
 Judge Releases Information about Police Use of Stingray Cell Phone Trackers - wglb
https://www.aclu.org/blog/national-security-technology-and-liberty/victory-judge-releases-information-about-police-use
======
declan
This is great news. Kudos to the ACLU. And I'm happy to say it came about as a
result of a note I posted on Twitter in January:

[https://twitter.com/declanm/status/429292173083688960](https://twitter.com/declanm/status/429292173083688960)

[https://twitter.com/NateWessler/status/473990510902640640](https://twitter.com/NateWessler/status/473990510902640640)

~~~
greenyoda
Kudos to you, too!

Here's the link from declan's tweet:

[http://caselaw.findlaw.com/fl-district-court-of-
appeal/16502...](http://caselaw.findlaw.com/fl-district-court-of-
appeal/1650231.html)

 _" James L. Thomas appeals convictions and sentences for sexual battery and
petit theft, contending that evidence obtained in violation of the Fourth
Amendment, and article I, section 12 of the Florida Constitution, was
introduced against him at trial. We reverse and remand for a new trial."_

So, because the police wanted to keep their use of the Stingray secret, they
entered the accused rapist's apartment without obtaining a warrant, which
caused the evidence they gathered, including the victim's phone, to fall under
the exclusionary rule. The defendant will get a new trial, and may go free and
commit other crimes, because of the police's preference for secrecy over the
rule of law.

~~~
deciplex
You forgot the next step:

"Thereby helping, in some small way, to (further?) turn the public against the
doctrine of Fruit of the Poisonous Tree."

~~~
joe_the_user
Well,

Like freedom of speech, the Fruit of the Poisonous Tree principle matters most
for cases and situations that look bad.

The only effective counter to the talk radio blow-hard shouting "he got off on
a technicality again!!!" is to educate the public. Otherwise, we have just
abandoned the principle that a defendant needs to be not just guilty but
justly proven guilty to be punished.

~~~
Shivetya
Actually the people pushing the he got off on a technicality will be police
sycophants, talk radio tends to drive for ratings but quite a few hosts across
the country are not blind friends of the police, far from it. Warrant less
searches are never looked upon favorably, let alone no knock warrants, and
finally the war on drugs isn't the most supported topic.

what you do have though is a very organized group out there whose job is to
support the actions of the police regardless of how distasteful some may fine
it, they will vilify the victim and perpetrators of crime to distract from
abuses of police power. This of course leads to political pressure and chest
thumping from hard on crime (at any cost) candidates.

~~~
rayiner
> Actually the people pushing the he got off on a technicality will be police
> sycophants, talk radio tends to drive for ratings but quite a few hosts
> across the country are not blind friends of the police, far from it. Warrant
> less searches are never looked upon favorably, let alone no knock warrants,
> and finally the war on drugs isn't the most supported topic.

I think these statements are out of touch with the viewpoints of the majority
of the voting public, at least as it has been over the last couple of decades,
although it's certainly trending in a different direction these days.

Let's take 2000 as a reference point, which isn't that long ago and is a
pretty good time-frame to look at, accounting from the lag in public opinion
to when those viewpoints are reflected in the legal system:
[http://www.people-press.org/2014/04/02/americas-new-drug-
pol...](http://www.people-press.org/2014/04/02/americas-new-drug-policy-
landscape).

In 2001, 90% of the U.S. thought that drug abuse was either a "crisis" (27%)
or a "serious problem" (63%). 45% of the country viewed the move away from
mandatory minimum sentences for non-violent drug crimes as a bad thing. 63%
thought that even marijuana should be illegal. Note that these are polls of
the overall public: actual voters skew older and more conservative. And these
are about drug use generally. Taking out marijuana, which most people view as
less serious, but isn't a major target of the drug war anyway, would show even
greater public support.

Now, things are slowly trending in the other direction, but it's flatly
incorrect to say that only police sycophants will view criminals "getting off
on a technicality" as being a bigger problem than 4th amendment violations.
Even today, 26% of those polled, and almost certainly a higher percentage of
voters, think the government should focus more on prosecuting drug users. Not
just dealers, but users! 32%, and again likely a higher percentage of actual
voters, still see the move away from mandatory minimums for non-violent drug
crimes as a bad thing.

Moreover, it's crucial to distinguish between growing support for marijuana
legalization, and opposition to the drug war generally. Many people have a
skewed perception that the drug war is about putting marijuana users in jail.
Less than 1% of people jailed for a drug offense are there solely for
marijuana possession (and many of those people pled down from more serious
charges):
[http://www.crimeandconsequences.com/crimblog/2011/06/facts-o...](http://www.crimeandconsequences.com/crimblog/2011/06/facts-
on-marijuana.html). The vast majority of drug enforcement activity is directed
at harder drugs. Because most people draw a major distinction between
marijuana and "real drugs" it's misleading to say that widespread support for
marijuana legalization indicates a major opposition to the drug war generally.

All you have to do is watch a modern police procedural to evaluate the
validity of statements like "warrant less searches are never looked upon
favorably." Watch through the first (and only) season of Almost Human. The
whole show is a parade of 4th amendment violations, justified by the premise
"but he's the bad guy!" Media companies don't put out shows that challenge or
disturb the typical person's views about things. The fact that almost every
police procedural portrays the 4th amendment as just something that just
protects bad guys and allows them to get off on technicalities reflects the
general sentiment of the public.

That is, of course, not to justify chipping away at the 4th, but rather to
point out why it's so hard to defend. The 4th amendment almost never comes up
in a context in which the police did a warrantless search and didn't find
anything incriminating. It almost always comes up when the police found a huge
stash of cocaine, or a cache of child porn, or boxes of illegal guns.

