The Bad Sort of Stringray

There’s the fish. There’s the car. And then there’s the Stingray that few know about, the type in the hands of law enforcement who have a yearning to know where you are and what you’re up to.  New to you? Mike Masnick at  Techdirt explains:


Back in 2011, the WSJ broke a huge story about the frequent use by government officials of a technique for mobile device surveillance generically called “stingray” devices (technically, there are a few products used for this, only some of which are actually called Stingrays, but the name is now used to refer to all of them). The device works by pretending to be a mobile phone tower, so devices can connect to it, and law enforcement gets all your data. It’s basically a cellular man-in-the-middle attack, with law enforcement being that man in the middle. Yay.
As is often the case, the government has been quietly enjoying the advantage of having a stingray or two in its arsenal without the public being aware or attuned to yet another means to thwart privacy.  This advantage extended to the courts, where the government is occasionally compelled to mention what it’s up to for the purpose of getting a warrant, but without giving too much actual information away.

Masnick writes about the case of Daniel Rigmaiden, who wanted to know how the government tracked him down.  When the response finally came and revealed the stingray, the government explained that it had been approved.  The judge found this curious.


In that case, we noted that law enforcement claimed it had a court order to use the technology, but the judge was confused, asking where were the warrants for the use of the device. The judge asked how it was possible that a court order or warrant was issued without the judge ever being told about the technology used in surveillance and was told, simply, “it was a standard practice.”
In other words, somebody signed off on what the government claimed to be “standard practice,” but which was in reality the use of a stingray, except the government never mentioned that piddling detail to the court.

So did the government lie?  Well, not exactly, as the ACLU found out. In fact, it was indeed standard practice to artfully dodge the details and obfuscate what they were doing.



The ACLU filed a bunch of FOIA (Freedom of Information Act) requests to dig into this and newly released documents show that, indeed, it was apparently standard practice by the DOJ to be “less than explicit” and less than “forthright” with judges in seeking warrants and court orders to make use of this technology. Here’s an email that was revealed:
As some of you may be aware, our office has been working closely with the magistrate judges in an effort to address their collective concerns regarding whether a pen register is sufficient to authorize the use of law enforcement’s WIT technology (a box that simulates a cell tower and can be placed inside a van to help pinpoint an individual’s location with some specificity) to locate an individual. It has recently come to my attention that many agents are still using WIT technology in the field although the pen register application does not make that explicit.

While we continue work on a long term fix for this problem, it is important that we are consistent and forthright in our pen register requests to the magistrates…
The naïve among us will react to this by saying, “wow, they’re going to be in big trouble with those judges now!”  Seriously?  Have you ever read through warrant applications?  Few documents are crafted so artfully as to convey an impression while actually saying nothing.  Try pinning the government down on detail, on factual errors, on lies, on outright fabrication, after the fact, when litigating the propriety of the warrant application on the basis of the judge having been misled into believing that probable cause existed.

Warrant applications read like bad pulp fiction, leading the reader to get the distinct impression that they say something, and what they say is pretty bad, but if you try to parse the actual language, the precise words used, you find that there is precious little of substance behind it. 

Vague references to standard law enforcement techniques combined with boilerplate provisos, equivocation and qualification make up the bulk of the application. But when it comes to the specifics, the words wiggle more than strawberry jello. 

What happened here is that the judge was left hanging, the government making the court look a bit foolish for not knowing what the secret code word was when what they meant to say was “stingray.”  But if they told the judge, then the defendant would know too. Can’t have that.

What makes the government’s concession here interesting is that it went so far as to admit it was being “less than explicit” in obtaining court approval of its use of the stingray.  Count how many head rolled as a result. That’s right. None. But we take our government admissions of wrongdoing where we find them, even if the most to be gained is the schadenfruede of having the government forced to concede it fell shy of perfection.

Why, though, would I suggest that this won’t result in some judge, somewhere, taking some serious action against the government?  This:


As the ACLU notes, this email was written three years after the Rigmaiden situation happened — suggesting that the DOJ has been getting away with this sort of thing for many years, without anyone digging in. The ACLU is now arguing that this should be a reason to suppress the evidence obtained via these devices, and will ask the court to “send a clear message” that it cannot hide the truth from federal judges in seeking rubber stamps to violate the privacy of the public.
Three years later and you still don’t know about stingray.  It’s been going on for a while, and warrants still get signed, people still get intercepted, courts still get fooled and not a single head has rolled.  The ACLU seeks suppression to “send a clear message,” but the clear message is already being sent.  As much as judges don’t like being made to look foolish, warrants will still get signed, privacy will still be invaded and evidence will still be admitted.  Because that is standard procedure, at least with this sort of stingray.







One comment on “The Bad Sort of Stringray

  1. Shawn McManus

    I know I’ve mentioned this before (and on SJ, too) but have to repeat it:

    Cellular phones are as secure as smoke signals. If you’re fine with everyone seeing your smoke, dial away.

Comments are closed.