StingRay - the cellphone tracking tech police won't talk about
Then they heard fast footsteps, and the next thing they knew, two men had guns pointed at their heads. They demanded money and cell phones.
Pavelich paused.
"Show him we're serious and shoot him," he remembers one of the men saying.
Instead, a gun smashed into Pavelich's face, opening a gash in his forehead and chin, and chipping a tooth. One of the men reached into Pavelich's pockets as he was reeling, and grabbed his iPhone and cash. They took Fischer's iPhone as well, and ran.
Luckily, Pavelich and Fischer found a St. Louis police officer nearby. They soon learned theirs was the last in a string of muggings that evening. In total, seven victims had their phones taken, though Pavelich was the only one who had to spend the night in a hospital getting stitches.
Fischer recalls that the police behaved as if they were hot on the trail of the stolen phones.
"They did say that they're tracking it," she says. She assumed that meant they were using the phones' GPS or something like the Find My iPhone app.
By the next day, four suspects were in custody, including a supposed lookout and a getaway driver. They were found in a hotel room in Caseyville, Illinois, allegedly with the stolen phones. Among the recovered property, Pavelich was able to identify the case he'd had on his phone. It seemed like a done deal.
But a year and a half later, as the trial date for three of the men got closer, Fischer called the prosecutor to find out when she needed to be in court. That's when he told her they'd dropped the charges."The reasoning was, there came up some legal issues that would cause insurmountable issues so that they wouldn't be able to continue with the case," says Fischer. "That's really all that they told me."
Two weeks later a story in the St. Louis Post-Dispatch helped shed some light on what happened. Titled "Controversial secret phone tracker figured in dropped St. Louis case," it explained that investigators had used a relatively new tracking device called a cell site simulator to trace one of the stolen phones. It was so accurate — more accurate than GPS — that it was able to pinpoint the exact hotel room where the accused thieves were holed up.
The technology is often referred to by a brand name: StingRay. When deployed, StingRay forces any cell phones in the area to send it a signal, the same way that a phone normally sends a signal to cell towers. Even if a cell phone is not in use, it still transmits its phone number and electronic serial number to the device.
Once a tool used by federal officials for combating terrorism, in the last decade StingRay-type devices have been approved for use by local law-enforcement agencies. Officers have been using the technology under the purview of the FBI — and only under strict orders not to disclose anything about it, even in court.
The Post-Dispatch story about Pavelich and Fischer's case hypothesized that authorities were backing away from the charges because they did not want to be forced to put a police intelligence officer on the stand and reveal how StingRay works — that government secrecy was essentially more important than a conviction. That did not sit well with Pavelich.
"I got hurt by these guys pretty bad, and they're just walking free now. It pissed me off a little bit," he says.
It may not be quite as simple as that. The St. Louis Circuit Attorney's Office has insisted repeatedly that the use of a StingRay is not why they dropped the case against the four suspected robbers.
"Contrary to the opinion of defense attorneys and to recent reports in the media, the dismissal of the cases was not related in any way to any technology used in the investigation," Lauren Trager, a public information officer for the circuit attorney, said in a statement. She declined to answer further questions about the case, as it is now considered a closed record.
Regardless of why the case was thrown out, it shows that one thing long suspected by local activists is now certain: St. Louis police are using StingRay devices or ones with similar data-capturing capabilities in their investigations.
Until recently, First Amendment watchdog groups like the ACLU said only that it was "probable" that StingRays were being used in St. Louis. But this case, along with documents obtained by Riverfront Times, are beginning to shed some light on the practice locally.
And now that StingRay is here, privacy advocates have a host of concerns: that innocent people's data may be collected without their knowledge, that merely deploying the device is equivalent to unconstitutional search and seizure, and that it may be used to spy on those simply exercising their legal right to free speech.
Local attorneys, journalists and citizens have joined those in other American cities (at least 51 state and local jurisdictions by the ACLU's count) who are struggling to understand StingRay, and are finding a wall of law-enforcement silence on the other side of their questions.
"It's ridiculous," says Hanni Fakhoury, senior staff attorney for the Electronic Frontier Foundation, a civil-liberties advocacy nonprofit. "It's secrecy for the sake of secrecy. It's not actually a public-safety issue now."
