THE GOVERNMENT’S USE of a controversial invasive technology for tracking phones just got a little more controversial.
The Anaheim Police Department has acknowledged in new documents that it uses surveillance devices known as Dirtboxes—plane-mounted stingrays—on aircraft flying above the Southern California city that is home to Disneyland, one of the most popular tourist destinations in the world.
According to documents obtained by the American Civil Liberties Union of Northern California, the Anaheim Police Department have owned the Dirtbox since 2009 and a ground-based stingray since 2011, and may have loaned out the equipment to other cities across Orange County in the nearly seven years it has possessed the equipment.
“This cell phone spying program—which potentially affects the privacy of everyone from Orange County’s 3 million residents to the 16 million people who visit Disneyland every year—shows the dangers of allowing law enforcement to secretly acquire surveillance technology,” Matt Cagle, technology and civil liberties policy attorney for ACLU-NC, wrote in a blog post about the new documents.
Stingrays and Dirtboxes are mobile surveillance systems that impersonate a legitimate cell phone tower in order to trick mobile phones and other mobile devices in their vicinity into connecting to them and revealing their unique ID and location. Stingrays emit a signal that is stronger than that of other cell towers in the vicinity in order to force devices to establish a connection with them. Stingrays don’t just pick up the IDs of targeted devices, however. Every phone within range will contact the system, revealing their ID.
They not only pick up trackable data from phones; Stingrays and Dirtboxes also can disrupt phone service for anyone in their vicinity whose phone connects to the devices. This means that potentially millions of people in Orange County had their phones unknowingly connected to government surveillance devices and may have experienced service disruption as a result. Last year an FBI agent admitted the disruption capability for the first time in a court case involving a Sprint customer.
“Because of the way the Mobile Equipment sometimes operates,” FBI Special Agent Michael A. Scimeca disclosed to a judge, “its use has the potential to intermittently disrupt cellular service to a small fraction of Sprint’s wireless customers within its immediate vicinity. Any potential service disruption will be brief and minimized by reasonably limiting the scope and duration of the use of the Mobile Equipment.”
Although stingrays are designed to recognize 911 calls and let them pass to legitimate cell towers without connecting to the surveillance device, the revelation from the FBI agent raises the possibility that other kinds of emergency calls not made to 911 may not get through.
Anaheim police have not disclosed how they use their stingray and Dirtbox devices or whether they take any steps to minimize service disruption.
The use of stingrays by local law enforcement agencies has been widespread for many years. But the use of the more invasive Dirtboxes has largely been limited to federal law enforcement, though at least two large cities were known before to be using them. In 2014, for example, the Wall Street Journalreported that the US Marshals Service was operating Cessna aircraft with Dirtboxes installed on them from at least five metropolitan-area airports. The locations of these airports provided authorities with a wide-sweeping flying range that covers cell phones used by most of the US population.
Subsequent news reports revealed that Los Angeles and Chicago local police departments possessed Dirtboxes as well. Anaheim is the smallest city known to have one.
“If a city of this size possesses a Dirtbox it really begs the question what other cities smaller than Los Angeles and Chicago were able to buy these devices in the six years since it has had one,” says Cagle.
It’s not clear to what extent Anaheim police use their stingray and the plane-mounted Dirtbox. Two years after buying the Dirtbox in 2009, the police department purchased its stingray. In 2013, the Chief of Police approved an upgrade to the stingray that the ACLU believes gave it the capability to monitor modern LTE cellular networks, which are used by millions of smartphones.
“In other words, as cell carriers upgraded their networks to LTE, Anaheim police took steps to exploit that very network which millions of customers would entrust with their private communications,” wrote Cagle.
Last year the Justice Department issued a policy asserting that any federal agency using a stingray or Dirtbox must obtain a warrant. That policy, however, left a loophole for local law enforcement agencies to continue using them without a court order. But California lawmakers passed state legislation last year closing that loophole at least for police and other local law enforcement agencies in that state. That so-called CalECPA law requires, as of January this year, that these local agencies also obtain a warrant. Another bill passed by California lawmakers requires any law enforcement agency in the state using such equipment to have established a usage policy for it and to make that policy publicly available.
“Without more transparency and an enforceable set of rules, we really don’t know whether these devices are used from the sky to investigate routine crimes or pursuant to a warrant as CalECPA now requires,” Cagle told WIRED. “We look forward to seeing jurisdictions releasing publicly available use policies with a warrant requirement.”
Source:https://www.wired.com/
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
