Documents obtained by the New York Civil Liberties Union (NYCLU) this month show that the New York Police Department used stingrays more than 1,000 times since 2008 without warrants.
Originally developed for the military and intelligence agencies, stingrays are surveillance devices that impersonate cell towers in an effort to get nearby mobile phones to reveal identification data (e.g. IMSI and ESN) and location information. In some cases, stingrays, which don’t require the involvement of mobile carriers, can be used to obtain the numbers dialed and the content of communications.
In response to Freedom of Information Law (FOIL) requests submitted by NYCLU, the NYPD provided documents showing that the police department has been using the controversial devices in its investigations.
The problem, according to civil liberties advocates, is that stingrays had been used 1,016 times between 2008 and May 2015 based only on lower-lever court orders, such as pen register orders, and not proper warrants. Another issue is that the NYPD does not have written policies regarding the use of cell-site simulators.
The NYCLU is concerned that the use of surveillance devices without a clear policy and a warrant puts New Yorkers’ privacy at risk. That is because stingrays intercept information from all nearby cell phone users, not just the targeted device. Furthermore, pen register orders can be obtained more easily by police because, unlike warrants which require probable cause, they only require that the information is relevant to an ongoing criminal investigation.
The NYCLU published records in April 2015 showing that the Erie County Sheriff’s Office in New York used stingrays 47 times over 4 years, but only once obtained a court order for their use.
The controversy surrounding stingrays led to the Justice Department releasing a new policy in September 2015 for the use of cell-site simulators in an effort to enhance transparency and accountability. The new policy dictates that federal law enforcement agencies must obtain a search warrant prior to using stingrays, they can only collect basic information and not the content of communications, and they must delete the data of users not targeted.
Civil rights advocates welcomed the new policy, but as the EFF noted at the time, some issues still remain, particularly regarding some potentially problematic exceptions.
NYPD has been contacted for comment.