In the dizziest days following Michael Brown's death in Ferguson, it was common to hear someone in a protest on West Florissant or out in front of the police station complaining that her cell phone was acting up — dropped calls, weird tones and clicks. Thomas Harvey, an attorney and executive director of the ArchCity Defenders, remembers many of his activist clients fretting that they were being electronically monitored."The night of the non-indictment, everyone's phone was shutting off or turning on. They couldn't use Google Maps. I had the same thing happen to me," he recalls. "There's no way for me to know what caused that."
(St. Louis County Police spokesman Brian Schellman says his department does not have a StingRay unit, but plenty of other law-enforcement agencies were on the scene in north county, including St. Louis and the FBI.)
While StingRay provides many benefits to law enforcement, how its capabilities will affect the general populace isn't as clear. Many people, like the protesters in Ferguson, worry their phones are being monitored while simply exercising First Amendment rights. They have some reason to be paranoid — federal authorities have admitted that StingRay can cause nearby phones to act glitchy, and in at least one instance, a law-enforcement agency has been open about wanting to monitor protesters: The Miami-Dade Police Department requested an emergency purchase of a StingRay just prior to the Free Trade Area of the Americas conference in 2003.
"Based on the history of these conferences, the department anticipated criminal activities directed at attendees and conference sites facilitated by the use of cellular phones," the request reads. "Wireless phone tracking systems utilized by law enforcement have proven to be an invaluable tool in both the prevention of these offenses and the apprehension of individuals attempting to carry out criminal activities."
There's also documented use of StingRay to track alleged perpetrators' movements, which civil-liberties advocates call a violation of the suspect's Fourth Amendment rights to be free from unreasonable search and seizure — because the signal travels into private spaces, through walls.
The first court case where the government acknowledged the existence of StingRay technology came out of a tax-fraud prosecution in Arizona in 2008, in which police used the tracker to locate the wireless broadband modem or "AirCard" of a man named Daniel Rigmaiden. Rigmaiden had been using it to access the Internet and submit fake tax returns, netting about $500,000 over the course of three years."I knew the instant I was arrested that they had to track down my AirCard," Rigmaiden says now. "There wasn't any other flaw in my methods."
The "flaw," as he puts it, was assuming that law enforcement would reserve the use of high-tech tracking technology for terrorism or kidnapping cases — not a lowly tax frauder. Turns out police use StingRay for a wide range of cases — which left Rigmaiden and his AirCard a sitting duck for the investigators hot on his trail.
As Rigmaiden mounted a pro se defense, he compelled federal investigators to produce tens of thousands of pages of documents. That paperwork, along with the testimony he obtained, gave the world its first glimpse at how the technology works.
Rigmaiden was unsuccessful in his argument that the StingRay sweep was unconstitutional. However, rather than getting more than twenty years in prison, prosecutors offered him time served in exchange for a guilty plea. The Arizona man got out of prison a year ago and now works to combat StingRay secrecy.
"Every citizen has a duty to make sure the Constitution is upheld," he says. "I have the opportunity to do it in this particular area."
Since Rigmaiden's case, dribs and drabs of information about the technology have come out of other criminal cases, but government secrecy has ruled the day. That may be about to change. Earlier this month the U.S. Department of Justice announced that it would review use of the technology by all arms of federal law enforcement including the FBI, the DEA and the U.S. Marshals.
"I wouldn't call it an investigation. It seems to be a reevaluation of their policy," says Nathan Wessler, staff attorney for the Speech, Privacy, and Technology Project at the American Civil Liberties Union. "It's crucial that local law enforcement follow suit immediately, including in St. Louis."
In St. Louis, former Division 16 Circuit Court Judge Jack Garvey says the first he heard of the "magical" technology that could track phones was during his regular Wednesday meeting with former police chief Dan Isom and Circuit Attorney Jennifer Joyce in 2011. At the time, he says, the cell site simulator belonged to the local branch of the U.S. Secret Service (apparently St. Louis has one of those, too).
"Isom says, 'We can use this device that is sitting in the back of a parking garage at police headquarters,'" recalls Garvey.
In those early days, Garvey agreed to sign off on warrants allowing the police to use the Secret Service's device to look for phones taken from crime victims. They had to provide the serial number for the phone and the cell service provider.
