Close Listening

Privacy, Security, and an Open Records Requet

by Jonah Max

published September 23, 2016

During an immobilizing snowstorm in 2014, residents of Johnston, Rhode Island could watch through their foggy windows as military-grade Humvees drove through snowbanks and down closed streets, looking for people and animals stuck in the winter snow. The vehicles, as well as other military devices—night vision goggles, submachine guns, gasmasks—could be seen again months later in the town park as the Johnston police held training exercises designed to simulate hostage situations, terror attacks, and manhunts. Though hardly acknowledged by the city’s police department, the equipment was just a glimpse of the hundreds of thousands of weapons and technological devices manufactured for use overseas and brought home through the now-infamous 1033 Program, a federal project designed to reallocate discontinued and surplus military technology to local police stations in America.

Since its induction in 2009, the program has continually drawn suspicion and ire from citizens and civil liberty groups who see the militarization of local police forces as a threat to Americans’ liberty, privacy, and safety. The conversation approached something of an apex after Black Lives Matter and other civil rights organizations documented and condemned the use of military tactics, weaponry, and surveillance by local law enforcement during protests following the deaths of Eric Garner and Michael Brown in the summer of 2014. Responding to these concerns, Jim Bueerman, president of the non-profit research group The Police Foundation, testified in front of the Senate Homeland Security and Governmental Affairs Committee in defense of the program. Echoing the message of many other advocates of the 1033 Program, Bueerman claimed that the “antidote” for the system’s abuse lay in its “transparency and accountability.” It’s worth noting that the original legislation called for neither transparency nor accountability, and instead authorized the acquisition and use of military technology for all local police departments without any formalized record. However, conveniently for Bueerman, just weeks before his testimony, the Pentagon fulfilled longstanding Freedom of Information requests regarding these programs from the New York Times and other outlets and released detailed reports on the various departments’ purchases.

While Bueerman’s slippery logic fails to acknowledge that for the vast majority of the program’s history, it was, by Bueerman’s own standards, abusable, he also fails to address the fact that the 1033 Program is simply one of countless programs, federal and corporate, designed to place military-grade technology in the hands of local police departments. Speaking with the College Hill Independent, Hillary Davis, a policy advocate for the Rhode Island ACLU, suggested that though “the 1033 Program certainly makes it easier for law enforcement to get military-grade technology…it’s very much not necessary for [them] to go through the 1033 Program anymore.” Rather, as Davis went on to say, corporations that manufacture and distribute particular military technology now often directly provide law enforcement with “free pilot programs” of their devices—programs which leave “no record that they’ve taken place” and allow departments to acquire weapons and technologies without public awareness. Recent leaks, such as one by the Intercept of a cyberweapons manufacturer Cobham, suggest that these pilot programs can offer local police an extensive array of tools for everything from covert video surveillance to car kill switch kits. Perhaps most worryingly, however, is a single surveillance device—The Stingray.

Also known by the names “Kingfish” and “Hailstorm” among others, the Stingray is a portable cell site simulator which cloaks itself as a telecommunications tower, prompting phones in a particular radius to join its falsified network. Once a phone is connected to this network, the Stingray operator can surreptitiously scrape its encrypted metadata—data which includes the phone’s location and the numbers it’s calling. With this information, law enforcement is able to track cell phone users virtually anywhere undetected, as long as the phone periodically rejoins the cloaked network. Since modern cell phone software bars one from easily seeing which tower a phone receives its signal from, this fabricated connection generated by a Stingray is undetectable to the phone’s user while the phone itself believes that it’s receiving a signal from a genuine tower nearby. Additionally, recent leaks and disclosures surrounding the Stingray’s software, called FishHawk, have led many journalists and tech experts to believe it now also possesses the capability to eavesdrop directly on phones connected to the device, allowing law enforcement to listen in on dozens of private conversations at one time. While manufacturers, federal agencies, and local law enforcement have worked hard to keep details on the Stingray and similar devices hidden, they’ve consistently tried to quell fears of the program by ensuring the public that no metadata is being stored by the device. This claim has been proven to be a lie; a leaked user manual explicitly details the Stingray’s ability to save and organize the call logs of connected cell phones.

