Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
Check out the new SourceForge HTML5 internet speed test! No Flash necessary and runs on all devices. ×
Privacy Cellphones Communications

Baltimore Police Used Stingrays For Phone Tracking Over 25,000 Times 83

An anonymous reader writes The Baltimore Police Department is starting to come clean about its use of cell-phone signal interceptors — commonly known as Stingrays — and the numbers are alarming. According to recent court testimony reported by The Baltimore Sun, the city's police have used Stingray devices with a court order more than 25,000 times. It's a massive number, representing an average of nearly nine uses a day for eight years (the BPD acquired the technology in 2007), and it doesn't include any emergency uses of the device, which would have proceeded without a court order.
This discussion has been archived. No new comments can be posted.

Baltimore Police Used Stingrays For Phone Tracking Over 25,000 Times

Comments Filter:
  • Loose procedures (Score:5, Insightful)

    by wvmarle ( 1070040 ) on Tuesday April 21, 2015 @12:17AM (#49517091)

    It sounds to me like not only the police is wrong by applying for too many uses of the device (of course they do - it's their job to gather as much information about potential criminals as possible), also the courts appear to be wrong by not doing much evaluation of the requests. Now having to handle nine requests a day is a huge number as well (that's before accounting for holidays and weekends), yet no excuse for not following proper procedures.

    From the face of it, the courts should be more strict. Take more time to properly evaluate each one, possibly causing a backlog, but that in turn should force the police to lower their number of requests to only the ones they believe are valid - and arguably the courts should be hiring more people to get the work done in a timely manner.

    • by TWX ( 665546 ) on Tuesday April 21, 2015 @01:12AM (#49517239)
      I don't think that regular rank-and-file police should be in the business of intercepting cell phone traffic in the first place. They should have to submit warrants to the carriers and those carriers should present them with only the data that the warrant calls for.

      A pipe dream, I know, but what the hey.
      • To me it is (or at least, should be) the modern equivalent of a wire tap where police investigators are listening in to someone's phone line.

        For that reason it should come with the same set of checks and balances: a court warrant required (with maybe an exception for "emergency cases" which will have to be defined really well), and the requirement that only the phone for which the warrant is given can be listened in to, so no "collateral damage".

        • by TWX ( 665546 ) on Tuesday April 21, 2015 @02:43AM (#49517475)
          The thing is, in a real wiretap, they're only tapping the one call. In this thing's case they're intercepting all calls for everyone in the area whose phones end up using it, not just the one call. That's why I think they need to go through the carrier, so the carrier can tape the one line or the series of lines that they have a legitimate claim through the courts to gain access to.
    • by mellon ( 7048 )

      It depends what they are doing. TFA describes a situation where a murderer was found because he kept the victim's phone (on!) in his house. I have no problem with using cell phone intercept to track down a murder suspect in a situation like this, although the degree of stupidity required for this to work is astonishing. So based on the article we don't actually know that there were lax procedures. I'm not saying there weren't, but getting a court order for this sort of thing is precisely what they sh

    • by DerekLyons ( 302214 ) <fairwater.gmail@com> on Tuesday April 21, 2015 @08:55AM (#49518523) Homepage

      It sounds to me like not only the police is wrong by applying for too many uses of the device (of course they do - it's their job to gather as much information about potential criminals as possible), also the courts appear to be wrong by not doing much evaluation of the requests. Now having to handle nine requests a day is a huge number as well (that's before accounting for holidays and weekends), yet no excuse for not following proper procedures.

      What's interesting is that you make an assertion... and then act as though that assertion was a fact.
       

      From the face of it, the courts should be more strict. Take more time to properly evaluate each one

      One of the things you've failed to account for, there are probably hundreds of judges in a city of a half million - thus it's quite possible to be strict and evaluate each one and still come up with this number. It's a distributed parallel system - what sound like scary huge numbers arise quite easily from a relatively modest number of actors, especially considering the length of time involved.

      But the ill-educated (or deeply biased, or prejudiced towards panic*) won't stop and think about these things. Thinking Is Hard.

      And, to those moderating, yes - I know the actual number is 4,300. I'm just so damn tired of the level of ignorance so prevalent on Slashdot.

      * Actually there's considerable overlap in these categories.

    • Crime in the City of Baltimore is such a target rich environment, it can be easy to forget that nsa is only a 15 minute drive from the City.

  • by Anonymous Coward on Tuesday April 21, 2015 @12:20AM (#49517093)

    The article states that the earlier figure was incorrect; the Baltimore police actually used it 4,300 times, not 25,000 times.

