Court documents ordered released by a judge in Oakland, California, have revealed rare insights into how local police and the FBI use a sophisticated surveillance device known as Stingray.



Stingray, manufactured by the Delaware-based Harris Corporation, is one of a class of devices known as “cell site simulators” or “IMSI-catchers”. About the size of a suitcase, they work by pretending to be a cellphone tower in order to strip metadata and in some cases phone content and data from nearby devices tricked into connecting to it.

Despite the fact that the devices are also capable of listening to phone calls, in many cases they still do not require a warrant to use, instead requiring a much lower-level authorisation known as a “trap-and-trace”, a court order designed in the era of the rotary phone.

However, following several years of reporting by the Guardian, Ars Technica, the Wall Street Journal and others, some states – including California – and some federal agencies now require a full warrant for their use.

The Oakland documents, which were first reported on by Ars Technica, show that the city police department used its Stingray device for several hours in a search for a suspect named Purvis Ellis, the lead defendant of four alleged members of an Oakland gang facing trial on nine federal charges including the attempted murder of a police officer in January 2013.

After they failed to locate Ellis using their Stingray device, the Oakland police then asked the FBI for help, the documents reveal. The FBI – using their own Stingray and an “augmentation device” about which little is known – located Ellis and brought him into custody.

Ars Technica speculates that this might have been because the Oakland police’s Stingray was an older model that did not work with 4G phone networks. In 2014 it was reported that Oakland was among the cities seeking funding to upgrade to the more sophisticated Hailstorm device, which is also made by Harris Corporation.

The scale of the use of such devices by local and federal law enforcement agencies has only recently begun to emerge into the daylight. A Guardian investigation in 2015 revealed the non-disclosure agreement that local police were forced to sign with the FBI before receiving permission to use Stingray – a document that mandated local prosecutors to abandon cases rather than risk information about Stingray becoming public.

The past two years have seen a slow drip of information about the spread of Stingray and similar devices. According to the American Civil Liberties Union (ACLU), at least 66 state and federal agencies are now known to use the devices, including the IRS, as well as dozens of state and local police departments.

The FBI’s statement in the Oakland case illustrates the lengths to which the agent goes to convince the judge that this type of surveillance is not overstepping the boundaries of privacy. The statement reads more like a press release than a legal declaration.

The agent says that, as configured by the FBI, “the cell site simulator does not remotely capture emails, texts, contact lists, images or other data from the phone,” a claim which is repeated almost in full two more times in the statement.

The agent also goes out of his way to describe how the data collected with the device was purged after the subject was taken into custody, and the affidavit from Oakland’s police department makes a similar claim.

As privacy activists have pointed out, the Stingray device – as well as similar devices like the newer and more powerful Hailstorm or Boeing’s DRTBox – are technically capable of accessing phone content and data; the judge, and the public, are effectively being asked to take the police and the FBI at their word that the devices are not being used in this way.

In 2015, the Guardian reported that up to 2,000 cases in Baltimore could be overturned after police were accused of “deliberate and willful misrepresentation” of the evidence obtained using Stingray devices.

The same year, Governor Jerry Brown of California signed a law which mandates that Stingray use requires a full search warrant, rather than a mere trap-and-trace order, to use. The federal departments of justice and homeland security have also updated their policy to require their officers to obtain a warrant in most – though not all – circumstances.

The Stingray Privacy Act, proposed in 2015 by Representative Jason Chaffetz of Utah, would make all warrantless Stingray use illegal. It is currently being considered by the House crime, terrorism, homeland security and investigations committee.