FBI's Smartphone Surveillance Tool Explained In Court Battle 168
concealment writes with news that a court battle has brought to light details on how the FBI's "stingray" surveillance tool works, and how they used it with Verizon's help to collect evidence about an alleged identity thief. Quoting:
"Air cards are devices that plug into a computer and use the wireless cellular networks of phone providers to connect the computer to the internet. The devices are not phones and therefore don’t have the ability to receive incoming calls, but in this case Rigmaiden asserts that Verizon reconfigured his air card to respond to surreptitious voice calls from a landline controlled by the FBI. The FBI calls, which contacted the air card silently in the background, operated as pings to force the air card into revealing its location. In order to do this, Verizon reprogrammed the device so that when an incoming voice call arrived, the card would disconnect from any legitimate cell tower to which it was already connected, and send real-time cell-site location data to Verizon, which forwarded the data to the FBI. This allowed the FBI to position its stingray in the neighborhood where Rigmaiden resided. The stingray then "broadcast a very strong signal" to force the air card into connecting to it, instead of reconnecting to a legitimate cell tower, so that agents could then triangulate signals coming from the air card and zoom-in on Rigmaiden’s location. To make sure the air card connected to the FBI’s simulator, Rigmaiden says that Verizon altered his air card’s Preferred Roaming List so that it would accept the FBI’s stingray as a legitimate cell site and not a rogue site, and also changed a data table on the air card designating the priority of cell sites so that the FBI’s fake site was at the top of the list."
Weak hack. (Score:5, Interesting)
Chris Paget was able to demo similar behavior at DEFCON 18, and he sure didn't need Verizon's help to do so.
Pretty sure the FCC wanted to bust him on stage, actually.
Re:Weak hack. (Score:5, Informative)
That's because he spoofed a GSM tower. You'll find that doing the same with CDMA is impossible without Verizon's help - see the bit about reprogramming the phone's roaming list in order to make the phone accept the spoofed tower.
Re: (Score:3)
More answers than you probably want:
http://www.scribd.com/doc/22599374/Security-Encryption-in-GSM-GPRS-CDMA [scribd.com]
And note that no traffic was intercepted in the FBI's operation... all they attained, with the carrier's help*, was an identification of the target's device on the network, which they then pinged in order to triangulate its location. Chris Paget's cell site spoofing blows GSM wide open; nothing remotely similar has happened in the CDMA world.
*(which also required that the carrier remotely reprogram the
Re: (Score:2)
Chris Paget was able to demo similar behavior at DEFCON 18, and he sure didn't need Verizon's help to do so.
That's a horse-shit comparison. Chris Paget isn't a career investigator who's knowledge of computers is limited to right-clicking, double-clicking, and e-mails. You can't judge a fish based on its ability to ride a bicycle. Of course the FBI wants Verizon's help! For two reasons: One, Verizon already has the expertise, and two, it's their shit. How would it look if Gumshoe Freddy tried to hack a cell phone tower and crapped an entire communities' access? 911 calls that go nowhere, customer service lines jam
Re:Weak hack. (Score:4, Informative)
How would it look if Gumshoe Freddy tried to hack a cell phone tower and crapped an entire communities' access? 911 calls that go nowhere, customer service lines jammed, people stranded because their GPS glitched out...
If Gumshoe Freddy was able to hack a cellphone tower and cause somone's GPS to "glitch out", I'd say Gumshoe Freddy was a remarkably skilled hacker. GPS and cellphones use entirely different sets of frequencies, and I doubt that you could coerce a cellphone tower into transmitting on a GPS frequency no matter how good you are at it. Maybe those cell transmitters have a DDS system that can go where the GPS lives, but I doubt the amps or combiners would pass the signal. They kinda have to be selective enough so that the transmitted signal doesn't block the received one, so transmitting out of band is not going to be highly efficient if possible at all.