    • by TechyImmigrant ( 175943 ) on Tuesday April 21, 2015 @01:40AM (#49517315) Homepage Journal

      The article states that the earlier figure was incorrect; the Baltimore police actually used it 4,300 times, not 25,000 times.

      Is this one of these things where they try to make 4300 sound small by first quoting a bigger number?

      • by gatzke ( 2977 )

        4,300 over eight years in a city the size of Baltimore is not that big a number. 1-2 a day in a city of 600,000 (metro of 2.7 million) may actually be on the low side of what you would expect.

        But hey, math class is tough. OUTRAGE!

    • Without knowing how many stingray devices they use, that is nearly two devices running every day for the 8 years they have been using them. It sounds like they turned the devices on and let them run constantly. More like a dragnet usage and hope they can find something later.

      ~~
    • The article states that the earlier figure was incorrect; the Baltimore police actually used it 4,300 times, not 25,000 times.

      It's still a big enough number that they must have full-time staff dedicated to these illegal searches. No wonder B'more has so many problems with dropped calls.

      • by Enry ( 630 )

        How is it illegal if there's a court order?

        • "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized"

          Any warrant that doesn't list the particular; one that authorizes a general collection is unconstitutional and illegal regardless of what the Judge says. In this case the Judge
  • In the past a telco would have to see court paper work to set a number into their system to track and log.
    The lack of any new court comment or even telco paperwork is telling. Local law enforcement have moved away from needing local telcos to just collecting it all.
    It is now cheaper to log all calls in an area and sort them than to request paper work a person of interest at a city or sate law enforcement level.
    A cell phone is now a gps, text, voice print, photo, numbers called and beacon carried aroun
    • In the past a telco would have to see court paper work to set a number into their system to track and log.

      Presumably stingrays are used for the real time interception of communications and live tracking of a suspect. Having the telcos provide the capability for real time monitoring across their networks to law enforcement provides far more potential for abuse than localized stingrays.

      • by AHuxley ( 892839 )
        Classic court allowed telco support would be for one cell number, account or person.
        The cellular phone surveillance device becomes a cell tower like device in a community and collects all calls in that area.
        The cell site simulator has total access as it forces all mobile phones in the area to connect to it.
        Collect it all is how a cell site simulator works for cellular phone surveillance.
        A change to bulk collection.
        • Classic court allowed telco support would be for one cell number, account or person.
          The cellular phone surveillance device becomes a cell tower like device in a community and collects all calls in that area.
          The cell site simulator has total access as it forces all mobile phones in the area to connect to it.
          Collect it all is how a cell site simulator works for cellular phone surveillance.
          A change to bulk collection.

          Are these devices attended by actual humans, or, as is likely, it's set up and left recording in some nearby convenient location like the back of a parked van, motel room, or abandoned building, etc?

          If so, they should be easy to radio-locate, like the old CB radio 'rabbit hunts'. How upset would they be to find their expensive toy missing when they returned?

          If it *is* attended, surround the location and start protesting and out them. Don't forget to video record.

          If police don't need a warrant, then does tha

          • by AHuxley ( 892839 )
            Re Finding?
            "This machine catches stingrays: Pwnie Express demos cellular threat detector" (Apr 21, 2015)
            http://arstechnica.com/informa... [arstechnica.com]
            Looks for Unauthorized or unknown cell providers, Anomalous or suspicious base stations, IMSI catcher/interceptor identification, Rogue or malicious cellular base stations.
  • So, I went to the local Social Security office in smallsville, CA. While waiting, I used my phone, and noticed that (Verizon) I was getting a 1x signal.

    There are *no* 1x signal towers in my local area, it's all 100% digital. There aren't even any 3G towers that I know of. And when I left, within a few hundred feet, I resumed seeing 4G signal,like normal.

    Stingray much?

    • by AHuxley ( 892839 )
      The new hardware should be totally ready for the next mobile standards, no dropping back.
      Wonder what the areas around news papers and press offices are like :)
      Journalists and people they meet should be very aware of that a log on a map can show. Two people standing next to each other for a short time both with their phones on.
    • by dougmc ( 70836 ) <dougmc+slashdot@frenzied.us> on Tuesday April 21, 2015 @02:04AM (#49517387) Homepage

      1x is digital too. [wikipedia.org]

      It does have longer range than 3G and 4G, and so it could very well be that you were simply getting a marginal signal and there was no Stingray involved at all -- your phone just used the best that was available, and that was 1x.

      And once you left, the 4G signal got strong enough again to use, and your phone switched back.

    • by bill_mcgonigle ( 4333 ) * on Tuesday April 21, 2015 @05:59AM (#49517917) Homepage Journal

      There aren't even any 3G towers that I know of.