~~~
danielweber
I think your [1] got clipped off the end.

~~~
rayiner
Sorry, I originally had my 5th paragraph as a footnote.

------
revelation
If you want to detect the presence of an IMSI catcher such as the Stingray
system, you won't be able to do that on Android, iPhone or basically any phone
out there you can buy today. What you need is a phone that has been hacked to
run the osmocomBB firmware and baseband software:

[http://bb.osmocom.org/trac/wiki/Hardware/Phones](http://bb.osmocom.org/trac/wiki/Hardware/Phones)

You can then use the CatcherCatcher software from SRLabs who have been working
on this GSM/mobile security stuff since forever:

[https://opensource.srlabs.de/projects/mobile-network-
assessm...](https://opensource.srlabs.de/projects/mobile-network-assessment-
tools/wiki/CatcherCatcher)

~~~
jacquesm
First I heard about this:

[http://michiganmedicalmarijuana.org/topic/45943-police-
depar...](http://michiganmedicalmarijuana.org/topic/45943-police-departments-
caught-covering-up-illegal-use-of-the-stingrayhailstorm-cell-phone-listening-
device/)

What is the legal status of using something like CatcherCatcher? (in other
words, could you get in trouble for using it in the same way that you can get
in trouble in many places for having a radar detector?)

~~~
exhilaration
Only if CatcherCatcher is made explicitly illegal, like the legislature of
Virginia and the city council of Washington D.C. have made radar detectors
illegal. Those are the only two places (and military bases) that radar
detectors are illegal for passenger cars in the United States.

~~~
gknoy
I did not know that radar detectors were illegal on military bases, let alone
in VA/DC. Thank you for the heads-up. :)

------
ipsin
It's great news. I'm still stunned by the Florida case, also linked to in this
page:

[https://www.aclu.org/blog/national-security-technology-
and-l...](https://www.aclu.org/blog/national-security-technology-and-
liberty/us-marshals-seize-local-cops-cell-phone-tracking-files)

Can Federal Marshals _really_ deputize state and local officers and
retroactively seize their work product? Can these officers be involuntarily
deputized?

It seems like simple theft of state records to me.

~~~
icambron
I'm not sure to what degree it was involuntary, but regardless, no, they don't
stop being state records because the government handed him a title. I'm not a
lawyer, but I'd be pretty shocked if the ACLU didn't win that one.

------
jauer
I'm curious about the regulatory side of this.

Did the FCC grant these police departments a license to transmit on
frequencies assigned to cell companies? Did the cell companies in question
allow the police to use their frequencies?

The FCC is usually quite particular about interference with cell phones. For
example, it's illegal for prisons to run a cell phone jammer but they can
coordinate with call companies to run a fancy repeater that MITMs calls in the
area and only allows authorized handsets.