For what? I can walk into a cell phone store and get a cell phone "mini cell" to put in my house to help with reception. FCC approved. I don't need a license to do that. Unless he's causing harmful interference to a licensed broadcaster and the broadcaster reports it, the FCC isn't going to do anything.
You can buy a type certificated cell phone mini cell because the cell phone companies have agreed to allow it and the FCC has created a specification for what they can do and manufacturers have to meet that spec. They aren't just deciding on their own say so that they can do this.
You don't have to be causing interference to a licensed broadcaster before the FCC cares, all you have to be doing is causing interference. True, most cases come to the attention of the FCC because the licensee complains, but the FCC can act without a complaint. You don't think Verizon or any of the other cell phone companies would complain about someone creating interference publicly?
The FCC is an administrative government entity. It is not really law enforcement in any meaningful sense.
That would be news to the FCC Enforcement Bureau [fcc.gov], and the people to whom they've issued notices of apparent liability and levied fines.
Re: (Score:3)
>GPS and cellphones use entirely different sets of frequencies, and I doubt that you could coerce a cellphone tower into transmitting on a GPS frequency
To be fair, there is aGPS (assisted GPS) which uses timing signals sent from cell towers for triangulation instead of/in addition to GPS satellites.
Re: (Score:2)
It's a misunderstanding. Nominally, aGPS is the use of ALMANAC and EPHEMERIS data obtained from the network, and not from the navigation signal itself. It speeds the acquisition - and nothing more. At least, U-blox dox say so. Unfortunately, I heard that some GPS chipsets have aGPS ONLY and have NO GPS data channel. The test is simple: Ensure that your smartphone can show your position while the network is absent.
Full disclosure: I am NOT a GPS specialist (GPS specialists sit in a neighboring lab).
And BTW:
Supply Chain Attack (Score:5, Informative)
Re: (Score:3, Interesting)
Re:Supply Chain Attack (Score:5, Interesting)
Screw PCs- how many people have a Microsoft XBox Kinect in their living rooms, complete with camera? You mean to tell me that Microsoft, at the perfectly legal (ie: rubber-stamped) request of the government, couldn't push an update that allows them to turn the Kinect cameras on at will??
Re: (Score:2)
Screw PCs- how many people have a Microsoft XBox Kinect in their living rooms, complete with camera? You mean to tell me that Microsoft, at the perfectly legal (ie: rubber-stamped) request of the government, couldn't push an update that allows them to turn the Kinect cameras on at will??
that's not really a problem of ms being bad - it's a problem of having auto updates combined with a government that just doesn't care for rules, like this case. what's the use of arguing they shouldn't have been doing it when they're in other cases putting pipebomb looking devices to random dudes cars to follow them??
now why did they spend such a large effort to triangulate this person, who they knew where he lived seemingly etc? fbi suddenly cares about identity theft now?(I guess the alleged 4 million tax
Re: (Score:2)
Re:Supply Chain Attack (Score:4, Funny)
Re: (Score:2)
Perhaps it should face a printout of goatse.cx. If they're going to break the law, let them suffer the consequences.
Re: (Score:2)
Re: (Score:3)
Re: (Score:3, Insightful)
So you're saying we should all run FSF approved operating systems?
Even then, unless you intend to audit several billion lines of code of a variety of packages, and understand it well enough to discover flaws that give a 3rd party control over you or your information, you're still trusting someone else that it's safe.
Re: (Score:2)
Or ... you are trusting that at least someone in the community that spends their free time reading through arbitrary open source code will find any exploits and notify the world before your PC or phone is owned by someone else.
Re: (Score:2)
What if Canonical or Red Hat Inc, or even a package maintainer is forced to include a patched package by the FBI/government without disclosing it? In those companies probably won't go so far, not enough people in those ecosystems are tied with NDAs to avoid leaking in a way or another that it happened pretty soon.
