In 2015 a Toronto police spokesperson said, ‘We do not use the Stingray technology and do not have one of the units', but documents obtained after an access to information request and appeal by the Toronto Star prove that this is untrue. The files show that Toronto police have used the data interception technology since at least 2010, including in major drug and gun cases, a bank robbery and a missing person case.
An important read by @wendygillis @jayme_poisson @katecallen — Documents show that Toronto Police have used an IMSI catcher, also known as a Stingray, in five separate investigations. “It’s troubling that it took a FOI request to confirm" says our @BJMcP https://t.co/iU90cxn8Lj
— Canadian Civil Liberties Association (@cancivlib) March 5, 2018
How Stingrays Work
IMSI catchers, commonly known as Stingrays, are a form of ‘man in the middle' attack, mirroring a cell phone tower and sending out signals to local phones to tell them to send data via the Stingray. They are typically placed in surveillance vans which are parked close to the target, with the aim of capturing their cell phone data as soon as it is sent. The Stingray then forwards the data onto the real cell network tower so the target doesn't realise they are being spied on.
READ MORE: For the First Time, Court Refuses to Consider Secretive ‘Stingray’ Evidence
Sputnik spoke exclusively to Brenda McPhail of the Canadian Civil Liberties Association, who explained how this causes various problems, not least because Stingrays record data from every nearby phone, not just the target:
'IMSI Catchers capture identifying information from every single phone in the area the device is active: in other words, to find one particular cell phone user, data from hundreds more could potentially be collected. That raises a serious question of proportionality: is catching one person worth the privacy invasion for many?'
The police said they didn't use them, but they were lying. Now they say the devices (which it seems obvious they're borrowing from the Mounties) 'do not capture third-party data.' I guess we just have to take them at their word?
— Jon Robson (@Robsonian) March 5, 2018
McPhail went on to ask how the data is handled after it is collected, and whether the data from innocent people's phones is deleted. She points out that very little is known about the processes in place to govern the use IMSI catchers because of the institutional secrecy surrounding them:
‘There is such a profound lack of transparency around the way these devices have been and are being used that those questions are very hard to get answered-our answers are mostly from access to information requests made by journalists, and that tell us what happened in one or two cases, but fails to reassure the public that the right kind of warrants are always acquired, that the right safeguards are always in place, that data collected is never used for secondary purposes, or that there is no function creep, with uses shifting from very serious crimes to more trivial ones where the equation between public risk and privacy invasion changes.'
Lack of Legislation?
Another serious concern is that technology is developing much faster than the legislation governing its use, so the laws always lag behind. As McPhail explains:
'There is no legislation specific to this technology… maybe we should be updating the rules around electronic surveillance to take into account the evolving nature of surveillance technology generally.'
'We know from information in the public domain that sometimes police use IMSI Catchers with a transmission data record warrant, which has a relatively low threshold-they just need reasonable grounds to suspect it may assist in the investigation. Other cases used a general warrant which requires reasonable grounds to believe it will help, a more stringent standard more in keeping with the degree of potential invasiveness. How it is decided which kind of warrant to apply for is unclear from a public perspective, but it matters a lot in terms of when and how the devices get used.'
Stingrays: A Pan-American Problem
The invasive nature of IMSI-catching technology is not just a concern for Canadians, but for Americans too. The American Civil Liberties Union identified 72 agencies in 24 US states who use these surveillance methods, as well as over a dozen federal agencies. These include the military, the NSA, ICE, the Drug Enforcement Administration and the Internal Revenue Service. Sometimes this is done without a warrant, such as when police used a Stingray to track a suspect's movements in Washington via his phone.
In 2016 it was revealed that police in Rochester, NY, had spent over $200,000 to purchase and maintain Stingray equipment, and that police in California were even mounting the technology in a plane in order to spy on people from the skies. In many cases authorities have refused to release information or records on IMSI catchers, leading to concerns that their use may be even more widespread that is currently known.
‘We have serious concerns about the department spending hundreds of thousands of taxpayer dollars on these powerful and invasive devices.' — KaeLyn Rich of the NYCLU
After it became clear that police in Baltimore had used Stingrays in thousands of cases, Civil Rights groups filed a complaint with the FCC. The complaint highlights how the police have no license to use the technology and that it often interferes with other nearby phones.
‘CS simulator manufacturers anticipated that CS simulators could block 911 calls, and reportedly have therefore programmed some CS simulators to allow 911 calls placed by connected handsets to pass through to cell towers. But even in devices that have this functionality, the 911 pass-through feature is known and has been demonstrated to be unreliable.' — FCC Complaint about Baltimore Police use of Stingrays
These ongoing issues around IMSI catchers, especially the secrecy surrounding their use by various law enforcement agencies, led McPhail to conclude:
‘There needs to be a lot more transparency and accountability around the use of these devices-not to interfere with legitimate law enforcement purposes, but to reassure the public that IMSI Catchers are only used when there is a pressing investigative need that can't be met with a less invasive method, that the right safeguards are in place, and that the information of all of the innocent people swept up in the investigation is protected and ultimately, we would hope, deleted.'
