A secretive surveillance device confounds criminals, but raises privacy concerns
Courts take aim at a technology beloved by the country’s police forces
Jan 26th 2016 | NEW YORK | United States
IN APRIL of 2014, three men were shot when a drug deal turned sour on a tree-lined residential street in Baltimore. The city’s police department quickly linked the crime to Kerron Andrews, a dreadlocked 22-year-old, but could not find him at his registered address. Agents used phone records to determine Mr Andrews’ general location, but instead of going door-to-door until they located him, they opted for something far more efficient: a Hailstorm. Using the device, they tracked Mr Andrews directly to an acquaintance’s sofa, between the cushions of which he had stuffed the gun used in the shooting.
The Hailstorm is a more advanced version of the StingRay, a surveillance device that operates by mimicking a cellular tower, forcing all nearby mobile phones to reveal their unique identifying codes, known as IMSI numbers. By crosschecking the IMSI numbers of suspects’ phones with those collected by “cell-site simulators” such as Hailstorm and StingRay, law enforcement can pinpoint people with astonishing precision. The tools have been used to trail suspects to specific apartment units in apartment blocks and find them on moving buses on busy city streets. Initially developed for the military and intelligence communities, cell-site simulators are now used furtively by federal agencies such as the Federal Bureau of Investigation (FBI) and the Drug Enforcement Administration (DEA) as well as by local police forces across the country.
Law-enforcement agencies rarely seek explicit court approval to employ cell-site simulators, and rarely admit to their use after the fact. As a condition for purchasing the devices, state and local police forces must sign strict nondisclosure agreements with the FBI, which argues that the more information is made public about cell-site simulators, the more “adversaries” will adapt. The agreements prohibit police from disclosing any information about the technology, including to judges in the form of warrant requests, and even instructs prosecutors to drop cases if pressured to reveal details about cell-site simulators. In one case in Baltimore, a judge threatened to hold a detective in contempt after he refused to testify about the use of StingRay in locating an armed-robbery suspect. Instead of instructing the detective to answer, the prosecution dropped the evidence. In another armed-robbery trial in Tallahassee, prosecutors offered armed robbers a generous plea deal rather than demonstrate how the device worked in court.
Given this secrecy, it is impossible to identify all the agencies using cell-site simulators. The American Civil Liberties Union (ACLU) has counted 58 agencies that possess the devices, across 23 states and the District of Columbia, but suspects the true number is much higher. The technology has been used to not only to trace murderers and armed robbers, but also to nab car thieves, phone pilferers and, in one case, a woman who made a series of abusive phone calls. The city of Baltimore alone has admitted to using the technology 4,300 times between 2007 and 2015. “I have never seen a tool that is on one hand treated in such a cloak-and-dagger fashion, but on the other used as a bread and butter tool,” says Stephanie Pell of West Point’s Army Cyber Institute.
Lawmakers are starting to address such grievances. Washington, California, Virginia, Minnesota and Utah have passed laws requiring their police forces to seek warrants before using cell-site simulators. Congressman Jason Chaffetz of Utah hopes to pass a bill that would do the same on a federal level, though he is unlikely to prevail in such a politically charged year.
Movement in the courts might come more quickly, however. After the Baltimore police department grudgingly confessed in a court hearing last summer that it had used a Hailstorm to locate Mr Andrews, the presiding judge suppressed all evidence related to the surveillance operation—including Mr Andrews’s gun. Without a warrant, she held, the police had breached his Fourth Amendment rights. Civil libertarians are optimistic about the precedent the case might set. The state of Maryland will appeal against the ruling on February 9th.