What about the kernel or drivers, specially the dark parts like binary blobs or closed drivers? Some are just dissapearing (nvidia is releasing some of the drivers with open source, and the nouvea
Ok..So verizon has shown they cant be trusted.. (Score:5, Insightful)
Issuing a custom radio firmware for a data only device, so that it responds to a telephone network signal demonstrates that verizon is willing to place nonstandard firmware on devices on their network, for the express purposes of aiding investigations that lack proper warrants.
This is a very bad thing Verizon. A Very Bad Thing.
Don't underestimate the impact that losing public confidence can have on your business. Being so self-conceited as to feel that you don't have to worry because you have cornered the market would only add fuel to the fire.
Plan you PR damage control messages carefully. Smile, you're on candid camera.
Re:Ok..So verizon has shown they cant be trusted.. (Score:5, Interesting)
I don't think Verizon is going to be too upset that publicity that they helped the FBI catch an identify thief in an apartment under one of the assumed names he was identity stealing....
Besides Verizon works with the military and has most of the government contracts. They've been pretty clear they are going to extra cooperative with the government for many years.
Re: (Score:3)
Who was also making the #1 mistake, Cracking from home.
Re: (Score:2)
Re: (Score:2)
The government continues to operate with the full consent of its subjects. Accept it
Exactly. And in this particular case, the laws against identity theft, I'm sure the level of support is incredibly high.
Re: (Score:2)
Not really. Governments can and should rely on the cooperation of the their community for law enforcement. Verizon's cooperation is part of the broader notion of community support for the laws we are governed by. Having individuals, or in the case corporate persons, stand up and assist the police in enforcing the laws is a very good thing. The opposite where the laws were so broadly disliked that the community didn't support them and wouldn't help the police I'd consider much more dangerous and damaging
Re:Ok..So verizon has shown they cant be trusted.. (Score:5, Informative)
FBI got a warrant and verizon helped catch a suspected scumbag
what's the problem here?
Re:Ok..So verizon has shown they cant be trusted.. (Score:5, Insightful)
"The trouble with fighting for human freedom is that one spends most of one's time defending scoundrels. For it is against scoundrels that oppressive laws are first aimed, and oppression must be stopped at the beginning if it is to be stopped at all."
H. L. Mencken
Re: (Score:3)
"The trouble with fighting for human freedom is that one spends most of one's time defending scoundrels."
Lenny Bruce was a scoundrel. Larry Flynt was scoundrel. They deserved to be defended. This guy is just a common thief. As long as the FBI has a warrant (it isn't clear that they did), then I don't see the issue here. He deserves a fair trial, but stealing from other people is not a "human freedom", and none of his actions are defensible.
Re:Ok..So verizon has shown they cant be trusted.. (Score:5, Informative)
A court order is not a warrant, and the judge who issued that court order may not have been fully informed. FTFA:
Re: (Score:2)
the paragraph before that one said they got a warrant
Re:Ok..So verizon has shown they cant be trusted.. (Score:4, Informative)
Reading comprehension fail.
The FBI agreed that it *needed* a warranted (eg, that what they were doing with the stingray needed one), but said that what verizon did for them was authorized by a court order, and did not need one.
This does not say that they in fact obtained such warrant, which they did not.
Re: (Score:3)
go read the linked articles
the FBI had multiple court orders and warrants. the perp is saying that the wording of their warrant did not allow the use of a stingray device
rule #1 of criminal law. if you can't fight the evidence then fight to have it excluded from the case. they already had lots of other evidence that he was a scumbag and were only trying to figure out who he was and where he lived
Re: (Score:2)
And it would appear that many other organizations, and even this court judge are either in agreement with that position, or are willing to consider that position's legitimacy, which is why this case has not been dismissed.
Like all things, the devil's in the details.
Re: (Score:2)
Warrants have to be specific as to the place to be searched. If they didn't have a warrant to do this, oh well.
Re: (Score:2)
technically, they weren't searching his home or vehicle, they were simply trying to triangulate his location to make an arrest based on other evidence already collected
Re: (Score:2)
"A court order is not a warrant,"
In fact, a warrant is a court order signed and issued by a judge via the District Attorney's office.
