The December 2012 document is a heavily redacted letter between the FBI and police in Tacoma, Wash., as the local department sought to acquire an IMSI catcher, sometimes described as a “fake cellphone tower” because it tricks individual phones into routing their calls and other data through the surveillance equipment. The Tacoma police were buying gear produced by Harris Corp., a Florida-based company that makes the StingRay and other IMSI catchers used by law enforcement agencies across the country.
The FBI letter, which was not classified but was designated as "law enforcement sensitive," told the Tacoma police chief that the Federal Communications Commission authorizes the sale of such surveillance equipment to state and local police departments on the condition that they first sign an FBI “non-disclosure agreement.”
The details of the agreement are redacted from the letter as released; the blacked-out portions stretch across the bulk of a six-page document, which was first published on Monday by MuckRock, a news site that helps journalists, researchers and others submit Freedom of Information Act requests and publishes the results.
The FBI, which calls IMSI catchers "cell site simulators," declined to comment on the document. The bureau has said elsewhere that it considers the tactics used by IMSI catchers to be sensitive technology that could be defeated if too much information becomes available about its capabilities. An affidavit by an FBI official in April said, "The FBI routinely asserts the law enforcement sensitive privilege over cell site simulator equipment because discussion of the capabilities and use of the equipment in court would allow criminal defendants, criminal enterprises, or foreign powers, should they gain access to the items, to determine the FBI’s techniques, procedures, limitations, and capabilities in this area."
The FCC last month began investigating reports of illegal use of IMSI catchers, by foreign intelligence services and criminals but has said it does not oversee the use of the surveillance gear by federal government agencies. Last week, the marketers of a device that’s designed to detect IMSI catchers reported finding 18 in the Washington area over two days of searching.
The locations, said the marketer of the GSMK CryptoPhone, included areas around the White House, the Capitol, the Russian Embassy and the cluster of defense contractors near Dulles International Airport. The CryptoPhone was not able to determine whether the IMSI catchers were being used by the federal government, local police or some other entity.
E-mails collected through a separate Freedom of Information Act request, by the ACLU, showed in June that the U.S. Marshals Service had asked police in Florida to not reveal that they had used IMSI catchers in determining the locations of criminal suspects. Instead, the police were instructed to say that they had learned the whereabouts of suspects using “a confidential source.”