Tracking Our Phones: How StingRay Devices are Being Used by Police

Canadian government officials say StingRays and devices like it have never been authorized for use in Canada – even if some security agencies have already used them. The controversial cellphone-surveillance technology allows police departments and other authorities to spy on the cellphone activity of a wide variety of citizens. How these devices work, where they come from, and how they are being used is a story of its own.

What is a StingRay or IMSI catcher?

To answer that, first we have to describe how your phone is constantly broadcasting your location. In simple terms, when you make a call on a mobile phone there is a radio transmitter and receiver inside that tries to connect to a cellular network or tower: you can actually see that radio connection by checking the bars on your phone, which measures signal strength.

Your phone’s radio will try to connect to the nearest and strongest radio signal from a base station or tower so that the call you are making can travel across the cellular network (like those offered by Rogers, Bell and Telus) all the way to the person you’re calling. The same holds true if you are texting, sending a Snap or a tweet: radios in your phone connect to other radios to transmit calls, text or data from the Internet.

Your cellular can’t always figure out exactly where you are, but it has a rough idea based on the tower you are connecting to, and perhaps can triangulate a little closer based on the strength of other nearby tower signals. Once the cellphone company locates your general area, a StingRay or device like it can narrow that down to the street, or the building or even the room where your phone is.

How does it work?

Cell phones have a number of unique digital identifiers that are constantly blasting out so that networks (cellular or wi-fi) can decide whether your device is allowed to transmit data on that network. Among them are the International Mobile Subscriber Number (IMSI) and the Electronic Serial Number (ESM). In 1996, a German company called Rohde & Schwarz starting selling something it called an IMSI catcher, to track those unique phone IDs. There are now several companies that sell them (often for tens of thousands of dollars each) to law enforcement and security organizations around the world.

At its core, an IMSI catcher like the StingRay is just another radio transmitter that pretends to be a base station or tower like the ones Rogers and Bell operate, except that it’s not going to route your calls through to your friends. Instead, it can identify and track your phone, as well as actually block you from making calls or in some circumstances, on some devices, can even record the calls themselves.

Like the cell towers, these devices have limited range, so you have to be near an IMSI catcher to show up on its system. The closer you get, the stronger the signal, which is how it can pinpoint your location. But it’s also indiscriminate: It tracks everyone in the area, in the hopes it will find a target it actually wants. Federal prison authorities in Canada are dealing with the consequences of that. They are facing a criminal investigation and lawsuit after using a surveillance device inside a jail.

How is it being used?

For a device that started selling in 1996, there was surprisingly little public mention of it in the U.S. for more than a decade after documents suggest they were in use. (A Stanford student newspaper noted the existence of the tech in 2006.) In 2010, former Reuters reporter Jim Finkle attended the DefCon hacker conference and wrote about security consultant Chris Paget’s construction of an IMSI catcher that cost about $1,500, saying “law enforcement has long had access to expensive cell-phone tapping equipment.”

In 2011, convicted felon Daniel Rigmaiden, who was serving a prison sentence for filing more than 2,500 fraudulent tax refunds, sent an eye-opening 200-page report on the secretive tool to the American Civil Liberties Union (ACLU). As he described on the WNYC radio show Note To Self, Rigmaiden had been living off the grid in the California forests when he was arrested, and suspected an unknown device had been used to track him down via his cellular-connected Internet air card. His case was the subject of several stories, and lawmakers and journalists began asking questions about the purchase of these devices, which often come with strict non-disclosure agreements that bar purchasers from discussing their use even in sworn testimony in court.

In 2014, Rigmaiden was released from prison after a years-long effort – involving 1,130 court motions filed – in which he charged that the federal government had concealed their use of the IMSI catcher during his trial. Google Trends show an increased volume of searches for IMSI catchers around the time of Rigmaiden’s release.

The ACLU has compiled a map that shows 61 local or state police departments in 23 states that are known to use IMSI catchers, and there are reports of Russian and Chinese authorities using the devices. As reporters Colin Freeze and Matthew Braga wrote in The Globe and Mail this week, Canadians are finally getting some answers about how the technology has been used here.

Why is it called a StingRay?

The first trademark for the “StingRay” brand of IMSI catcher was filed in 2001 by Harris Corporation. It’s a non-descript rectangular box with a variety of input and output ports, and looks like a box you’d slide into a server room rack or a control booth at a radio or TV station. That same year, Harris also filed trademarks on an array of complimentary devices like the Amberjack (a mobile range-boosting antenna), Kingfish (a more portable, cheaper StingRay) and Triggerfish (a device designed to record the conversations of nearby cell-phone users).

Because the StingRay brand name has been identified in several freedom of information requests and lawsuits by civil society organizations in the U.S. (including the ACLU, the Electronic Frontier Foundation, and the Electronic Privacy Information Center) it has stuck as a catch-all term to describe an array of devices, sometimes from different manufacturers. For instance, the so-called DRTBOX is an IMSI catcher used by the U.S. Marshals Service, made by Boeing subsidiary Digital Receiver Technology Inc. The FBI, which has spent millions of dollars to acquire these technologies, often refers to them in internal documents as “digital analyzers” or “cell-site simulators.”