This is a paper that I wrote for my Wireless Networking class in Spring 2020.

Stingray devices are categorized as cell-site simulators by the Federal Government.  They are also known as IMSI (International Mobile Subscriber Identity) catchers.  They can pinpoint cell phone locations.  They are used by law enforcement and government agencies.  These devices are illegal for civilians to use.  They are costly and range in price from $40,000 to over half a million dollars.  Stingrays come in various sizes.  The most prevalent and convenient stingray device size is the size of a suitcase.  This size permits them to be easily transported in police cars or on planes.  Their legality is still being hashed out in the court systems.  Very few states require a warrant for their use.  Several states that do require a warrant include California, Utah, Virginia, and Washington.  There are no federal laws that regulate their use (Collier, 2017). 

Stingrays work by imitating a cell phone tower’s signal.  It forces all the cell phones in an area to connect to the stingray device.  Cell phones will automatically connect to the cell tower that broadcasts the strongest signal.  A cell phone will connect and reconnect many times each day, which allows it to obtain the strongest signal while its user is traveling or moving about.  A stingray device will create a boosted signal that will be stronger than the legitimate cell towers’ signals.  This will make the cell phone connect to the stingray since it will have the strongest signal.  The stingray’s activity is performed in the background.  The cell phone’s user won’t have any knowledge of what is going on.  It all happens without any input from the user or the cell phone’s network carrier.  Once the cell phone successfully connects to the stingray, the stingray’s operator can locate the cell phone, retrieve personal data from the phone, and interfere with the cell phone’s signal (Bates, 2017). 

A cell phone’s IMSI can assist with finding it.  An IMSI is a unique number that cell phones use to communicate with a cellular network.  The Government can ask a third‐party carrier to voluntarily disclose the IMSI of a cell phone or require the carrier to provide it using a court order.  The stingray will make all the cell phones in a target area connect to it.  The stingray’s operator will screen the incoming IMSI numbers against the IMSI number of the cell phone that they are attempting to find.  Once the IMSI of the cell phone they are trying to find pings the stingray, the exact location of that cell phone can be determined.  If the stingray operator doesn’t know the IMSI number of the cell phone that they are trying to find, the stingray can gather the IMSI numbers of each cell phone in the target area.  Law enforcement agents will visually assess the scene while gathering cellular data that will allow them to segregate the IMSI number of the cell phone that they are trying to find.  As law enforcement agents follow the cell phone out of range of the other cell phones in the area, that cell phone’s IMSI will make itself known to the stingray operator.  This method can be used in combination with the pinging method, which means that the network carrier’s assistance won’t be needed.  It permits law enforcement agents to obtain and investigate a cell phone user’s IMSI number by themselves (Bates, 2017). 

Stingray devices help law enforcement and government agents find cell phones.  The information obtained from these cell phones are used to help solve cases.  What the War on Drugs did for police militarization, the War on Terror is doing for police intelligence gathering.  When these surveillance devices are used, the assistance of cell carriers isn’t required, and judicial authorization also isn’t required (Bates, 2017).  Police departments use stingray devices to solve cases, especially drug cases.  For example, the NYC (New York City) Police Department has used these devices over 1,000 times to solve cases since 2008.  A police department in Annapolis, Maryland, successfully used a stingray device to search for a man who allegedly robbed a restaurant delivery worker of $57 worth of chicken wings and sandwiches (Collier, 2017). 

These devices were originally developed for military, Federal Government, and national security use.  However, these devices also came to be used by local law enforcement agencies.  Local law enforcement uses these devices due to various transfer and grant programs, which include the Urban Areas Security Initiative and local funding sources, including civil asset forfeiture funds.  Police agencies in 23 states, the District of Columbia, and federal agencies use these devices.  Some of these agencies include the U.S. Marshals Service, the FBI (Federal Bureau of Investigation), the ATF (Bureau of Alcohol, Tobacco, Firearms, and Explosives) the DEA (Drug Enforcement Administration), the NSA (National Security Administration), ICE (Immigrations and Customs Enforcement), DHS (Department of Homeland Security), the DOJ (Department of Justice), the IRS (Internal Revenue Service) the Army, the Navy, the Marine Corps, and the National Gard.  It has been hard to verify the extent of law enforcement use of this technology, so there may be police agencies in additional states that are also surreptitiously utilizing these devices that the public is unaware of (Bates, 2017). 

