Judge: Stingrays Are 'Simply Too Powerful' Without Adequate Oversight (arstechnica.com) 111
New submitter managerialslime sends news that an Illinois judge has issued new requirements the government must meet before it can use cell-site simulators, a.k.a. "stingrays," to monitor the communications of suspected criminals. While it's likely to set precedent for pushing back against government surveillance powers, the ruling is specific to the Northern District of Illinois for now.
What is surprising is Judge Johnston’s order to compel government investigators to not only obtain a warrant (which he acknowledges they do in this case), but also to not use them when "an inordinate number of innocent third parties’ information will be collected," such as at a public sporting event. This first requirement runs counter to the FBI’s previous claim that it can warrantlessly use stingrays in public places, where no reasonable expectation of privacy is granted. Second, the judge requires that the government "immediately destroy" collateral data collection within 48 hours (and prove it to the court). Finally, Judge Johnston also notes: "Third, law enforcement officers are prohibited from using any data acquired beyond that necessary to determine the cell phone information of the target. A cell-site simulator is simply too powerful of a device to be used and the information captured by it too vast to allow its use without specific authorization from a fully informed court."
A step in the right direction (Score:5, Insightful)
Re:A step in the right direction (Score:5, Insightful)
Re:A step in the right direction (Score:5, Insightful)
Well, it is still fruit of the poison tree but is only known as such if someone is willing to admit that was how they found the information.
Parallel construction largely relies on a lie being in place. If at any time it is discovered that this other source or means was crafted due to the illegal connections, it can and likely would be toss out with it.
Re:A step in the right direction (Score:5, Insightful)
Well, it is still fruit of the poison tree but is only known as such if someone is willing to admit that was how they found the information.
Parallel construction largely relies on a lie being in place. If at any time it is discovered that this other source or means was crafted due to the illegal connections, it can and likely would be toss out with it.
One neat thing about this type of deception is that the bigger it grows, the harder it is to hide. One person can keep a secret. Two people struggle to keep a secret. Hundreds of people cannot keep a secret, there will be a media leak by with a citation as a "confidential source not authorized to talk to the media."
If that happened it would not be one case tossed. It would be at least one case tossed and thousands of other cases re-opened for investigation, and intense scrutiny and a nasty public relations backlash.
We had a situation in a local PD where a highly acclaimed officer was caught faking field sobriety tests, falsifying reports and even the discovery of dashcam video showing the tazering of a sober person while shouting at them. In addition to the officer losing their job and various awards, there were various convictions overturned, convictions expunged, and several settlements allegedly of a quarter million dollars each were issued.
When discovered the impact to the groups is huge.
Discovery of illegal wiretaps and illegal records and failure to disclose potentially exculpatory evidence? That's the kind of thing that gets mass terminations and prison time for officers.
Re: (Score:2)
You have far too much faith in the system. The DEA outright admitted to using parallel construction (One DEA official had told Reuters: "Parallel construction is a law enforcement technique we use every day. It's decades old, a bedrock concept.") and no cases were reopened or even scrutinized.
If somebody at a little local PD does some sleazy illegal stuff, people may go to jail. When whole branches of the federal government start doing illegal stuff in an organized manner, it becomes the de facto law of the
Re: (Score:2)
Or maybe they're getting tips [washingtonpost.com] from domestic and foreign intelligence [reuters.com] agencies and not just from innocuous tippers who won't testify. But if you want to trust them implicitly, then go right ahead.
Re: (Score:3)
But in the end, these court orders and government actions do little. These organizations are almost clandestine in nature and are just going to do what they want.
The point of the law, as always, isn't about some wishful thinking about those who would choose to violate the law. It applies to how we want to act within the law. Murder, rape, theft, fraud, are all illegal and yet still happen far too often. The point of having a clearly defined line is to let people know when they have crossed over it.
Next step? (Score:4, Interesting)
Perhaps carriers should be forced, by law, to encrypt their traffic such that the police would necessarily be forced to ask for the keys to decrypt the calls from a specific phone?
Re: (Score:3)
Stingrays wouldn't suffer any setback in this light. They work by simulating a cell tower and it is very difficult to find out that you are not connected to a legitimate tower.