Try again. This isn't the '50s.
Re: (Score:2)
Re: (Score:2)
Not for another 37 years...
Re: (Score:2)
A warrant is a court order, but a court order is not necessarily a warrant. Somewhere, your elementary school math teacher is facepalming.
Nobody read last week? The judge is PISSED (Score:2)
Did nobody in this thread read about this when it was posted on Slashdot a week or two ago? Everybody is wondering about whether or not they got a warrant, etc. and that was all thoroughly covered last time. The FBI claimed this was covered under an order telling Verizon to provide technical assistance locating the card. The judge who signed that order is pissed, saying it did NOT authorize the FBI to do ANYTHING, and especially it did not authorize them to use a Stingray. The judge's colleagues agree
Re: (Score:3)
I was under the impression that verizon complied with the FBI request in "rubber stamp" fashion, and not due to a warrant. (Which was why their use of the stingray had caused judges to get stingy when discovered.)
Pushing firmware to devices without permission/authorization from the downstream user can count as vandalism, if the device is not subsidized by verizon, and is the user's personal property. I don't use verizon, so this does not really impact me except as being a chilling effect, as other provider
Re: (Score:2)
A warrant has to be issued, it has to be specific in what is to be taken, and specific in the place, time, and person of interest investigated.
That's the interesting thing about this case. It's not just a thing to be taken, but they performed active malicious operation of the suspect's own data card. And it's hard to exactly name an identity thief, when his true identity was one of the facts they were trying to ascertain.
I suspect the ruling will be narrowly focused on some detail of this specific case and won't answer the broad question of whether or not all Stingray use needs a warrant.
Re: (Score:2)
"The above 3 posts fail to take into account that all persons of interest are innocent until proven guilty in a court of law"
You must not have been paying attention to the system for the last decade+.
Slip down your law and order slope, citizen (Score:5, Funny)
"When they came for the scumbags, I did not speak out, for I was not a scumbag..."
Re: (Score:2)
what's the problem here?
Alleged 4th amendment viloation [engadget.com]
Re: (Score:2)
lazy troll is lazy.
warrant was not legitimate, search was violation of 4th amendment.
when/how is that ever not a problem?
Re: (Score:2)
lazy troll is lazy.
warrant was not legitimate, search was violation of 4th amendment.
when/how is that ever not a problem?
Got any proof of that?
Re: (Score:2)
did you read a single claim in the case? This is literally the argument made by both the EFF and the defendant. RTFA.
Re: (Score:2)
Depending on how the warrant was written... It sounds like it was an "order" to assist the FBI in finding the offender with a specific device they identified as used for criminal activity.
As VERIZON OWNS the towers and the FIRMWARE they modified. It need to be a "warrant" because they were not "following the whereabouts" around town, but trying to pick out where he was staying.
A WARRANT requires that they KNOW who you are and can identify a place to search. In this case they had no PLACE. This is like track
Re: (Score:2)
An example of the same thing would be YOU activating "Find my iPhone" remotely after somebody took your stuff... But you didn't know WHO. YOU would be activating a big that is not normally active but on YOUR PROPERTY. The AirCard was fraudulently purchased, therefore "Verizon" was the grieved party acting as the owner of the network the card was illegally operating on.
Re: (Score:2)
This does not follow. Drop in replacement time:
We have a crook with an "illegally activated" laptop. Maybe he registered the serial number under a false name, whatever. The physical device is owned by the person of interest, and not the ISP, nor the OS maker.
The FBI tasks the ISP of the PoI to install a network worm that alter's the laptop's normal operation, so that they can track its access, and thus locate it.
They do so.
In doing so, they have vandalized that person's private property (the laptop) by ill
Re:Ok..So verizon has shown they cant be trusted.. (Score:4, Insightful)
But the perp in question was an identity thief who had activated the device in the victim's name. In this case, the victim technically 'owns' the service/device, right? How can you claim that the FBI/Verizon violated the thief's 'private property' when it was fraudulently bought/activated in the victim's name?