The police and the prosecutors kept this new-fangled tactic tightly under wraps. But Garvey says he spoke openly about the warrants and was astonished no defense attorney ever followed up with questions during the year he was signing them.
"It was a joke," he says. "We were yukking it up back then."
At some point after Garvey moved to the 17th Division and was no longer the primary judge signing the warrants, the way cell site simulator technology was used at the department changed. The same month that Isom announced his retirement, the board of commissioners for the St. Louis Metropolitan Police Department put out an invitation for bids for a "Stingray II System" and the installation of the system in a Chevrolet Tahoe. StingRay units are relatively portable — some are about the size of a suitcase, and can be installed in vehicles and taken on the road.
At this point, StingRay deployment is more like an old-fashioned game of cops-and-robbers than an omniscient Big Brother seeing and knowing all. According to the ACLU the device is often hooked up to a laptop in a police car, and officers drive around as the laptop display shows them whether the signal is getting hotter or colder. Some authorities have even described walking with handheld units through large apartment buildings until they were certain which room had the phone inside.
Although several companies produce this type of product for law enforcement, the leader is Florida-based Harris Corporation, which is also the only company that calls its devices "StingRay."
"Harris is kind of like the Apple corporation of the surveillance world. It's really easy to use their stuff," says Rigmaiden. "The other stuff is more complicated."
Prices for these types of devices range from $16,000 to $400,000 for a suite of technology.
It's not clear whether the St. Louis Police Department successfully purchased the StingRay, or decided to continue using loaners from some other federal jurisdiction. An attorney for the city denied a Sunshine Request for any purchasing paperwork, saying the documents would "reveal trade secrets and commercial or financial information." Isom wouldn't comment on where the purchase stood at the time of his departure, and Police Chief Sam Dotson has not responded to interview requests.
But the department did respond to RFT's request for applications for search warrants or orders authorizing the use of cell site simulators. That request yielded two examples. To Garvey, they're unrecognizable from the orders he signed four years ago.
"It's more of a broad thing. My search warrants that we were doing were, 'This is the phone of this person, this is the serial number of this phone,'" he says. "Something happened. Either the cops got a new machine, or they're running it from a new machine."
The two example applications given to RFT are called "pen register applications," more commonly understood as applications to install a device that reads which numbers are being dialed — and which are incoming — on a landline. But the new application paperwork broadens the language to include "cell site activations," "call detail records in an electronic format" and, most densely, "24-hour a day assistance to include switch based solutions including precision location pursuant to probable cause based information queries and all reasonable assistance to permit the aforementioned Agencies to triangulate target location."
That last, almost inscrutable paragraph is the closest the documents come to referring directly to StingRay usage.
"The secrecy in cities across the country has been so extraordinary," says Nathan Wessler, staff attorney for the ACLU.
To Wessler of the ACLU, the very vagueness of that language makes it unconstitutional.
"This violates the Fourth Amendment," he concludes after reviewing RFT's documents. "Nothing in the applications suggests that police will be using cell site simulators. Nor do the applications explain to the judge the capabilities of cell site simulators."
It's also simply too easy for police to obtain pen register application approval, Wessler says, as opposed to the higher burden of proving probable cause for a warrant. To obtain a warrant, police have to show there's a preponderance of evidence — as spelled out in the Fourth Amendment — that makes their search necessary.
For a pen register application, all cops have to show is that it could help the investigation. And because of the extremely vague and/or technical language in the applications, judges may have no idea they're authorizing use of a StingRay — the term simply never appears in the document.
Privacy advocates are also concerned about what happens to the data from innocent bystanders in the area who may have their phones swept.
A good analogy, says the ACLU's Nathan Wessler, is a game of Marco Polo: "The device yells 'Marco!' and all the [nearby] phones are forced to yell back 'Polo!' The StingRay can then be used to hone in on the signal from the suspect's phone and locate him/her based on the strength and direction of the signal. But all the while, every other phone is still being forced to yell 'Polo!' over and over, letting the StingRay know that they are in the area too."
It's those other phones that have some activists worried.
"What is done with all that data that's irrelevant? Are they keeping that information, or are they deleting it?" asks Electronic Frontier Forum attorney Fakhoury. "These things identify phones in the area; they don't necessarily listen in on phone conversations or capture data. But that is a technical limitation. What that means is, they are configured not to do that, but we don't know how they're not doing that."
