Why would the well-heeled suburb of Gilbert, Ariz., spend a quarter of a million dollars on a futuristic spy gadget that sounds more at home in a prime-time drama than a local police department?
The ACLU caused a stir Monday with its extensive report of cellphone surveillance by local police departments, which routinely request location information and other data from cellphone providers, often under vague legal circumstances.
But one bit of information provided by Gilbert officials suggests that cops sometimes try to cut out the middle man. Buried in the 380 public records requests sent by the ACLU is a response from Gilbert which indicates that the town purchased a device that allows it to track cellphones on its own for $244,195.
"The Gilbert Police Department obtained a $150,000 grant from the State Homeland Security Program," the agency wrote to the ACLU in response to a public records request. "These funds, along with $94,195 of R.I.C.O monies, were used to purchase cell phone tracking equipment in June 2008 (total acquisition cost of $244, 195)."
Gilbert didn't offer additional details about the device to the ACLU, and Chief of Police Tim Dorn didn't immediately respond to requests for comment.
But several surveillance experts said the device sounds like a gadget that's sometimes called a stingray.
The stingray, made by Harris Wireless Products Group of Melbourne, Fla., lets users set up what amounts to a fake cellphone tower and trick all phones nearby into connecting with it. That data can then be used to track the physical location of anyone nearby carrying a powered-on cellphone -- even if the citizen isn’t on a phone call. A stingray can also register other data, such as the phone numbers dialed by all phones while connected to it. The device reportedly cannot record or intercept the content of a phone call, so it does not act like a wiretap.
Still, the stingray is at the heart of a hotly contested criminal case involving an identity thief named Daniel David Rigmaiden, who allegedly stole $4 million through a fake tax return scheme. Federal authorities used a stingray to find Rigmaiden in California in May 2008, then sent him to Arizona for trial.
Perhaps Gilbert was impressed with the result -- it says it acquired its device one month later.
In September 2011, a federal court in Arizona heard Rigmaiden's request to receive all details about the government's secretive use of the surveillance technology. Federal prosecutors are resisting disclosure because they say it will jeopardize use of the critical law enforcement technology in other cases.
Rigmaiden's case, as yet undecided, is largely seen as a test of the constitutionality of stingray and related police surveillance technologies. Would use of a stingray constitute a search, and thus require application for a time-consuming search warrant? Or do cellphone users give up their expectation of privacy by turning on a phone and carrying it in their pocket? The issues were discussed extensively in this recent Wall Street Journal story.
Use of a stingray-like device raises even thornier issues than cellphone records requests, said Catherine Crump, the lawyer who headed the ACLU project.
"I think when law enforcement starts purchasing technology that allows them to track cellphones in that manner, it raises a whole host of questions about how that technology is being used that are even more serious when they track people through carriers," Crump said. "At least when a carrier is involved, there's a third party that may raise concerns if the request is of questionable legality. But when a law enforcement agency can do on its own surveillance, that raises even more serious questions about whether there is appropriate oversight."
No other local police department that responded to the ACLU's public records requests mentioned purchase of a stingray-like device -- one other community mentioned borrowing such a gadget -- but Crump said that's because she didn't specifically ask about them.
"If I had to write the requests it over again, I would,” she said. “We didn’t realize how big an issue these devices were at the time. We know that there are others purchased by other agencies around the country, mainly from press reports."
The Miami police department, for example, asked Harris for a price quote in 2008. The firm's response is still on the city of Miami's website. A more extensive price list from Harris can be found at this website.
A spokesman for Harris Wireless said the company didn't comment on clients' purchases and referred questions to Gilbert's Police Department.
The use of fake cellphone towers by law enforcement has caught on outside the U.S., too. Britain's Metropolitan Police, which serves the greater London area and is that nation's largest police force, began deploying similar technology provided by England-based Datong PLC last year, according to The Guardian. The disclosure began a round of debate about civil liberties in Britain.
Matt Blaze, a computer science professor at the University of Pennsylvania and an expert on stingray-like devices, said they are a mixed bag.
"Certainly these devices are powerful surveillance tools that, if misused, have the potential to be quite invasive against the privacy of innocent people," he said. "But, then again, so do many other law enforcement investigative methods -- physical searches, hidden microphones, informants and so on. The question is how they are used, how often they are used and the oversight mechanisms in place to prevent and detect misuse."
Devices like stingrays are technologically limited in scope, however -- they can only monitor a limited physical area in real time -- so Blaze is less concerned about them than he is the revolving door of data between private companies and law enforcement.
"I'm less worried about law enforcement agencies with stingrays and other targeted surveillance gadgets than I am about location and other kinds of tracking through the carriers, especially when done without strong legal oversight or without probable cause," he said. "While I do worry about abuse of these kinds of electronic surveillance devices, the fact that they are inherently rather targeted in what they can collect acts as something of a built-in safeguard. I'm more concerned, in the long run, about large-scale surveillance capabilities being included in our communications infrastructure."
Still, privacy researcher Chris Soghoian – who has written extensively on law enforcement use of cellphone technology for surveillance – said police use of the stingray device is among the most troubling privacy developments in years. Some phone companies allow police officers to use a website to download customers’ GPS location data easily, “from the comfort of their own desks,” he said, and charge as little as $5 for the information. With phone company record access that easy and inexpensive, there’s no need for stingray, he argued.
“The real issue is that this device is about allowing police to perform surveillance when the phone company would say no,” said Soghoian, who is Graduate Fellow at the Center for Applied Cybersecurity Research at Indiana University. “This is not about saving time and money … it’s about the fact that there’s no one to insist that the law be followed when a stingray is used.”
*Follow Bob Sullivan on Facebook
*Follow Bob Sullivan on Twitter.