If the victim gives permission for the FBI/VZW to track the device that's in his/her name, that's good enough for me. If someone stole my identity to activate service, I'd be begging for them to track the fucker down. After all, I'm the legal account holder, whether I like it or not.
You say that 'Verizon does not own the aircard' but neither does the identity thief, dammit! The victim does!
Re: (Score:2)
Repeat after me:
Activation does not make me the owner.
Providing service to another does not make me the owner.
PAYING MONEY IN EXCHANGE FOR A PRODUCT MAKES ME AN OWNER.
What does this mean?
"Somebody activated a cellphone with my identity! Nevermind they paid cash for the phone, and have a reciept! The are using my identity and good name/credit to get service they would otherwise be denied!"
Does this person own *THE PHONE* being serviced?
NO! THEY DON'T! The identity thief paid cash! The theif owns the phone le
Re: (Score:2)
(It can be argued that if the device was not paid for up front, then the identity theft victim owns the handset, having had money exchanged for it. In which case, Verizon should have asked the victim if they wanted to keep the device after being collected [arresting the perp], or if they just want reimbursement. If the victim says the want to keep it, then Verizon needs to ask the legal owner of the device if they can install the firmware. If they say they want reimbursement, then Verizon can do whatever th
Re: (Score:2)
Except ACCESSING Verizon's network requires agreeing to a TOS that among other things GRANTS THEM PERMISSION to install whatever baseband updates are necessary to work with their network. The suspect was accessing their network via payments from stolen credit cards.. So Verizion had no obligation to even turn the device on. If Verizon wishes to track a stolen device that has "clicked thru" to access THEIR PROPERY they have no legal problems doing so.
Even the whole "transmitting from the location" argument d
Re: (Score:2)
I steal your identity.
I walk into a car dealership, and use your credit rating to walk way with a fancy new car. I pay a down payment in cash, and the rest is billed... to you.
You'd be furious that I stole your identity to buy a car. You'd call the cops. Let's say it turns out that the car has OnStar built in, and that the cops can give a simple court order to OnStar and then OnStar will pass along the vehicle's location.
Wow, this would be an easy and great way to catch a fucking thief!
Too bad... by your st
Re: (Score:2)
How is this any different from the use of a GPS tracking device attached to someone's car. The Supremes decided that GPS tracking devices need warrants. [usatoday.com] They even suggested in that ruling that warrants would be required to tracka smartphone.
Re: (Score:2)
Attaching a GPS device to person's owned car requires a warrant.
Does attaching a GPS device to a stolen car require a warrant? What if the legitimate owner of the car agrees to the tracker.
That's more the situation here. Suppose the legitimate owner activated a GPS on his own car and reported it to the authorities.
Is there a right for a person to be secure in somebody else's houses, papers and effects?
Re: (Score:2)
They didn't get a warrant. They got a court order, which isn't something that requires demonstration of probable cause.
Re: (Score:2)
Most court orders aren't issued without some probable cause.
Example: The court order for me to report for a felony trial (aka a warrant for my arrest) was issued because my IP tied directly to the IP which sent out an e-mail, with my headers and info.
There's plenty of means to find probable cause. Your definition might differ from others with higher or lower logical skills.
Re:Ok..So verizon has shown they cant be trusted.. (Score:4, Insightful)
While I really agree with what you are saying... The market has not demonstrated that it cares about this type of behavior. Joe Six Pack continues to pile on more and more devices onto the Verizon network without a second thought to privacy. If you think I'm wrong look at the 6-strike rule in their Internet business... This hasn't hurt them one bit.
The average person simply doesn't understand the behinds the scenes technology well enough to care.
Re: (Score:2)
The average person simply doesn't understand the behinds the scenes technology well enough to care.
The average person doesn't need to understand the technology to care. The problem is that very often the average person doesn't understand why they should care.
