OAKLAND, CA—Documents released last week by the City of Oakland reveal that it is one of a handful of American jurisdictions attempting to upgrade an existing cellular surveillance system, commonly known as a stingray.

The Oakland Police Department, the nearby Fremont Police Department, and the Alameda County District Attorney jointly applied for a grant from the Department of Homeland Security to "obtain a state-of-the-art cell phone tracking system," the records show.

Stingray is a trademark of its manufacturer, publicly traded defense contractor Harris Corporation, but "stingray" has also come to be used as a generic term for similar devices.



The cellular surveillance system's upgrade, known as Hailstorm, is necessary. Existing stingray devices will no longer work in a few years as older phone networks get turned off.

According to Harris' annual report, which was filed with the Securities and Exchange Commission last week, the company profited over $534 million in its latest fiscal year, the most since 2011.

"We do not comment on solutions we may or may not proivde to classified Department of Defense or law enforcement agencies," Jim Burke, a spokesman for Harris, told Ars.

Other locales known to be in the process of related federally-funded upgrades include Tacoma, Wash.; Baltimore, Md.; Chesterfield, Va.; Sunrise, Fla.; and Oakland County, Mich. There are likely many more, but such purchases are often shrouded in secrecy.

Relatively little is known about how stingrays are precisely used by law enforcement agencies nationwide, although documents have surfaced showing how they have been purchased and used in some limited instances. Last year, Ars reported on leaked documents showing the existence of a body-worn stingray. In 2010, Kristin Paget famously demonstrated a homemade device built for just $1,500.

Worse still, cops have lied to courts about the use of such technology. Not only can stingrays be used to determine a phone’s location, but they can also intercept calls and text messages.

Robert Shipway, of the Alameda County Public Defender’s Office, said he was not aware of their described use during the process of criminal discovery in county prosecutions in recent years. That could mean that local law enforcement and prosecutors are concealing or obscuring their use.

"[The upgrade] has not been fulfilled," Michael O’Connor, an assistant district attorney in Alameda County, told Ars. "It has not been approved and it has not been purchased."

He also noted that the county had applied for a similar grant to conduct an upgrade in 2012, but that application was denied, and he did not know why.

O’Connor also said that his office was currently in the process of gathering more relevant documents and would publicly release them in September. According to the newly released documents, the entire upgrade will cost $460,000—including $205,000 in total Homeland Security grant money, and $50,000 from the Oakland Police Department (OPD). Neither the OPD nor the mayor's office immediately responded to requests for comment.

Not your grandfather's stingray

One of the primary ways that stingrays operate is by taking advantage of a design feature in any phone available today. When 3G or 4G networks are unavailable, the handset will drop down to the older 2G network. While normally that works as a nice last-resort backup to provide service, 2G networks are notoriously insecure. Handsets operating on 2G will readily accept communication from another device purporting to be a valid cell tower, like a stingray. So the stingray takes advantage of this feature by jamming the 3G and 4G signals, forcing the phone to use a 2G signal.

Christopher Soghoian, a technologist with the American Civil Liberties Union and a close observer of stingray technology, told Ars that little is known about the upgrades Hailstorm offers.

"The only difference that we know about is the 4G," he said, citing a purchase order from the Drug Enforcement Agency first unearthed by The News Tribune in Tacoma. That March 2014 document states: "Stingray II to Hailstrom Upgrade, etc. The Hailstorm Upgrade is necessary for the Stingray system to track 4G LTE Phones"

He explained that the new upgrade will continue to provide existing surveillance capability even after major cellular providers turn off support for the legacy 2G network, which is expected to occur in upcoming years. In 2012, AT&T announced that it would be shutting down its 2G network in 2017. Without the forced downgrade to 2G, a 4G phone targeted by a stingray would not be susceptible to the same types of interception at present, but it likely would still be susceptible to location tracking.

"Presumably, at some point after, new phones sold by AT&T will no longer support 2G," Soghoian added. "Once new phones stop working with 2G, Stingrays won't work any more. At that point, the Hailstorm will be the only way."

Thomas Pica, a Verizon spokesman, told Ars that the company's network would be operational "through the end of the decade." T-Mobile nor Sprint did not respond to Ars' request for comment.

"These things aren't cheap," Soghoian added. "My guess is that there are law enforcement agencies around the country who are frantically trying to find the money because at some point in the future, in the next two to five years, their existing stingrays are going to stop working and my guess is that they're really worried about that."

Other firms that make related devices include Martone Radio Technology, located 25 miles from Oakland, in San Ramon, Calif. Martone also did not respond to Ars' request for comment. Martone advertises 4G LTE interception on its site.

For now, 4G LTE stingray-like devices appear relatively rare.

"We haven't seen any 4G LTE IMSI catchers from any of the brochures from companies that we've picked up yet, so this will be the first," Eric King, the deputy director of Privacy International, told Ars, using another name for stingrays.

His London-based organization, in conjunction with WikiLeaks and other groups, released the Spy Files in 2011, which includes many corporate documents illustrating telecom interception and surveillance.

"It isn't actually invasive at all."

Local law enforcement and federal agencies have taken extraordinary steps to conceal their use and have been reticent to disclose detailed information about their use.

"Once that's disclosed then the targets of the technology will know how to avoid it," O’Connor, the assistant district attorney, told Ars. "Once the bad guys understand how to beat it then they will. It's not like people are running around looking through peepholes. If I told you that I have a blue truck that I'm going to park in front of your house and told you I was going to watch you go out of your house then you're not going to come out of your house. It isn't actually invasive at all, but I can't tell you any more than I just told you without compromising the technology."

"It can't easily be resolved—the public's right to know, the Fourth Amendment rights of people who might be subject to this kind of analysis and the needs of law enforcement to keep sources confidential especially in a day and age when the bad guys have acquired considerable technology that is turned against good guys."

In nearby San Francisco, the police also refused to provide any stingray-related documents last week to Ars as part of another public records request.

In August, the Federal Communications Commission said it will investigate the "illicit and unauthorized use" of stingrays.

The newly published letter from FCC Chairman Tom Wheeler to Rep. Alan Grayson (D-FL) states that Wheeler has created a task force that recently took "immediate steps to combat the illicit and unauthorized use of IMSI catchers. The mission of this task force is to develop concrete solutions to protect the cellular networks systemically from similar unlawful intrusions and interceptions."

As a result, one state lawmaker has even recently attempted to regulate the device’s use in the wake of the disclosure of the Hailstorm acquisition in Oakland County, Mich.

"The most frustrating part of this whole situation is that the county continually refuses to share information on what the technology does, while telling lawmakers and the public to just trust them," Michigan state representative Tom McMillin said in a statement in June 2014. "Among other things, this technology can mimic cell towers to collect data, and citizens wouldn’t have any way of knowing their privacy, or worse their rights, have been violated. To me, that runs into our constitutional rights."