the devices.

“The lack of uniformity at the state and local level currently creates the possibility that states and localities are deploying cell-site simulator technology in a manner that is less strict than the guidelines being adhered to by federal law enforcement agencies,” the report says. “Insofar as state and local law enforcement receive federal grants to purchase these devices, DHS has acknowledged the need for potential improvements in the grant-making process to encourage recipients to adopt the more stringent federal guidelines for use of these devices.”

The committee found that the Baltimore Police Department and Tennessee Bureau of Investigation both got devices under DHS grants. Baltimore PD has three devices, and one is currently in use, according to the report. Tennessee has one.

Other state and local entities used local funding, including Washington, D.C.’s Metropolitan Police; the City of Alexandria, Virginia; and the Virginia State Police.

“The local prosecuting office in the District of Columbia is the United States Attorney’s Office and, as such, Washington D.C. follows the DOJ policy governing the use of cell-site simulators,” according to the report.

The City of Sunrise, Florida, indicated to the committee that it also follows the DOJ policy.

In its report, the committee also recommends Congress pass legislation “to establish a clear, nationwide framework for when and how geolocation information can be accessed and used.”

The report also highlights a common accompaniment to stingray use — FBI-required nondisclosure agreements that prevent state and local law enforcement from talking in court about how they are used. The committee was given copies of some of the nondisclosure agreements.

“Because cell-site simulators operate over the airwaves, manufacturers of these devices must obtain a special license from the Federal Communications Commission to sell them,” the report notes. “As part of its condition of approving any sale, the FBI imposed a requirement on state and local entities that in order to obtain the devices, they must sign a non-disclosure agreement with the FBI.”

The report later adds that the agreements “condition the possession and use of cell-site simulators on an agreement by state or local law enforcement to dismiss a criminal case at the FBI’s request rather than produce information that could compromise the devices.”

The new DOJ policy does not address these agreements, according to the report.

But the report recommends that “non-disclosure agreements should be replaced with agreements that require clarity and candor to the court whenever a cell-site simulator has been used by law enforcement in a criminal investigation.”