A new report by VICE highlights several purchases by federal agencies and the military of a new surveillance device called a “Crossbow,” described as “an upgrade to the well-known Stingray brand of IMSI-catchers which appears to target 4G devices.”
In plain English, this means that there’s an upgraded technology to spy on people’s phones. Stingray devices, the earlier predecessor, made headlines several years ago when the public learned about their use by law enforcement. They work by simulating a cell phone tower, so your phone automatically connects to the device thinking that it’s a cell tower relay. Instead, the device siphons and collects information without being detected—capturing who and when you are calling, your location, and sometimes the content of your conversations.
Many agencies across the country use these devices. And their use is often secretive. For example, the Baltimore Police Department has used a cell site simulator thousands of times and signed a nondisclosure agreement with the FBI which told prosecutors to drop their cases rather than reveal the department’s use of the stingray through the court process.
As VICE reports:
Multiple courts have ruled that law enforcement need to obtain a warrant before deploying such a device, and civil liberties experts have said that it is difficult to use an IMSI-catcher without sweeping up data from all cell phone devices in a given area.
Originally a product geared for military-use, law enforcement agencies have used IMSI-catchers to investigate all sorts of crime domestically, from petty crime like the theft of chicken wings right up to the attempted purchase of explosives on the dark web.
Whatever the name of features of the technology, in Utah it is restricted. Several years ago, we worked with former Representative Ryan Wilcox to pass a landmark bill that required a warrant for officers to deploy such a technology, and also required police to purge all data collected on individuals not included as part of the warrant.
Further, the bill—which passed almost unanimously—required notification be provided to the subject of the warrant so they would know that the device had captured information from their phone.
More recently, we worked with Representative Craig Hall on House Bill 57, nation-leading legislation that expanded on the previous law to also require a warrant for information held or generated by third parties, such as cell phone providers, cloud storage companies, and others—closing a loophole that the U.S. Supreme Court opened decades ago.
These laws, of course, only apply to state and local law enforcement officials; federal officials operating in Utah are not subject to their restraints and can continue to invade our privacy without judicial oversight. (The fact that an NSA facility warehousing our digital data is located in Utah illustrates the point further, perhaps.)
Still, this legislation serves as an example to other states and gives advocates countrywide a precedent to point to—one that strikes the balance of allowing law enforcement to appropriately and narrowly use such technologies subject to judicial oversight, while also protecting the rights and privacy of the individual.
