Judge: Stingrays Are 'Simply Too Powerful' Without Adequate Oversight (arstechnica.com)

New submitter managerialslime sends news that an Illinois judge has issued new requirements the government must meet before it can use cell-site simulators, a.k.a. "stingrays," to monitor the communications of suspected criminals. While it's likely to set precedent for pushing back against government surveillance powers, the ruling is specific to the Northern District of Illinois for now. What is surprising is Judge Johnston’s order to compel government investigators to not only obtain a warrant (which he acknowledges they do in this case), but also to not use them when "an inordinate number of innocent third parties’ information will be collected," such as at a public sporting event. This first requirement runs counter to the FBI’s previous claim that it can warrantlessly use stingrays in public places, where no reasonable expectation of privacy is granted. Second, the judge requires that the government "immediately destroy" collateral data collection within 48 hours (and prove it to the court). Finally, Judge Johnston also notes: "Third, law enforcement officers are prohibited from using any data acquired beyond that necessary to determine the cell phone information of the target. A cell-site simulator is simply too powerful of a device to be used and the information captured by it too vast to allow its use without specific authorization from a fully informed court."

Comments

A step in the right direction

[Anonymous Coward]

But in the end, these court orders and government actions do little. These organizations are almost clandestine in nature and are just going to do what they want. Props to GNAA.

Re:A step in the right direction

[bhcompy]

They'll still use it, but it will not be used in court, rather it will be used to gather information until another method of making a charge stick is found. It's not fruit of the poison tree at that point.

Re:A step in the right direction

[bigpat]

But in the end, these court orders and government actions do little. These organizations are almost clandestine in nature and are just going to do what they want.

The point of the law, as always, isn't about some wishful thinking about those who would choose to violate the law. It applies to how we want to act within the law. Murder, rape, theft, fraud, are all illegal and yet still happen far too often. The point of having a clearly defined line is to let people know when they have crossed over it.

Re:A step in the right direction

[sumdumass]

Well, it is still fruit of the poison tree but is only known as such if someone is willing to admit that was how they found the information.

Parallel construction largely relies on a lie being in place. If at any time it is discovered that this other source or means was crafted due to the illegal connections, it can and likely would be toss out with it.

Re:A step in the right direction

[Frobnicator]

Well, it is still fruit of the poison tree but is only known as such if someone is willing to admit that was how they found the information.

Parallel construction largely relies on a lie being in place. If at any time it is discovered that this other source or means was crafted due to the illegal connections, it can and likely would be toss out with it.

One neat thing about this type of deception is that the bigger it grows, the harder it is to hide. One person can keep a secret. Two people struggle to keep a secret. Hundreds of people cannot keep a secret, there will be a media leak by with a citation as a "confidential source not authorized to talk to the media."

If that happened it would not be one case tossed. It would be at least one case tossed and thousands of other cases re-opened for investigation, and intense scrutiny and a nasty public relations backlash.

We had a situation in a local PD where a highly acclaimed officer was caught faking field sobriety tests, falsifying reports and even the discovery of dashcam video showing the tazering of a sober person while shouting at them. In addition to the officer losing their job and various awards, there were various convictions overturned, convictions expunged, and several settlements allegedly of a quarter million dollars each were issued.

When discovered the impact to the groups is huge.

Discovery of illegal wiretaps and illegal records and failure to disclose potentially exculpatory evidence? That's the kind of thing that gets mass terminations and prison time for officers.

Steve Irwin agrees

[JoeyRox]

Crikey!

Re:Jihad

[Coren22]

Perhaps it was modded down because it has nothing to do with stingray use by police?

Great

[clonehappy]

So the three-letter-agencies and the local yokels will have to just continue using parallel construction. Isn't it amazing how many detailed and accurate "anonymous tips" the police receive?

Re:Great

[NormalVisual]

It's usually a little more subtle than that. Once the evidence is discovered via illegal means, the information is forwarded on to the local law enforcement folks, who then might tail the suspect until they do something *provably* illegal (tail light out, improper lane change, loitering, etc.). Once they have an excuse to detain the suspect, they can use dogs (also questionable, IMO) or whatever other *actual, documented* means (as opposed to "theoretical" means) to get the evidence that will then stand up to scrutiny in court. I imagine it often happens that the arresting officers themselves aren't even let in on the secret by their bosses. They're just told to look for a specific person or make/model of car with this license plate number, and find a reason to pull it over.

Your basic premise is sound though - it's still nothing more than a near-bulletproof means of gaining evidence illegally and keeping the true means by which it was discovered from the court. Lies of omission are still lies.

Why use stingrays at all?

[hawguy]

Is there any information a stingray can collect that the cellular carriers don't also collect?