Either way, the handset would have to negotiate the encryption key in which they capture or just mimic, or it would have to be hard coded into the system in which they already mimic. The same people producing the stingrays are likely the same producing the cell towers. Even if they are not, they are designed so your handset will not k
Re: (Score:3)
So I'm likely to know I'm on a Stingray. Do you think I could sort of wardrive to try to locate the device? Or should I just call a random friend and talk about it and say bad things about the FBI and law enforcement while on the line?
Re: (Score:3)
I've often thought about crap like that. Get a few burner phones, find a stingray and say we are moving two kilos of cocaine, the pot is in and we need to move a bale or something. Perhaps talk about someone selling explosives and going to pick them up at a specific time and location and wanting backup to watch your back. Then identifying myself as an older person driving a car which make and model and license matches that of the local judge or something. Perhaps the mayor's wife or family or something like
Re: (Score:3)
So I'm likely to know I'm on a Stingray. Do you think I could sort of wardrive to try to locate the device?
Kinda. You can install AIMSICD [github.io] on an Android phone; it displays a map of cell towers and alerts you when the presence of a stingray is likely. An icon in the phone's status bar will change from green, to yellow, to orange, to red indicating the threat level. I've seen a couple of yellows, which means something weird is going on with tower IDs, but isn't necessarily dangerous. If you got an orange or red icon you could pull up the tower map, find the dot, and drive towards it (or very fast away from it!).
Re: (Score:2)
There are apps for Android that claim to do exactly that. I believe some of them warn you if you were downgraded to 2G unexpectedly or if encryption was switched off by the cell site.
Two problems. One is nobody uses such apps. It needs to be integrated with the OS really. And another is that apparently the makers of the Stingray devices have a device that can attack 3G networks as well. This latter device is only rumoured and last time I researched it, I concluded almost nothing is known about how it works,
FBI to Judge Johnston (Score:2, Funny)
"We don't use stingrays. Prove to us that we do. Neither ownership nor signing out a stingray constitutes proof. Should you be able to prove it we will issue an NSL and shut you down based upon National Security considerations. Also we have the President, Administration, CIA, NSA and Homeland Security on our side."
Problem solved!
Wow, did a troll just get +5 (Score:3)
Re: (Score:2)
I expect my calls to be private even on the street.
Someone has to make an encryption app for the calls where you exchange keys in person and they are never on the network.
Expectation of privacy needs to be reviewed. Definitions of privacy should not be capricious.
There is privacy in a crowded noisy room.
There is privacy in the middle of an open field.
There is privacy in the home.
There is privacy in the bedroom (hotels have bedrooms).
There is privacy in a special RF shielded, sound deadening special room.
A conversation in a restaurant while on a date has privacy expectation.
There is privacy in the confessional of the catholic church.
To subject the population to privacy rules
Re: (Score:3)
Perhaps it was modded down because it has nothing to do with stingray use by police?
Re: (Score:1)
Wow, you have really lost your mind over this, it is lovely to see I am getting to you finally, you are starting to correct some of the issues, though you did still ignore much of my responses yet again. I guess I shouldn't expect too much from you.
Re: (Score:2)
That is easy, no.
Re: (Score:2)
http://slashdot.org/comments.p... [slashdot.org]
Why do you keep asking me to repeat myself? Do you have short term memory loss?
Re: (Score:2)
http://slashdot.org/comments.p... [slashdot.org]
Is reading too much to ask? You ask the question, read the freaking answer. Yes, you claimed that DNS wasn't needed by trying to say that it uses more resources to run than a hosts file.
Re: (Score:2)
I'm not the AC, but I'll bite.
Come at me bro.
Re: (Score:2)
The smell might knock me out, but it is highly unlikely you could. You would probably hide behind your mom.
Re: (Score:2)
What, are you going to try and sit on me?
Re: (Score:2)
So responding to the question three times is running away...I see...you are deranged aren't you?
Re: (Score:2)
Better yet, come meet me here - you know where I am!
So does the rest of the planet, including me. As you know quite well, Mr Internet Tough Guy.
Re: (Score:2)
You are my hero. How did you resist the burning poop gag though?
