Legislation from Jason Chaffetz would make it illegal for Stingray technology to be deployed without a warrant: ‘If you’re just on a surfing expedition, back off’

A bill has been introduced in Congress that aims to control the use of the sophisticated surveillance equipment known as Stingray, following a Guardian investigation which revealed the Internal Revenue Service (IRS) as the 13th federal agency known to possess the devices.

Stingrays are one of a class of suitcase-size devices known as “cell-site simulators”, which work by pretending to be a cellphone tower in order to strip data and metadata from any phones which connect to them.

They are used by at least 13 federal agencies, and at least 50 local and state police departments, according to the American Civil Liberties Union. A Guardian investigation in April uncovered the non-disclosure agreement that local police departments were forced to sign with the FBI before using Stingrays, which mandated local prosecutors to throw cases in some instances rather than reveal that they used the devices. In October, the Guardian reported that the IRS acquired Stingray technology for undisclosed reasons.

On 29 October, three days after the investigation was published, Representative Jason Chaffetz, the chair of the House oversight committee, along with the rest of the committee, sent a bipartisan letter to IRS commissioner John Koskinen demanding documents detailing the agency’s guidelines, policies and use of the devices.

The Senate judiciary committee is also holding an inquiry into their use, and in the Senate finance committee, Ron Wyden of Oregon also asked Koskinen for details about the agency’s use of Stingray. In response, Koskinen said that it requires a court order for its use.

On Monday, Chaffetz introduced a bill to the House floor which would make it illegal for Stingray technology to be deployed without a warrant by either local, state or federal agencies – a much higher judicial bar for their use than the Pen register, or trap-and-trace, court order which they previously required.

“When you find out the IRS, and potentially others are using this tech – whoa! That’s a bridge too far,” Chaffetz told the Guardian on Wednesday. “If they have [probable] cause, go get a warrant. But if you’re just on a surfing expedition, back off.”

His bill, which is called the Stingray Privacy Act, or Cell-Site Simulator Privacy Act, makes use of these devices without a warrant punishable by a fine or up to 10 years’ imprisonment.



Chaffetz said that technology development was moving faster, currently, than lawmakers can keep up. “My 14-year-old daughter knows more about technology than 90% of Congress,” he said. “It’s going to present its new set of challenges for America. The seminal question is: how much liberty are we going to give up in the name of security?

“I think personal privacy will triumph,” he added. “But we’ve got to be really careful.”