Citing conversations with unnamed executives from Harris Corporation, a Florida-based government contractor that makes a widely used cell tower simulator, Wyden wrote that the devices “completely disrupt the communications of targeted phones for as long as the surveillance is ongoing.”
“According to Harris, targeted phones cannot make or receive calls, send or receive text messages, or send or receive data over the Internet,” Wyden wrote.
Harris Corporation director of global public relations Jim Burke declined to answer questions about whether the company’s devices can interfere with U.S. citizens' emergency call services. A Justice Department spokesman said: “we’re aware of the senator’s letter and will be reviewing it.”
Jonathan Mayer, a Princeton computer science professor who served as a technologist at the Federal Communications Commission, said the issue deserves close scrutiny.
“Anything that significantly interferes with 911 is a problem," Mayer said. "And anything that could significantly interfere with 911 deserves a close look.”
The devices work by effectively posing as a cellphone tower and tricking targeted cellphones into connecting with them, giving the user a sense of where the targeted phone is located. They can also be used to eavesdrop or plant malware.
Cell tower simulators have worried privacy advocates for years, and their availability online has sparked fears that foreign governments could be using them to conduct espionage in the United States.
The FBI says it primarily uses them to track suspects’ movements in high-stakes cases like drug trafficking and child kidnapping, and does not collect data from the phones themselves. The U.S. government does not have a monopoly on them, however: The devices can be found for sale on Chinese e-commerce sites. And technologists have built their own devices from scratch.
In June the Department of Homeland Security found them deployed near the White House. One mobile security firm claims to have detected them outside major government buildings and embassies across Washington.
The devices' wide-ranging use – and a web of nondisclosure agreements that limit the public’s view of how they work – has been a continuous point of contention for online privacy advocates.
In 2013 a trove of documents released through a Freedom of Information Act lawsuit revealed that federal investigators failed to fully detail the practice to judges authorizing warrants. Wyden’s letter revived those concerns, claiming that Justice Department’s warrant applications understate how much disruption the devices cause to cell services.
The Justice Department “knows far more about cell-site simulators than the courts,” Wyden’s letter reads. “It has an obligation to be candid, forthright and to fully disclose to courts the true impact of this surveillance technology.”
Stingray devices made by Harris Corporation are supposed to include a feature that would relinquish control when a targeted phone dials emergency services, but that the feature has not been independently tested as part of the company’s Federal Communications Commission’s certification process, according to unnamed Harris Corporation executives cited in Wyden’s letter. The letter similarly asserts that the devices could block emergency services for people who are deaf and hard of hearing by interfering with text-based emergency services.
In a 2017 FBI search warrant request to track the phone of a drug trafficking suspect, for example, an FBI agent wrote that the devices “may interrupt cellular services” of nearby phones, but described that disruption as “brief and temporary." The warrant does not discuss whether such disruption could interfere with 911 calls, something that legal experts said should play into courts' decision on whether a search warrant is “reasonable,” as spelled out in the Fourth Amendment.
“If what [Wyden’s] letter is saying is true about the extent of disruption that Stingrays cause, this is very concerning,” said Stephen Smith, a Stanford Law School professor who served as a magistrate judge from 2004 until 2018. “The ultimate test is whether the warrant is reasonable or not, and it seems that is a very important bit of information to have.”
For Harris Corporation, the government’s surveillance efforts are an important source of business. Harris Corporation has sold Stingray devices and related equipment to the FBI, Drug Enforcement Agency and the Immigration and Customs Enforcement among other federal agencies, sales that amounted to tens of millions of dollars over the past decade. A congressional committee staff report found the devices themselves cost $41,500 to $500,000 each.
A 2016 report from the House Oversight Committee said the Justice Department at the time had 310 cell tower simulators and spent more than $71 million on them between 2010 and 2014. Local law-enforcement agencies have used them as well, including metropolitan police in D.C., Alexandria and Baltimore, the report states.
Harris Corporation and the Justice Department maintain strict nondisclosure agreements preventing buyers from publicly discussing the technology, according to documents posted online by the ACLU. Cooper Quintin, a technologist at the advocacy group Electronic Frontier Foundation, said courts have been “kept in the dark” about Stingray technology.
“Harris Corporation might claim that they’re not in fact blocking 911 calls,” Quintin said. “But it’s unknowable because thanks to Harris Corporation’s nondisclosure agreements and their corporate policy of silence, we have very little information about how [Stingrays] work and what implications they have.”