Law enforcement use of IMSI catchers and their insidious efforts to hide it.
By Miriam Swedlow
Thanks to NPR’s radio program, Serial, thousands of Americans now know that a person’s movements can be verified by following the interaction between a cell phone and nearby cell phone towers. An International Mobile Subscriber Identity (IMSI) catcher, commonly referred to as a “StingRay,” takes this concept a step further. The device tricks cell phones to connect to it by masquerading as a cell phone tower. Once connected, the StingRay provides “real time” tracking of a phone’s location and is capable of obtaining data from the phone (including emails, photos, and contact files). Although Federal and local law enforcement increasingly use these devices as part of surveillance activities, they have been reluctant to disclose to judges and the public exactly how and when they use them. This is likely because IMSIs cast a broad net, gathering invasive data on scores of innocent people in the process of tracking a single suspect.
Law enforcement agencies have utilized a “smoke and mirrors” approach to keep their use of StingRay equipment a secret. After the 2001 Patriot Act, the Department of Justice declared that law enforcement would need a Pen/Trap order before using direct surveillance technology on communication systems, such as IMSI catchers. Almost fifteen years later, there have been only two published magistrate opinions on the use of IMSI catchers. The lack of judicial opinions is directly related to law enforcement’s pervasive practice of obfuscating the use of IMSI catchers in pen register applications without explicitly disclosing the nature of the technology. For example, officers in Sarasota, Florida referred to the StingRay as a “source” in official documents to obtain warrants. In Tacoma, Washington, judges learned that they had signed off on the use of IMSI catchers through local newspaper reporting. The result is that judges have unwittingly granted hundreds of orders to use IMSI catchers.
As reports surface about the use of IMSI catchers, law enforcement claim that secrecy is necessary to prevent criminals and terrorists from modifying their behaviors or developing defensive technology. Nonetheless, state courts and legislators have pushed back against these threats to privacy. Eight states have enacted legislation requiring a warrant for police to track an individual’s cell phone in real time. A number of state supreme courts have rendered similar limitations on real time tracking of cell phones. U.S. Senators have demanded more information from DOJ and the Department of Homeland Security in the wake of reports of a secret U.S. Marshals program that involved attaching IMSI devices to airplanes. Still, broad use of this technology continues. According to the ACLU, 47 agencies in 19 states are known to own StingRay devices. Until the legality and acceptable scope of such surveillance is clarified, the StingRay is likely to remain a hidden threat to Fourth Amendment protections against unreasonable searches and seizures.
Washington Journal of Law, Technology & Arts 