The stingray just seems like an end-run around getting a court order to subpoena the information from the carriers.

Re:Why use stingrays at all?

[AHuxley]

They get location, tech details about a call (unique ID numbers, traffic data), If needed voice prints, voice or message content, mapping or gov malware push down to allow a phone to be activated (live mic) or tracked.
"Turns Out Police Stingray Spy Tools Can Indeed Record Calls" (10.28.15)
http://www.wired.com/2015/10/s...
Why? Parallel construction. It gets around needing a warrant, taking to/entering details into any court system or having any telco database knowing who is been looked at.
Both court systems and telco databases can be seen by *many* different people as a sensitive case is been investigated.

Re:Why use stingrays at all?

[ShaunC]

Is there any information a stingray can collect that the cellular carriers don't also collect?

Yes, everyone else's information in addition to the hypothetical suspect's, with zero requirement for any semblance of probable cause.

The stingray just seems like an end-run around getting a court order to subpoena the information from the carriers.

Right, that's the whole point. The court would never grant a subpoena for information about "everyone who was in the area of Main St. and 4th Ave. on January the 9th," so they're subverting the court altogether.

FINALLY!

[tgrigsby]

Someone who gets it!

Without getting stupidly extremist ("Death to eavesdroppers"? Really?!), our law enforcement and judicial systems have gotten off into the weeds and need to be reminded that the spirit of the Constitutional amendments that grant privacy are designed to limit personal exposure down to only what is needed to investigate specific crimes committed by specific individuals. The idea of casting a wide net and picking up everyone doing anything wrong will always be attractive and based on the faulty logic that our judicial system is perfect in discerning proof of offense from misleading and incomplete evidence. The Constitution, on the other hand, assumes the judicial system is imperfect and must be held to a high standard that assumes imperfection.

Next step?

[tgrigsby]

Perhaps carriers should be forced, by law, to encrypt their traffic such that the police would necessarily be forced to ask for the keys to decrypt the calls from a specific phone?

Re:Next step?

[sumdumass]

Stingrays wouldn't suffer any setback in this light. They work by simulating a cell tower and it is very difficult to find out that you are not connected to a legitimate tower.

Either way, the handset would have to negotiate the encryption key in which they capture or just mimic, or it would have to be hard coded into the system in which they already mimic. The same people producing the stingrays are likely the same producing the cell towers. Even if they are not, they are designed so your handset will not know the difference.

Re:Next step?

[david_thornley]

3G and 4G require the network to identify itself. You either need the carrier private key or downgrade the link to 2G (what most stingray class devices do)

So I'm likely to know I'm on a Stingray. Do you think I could sort of wardrive to try to locate the device? Or should I just call a random friend and talk about it and say bad things about the FBI and law enforcement while on the line?

Re:Next step?

[sumdumass]

I've often thought about crap like that. Get a few burner phones, find a stingray and say we are moving two kilos of cocaine, the pot is in and we need to move a bale or something. Perhaps talk about someone selling explosives and going to pick them up at a specific time and location and wanting backup to watch your back. Then identifying myself as an older person driving a car which make and model and license matches that of the local judge or something. Perhaps the mayor's wife or family or something like that. Maybe even taping the burner phone under the bumper or something so they close in for the parallel construction in confidence.

I'm not sure if you could get into trouble for something like that. It would seem that if they wanted to bust you for something, they would either have to fabricate it or reveal their illegal wiretapping as the reason for arresting you.

Re:Next step?

[ShaunC]

So I'm likely to know I'm on a Stingray. Do you think I could sort of wardrive to try to locate the device?

Kinda. You can install AIMSICD on an Android phone; it displays a map of cell towers and alerts you when the presence of a stingray is likely. An icon in the phone's status bar will change from green, to yellow, to orange, to red indicating the threat level. I've seen a couple of yellows, which means something weird is going on with tower IDs, but isn't necessarily dangerous. If you got an orange or red icon you could pull up the tower map, find the dot, and drive towards it (or very fast away from it!).

FBI to Judge Johnston

[Anonymous Coward]

"We don't use stingrays. Prove to us that we do. Neither ownership nor signing out a stingray constitutes proof. Should you be able to prove it we will issue an NSL and shut you down based upon National Security considerations. Also we have the President, Administration, CIA, NSA and Homeland Security on our side."

Problem solved!

Wow, did a troll just get +5

[rsilvergun]

Seriously. We're not talking about the CIA here. You want to build a Stingray? There are plans online. It's not hard. If I was a crook I'd say let 'em use one against me in the way you're suggesting. Without a court order it gets thrown out. If you want to stop worrying about the rest of the bad guys out there then go have a look at what Bernie Sanders is doing...