Two U.S. senators are questioning whether the FBI has granted itself too much leeway on when it can use decoy cellphone towers to scoop up data on the identities and locations of cellphone users. The lawmakers say the agency now says it doesn't need a search warrant when gathering data about people milling around in public spaces.
Sen. Patrick Leahy (D-Vt.) and Chuck Grassley (R-Iowa), the chairman and ranking member on the Senate Judiciary Committee respectively, have written a letter to Attorney General Eric Holder and Department of Homeland Security Jeh Johnson about the use of the surveillance technology called an IMSI catcher, though also referred to by the trade name “Stingray."
Cell tower simulators work by mimicking the legitimate cell towers used by companies like Verizon, AT&T, and Sprint. They catch the signals emitted from cellphones and other mobile devices and extract insight into who owns the phone, his or her location, and other details. That's a bit like someone setting up a big blue box, posting a United States Postal Service logo on the side, copying information from the letters fooled users deposit in it, and then soon after dumping the accumulated mail into a real mail box. No one need be the wiser.
The hitch of, course, is that spoofing the U.S. Postal Service would be illegal. What Leahy and Grassley are wondering is whether what the FBI is doing crosses a legal line.
What has particularly prompted their concerns, they say, is a meeting between their Senate staffs and the FBI. In that discussion, the agency representatives, they say, indicated that FBI policy requires obtaining a search warrant before using a cell-tower simulator to go after a target. But, say the senators, FBI officials revealed that along with the carve-outs for search warrants for cell-tower spoofing that follow regular law enforcement practice -- where the public is in immediate danger or where it is a fugitive being tracked -- the FBI has recently granted itself an exception for "cases in which the technology is used in public places or other locations at which the FBI deems there is no reasonable expectation of privacy."
That would seem to suggest that the FBI has determined that simply making a call while walking down a city street is enough to free federal law enforcement from its internal restrictions on digging into your phone data. The senators have given the departments until Jan. 30 to respond. The FBI did not respond to a request for comment.
The use of Stingray devices by state and local law enforcement as well has prompted objections from civil liberties groups; the Electronic Frontier Foundation has criticized the technology for offering police and others "all-you-can eat data buffets" on people in the United States. But there is, so far, little settled law saying how they can and cannot be used.
If some of the haziness around the legality of who is doing what with which digital data sounds familiar, it is likely because much of the Stingray debate closely tracks the lack of public knowledge around the novel and largely behind-closed-doors legal reasoning the Bush-era Department of Justice used to justify the collection of so-called metadata on Americans' e-mails after the Sept.r 11, 2001, attacks.
The letter from Leahy and Grassley makes plain how little even two powerful, well-resourced, and deeply-experienced senators on both sides of the political aisle know about how federal law enforcement is using cell-tower spoofing technology today. The senators are asking the Obama administration officials to fill in the gaps in their knowledge about everything from who, exactly, in federal law enforcement are using the spoofers to details on how often they are doing so without a warrant, simply on the grounds that people have made the choice so many millions of us do each and every day -- to bring our cellphones with us when we are out and about.