The second problem is that even when you do care, what does the average person have in the way of alternatives?
Re: (Score:2)
Re: (Score:3)
But the flip side is that their network is secure enough VERIZON has to have their engineers actually write a patch for police to use. So while they have low standards for cooperating, it seems like it is a lot of work for Verison to do... EXPENSIVE work police won't want to use too often.
technology vs law (Score:3, Insightful)
Ok, so this is a guy who does identity fraud.
I'm not crying for him
He's lucky to even have access to due process as far as I'm concerned However, that your very own devices can be used against you in such ways, which means that the trust you have in your provider is broken, seems unethical.
If the FBI and/or other agencies require such abilities, perhaps then, companies such as Verizon should place this in their contracts something like "authorities can use your devices to track you and/or use your data for any of their investigations as they see fit".
Transparency would be nice.
All I know is that, I've got nothing to hide, so I don't care, but, for those who do, they may have to switch to another provider....
Re: (Score:2, Insightful)
Then you, sir, deserve to be dragged off in the night and charged without due process.
Everybody deserves due process, or you cease to be a free society. And the "you have nothing to fear if you have nothing to hide" is the lament of cowards and fascists.
Fuck you you worthless sack of shit. You're part of the problem of tacitly accepting it as okay when your government brea
Re: (Score:2)
All I know is that, I've got nothing to hide, so I don't care, but, for those who do, they may have to switch to another provider....
And what happens when it becomes a felony to possess $100 bill, or to take 4 pain killers when the bottle says 2, .. speeding over 5 mph ..
not taking reusable bags to the grocery store
In this day and age .. no telling what will be the next big federal crime... streaming copyrighted video from a site not owned by the copyright holder comes to mind.
Re: (Score:2)
What happens is simple. It's all about consent of the governed and common sense. [wikipedia.org]
Re: (Score:2)
Re: (Score:2)
Your list of potential crimes is insanely stupid and completely unrealistic. What next? Are you going to outlaw all sodas sold in cups 17 oz or larger? That will be the day.
That was the point .. the vastly increasing number of laws, rules, regulations and policies for which the American public is willing to surrender their constitutional rights. Yes, some sanity prevailed in the NYC case, but not common sense. The NYC ban was struck down because the judge decided it was unfair to say certain merchants couldn't sell 17+ oz sodas, but someone next door could because they were classified differently.
It all boils down to the rapidly disappearing concept of common sense. Eve
Re: (Score:2)
Re: (Score:2)
If the FBI and/or other agencies require such abilities, perhaps then, companies such as Verizon should place this in their contracts something like "authorities can use your devices to track you and/or use your data for any of their investigations as they see fit".
I'm going to go out on a limb here and say you haven't read your agreement.
Re: (Score:2)
I'd like to see transparency too, but it doesn't really matter. The FISA Revisions Act of 2007 basically shredded any privacy agreements we might have with the telecom companies and absolved them of any legal responsibility for protecting their customers' information.
The feds didn't want any details of their blatantly illegal and unConstitutional warrantless surveillance program leaking out.
Therefore, they came along and granted all the telecom providers complete immunity from civil suits or any criminal i
Re: (Score:2)
> companies such as Verizon should place this in their contracts something like "authorities can use your devices to track you and/or use your data for any of their investigations as they see fit".
It's not that simple. Many posters here are missing the point that this guy stole someone else's identity to establish his Verizon account.
-They probably first contacted the person who was the 'real' accountholder (the identity theft victim).
-That victim says, 'Some stole my ID? Track the fucker!' to bo
Felonies even if the FBI did'em (Score:2)
... 'scuse me, but I see "unauthorized access to a computing system" and "theft of service" all over here. A badge should not be a free pass to commit crimes.
The fibbies might well have a warrent that would allow searching the machine, and a different one that would allow monitoring electronic conversations. But that is not the same as planting malware that creates transmissions. Not that the FBI transgressions are likely to be presented to a Grand Jury.
