Fake cell towers mounted on planes. Signals stronger than normal towers and every phone within range contacts the system with their ID.
This post was updated on .
"Stingrays and Dirtboxes are mobile surveillance systems that impersonate a legitimate cell phone tower in order to trick mobile phones and other mobile devices in their vicinity into connecting to them and revealing their unique ID and location. Stingrays emit a signal that is stronger than that of other cell towers in the vicinity in order to force devices to establish a connection with them. Stingrays don’t just pick up the IDs of targeted devices, however. Every phone within range will contact the system, revealing their ID."
NOTE: Altho this story is about fake cell phone towers being used on airplanes over So Cal... I imagine it could also be used with drone technology.
AUTHOR: KIM ZETTER. SECURITY DATE OF PUBLICATION: 01.27.16.
TIME OF PUBLICATION: 6:28 PM.
CALIFORNIA POLICE USED STINGRAYS IN PLANES TO SPY ON PHONES
THE GOVERNMENT’S USE of a controversial invasive technology for tracking phones just got a little more controversial.
The Anaheim Police Department has acknowledged in new documents that it uses surveillance devices known as Dirtboxes—plane-mounted stingrays—on aircraft flying above the Southern California city that is home to Disneyland, one of the most popular tourist destinations in the world.
According to documents obtained by the American Civil Liberties Union of Northern California, the Anaheim Police Department have owned the Dirtbox since 2009 and a ground-based stingray since 2011, and may have loaned out the equipment to other cities across Orange County in the nearly seven years it has possessed the equipment.
“This cell phone spying program—which potentially affects the privacy of everyone from Orange County’s 3 million residents to the 16 million people who visit Disneyland every year—shows the dangers of allowing law enforcement to secretly acquire surveillance technology,” Matt Cagle, technology and civil liberties policy attorney for ACLU-NC, wrote in a blog post about the new documents.
Stingrays and Dirtboxes are mobile surveillance systems that impersonate a legitimate cell phone tower in order to trick mobile phones and other mobile devices in their vicinity into connecting to them and revealing their unique ID and location. Stingrays emit a signal that is stronger than that of other cell towers in the vicinity in order to force devices to establish a connection with them. Stingrays don’t just pick up the IDs of targeted devices, however. Every phone within range will contact the system, revealing their ID.
They not only pick up trackable data from phones; Stingrays and Dirtboxes also can disrupt phone service for anyone in their vicinity whose phone connects to the devices. This means that potentially millions of people in Orange County had their phones unknowingly connected to government surveillance devices and may have experienced service disruption as a result. Last year an FBI agent admitted the disruption capability for the first time in a court case involving a Sprint customer.
“Because of the way the Mobile Equipment sometimes operates,” FBI Special Agent Michael A. Scimeca disclosed to a judge, “its use has the potential to intermittently disrupt cellular service to a small fraction of Sprint’s wireless customers within its immediate vicinity. Any potential service disruption will be brief and minimized by reasonably limiting the scope and duration of the use of the Mobile Equipment.”
Because they are military-grade and very powerful, they are perfect for mounting from a plane.
Although stingrays are designed to recognize 911 calls and let them pass to legitimate cell towers without connecting to the surveillance device, the revelation from the FBI agent raises the possibility that other kinds of emergency calls not made to 911 may not get through.
Anaheim Police have not disclosed how they use their stingray and Dirtbox devices or whether they take any steps to minimize service disruption.
“Because they are military-grade and very powerful, they are perfect for mounting from a plane,” Cagle told WIRED.
The use of stingrays by local law enforcement agencies has been widespread for many years. But the use of the more invasive Dirtboxes has largely been limited to federal law enforcement. In 2014, for example, the Wall Street Journal reported that the US Marshals Service was operating Cessna aircraft with Dirtboxes installed on them from at least five metropolitan-area airports. The locations of these airports provided authorities with a wide-sweeping flying range that covers cell phones used by most of the US population.
Subsequent news reports revealed that Los Angeles and Chicago police departments possessed Dirtboxes as well. Anaheim is the smallest city known to have one.
“If a city of this size possesses a Dirtbox it really begs the question what other cities smaller than Los Angeles and Chicago were able to buy these devices in the six years since it has had one,” says Cagle.
Anaheim police use both versions of the surveillance equipment—stingrays and the plane-mounted Dirtbox. Two years after buy the Dirtbox in 2011, the police department purchased a stingray. That same year the Chief of Police approved an upgrade to the stingray that the ACLU believes gave it the capability to monitor modern LTE cellular networks which are used by millions of smartphones.
“In other words, as cell carriers upgraded their networks to LTE, Anaheim police took steps to exploit that very network which millions of customers would entrust with their private communications,” wrote Cagle.
Last year the Justice Department issued a policy asserting that any federal agency using a stingray or Dirtbox must obtain a warrant. That policy, however, left a loophole for local law enforcement agencies to continue using them without a court order. But California lawmakers passed state legislation last year closing that loophole at least for police and other local law enforcement agencies in the state. That so-called Cal-ECPA law requires, as of January this year, that they also obtain a warrant. Another bill passed by lawmakers requires any law enforcement agency in the state using such equipment to have establish a usage policy for it and to make that policy publicly available.
“Without more transparency and an enforceable set of rules, we really don’t know whether these devices are used from the sky to investigate routine crimes or pursuant to a warrant as CalECPA now requires,” Cagle told WIRED. “We look forward to seeing jurisdictions releasing publicly available use plicies with a warrant requirement.”