One thing appears to be similar from the days when Garvey was signing off on the StingRay warrants: the ones obtained by RFT show that, locally, the device has only been used to track the phones of victims, rather than perpetrators or activists.
The two heavily redacted pen register applications provided by the police department are both from homicide cases in which the alleged murderer is thought to have stolen the victim's phone.
"Victim ____ registered a hotel room on ______ and prepaid through ______. Witnesses at the scene reported hearing a loud argument near the victim's room earlier in the week," reads one of the applications. "Detective _____ stated an _____ wall charger located in ______ hotel room; however no _______ was located in his room or on his person."
The second application describes a drug deal gone bad, with one fatality. "A suspect pulled a long barreled firearm and began firing shots at the victims. ________ was able to flee the residence through a second floor window and later discovered the other victims had been shot. During this incident victim ______ disclosed his cellular phone had been stolen."
Both applications were approved for 60 days, and the judge — whose name is also redacted — agreed that the orders be sealed.
Garvey says at least one StingRay warrant he signed off on caught a murderer, a guy who was strolling out of a Walmart with the stolen phone in his pocket.
"I'm telling you, it's doing miracle work," he says.
St. Louis Pen Register Applications and Orders
For assistant public defender Megan Beesley,her journey down the StingRay rabbit hole began with five little words: "A proven law enforcement technique."
Beesley, who works out of the Carnahan Courthouse downtown, remembers the phrase leaping out at her when she read the police report from the post-Game 5 robberies on October 28, 2013. Her client was one of the men arrested for his role in the string of muggings, and the line was used as the only explanation for how authorities managed to find him and his alleged accomplices in the hotel room in Caseyville.
"A proven law enforcement technique" seemed almost like the cop-speak equivalent of Seinfeld's "yadda yadda yadda."
"It seemed like a very odd sentence to me," she says.
Beesley got the chance to ask about the phrase at a November 7, 2014, deposition of St. Louis police detective John Anderson.
"I just said, 'What does this mean?' The detective acted really weird, looks at the prosecutor, who acts really weird," she recalls. "They go outside and talk. He comes back in and awkwardly refuses to answer."
At a subsequent hearing, Anderson again said he could not answer, Beesley recalls, because of a "non-disclosure agreement that had to do with the FBI. So that confirmed to me that this was probably a StingRay."
In order to use the technology, sheriffs and police chiefs have historically had to sign a non-disclosure agreement with the FBI and the Harris Corporation agreeing not to provide the public with any information about how it works. According to an affidavit given by a supervisory FBI agent in a 2014 case in Virginia, if a prosecutor were to disseminate technical information about StingRay to media with international readership, it could constitute a violation of the Arms Control Export Act, which is a felony. That blanket of silence also covers court proceedings.
St. Louis police refused even to allow the Riverfront Times to view any non-disclosure agreement it may have with its cell site simulator provider or the FBI, declining our Sunshine Act request.
One such agreement, obtained from the Erie County Sheriff's Office in New York State, reads: "If the Erie County Sheriff's Office learns that a District Attorney, prosecutor, or a court is considering or intends to use or provide any information concerning the Harris Corporation wireless collection equipment...the Erie County Sheriff's Office will immediately notify the FBI in order to allow sufficient time for the FBI to intervene to protect the equipment/technology and information from disclosure and potential compromise."
In a handful of incidents around the country, prosecutors have dropped cases, offered plea deals or withdrawn evidence rather than disclose information about StingRay. That happened in Baltimore, Maryland; Tacoma, Washington; and Tallahassee, Florida — and even in homicide cases.
"It is troubling that their use of this extraordinary secrecy is getting in the way of proper government functions," says Wessler. "I suspect part of what this secrecy is protecting is constitutional violations."
Christopher Allen, a spokesman for the FBI Office of Public Affairs, says that the purpose of the non-disclosure agreements is to prevent criminals from learning how the technology works and figuring out a way to avoid it.
"Specific capabilities of certain equipment used by law enforcement agencies are considered Law Enforcement Sensitive, since their public release could harm law enforcement efforts by compromising future use of the equipment," he said in a statement. "As a last resort, after exhausting all other legal means to protect LES information, the NDA does require state and local law enforcement to drop a criminal case rather than compromising the future use of the technique by disclosing LES information."