      Seriously? A good chunk of the existing phone base can't even do 4G - prepaid is still largely 3G-only phones, which are still sold new today. It would be very rare to have 4G-only coverage areas in a town.

      However, if you never go anywhere and have really good 4G coverage, setting your phone to 4G-only may well be a good workaround to reduce your chance of an intercept.

      • by afidel ( 530433 )

        However, if you never go anywhere and have really good 4G coverage, setting your phone to 4G-only may well be a good workaround to reduce your chance of an intercept.

        The current generation of Stingray devices can do LTE interception.

    • by sudon't ( 580652 )

      If you travelled outside of the cities, you'd find that much of the country is 2G.

    • Most likely the SSA office has a cell phone repeater system installed inside the building to provide decent service for the workers and clients. I have installed multiple systems inside office buildings when the local tower is not providing a decent signal.

  • Yah, makes sense to me. Nothing like using time, material, massive tax dollars and technology used to stop _a_ nasty homicidal maniac from murdering again. Well done! A truly Cadmean victory to brag about. Whoo hoo! Let's hear it for the Blatimore Policy mens!

  • *gasp* (Score:4, Interesting)

    by jargonburn ( 1950578 ) on Tuesday April 21, 2015 @01:06AM (#49517211)

    What the actual fuck?! What did they do before Stingrays? Not catch anybody? Good fucking grief!

    The above was my initial reaction, anyway. I checked the article; seems to have been updated to say 4300 times, which is not such a jaw-dropper. Also, I'd be interested to know whether that covers every time the device was used to intercept or track a mobile device (4300 is a number I could believe, if not like) or if that was the number of court-orders/warrants obtained (4300 still seems ridiculously over-used).

    • by AHuxley ( 892839 )
      Before the cell site simulator a court would just ask the telco to track a persons cell phone, account US wide. It worked well and could be accepted in any open court setting as a per person log.
      The new cell site simulator count could be how many times a person of interest connects or is logged vs the bulk community collect it all using the cell site simulator 24/7.
      A smaller number would be presented to keep the bulk community collection count well hidden.
    • by Anonymous Coward

      What the actual fuck?! What did they do before Stingrays? Not catch anybody? Good fucking grief!

      No, the real question here is, did they start catching anyone after abusing the shit out of our Rights.

  • i understand the basics of how a stingray works - it puts out a stronger signal than the nearest tower, and the phones connect to it instead of the tower. but what is it capable of, and how does it do it?

    First, location. obviously any phone that connects to the stingray must be in the vicinity of the stingray. But do phones ping the tower with their GPS coordinates? Cuz then the stingray would be receiving a whole bunch of imei numbers with attached gps coordinates.

    what about call metadata and call content

    • by Anonymous Coward

      Yes, they record your position and call metadata. They can most certainly collect your content, too. A stingray is literally a miniature celltower that does a MITM attack.

    • by AHuxley ( 892839 )
      The cell site simulator becomes the tower and depending on the local law enforcement needs will gather voice, data, images, logs, text, gps, calls made.
      Voice prints would be the next step. Malware down for software passwords would then allow for plain text as entered no matter the secure app loaded.
      The phone trusts the cell site simulator network as it would a telco cell tower. The network between the phone and cell site simulator is wide open at the point.
    • by jeti ( 105266 )
      AFAIK, Stingray is based on an IMSI catcher. It simulates a cell tower and gets cell phones in the area to connect to it by providing the strongest signal. It then records the data of all connected cell phones and forwards it to the network.

      Since IMSI catchers are well understood, all this secrecy is a bit surprising. It makes speculation about additional capabilities plausible. It could use exploits in the modem software to install malware. Such malware could do all sorts of things like reading local fi
  • Update (Score:4, Interesting)

    by jklovanc ( 1603149 ) on Tuesday April 21, 2015 @04:05AM (#49517647)

    Police outlined for the first time this month their usage of the stingray, pegging it at more than 4,300 times — a figure experts called a "huge number" compared to a trickle of disclosures in other cities.

    Lets do the math over. 4300/8/365= 1.5 times a day. Then there is the issue of duration and range. Is every day a different court order? Is every Stingray a different court order? One ongoing investigation that covers a home, a workplace and a meeting place would more than cause that many "uses".

    Big numbers look big until you break them down.

    • Re: (Score:3, Interesting)

      by chasm22 ( 2713399 )

      Let's do some more math. All cell calls within a mile are intercepted and rerouted. I really don't give a hoot about this particular case, but how about giving us an educated guess as to how many 'innocent' cell phone calls are intercepted each and every day in each and every major city(and undoubtedly many mid and small sized cities as well) by not only the local PD but also any number of state and federal agencies.

