What are the Baltimore Police doing with Stingray cell-site simulators?

The Baltimore Police Department gets accused of many things, often spuriously, but one question which has been raised about them this year deserves a closer look. According to multiple reports dating back to last year, the cops in Charm City have regularly been tapping into the cell phones of pedestrians around the city (without a warrant, we should add) using a bit of technology known as a Stingray cell-site simulator. The usual accusations are flying about this being racially motivated, unevenly applied to minority communities and all of the standard charges we hear, but the underlying question of the legality of this tactic is a valid one. The Hill gives a brief rundown of the debate.

The Center for Media Justice, Color of Change and the New America Foundation’s Open Technology Institute are calling for the Federal Communications Commission (FCC) to investigate the Baltimore police for allegedly violating civil liberties laws, The Washington Post reports.

The groups claim that Baltimore police are violating the Communications Act, which requires a license to access frequencies normally used by wireless carriers.

According to the Post, however, an official from the FCC said law enforcement is exempt from laws that normally require such licenses, and that the trackers in question did not access the frequencies for which a license is normally needed…

The devices used by Baltimore police, known as stingray phone trackers, gets nearby phones to connect with them instead of cellphone towers, and allows the stingray operator to gain data from the connected phones, like the phone’s location. When the stringray is in use it interferes with the phone’s ability to connect with cellphone towers and make calls.

This particular piece of technology certainly seems dubious in terms of legitimate use and sounds more like something that identity fraud scammers would have a field day with. You can read a brief description of how the stingray works here. Basically, your cell phone is constantly looking for the closest cell tower to stay connected to the world. The cell tower is able to quiz your phone and obtain any number of bits of data so the network knows who it’s talking to when completing calls. The stingray is a sneaky device which impersonates a cell tower, causing your phone to connect to it instead. It can then obtain data such as your IMSI identification number, metadata about who you are calling and the duration of your calls, the content of instant messaging contacts and records of data usage including the URL of sites you visit.

Additional accusations – particularly in Baltimore – further claim that while the stingray is connected to your phone it prevents you from making calls, including ones to emergency services. But the data I’ve found indicates that while this is possible, it would require a deliberate decision by the stingray user. The default usage would allow the subject phone to continue to operate normally.

Proponents argue that it’s not the same as a wire tap because such metadata isn’t the same as listening in on calls, but Wired Magazine researched this technology last year and determined that you could indeed record calls this way if you know what you’re doing.

Now documents recently obtained by the ACLU confirm long-held suspicions that the controversial devices are also capable of recording numbers for a mobile phone’s incoming and outgoing calls, as well as intercepting the content of voice and text communications. The documents also discuss the possibility of flashing a phone’s firmware “so that you can intercept conversations using a suspect’s cell phone as a bug.”

Regular readers know that I tend to give law enforcement a lot of leeway when it comes to pursuing criminals, and even the collection of metadata can, in my opinion, be both useful and constitutional in finding the bad guys. But this blanket ability to hijack the phones of random passers by and record calls or gather text messages without ever asking a judge or showing a reason for hitting that particular phone sounds like a huge bridge too far. In fact, I’d be interested in having someone explain what the legitimate purpose of a stingray is and why the use or even possession of such a device shouldn’t be illegal in the first place.