The Department of Homeland Security (DHS) has acknowledged a 2017 discovery of several "rogue devices" placed throughout Washington D.C. often used by spies and criminals to track and eavesdrop on private cellular devices, AP reports.
The DHS admission came in a March 26 response to a November request from Oregon Sen. Ron Wyden (D), however the agency did not say how many devices were detected or where they found them.
The agency’s response, obtained by The Associated Press from Wyden’s office, suggests little has been done about such equipment, known popularly as Stingrays after a brand common among U.S. police departments. The Federal Communications Commission, which regulates the nation’s airwaves, formed a task force on the subject four years ago, but it never produced a report and no longer meets regularly. -AP
American intelligence and law enforcement agencies use similar eavesdropping equipment in the field, which can cost anywhere between $1,000 to around $200,000. The devices are typically the size of a briefcase but can be as small as a cell phone. Police use Stingrays to track down and implicate perpetrators of mainly domestic crimes.
The devices can be mounted in vehicles, drones, helicopters, and airplanes, allowing police to gain highly specific information on the location of any particular phone, down to a particular apartment complex or hotel room.
The Stingray units operate by tricking a cellular device into locking onto them instead of a legitimate cell tower - revealing the exact location of a particular phone. As AP notes, more sophisticated versions can eavesdrop on calls by forcing phones to step down to the older, unencrypted 2G wireless channel. Other Stingray devices can plant malware on a phone.
Thousands of members of the military, the NSA, the CIA, the FBI and the rest of the national-security apparatus live and work in the Washington area. The surveillance-savvy among them encrypt their phone and data communications and employ electronic countermeasures. But unsuspecting citizens could fall prey. -AP
The DHS reply from official Christopher Krebs said that the agency had observed "anomalous activity" consistent with Stingrays in the Washington area. Another DHS official speaking anonymously to AP says that the devices were detected during a three-month trial of equipment provided by Las Vegas-based agency contractor, ESD America.
Krebs notes in his letter that the DHS lacks the equipment and funding for wide-scale detection of Stingrays - even though their use by foreign governments "may threaten U.S. national and economic security."
Legislators have been raising alarms about the use of Stingrays in the capital since at least 2014, when Goldsmith and other security-company researchers conducted public sweeps that located suspected unauthorized devices near the White House, the Supreme Court, the Commerce Department and the Pentagon, among other locations.
The executive branch, however, has shied away from even discussing the subject.
Aaron Turner, president of the mobile security consultancy Integricell, was among the experts who conducted the 2014 sweeps, in part to try to drum up business. Little has changed since, he said.
Like other major world capitals, he said, Washington is awash in unauthorized interception devices. Foreign embassies have free rein because they are on sovereign soil. -AP
Turner says that every embassy “worth their salt” has a cell tower simulator installed, which they use “to track interesting people that come toward their embassies.” The Russians’ equipment is so powerful it can track targets a mile away, he said.
How to shut them down?
As AP notes, shutting down rogue stingray devices is an expensive prospect which would require the wireless industry to completely upgrade its infrastructure, which security experts say companies are loathe to pay for.
The upgrade could also lead to conflict with U.S. intelligence and law enforcement agencies. At least 25 states and the District of Columbia use the devices, according to the ACLU.
After the 2014 news reports about Stingrays in Washington, Rep. Alan Grayson, D-Fla, wrote the FCC in alarm. In a reply, FCC chairman Tom Wheeler said the agency had created a task force to combat illicit and unauthorized use of the devices. In that letter, the FCC did not say it had identified such use itself but cited media reports of the security sweeps.
That task force appears to have accomplished little. A former adviser to Wheeler, Gigi Sohn, said there was no political will to tackle the issue against opposition from the intelligence community and local police forces that were using the devices “willy-nilly.” -AP
“To the extent that there is a major problem here, it’s largely due to the FCC not doing its job,” said Laura Moy of the Center on Privacy and Technology at Georgetown University. Moy says that the agency should require wireless carriers to protect their networks, thus “ensuring that anyone transmitting over licensed spectrum actually has a license to do it.”
The FCC, however, said the agency's only role is "certifying" that said devices don't interfere with other wireless communications.
In other words, despite the prevalence of stingray devices throughout our nation's capital and most assuredly in use across the rest of the United States, nobody seems to be able to do anything about it.