      Sorry, you can make this seem small with your math, but in reality this is probably a bigger

      • I really don't give a hoot about this particular case, but how about giving us an educated guess as to how many 'innocent' cell phone calls are intercepted each and every day in each and every major city(and undoubtedly many mid and small sized cities as well) by not only the local PD but also any number of state and federal agencies.

        Those are "interceptions" that are not logged or looked at. All that happens is the call is passed through to the real cell tower.

        You see the judge had decided to issue a blanket search warrant for all the locations on the GPS.

        So the cell phone of a suspect found in possession of dealer quantities of drugs was searched and found to contain an number of locations. The judge found that the link between the drugs and the locations on the cell phone sufficient evidence to provide probable cause to search those locations. You do not have enough detail to make an accurate determination on how far the warran

        • If it's just for one phone, all telecommunication providers in the US have to, by law, provide full "tapping" ability. What's the advantage of the Stingray then?

          BTW, would a blanket search warrant even be Constitutional? The Fourth Amendment says that warrants must be specific.

          • What's the advantage of the Stingray then?

            Timing. Stingray allows real-time access to the presence of a desired number without having to wait for the information to filter through the telco's bureaucracy. A telco will not watch for a suspect while police will.

            BTW, would a blanket search warrant even be Constitutional?

            I bet the warrant was more like "here is the list of locations from the cell phone we would like to search". I think that because the judge approved all the locations the OP calls it a "blanket warrant".

  • Life imitating art.
  • by Jim Sadler ( 3430529 ) on Tuesday April 21, 2015 @06:07AM (#49517931)
    Around 1969 the military operated what were called fixed syphoning stations. The idea was to secretly listen in on communications and to insert false commands at critical moments. Turn left in a foreign language could be changed to turn right for example. And it had to duplicate all of the intonations and accents of the sender's voice. And that was 1969 technology. One can only wonder just how signals can be altered these days and worse yet the altered conversations could be saved as evidence of wrong doing. It is sort of like being able to produce the smoking gun in a murder case even though the gun never existed.
    • by AHuxley ( 892839 )
      Now part of the DRT box, device or dirtboxes ie cell site simulators. Some are fixed-site, tactical trailer ready or man-packable.
      What was big for Iraq and Afghanistan is now back for domestic use. Data visualisation, graphs, geospatial maps are all in the mix depending on what is offered. Mix in private databases, purchased data for phone numbers.
      The US seems to have been early with it but the US is now finding other nations efforts locally.
      The other side is the wired versions for any/all Public Switche
  • It seems to me that with a warrant that Stingray is 100% unnecessary, thus this device entirely exists so that there are no inconvenient records being kept by the cell companies. Also, and probably more importantly, this is no doubt causing crappy cell service. Cell towers are very carefully engineered and to have a stingray system somehow playing man in the middle games of any sort would be causing poor reception.

    So quite simply I hope that the various cell manufacturers are presently working on technolo
  • There are only about 50,000 TOTAL ARRESTS a year in Baltimore. So for every 16 arrests, there is one Stingray use?? They must be regularly tapping the phone of everyone even suspected of being a felon in the fucking city.

  • Here's my question, why aren't the cell companies screaming mad about unlicensed use of their cellular bandwidth by Stingray devices. Let's not forget, these are massive corporations that spend billions of dollars for a slice of the radio spectrum and here they have this regular intruder on their space. I would think it would be a matter for the FCC to get involved, but nobody says anything other than, yeah, they intercept cell signals and retransmit the data. I can guarantee if I were to do this, I'd have
    • Their licenses probably say that the government gets to do what they want, and shut up.
      • by mlynx ( 812210 )
        Actually that's not how the FCC tends to license bandwidth. Quite the contrary, you have to have all sorts of approvals from said FCC before you operate a radio device in licensed spectrum. There's a reason Apple and others pay gobs of cash to make sure that they are producing compliant devices.
  • Why can't these be locked down to a single IMEI or Sim or whatever? Anything else tries to connect just gets shunted on to the real tower. The court order should allow only one phone to be monitored, not anybody that happens to be in the neighborhood.
  • I've had very weird signal connections and data problems in certain areas of Baltimore. And have been convinced for a while that I've been encountering a stingray tower in certain areas.

  • The phone operating system could also prevent this from happening. The police are easy targets but Google and Apple do not change until the consumer does. The choice of mobile phone and operating system you get is: 1 device and 1 operating system. I purchased a Chinese Meizu MX6 with plans to change the OS for this reason. They are tracking you with the phone design you must buy and the keys are kept with the service providers. Take notice how the cell phone commercials say "Verizon service sucks" or "T-Mob

Economics is extremely useful as a form of employment for economists. -- John Kenneth Galbraith

Working...