Friday, March 06, 2015

Reining in 'cellphone snoops'

The Houston Chronicle published a staff editorial this week ("Cellphone Snoops," March 4) lamenting Houston PD's opacity surrounding their use of international mobile subscriber identity (IMSI) catchers, known by the trade name "Stingray." The article opened, "For about seven years, HPD has been spying on Houstonians by using devices that mimic cellphone towers and trick phones into connecting through them." Moreover:
the whole history of law enforcement using Stingrays has been tarnished by a pattern of secrets and cover-ups. Police departments across the nation have relied on non-disclosure agreements to keep citizens in the dark about what the devices are capable of. Harris County prosecutor Bill Exley told Chronicle reporter Karen Chen that even prosecutors were out of the loop on HPD's Stingray use.
The paper also mentioned the useful fact bite that:
State Supreme Courts in Florida and Massachusetts have required police to seek warrants before engaging in real-time cellphone tracking. Eight states - Illinois, Indiana, Maryland, Minnesota, Tennessee, Utah, Virginia and Wisconsin - have passed laws specifically requiring warrants.
Real-time cell phone tracking probably is the closest analogy to what an IMSI catcher is doing, so I agree it should require a warrant. But the Chronicle repeated a misconception that dogs the Stingray debate - mostly because of misinformation spread by law enforcement - and which deserves correction. Said the editorial, "These briefcase-sized gadgets ... allow officers to look at the metadata on any nearby cellphone - such as whom you call and where you travel - all without needing a warrant."

The "without a warrant" part is accurate. But, while it's technically correct to say the device collects "metadata," it's also incomplete and misleading. A Stingray gathers more than "metadata," a term more applicable to information from phone companies about their customers. Instead, IMSI catchers hijack the phone call entirely, using fraudulent identifiers to convince your device that it's a real, commercial cell phone tower instead of a covert device performing a man-in-the-middle hacking attack. Stingrays don't just collect "metadata," they collect content, similar to an interloper climbing up a pole to listen in on a telegraph line in the 19th century. That's how they work.

Law enforcement claims they do not use Stingrays for wiretapping but that's not because an IMSI catcher cannot perform that function. Some models sold by the vendor, Harris Corporation can tap phones as well as gather "metadata," but non-disclosure agreements prevent anyone - even prosecutors - from knowing whether the model purchased by the City of Houston has that functionality.

Basically, HPD is telling you: Trust us, we're the government. But as Ronald Reagan advised, it's always best to "trust, but verify."

Legislation filed this week by state Senators Craig Estes and Rodney Ellis (SB 942) would require judicial oversight of Stingrays, but treating them as "pen registers" which require a lower standard than a probable-cause warrant ("reasonable suspicion"). Like Rep. Bryan Hughes' HB 2263, Estes' bill would require a search warrant for law enforcement to access personal location data from a third-party cell service provider. Grits expects legislation to be filed in the House suggesting a full-blown Fourth Amendment warrant requirement for Stingray use before the bill filing deadline March 13.

While they're regulating Stingrays, let's hope the Lege formally disallows law enforcement from entering into non-disclosure agreements with vendors regarding use of surveillance equipment. It seems like a no-brainer to me that state open records law should trump such a spurious NDA. But the Attorney General hasn't made them give it up, so - by denying information even to prosecutors - HPD has probably made it necessary to pass a law in order to enforce the law.

RELATED: While we're on the topic, check out the recently upgraded website for the Texas Electronic Privacy Coalition, with which your correspondent is working to pass legislation to require warrants for electronic snooping.


Anonymous said...

HPD is most likely breaking the law and that is the reason for the issue being so secret. Access to stored communication is a crime in Texas. Use of a pen register is a crime. Maybe if the prosecutor doesn't know and it's sounds like a crime, they need to take to issue to a grand jury to investigate. I bet some people in HPD lawyer up.

Anonymous said...

Wouldn't be anything new for HPD. They've had experience breaking the law for years.

Anonymous said...

Can the general public buy one of these? Maybe we could start snooping on law enforcement and fight fire with fire...just sayin'...

Simran said...

HPD's Chief is a joke! Just another political stunt artist. One day he says "We shouldn't be arresting for marijuana" but continues to illegally spy on citizens. Total mess. Impeach them all! Hope all the officers involved in scheme get fired and get a Dishonorable Discharge on their F-5's.

Gritsforbreakfast said...

@8:59, the general public can't buy one, but hackers have made them for a few hundred dollars.

@1:43, HPD would likely argue that the law doesn't presently cover IMSI catchers, which is true. One of the flaws in the law is it's organized more or less by device instead of by categories of information protected. I agree with you in principle but in practice they'd probably squirm out of it.

john said...

When I had a traffic citation, last year, in trying to get simple discovery in fairness to Brady law, etc.--the HPD immediately ran to the TX A.G to protect them from giving me information on my case.
Nuts to me; and likely anyone in the private sector.
A few years earlier, when unmarked Sheriffs attacked for no reason, the A.G. made Sheriff reply, but they lied about how many cars & officers were even there.
I'm just saying, isn't it much like the federal Executive Branch alphabet Agencies, working on evolved policy expedient to them, outside their authority?