He insists, however, that the FBI has never forced any jurisdiction to dismiss a case because of the agreement.
Regardless, Beesley is convinced that by dropping charges against her client, the St. Louis circuit attorney is helping honor a non-disclosure agreement signed by the city police. She and her colleagues scoured their current caseload and found the phrase "a proven law enforcement technique" in four different police reports.
"I think that's the closest we've come to the cops acknowledging this," she says.
Riverfront Times contacted several defense attorneys and only found one additional case with the "proven law enforcement technique" verbiage in the police report. Nick Williams, a criminal defense lawyer whose client was arrested and charged in a different robbery case, says he noticed the phrase even before the Post-Dispatch piece and has alerted the prosecutor at the circuit attorney's office to his concerns. His client's next court date is in June.
"It begs the question of whether or not there is an official policy in place, and if so, what is that policy?" says Williams. "The way in which this is being used on a local level is certainly an infringement on an individual's Fourth Amendment rights.
"A person has a right to privacy, and an infringement on that privacy should be protected against."
Although St. Louisans are just waking up to the fact that StingRay is swimming in their back yards, the secrecy surrounding the technology is beginning to drop away across the country. That's starting with increased willingness by local law enforcement to simply admit that they are using the devices.
For example, Baltimore disclosed recently that it deployed the technology 4,300 times since 2007. In Tallahassee, a police investigator admitted they'd used it 200 times. (The Post-Dispatch puts the number of approved pen register applications locally at 80.)
Legislators are showing increasing discomfort with StingRay. Ten states, including Illinois, Florida and Maryland, have passed some kind of legislation designed to force local law enforcement to obtain a warrant before using cell-phone-tracking technology. A bill Daniel Rigmaiden helped to shaped just passed in Washington State.
Even the federal government is paying more than lip service to the idea that its warrantless deployment of StingRay technology may be unconstitutional. Soon after, to the announcement by the DOJ that they will review the usage of the technology, the FBI went even further in a May 14 article in the Washington Post. The agency told the newspaper that its officers will now apply for a warrant before using StingRay, and that it's OK for local law enforcement to acknowledge the use of the technology, as long as details about how it works are kept secret.
"It's kind of throwing local agencies under the bus a little bit," says Wessler. "Now the FBI's saying, 'No, no, no, that's not what we really meant,' which is a helpful clarification now, but there are years' worth of cases where defense attorneys were kept completely in the dark, as well as judges, and that needs to be remedied right now."
Not everyone in the criminal justice system may be on board with the technology's black-box status either. Judge Garvey, who has praised the usage of StingRay, does not agree with the secrecy imposed by the nondisclosure agreements.
"I think the FBI — they're kind of dumb," he says. "They're being overly federal about the whole thing."
When the last of the four alleged Game 5 muggers had her case dropped in a St. Louis courtroom on April 27, Assistant Circuit Attorney Tanja Engelhardt made an interesting statement as reported by the Post-Dispatch. She let slip that though StingRay practices in St. Louis haven't been litigated yet, "They will be. This isn't the case."
In a statement to Riverfront Times, Trager nudged the sentiment slightly further: "The technology has been used around the country and has withstood challenges in the past. The legality of this technology has recently been challenged in this jurisdiction, and we anticipate it will be litigated in a court of law."
As for Brandon Pavelich, he's more confused than ever about his case. If it wasn't dismissed because of StingRay, what happened?
"If that's the big controversial issue, and that's not it, what the heck could it be?" he says. "That feels super sketchy. What are these guys doing?"
Then again, Pavelich says, it's not as though he just had his eyes opened to the fact that the criminal justice system doesn't always function properly. He has two brothers who've been in and out of the prison for years, he says, mostly for non-violent drug offenses and parole violations. He's not naïve.
"I really see the system as being stupid anyway," he sighs. "I'm not entirely surprised these things are happening."
Additional (and crucial) reporting by Chris McDaniel.
This entry passed through the Full-Text RSS service - if this is your content and you're reading it on someone else's site, please read the FAQ at http://ift.tt/jcXqJW.
0 reacties:
Post a Comment