Re: (Score:2)
Modded down because it's offtopic...
Steve Irwin agrees (Score:4, Funny)
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
Great (Score:4, Interesting)
So the three-letter-agencies and the local yokels will have to just continue using parallel construction. Isn't it amazing how many detailed and accurate "anonymous tips" the police receive?
Re: (Score:2)
So the three-letter-agencies and the local yokels will have to just continue using parallel construction. Isn't it amazing how many detailed and accurate "anonymous tips" the police receive?
Not sure how Stingrays wouldn't be supremely helpful to parallel construction. Sure they can't prove it with the call records, but now they might be taken to task for even using them at all.
Police State no-likey this.
Re:Great (Score:5, Interesting)
Your basic premise is sound though - it's still nothing more than a near-bulletproof means of gaining evidence illegally and keeping the true means by which it was discovered from the court. Lies of omission are still lies.
Re: (Score:1)
ohio state highway patrol (turnpike) works this way.
only they can once a week seem to pull someone over for an improper lane change or faulty license plate light and magically find 10 keys of coke hidden in a secret compartment inside the gas tank,
I drive through there with marker lights out all the time, but i'm not doing anything illegal so I won't get stopped.. but i guarantee if i had a trunk full of weed and only let my blinker flash twice before changing lanes, i would be in jail,
Meh, you do what you can (Score:2)
Why use stingrays at all? (Score:4, Insightful)
Is there any information a stingray can collect that the cellular carriers don't also collect?
The stingray just seems like an end-run around getting a court order to subpoena the information from the carriers.
Re: (Score:3)
"Turns Out Police Stingray Spy Tools Can Indeed Record Calls" (10.28.15)
http://www.wired.com/2015/10/s... [wired.com]
Why? Parallel construction. It gets around needing a warrant, taking to/entering details into any court system or having any telco database knowing who is been looked at.
Both court
Re: (Score:2)
Is there any information a stingray can collect that the cellular carriers don't also collect?
Yes, everyone else's information in addition to the hypothetical suspect's, with zero requirement for any semblance of probable cause.
The stingray just seems like an end-run around getting a court order to subpoena the information from the carriers.
Right, that's the whole point. The court would never grant a subpoena for information about "everyone who was in the area of Main St. and 4th Ave. on January the 9th," so they're subverting the court altogether.
Fuck no (Score:1)
Any government official who eavesdrops on the communications of US citizens should get the death penalty. No exceptions.
FINALLY! (Score:4, Insightful)
Someone who gets it!
Without getting stupidly extremist ("Death to eavesdroppers"? Really?!), our law enforcement and judicial systems have gotten off into the weeds and need to be reminded that the spirit of the Constitutional amendments that grant privacy are designed to limit personal exposure down to only what is needed to investigate specific crimes committed by specific individuals. The idea of casting a wide net and picking up everyone doing anything wrong will always be attractive and based on the faulty logic that our judicial system is perfect in discerning proof of offense from misleading and incomplete evidence. The Constitution, on the other hand, assumes the judicial system is imperfect and must be held to a high standard that assumes imperfection.
Cell phone company to only allow registered towers (Score:1)
This is something that as the CEO of a cell phone company you could fight against.
Why hasn't someone simply said "No, the phones we issue will not connect to anything short of a proper registered cell phone tower which WE own, stingrays will be ignored".
Or is that somethign that isn't technically possible? I'm sure there's a way. And I for one would be quite willing to be restricted to the coverage area of a specific network IF that also ensured that I was guaranteed to not be fooled by a stingray.
Alterna
Re: (Score:2)
This is something that as the CEO of a cell phone company you could fight against.
If you wanted to be harrassed by TLAs for the rest of your life.
I have a phone that displays the difference between a secure call/data connection and an unsecure (unencrypted) one. It is an ancient Motorola RAZR V3. Now, correct me if I'm wrong, but in the case of more modern phones, this feature has been dropped. And I'd guess that this was at the request of law enforcement.
Re: (Score:1)
Did you count the number of letters in FCC? Notice it's the same number of letters as in FBI and CIA and NSA? Those are all known as TLAs and they all whore around town together. They certainly aren't going to cock-block each other.