What is a Stingray?

Recent protests have led to concerns about how law enforcement is using technology to surveil protesters. Facial recognition, drones, body cameras, and Stingrays are all methods outlined in the media as threatening the first amendment right to free speech and assembly. While most are familiar with facial recognition, drones, and body cameras, Stingrays may be less recognized or understood.

Stingrays are a common name for International Mobile Subscriber Identity (IMSI) catchers. These devices are small, box-like, mobile network nodes that trick your phone into connecting to a fraudulent network to identify your phone, its location, its device number, and with highly advanced – and expensive – models, even access content. Stingrays work by jamming the 3G and 4G network protocols in a specific area, which forces your mobile device to connect to the only available network node, the fraudulent Stingray. It then captures your phone’s device identification information, revealing its location, and then releases the phone back to a legitimate mobile network. While advanced IMSI catchers can track payloads, which are text messages and call metadata, most afforded by law enforcement simply reveal location.  

The Federal Communications Commission authorized IMSI catchers for law enforcement use, under specific circumstances, since at least 2011. But Stingrays can be employed by hostile operators. Recently, unidentified IMSI catchers were found near the White House, the Pentagon, and the Federal Communications Commission. These IMSI catchers are illegal and hard to track. In 2017, the Department of Homeland Security concluded a pilot program meant to detect hostile foreign IMSI catchers. While network anomalies were found, indicating foreign Stingrays, no official attribution was made.

To help combat these hostile devices, I authored an amendment that was signed into law as part of the Intelligence Authorization Act of 2020. This amendment required the Department of Homeland Security, Federal Communications Commission, and Office of the Director of National Intelligence to undertake an effort to identify hostile, foreign IMSI catchers and remove them.

Are Stingrays surveilling protesters?

The potential use of Stingrays underscores the need for a federal privacy law. Legal use of an IMSI catcher authorized by a warrant provides legitimate law enforcement capabilities. But without this explicit consent, consumers should have the right to opt-in to the collection of their information.

Once a tool is revealed there is an assumed weaponization for nefarious purposes. Identifying the phones of hundreds of protesters in one small area is not only difficult, it would prove useless without cross coordinating that information with other known law enforcement data about the same individuals. Unless a protester is inciting violence or breaking a law, there is no need to track the peaceful exercise of first amendment rights.

The overlooked threat in this situation is the ability of foreign entities to track and exploit Americans. Based on the previously mentioned detection pilot program, we know that hostile foreign-manufactured IMSI catchers have been deployed near sensitive areas of the capital. Most of the protests in Washington, D.C. centered around the White House and surrounding areas. It is not outside the realm of possibility that China and Russia employed devices, like Stingrays, to identify those gathered in protest. The network disruption by these Stingrays either went unnoticed or was likely reasoned to be the effect of hundreds of devices accessing what they thought were legitimate mobile networks. 

To protect against foreign actors who do not comply with our laws, my IMSI catcher amendment must be fully implemented to thwart these hostile activities. Now more than ever, we must secure our technology supply chain, bring greater transparency to law enforcement, and pass a federal privacy law to ensure all Americans have control over the collection and processing of their data.