It is not only the breadth and depth of the system’s informational dragnet which has caused concern for critics of the device, but also the simplicity with which the program accesses this information. Richard Tynan, a technologist at Privacy International, has written extensively on the ease with which a third party could set up their own improvised Stingray with largely public software and inexpensive hardware—quickly culling troves of information from unsuspecting phones using the very same exploits law enforcement is dedicated to preserving for their own use. And as greater and greater portions of America’s public and private infrastructure are connected to the Internet, the Stingray’s nearly unbridled access to the data traveling across these networks poses what Tynan calls “a massive risk to public safety and security.” While Senators such as California’s Dianne Feinstein (D) and North Carolina’s Richard Burr (R) claim their petitions for greater government surveillance and the preservation of backdoor exploits like the ones the Stingray uses are all in service of Americans’ security, they’ve completely failed to appreciate how these very exploits could quickly be turned against the American people. Banking information, hospital records, and other sensitive, private information shuttle through these networks every day, and the lack of safeguards against Stingray-like technologies renders all of it vulnerable and unsecure.

Even beyond these concerns of misuse and security, though, the device itself often operates in a fashion that seems unconstitutional. Talking with the Indy, Davis made it clear that the expansive nature of the Stingray’s dragnet means that it “captures large amounts of information on a broad group of individuals who aren’t even suspected of a crime or wrongdoing,” and it is capturing this information almost exclusively without warrant. While some legal experts have tried to argue that metadata is public information and therefore can be seized without any court oversight, the Stingray pays no heed to where this information is coming from, and therefore often invades constitutionally protected places, such as a cell phone user’s home. In this way, the device provides law enforcement with the ability to carry out secretive and often warrantless searches and seizures.

Although many in law enforcement argue that these breeches of privacy are done in the name of anti-terrorism, they’ve been unable to produce a single case in which any terrorist was ever apprehended with the aid of the Stingray or any other cell site simulator. Rather, court cases and other documents show that the technology has largely been used against low-level marijuana dealers and political activists. A case against a pot dealer in Tallahassee, for instance, was thrown out last year after evidence gathered against him from a Stingray was deemed unconstitutional by the state judge. More concerning, during the 2014 protests in Chicago, Los Angeles, New York, and elsewhere following the death of Eric Garner, Twitter was flooded with images of IMSI-catchers installed in police vehicles which would allow law enforcement to not only track protestors but also, if desired, disrupt their communication networks and block access to cellular service providers. More recently, the National Lawyers Guild raised concerns that some of the 50 million dollars the federal government gave Cleveland, Ohio to provide security for this year’s RNC was spent on Stingray technology to help monitor potential protests. The Cleveland Police refused to comment on these allegations.

The Stingray, though, could have legitimate uses as well. Manufacturers posit that the device’s location-tracking capabilities could help police locate missing persons or aide first responders looking for survivors after a natural disaster. Bueerman, whose Police Foundation has recently helped Baltimore Police and other departments with funding to acquire Stingrays, even boasted that the device “saves taxpayer money” during an interview with the Baltimore Sun last month. While Bueerman failed to explain precisely how a Stingray would do that, he also seemingly lost his penchant for “transparency and accountability,” instead telling the Sun that he couldn’t tell them “whether all of that is going on in Baltimore or not.” By Bueerman’s own logic, law enforcement—alongside corporations and organizations like the Police Foundation—have created a system primed for abuse. For Rhode Island, Davis noted that we have no way “of knowing to what extent the device is already being used” and as such it makes it extremely difficult if not impossible for the public to “parse out that line” between legitimate and abusive usage—a “confusion from which law enforcement has benefited,” Davis added. 

In an effort to both advance this debate and demand transparency and accountability, The Indy has submitted an Open Records Request to Colonel O’Donnell of the Rhode Island State Police. The request, which can be read below, simply asks Colonel O’Donnell to provide the Indy and its readers with all relevant information concerning the device and its use in Rhode Island, if any use exists. As greater and greater military technology returns home and falls into the hands of our local police, it unfortunately falls on citizens to ensure that it is done, at the very least, in a transparent and accountable fashion.


JONAH MAX B’18 is screening his calls.


Update: The Rhode Island Department of Public Safety Office of Legal Council responded to our Open Records Request on October 4, 2016, informing The Indy that at this time “the Rhode Island State Police does not use cell site simulators.”