Cellphone Tracking Means They Can Hear You Now

Suitcase-size systems mimic cellphone towers and follow your every move.

If you have a cellphone, the odds are good that the phone company knows where you are as you move around throughout the day. And if you live in Chesterfield, someone else might know too: the police.

Back in December, Virginia Attorney General Ken Cuccinelli announced a boatload of grants to local law-enforcement agencies, made possible by a multimillion-dollar Medicaid fraud settlement with Abbott Labs. Chesterfield received more than $550,000 "to fund training for four officers for the Hailstorm Training in Florida, to purchase the StingRay I to Hailstorm Upgrade which will allow officers to transmit and receive communication signals from targeted cell devices, the Harpoon PA kit…an AmberJack, which is an antenna upgrade," and more.

Coming from now former Attorney General Cuccinelli, this was a bit surprising. Only a few months before, he had issued an opinion warning local police departments about license-plate readers. It was fine to use them to confront an immediate threat. But routinely using the readers—which can take up to 1,800 pictures a minute—to vacuum up large amounts of data regarding the whereabouts of ordinary citizens unconnected to an investigation is unconstitutional, he said. Some departments ignored his warning and continue to do it anyway.

And that's exactly what the Stingray and Hailstorm systems do—only with cellphones.

Originally used by the spooks at three-letter federal entities such as the NSA, the suitcase-size systems mimic cellphone towers. They send out a signal to which all cellphones in the area respond, thereby allowing the operator to track the location of phones in real time. (Another practice, known as a tower dump, collects data from cellphone towers about where phones have been.) The grants announcement from the AG's office was inaccurate in at least one particular: Stingray and Hailstorm communicate with many, many phones at once—not just "targeted" individual ones.

What's more, the systems are stealthy: They leave no evidence of having been used. If the phone in your pocket has answered a ping from a nearby squad car instead of a cell tower, you'll never know it.

Precisely what else the systems can do is also shrouded in secrecy. Hailstorm, for instance, reportedly has the capacity to capture the content of cell-phone conversations. Harris Corp., the manufacturer of both systems, insists it does not include that functionality in units provided to local law-enforcement agencies.

More than 100 police departments around the country use either Stingray or Hailstorm (and roughly a quarter of all departments rely on tower dumps). Often, the law hasn't caught up with the technology, so there are few statutory controls on how, or how often, it is used. According to a USA Today investigation, for instance, "when Miami-Dade police bought their Stingray device, they told the city council the agency needed to monitor protesters at an upcoming world trade conference." They needed a $400,000 gadget to "monitor" protesters?

Some police departments have been less than forthright about what they're doing. Some conceal their use of Stingray and Hailstorm, as when a Sarasota, Fla., police sergeant instructed a subordinate to change a probable-cause affidavit to keep the technology secret. In Sacramento, Calif., where officers also use the technology, judges and prosecutors say they are unaware of it. Federal authorities even have advised local agencies that if a judge asks how they got certain information that was obtained via Stingray, they should say it came from a "confidential source."

None of this is meant to suggest Stingrays and Hailstorms have no legitimate law-enforcement use. They clearly do. They even can help save innocent lives—for instance, by quickly finding an unconscious missing person.

But law enforcement still needs to operate within boundaries established by legal standards, judicial oversight, and public accountability. Unfortunately, when it comes to Stingray and Hailstorm the first two of those elements are often weak or absent, and the third occasionally meets stiff resistance. Some police departments have stonewalled media inquiries, including Freedom of Information Act requests, by citing nondisclosure agreements with Harris Corp.—a practice David Cuillier, who runs the University of Arizona's journalism school, finds disturbing. "I don't see how public agencies can make up an agreement with a private company that breaks state law," he told The Associated Press.

Chesterfield, to its credit, has been more forthcoming. In response to queries, the police department says it has had a Stingray since 2005, which it uses three to four times a month—but only with judicial oversight: "either a court order or search warrant." And the department never records, keeps or shares information collected by the system.

That's reassuring. Or at least it should be. Then again, the department recently insisted it did not have a quota system for writing traffic tickets—only "performance benchmarks" for them, which are supposedly different. Moreover, the public recently has discovered that the federal government collects a great deal of electronic intel on private citizens without telling them. Moreover, Director of National Intelligence James Clapper showed no compunction about lying about that in open testimony before Congress. And then there is CIA director John Brennan, who hotly denied the agency was hacking into Senate computers. Guess what? It was.

So yes, it's good to have Chesterfield's assurance that it is using cellphone tracking devices with care and restraint. It would be even better if the public could know for sure.