~~~
eli
The FCC is clearly aware of what's going on and the FOIA denial suggests that
at least someone somewhere has been authorized to use them:
[http://files.cloudprivacy.net/FOIA/FCC/fcc-stingray-
reply.pd...](http://files.cloudprivacy.net/FOIA/FCC/fcc-stingray-reply.pdf)

~~~
eitally
The attached letters from the municipalities of Houston, Anne Arundel County,
etc... indicate -- to me, at least -- that the authorization was granted. If
they hadn't been, I don't see the FOIA officer bothering to attach them, but
who knows.

------
mysteriousllama
Tasker for Android can help notify you if this is happening to you.

From the documentation I've gathered stingray devices appear to impersonate a
cell tower with a stronger signal than the real one in order to get the device
to associate. This means that stingray devices likely have their own cell ID
so as not to trample the real one. If it didn't, it'd be a jammer not an
interception device.

A simple PoC Tasker script (I wish it had an actual text-based language..):
Add a new state, "Cell Near", Scan and pick the tower with highest signal.
Invert the action. Tie it to a Notification task.

Whenever your phone associates with anything other than that tower you will
get a notification. If you're good with Tasker it can be expanded to use
GPS/Expected-tower pairs and alert you if something strange is going on.

Yes, someone should write an app for the general public. Maybe even see if the
EFF can help promote it!

~~~
genericacct
[https://github.com/SecUpwN/Android-IMSI-Catcher-
Detector](https://github.com/SecUpwN/Android-IMSI-Catcher-Detector)

~~~
atmosx
Hm, impressive. Nothing for iOs right? Android might not be as polished, but
gets all the cool stuff.

------
ekianjo
> In this case, police used two versions of the stingray — one mounted on a
> police vehicle, and the other carried by hand. Police drove through the area
> using the vehicle-based device until they found the apartment complex in
> which the target phone was located, and then they walked around with the
> handheld device and stood “at every door and every window in that complex”
> until they figured out which apartment the phone was located in. In other
> words, police were lurking outside people’s windows and sending powerful
> electronic signals into their private homes in order to collect information
> from within.

Seriously ? And no police officer was ashamed of what they were doing during
that whole time ?

~~~
kareemm
Perhaps you're forgetting that the police likely believed they were doing the
right thing and attempting to bring a bad guy to justice.

It's not a popular sentiment on HN, but not all police officers are part of
the shoot / oppress first, ask questions later school of policing.

~~~
bediger4000
Law enforcement officers, of all people, should know and respect The Law,
shouldn't they? I mean, "ignorance of the law is no excuse", and they are
doing a special job which requires special knowledge, skills and care. So, I
think that we can assume they knew they weren't doing "the right thing".
Stingrays are pretty clearly against the spirit of American Democracy and Law
Enforcement, as traditionally held.

Beyond that, the ends rarely justify the means, even legally. There are
supposed to be limits to _how_ the police find stuff out. See 4th Amendment.
Traditional sense of fair play, decency, etc.

~~~
dragonwriter
> Beyond that, the ends rarely justify the means, even legally.

The ends _often_ justifies the means, even legally, its just that the cases
where the proposition that the means used is justified by the ends served
isn't controversial don't get any attention, in much the same way that you
never see news stories of the form "Today, the following areas had no major
earthquakes..."

------
link15
Honestly, this is all being done over public airwaves. It may be an FCC
violation (cell phone jammers?), but I don't think that's what the ACLU is
upset about here.

The part that seems shady to me is that Verizon appears to think it is OK to
give out customer information to law enforcement without a warrant. Without
being able to tie a device ID to a person, its all just a bunch of numbers.

------
coldcode
I can't see how this is constitutional without a warrant. How is this
different than using an infrared detector outside someones home?

~~~
forrestthewoods
There's no way it's constitutional. These days that doesn't seem to be of much
importance.

~~~
ekianjo
> These days that doesn't seem to be of much importance.

It's not of much importance because nobody is outraged by it and nobody is
fighting it (apart from a few organizations whose only action is to complain
through their websites).

~~~
r00fus
The corporate "news" media essentially ignores dissemination of this
information and instead jams us full of useless blather about Benghazi and
$random_celebrity.

If enough people actually heard about this then there'd be a big furor.

------
nness
I don't quite understand how this is a constitution issue?

I get that the Fourth Amendment protects against warrantless entry, but if
you're using a device that is producing a signal that leaves the boundaries of
your property, is capturing that signal considered warrantless?

I don't see the nuance between the Stingray device and Wifi networks. If a
police officer were to identify your home via a wifi network SSID, would that
be warrantless entry?