The privacy of millions of Americans is at risk.  The location data generated by the stingray and its software is very accurate.  Stingrays have been able to find a cell phone within six feet of its location.  They can also detect a cell phone in a room inside an apartment in a sizeable apartment complex.  Since the data obtained from stingray devices is so accurate, it has raised concerns over constitutionality with regards to warrantless searches of private residences.  The Supreme Court typically views this with skepticism.  The full powers and capabilities of stingray devices are unknown.  Stingrays can obtain user content, including browser activity, SMS text messages, phone call content, and other personal data (Bates, 2017).  

The DOJ currently has a written policy for their department’s stingray usage.  However, the policy doesn’t do much to alleviate fears about the possibility of using stingrays to gather large amounts of personal data.  Their policy simply states that stingray devices aren’t configured to gather personal data, especially unnecessary data.  The Department of Justice states that using stingrays to gather personal data would violate Federal Law.  Federal Law states that stingrays utilized by the DOJ must be configured as pen registers.  These devices are not permitted to gather the contents of any communication.  The DHS also has a similar written policy in place for these devices (Bates, 2017). 

The policies written by the DOJ and DHS include requirements that federal law enforcement agencies must obtain warrants for stingray use except under certain essential conditions.  Data is also supposed to be regularly destroyed when it’s not needed for an investigation.  Government agencies are supposed to be open with courts about their usage of stingray devices in criminal investigations.  However, these policies are only internal administrative policies.  The enforcement of these policies is left up to the executive agencies that are using the stingray devices.  These policies apply to the Federal Government, but they do not apply to state and local police departments.  State and local police departments can set up their own guidelines and accountability systems (Bates, 2017).

The usage of stingray devices continues to bring up various legal issues.  When stingray devices are used, they gather information about each individual cell phone that is within range of the device.  This is an invasion of privacy.  The Constitution’s 4th Amendment provides U.S. citizens with protection from unlawful searches and seizures.  It also requires a warrant (Collier, 2017).  The Fourth Amendment states that people have the right to “be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures.”  The Supreme Court has developed methods of analyzing Fourth Amendment claims, including the reasonable expectation of privacy test and third‐party doctrine.  The lack of transparency with regards to the Government’s use of stingray technology ensures that bad actors aren’t held accountable.  Also, any stingray guidelines that exist aren’t always followed.  The Federal Government doesn’t disclose which departments own or lease these devices.  They also don’t disclose which departments are actively using them and how often they are used.  They aren’t disclosing what guidelines govern these devices or what systems are in place to guarantee that they are being used appropriately.  There are no strict and independently implemented accountability systems in place (Bates, 2017). 

It is not possible to obtain an inclusive look at the usage of stingray devices within the U.S.  The FBI has testified that these devices come with nondisclosure agreements.  Police departments and other law enforcement agencies typically make a promise to the FBI that they will never admit they have these devices.  The FBI has directed local police departments to use stingray devices only for lead purposes.  They aren’t supposed to be used as primary evidence in any affidavits, hearings, or trials.  The public is still mostly unaware of precisely how and where these devices are used.  It is also not possible to know the exact number of stingray devices being used.  Stingray purchase orders were obtained through the Freedom of Information Act for 2001 through 2015, which showed a minimum of 124 stingray devices were purchased by local police departments, states, and counties (Collier, 2017). 

Stingray devices can gather a plethora of personal data.  However, when these devices are used, data from an alleged criminal’s phone is collected, along with everyone else’s data.  The stingray device never differentiates between the target cell phone and other cell phones in the target zone.  Stingray devices can perform many tasks, such as interfering with signals, recording telephone data, finding precise cell phone locations, and intercepting the content of calls and text messages.  There are many jurisdictions that don’t have any publicly available policy guidelines on these devices. 

Without obtaining a complete list of their capabilities and public acknowledgment of their use by every law enforcement agency, it will continue to be very difficult to measure accountability and misuse of these devices (Bates, 2017). 

References

Bates, A. (2017, January 25). Stingray: A New Frontier in Police Surveillance. Retrieved from Cato

Institute: https://www.cato.org/publications/policy-analysis/stingray-new-frontier-police-surveillance

Collier, K. (2017, April 26). How Police Use 'Stingray' Devices to Secretly Track Your Phone.

Retrieved from The Week / Vocativ: https://theweek.com/articles/694360/how-police-use-stingray-devices-secretly-track-phone