New cell phone surveillance method raises privacy concerns

Published 1 November 2012

The FBI is using a new method to access cell phone customer data, but the
<http://www.aclu.org/> American Civil Liberties Union (ACLU) contends that
the method is overly invasive

The FBI is using a new method to access cell phone customer data, but the
<http://www.aclu.org/> American Civil Liberties Union (ACLU) contends that
the method is overly invasive.

The method, known as "stingrays," uses a person's international mobile
subscriber identity (IMSI) secretly to track someone's location using
stingray devices, known as IMSI catchers. The catcher mimics a cell phone
tower, but stingrays track the locations of all mobile devices in a given
area, including those which are not being targeted.

NBC
<http://www.nbcbayarea.com/news/local/Calif__privacy_groups_oppose_cel...
_surveillance_device-176210751.html> reports that a big reason this scares
privacy groups is that an IMSI catcher can be built at home for about
$1,500, exposing a weakness in cell phone security to which most consumers
are oblivious.

In 2010 a communications expert was able to make an IMSI catcher and thirty
cell phones in the room attempted to connect to the make-shift tower. Anyone
who made a call while connected to the stingray received a message saying
that their call was being recorded.

On 19 October, a friend-of-the-court brief, filed with the U.S. District
Court of Arizona by the Electronic Frontier Foundation in San Francisco and
the American Civil Liberties Union of Northern California, argued that
stingrays are "highly intrusive and indiscriminate," and claimed government
investigators attempted to utilize them while giving Judge Richard Seeborg
only a few details about how powerful stingrays can be.

"The government prevented the court from making an informed determination on
the warrant application," Linda Lye, staff attorney for the ACLU of Northern
California, told the court. "Maybe the court would have said, 'No, I'm not
going to grant this at all because of the impact on third parties.' Maybe
the court would have said, 'OK, you can do this, but let's follow these
safeguards and procedures to make sure that third-party privacy is
protected."

Hanni Fakhoury, a staff attorney for the Electronic Frontier Foundation,
told the court that law enforcement deceived the courts in the warrants.

"If you read the warrant affidavit, it has absolutely zero mention at all of
IMSI catchers and stingrays or fake cell phone towers or any explanation of
the technology," Fakhoury told the court.  "Courts are busy, judges are
busy; they rely on the government in good faith to explain what they're
doing."

Earlier this year a federal judge in Texas denied DEA investigators an
application to use a stingray, once he understood the technology.

"They did not address what the government would do with the cell phone
numbers and other information concerning seemingly innocent cell phone users
whose information was recorded by the equipment," Magistrate Judge Brian
Owsley wrote in June. "While these various issues were discussed at the
hearing, the government did not have specific answers to these questions.
Moreover, neither the special agent nor the assistant United States attorney
appeared to understand the technology very well."

NBC notes that the U.S. attorney's office in Phoenix did not comment on the
most recent case involving stingrays. Prosecutors stated in a 20 August
filing that they only needed to show how a communications device can show
evidence of criminal activity, but are not required to show what method
would be used to get the information.

"Defendant was perpetrating a multi-million dollar tax fraud scheme, and he
hid his tracks through the use of encrypted emails, money mules, layers of
false identities, forged documents, forged identification cards, and botnets
and/or proxies," the filing reads. " . The alleged inconvenience and
intrusiveness of the air card location operation (which went undetected by
an individual who appeared to spend a significant portion of every day
seeking to avoid detection or identification) was reasonable under the
circumstances."

http://www.homelandsecuritynewswire.com/dr20121101-new-cell-phone-sur...
ce-method-raises-privacy-concerns