~~~
Terr_
Technically speaking, EVERYTHING in your house is giving off some kind of
indication that could theoretically be captured and re-assembled.

IMO the only reasonable interpretation is that the 4th Amendment protects you
from anything beyond whatever passes for ordinary observation by normal
people.

~~~
crusso
And that's what the supreme court basically said. It's one thing for the
police to look in an open window - but quite another for them to scan your
home with a thermal imager.

[http://abcnews.go.com/US/story?id=93127](http://abcnews.go.com/US/story?id=93127)

------
andyjohnson0
From [https://en.wikipedia.org/wiki/IMSI-
catcher](https://en.wikipedia.org/wiki/IMSI-catcher):

 _" The IMSI catcher masquerades as a base station and logs the IMSI numbers
of all the mobile stations in the area, as they attempt to attach to the IMSI-
catcher. It allows forcing the mobile phone connected to it to use no call
encryption (i.e., it is forced into A5/0 mode), making the call data easy to
intercept and convert to audio."_

If it is possible for an Android/iOS app to detect when a GSM call is
initiated without encryption then it should be possible to warn the user. Does
anyone know if the encryption level is available to the OS, or is it
restricted to the baseband processor?

~~~
WillKirkby
I think it's restricted to the baseband, but I'm not an expert. Fun fact: SIM
cards actually have a flag which tells the handset to display a warning to the
user if they are using an unencrypted connection. Basically no commercial SIM
cards have this flag enabled.

Source:
[https://www.youtube.com/watch?v=xKihq1fClQg](https://www.youtube.com/watch?v=xKihq1fClQg)

~~~
BuildTheRobots
I believe you have to enable a bit to _disable_ the warning (eg, it should be
there as default). On my own network with my own sim cards, I've yet to find a
modern handset that actually alerts me, though :(

~~~
WillKirkby
Just re-watched the talk (was going from memory) and it seems you're right,
it's "enable this flag to disable the warning".

------
eyeareque
This is great. I wonder if by making the stingray'd phones transmit at full
power, it allows them to find the phone quicker/easier.

How quickly can someone create a phone widget that shows when your cell
"tower" has asked your phone to transmit at full power?

~~~
RankingMember
Pie in the sky idea: App that indexes cell towers to a central database. When
a new tower goes up, it undergoes a confirmation process that verifies its
presence for some given amount of time before adding it to the list of
confirmed cell towers. The software would then give you the ability to choose
to only engage with/respond to registered towers.

This would only work if a good amount of people adopted it (and various other
contingencies were satisfied).

~~~
bdonlan
There are legitimate uses for temporary base stations - often at large sports
events cellular providers will install portable temporary stations for
example.

~~~
x1798DE
The phone could just notify you: "A temporary base station has been detected -
do you want to allow this?"

~~~
georgemcbay
How would it know that the base station was temporary?

This is somewhere between a rhetorical question and a real one, in that I
don't know enough about low-level cell protocols to know if temporary base
stations identify themselves in a way that is detectable compared to
"permanent" ones, but I would assume they don't?

If there's no way to tell the difference between a temporary and permanent
station such a notification would quickly become unbearable as it would pop up
each time a new station is seen.

------
chmars
Stingray? Is that American slang? In the rest of the world, the device is
called IMSI catcher:

[https://en.wikipedia.org/wiki/IMSI-
catcher](https://en.wikipedia.org/wiki/IMSI-catcher)

~~~
pyre
From another ALCU link elsewhere in the comments:

> cell phone tracking devices known as “stingrays.” (The devices are also
> known as “cell site simulators” or “IMSI catchers.”)

~~~
chmars
It seems that 'Stingway' is a manufacturer's brand name, thanks!

------
TwoBit
I wonder, can you make a device that's an anti-stingray? I mean a device that
detects a stingray is present and compromises it somehow.

~~~
peterwwillis
Well you could detect if your cell tower(s) changed strength or location for
no reason, and then spam the relevant radio frequencies with noise, or a clear
signal. In general the co-channel interference is bad enough that most clients
can't talk if they've got two or more radios broadcasting on the same
frequency in the same cell at the same power. But increased noise is a sure-
fire way to corrupt signal.

You could also take up too many channels to keep it from servicing more
clients. Or broadcast too many handset identifiers, flooding them with random
traffic so it's hard to tell if they've actually found their handset or it
just came up randomly.