The interesting thing is this is a criminal trial w
Re: (Score:2)
... 'scuse me, but I see "unauthorized access to a computing system" and "theft of service" all over here. A badge should not be a free pass to commit crimes.
So the police can't come on to your property to arrest you, because that would be trespass. Go out, kill, rob, maim, and race home. If they don't restrain you before you reach your property, you are safe indefinitely.
No, that's not how it works.
Re: (Score:2)
Do not kid yourselves, the police skate close to felonies. The more conscious amongst them are well aware of this and appropriately cautious.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Based on the statements related above about the judge insisting that the order did not authorize this, this does seem like Verizon and the FBI committed offenses here, probably felony unauthorized access to a computing system and others. Regardless of the outcome of this case, if it were me I would file civil and criminal charges.
Re: (Score:2)
Look, the guy had activated the aircard under a stolen ID.
Let's say someone steals your ID and uses it to buy a new Escalade at the dealership (and then skip out on the payments, leaving you with the credit hit).
Let's now assume that the Escalade came with OnStar built in.
Now let's say that in search of this criminal - almost certainly with the ID theft victim's consent, not that it matters really, as there are two victims of the stolen property here, the dealership AND the ID victim - LEO gets a court orde
One has to wonder if Verizon's routers and STBs (Score:2)
...aren't also targets for reprogramming and surveillance.
Um all sorts of AirCards, USB 3G dongles, etc (Score:3)
Um all sorts of AirCards, USB 3G dongles, etc can be made to make and recieve calls.
All the Huwaei 3G usb modems that are sold by telco's here in Aus/NZ i've managed to get to make and recieve calls. (Yeah you need to use a USB headset or something, but you already do for skype and voip.)
Is there any point to it? I don't know, but you can.
Just like most tablets can be made to make/receive phone calls even though they aren't considered phones by the law.
Re: (Score:2)
I had an old Sierra Wireless aircard (PCMCIA form factor) some years ago that actually had a headphone jack on the aircard itself, and you used the 'dialer' software to initiate a call.
Re:Holy crap ... (Score:4, Informative)
That's one of the issues in this case. A Stingray is not discriminating and could impact other cellular devices. The FBI also claims they "throw away" all data that is not pertinent to their investigation, meaning there is no way to determine what they did or did not see regarding other people's communications. (Kind of a damned if you do, damned if you don't situation.)
There is also the difference between wiretaps and pen trace registers. Wiretaps require a warrant, but pen traces don't. The Stingray doesn't record the call or data contents, so it could be claimed to be more like a pen trace. But a Stingray is actively pinging the target's machine to generate data to be used against the owner, which is a completely different use (abuse?) of the technology.
Anything like this would be perfectly legal with a warrant. The real question is if this is legal without one.
Re: (Score:2)
Clarification: in this case they had a "court order signed by a magistrate". I don't know how that differs from a "warrant", but it does sound like an appropriate level of judicial oversight, and that this was not just a rogue agent fishing for tax evaders.
Re: (Score:2)
Well, except that:
They didn't have the appropriate level of oversight, they
Re: (Score:2)
Re:Holy crap ... (Score:5, Insightful)
It's a little more complicated than that.
It seems Verizon pushed an update to his specific wireless card. This update allowed it to receive phone calls, thus allowing them to "ping" him in particular. It also set the preferred tower list so that the stingray would always be connected to first.
The fun thing is that by modifying his wireless card, the FBI has "planted" a tracker on him. That requires a warrant. If this guy was such a big deal, then it shouldn't have been hard to get the warrant. The problem is the FBI didn't want anyone, even the judges, to know what cards they held. So even when they got there court order, it wasn't a warrant, and they misled the judge who issued the order. That's a big no no.
Re: (Score:3)
Got it, thanks. I missed equating the change to his card as "planting a tracking device", which makes total sense, at least to me. So now, it's up to the court to decide if the law sees those as equivalent activities, requiring equivalent oversight.
Oh well. Better to let 100 scoundrels roam free than to wrongly imprison one man.
Re: (Score:2)
That's one of the issues in this case. A Stingray is not discriminating and could impact other cellular devices. The FBI also claims they "throw away" all data that is not pertinent to their investigation, meaning there is no way to determine what they did or did not see regarding other people's communications. (Kind of a damned if you do, damned if you don't situation.)
From what I've read on the issue, the stringray only works if the targeted phone's PRL has been modified to accept the stingray as a "friendly" tower. On or off, unmodified phones aren't going to connect to the stingray, seeing it as a rogue device.
I'm not saying there isn't anything to be concerned about here, just saying that you're focusing on the wrong (and incorrect from what I'm reading) issue. In these circumstances, the stingray appears useless without the service provider's complicity in both traci
Re: (Score:2)
That was the beauty of Paget's hack. He used one of the non-domestic cell frequency bands to attack quad-band cell phones (using the ISM band at 900MHz.) Because the phone decided it was roaming, and didn't care about the network ID being set to zero, the phone believed whatever the fake tower told it. The other thing he needed was to send a tower signal that claimed it was getting perfect reception from the subscriber device, so the phone would prefer it above the real towers. No PRL change needed. He also
Re: (Score:2)
I'm not so sure about some of that.
I watched the video: https://www.youtube.com/watch?feature=player_detailpage&v=DU8hg4FTm0g#t=1314s [youtube.com] and didn't see anything on preventing rogue base stations for GSM. Of course, Verizon uses a CDMA network, so they may have extra precautions.
The part about using the 900MHz band didn't have anything to do with roaming. It had to do with legality. The frequency he's using is a ham radio frequency, and he's complying with FCC regs. https://www.youtube.com/watch?featur [youtube.com]
Re: (Score:2)
Re: (Score:2)
You have to realize that we are now living in an era when the law is WHATEVER the FBI/TSA and all of the other multitude of three-letter-acronymed agencies SAY it is.. I've given up hope that sanity and Consitutional freedom will return to America anytime soon.. I'm thankful I'm not a kid anymore having to live in what is quickly becoming what the old soviet union was..
FTFY (Score:2)
If the FBI's looking for you and gets the proper documentation, then it is legal. full stop
Whether things are fine, or whether you do or don't have something you would like to hide, it becomes irrelevant to the discussion.
Re: (Score:2)
If the FBI's looking for you and gets the proper documentation, then it is legal. full stop
For sufficient levels of proper documentation. I'm not convinced that today's warrants are given a sufficient amount of scrutiny. Without oversight, all human processes have a tendency to degrade.
If someone were given a task to perform, and there are no consequences if the task is not performed, it won't be long before the task sits uncompleted.
If the penalties for underperforming are less severe than the additional
Re: (Score:2)
Exactly. Government employees are never held responsible for their under-performance or even their criminal activities. Warrantless wiretapping was a clear violation of the FISA law with both civil and criminal penalties, but nobody is held responsible. ATF smuggles guns to the Mexican cartels, they do an internal investigation and nothing happens. The OTS, SEC and FDIC have clearly defined obligations (the agency SHALL ....) to regulate banks, but they ignore those obligations. Their failures result
Re: (Score:2)
Nobody is disputing the facts of the case. The questions are if the legal protections were adequate in this case, or if the FBI should have done something more.
And the card wasn't "reprogrammed", at least not in the sense of sending an actual new program to it. An artificial list of cell tower IDs was sent to it, prominently featuring the fake tower ID as top priority. This duped his card into always trying to connect to the FBI's Stingray.
It was "reprogrammed" in the same sense that your grandmother equate
Re: (Score:2)
Well, then go with "reconfigured" instead of getting mired in the definition of "programmed".
The end result was they broadcast something which caused his card to report his whereabouts, and gets into the realm of things that the FBI + Verizon may or may not be able to do without some proper authorization.