Confirmed: PA State Police Purchased Controversial StingRay Surveillance Technology Last Year

 

By Dustin Slaughter

The Declaration has learned that Pennsylvania State Police have been in possession of a highly-controversial type of surveillance technology, known as StingRay, since December of 2013.

The purchasing order, obtained by The Declaration through a PA Right-to-Know request filed in February, is with a highly secretive company based in Melbourne, Florida named Harris Corporation. The documents indicate that State Police purchased two of the devices last year at a total cost of $232,772, likely through federal homeland security grant funding.

The use of this powerful domestic surveillance technology is coming under increasing scrutiny – and criticism – for its ability to “trick” cell phones within a targeted radius into connecting to the device by posing as a fake cell tower. The easily-portable device can rest inside a police cruiser, for instance, and once a StingRay gathers a phone’s “International Mobile Subscriber Number” (IMSI) and serial data, the phone can be singled out for closer scrutiny, including real-time location tracking.

More details on the State Police purchase: last year, authorities obtained the latest version of the technology, HailStorm, an “upgrade” to StingRay which, if used in combination with a software named Pen-Link, enables authorities to communicate directly with cell service carriers over an Internet connection to strengthen real-time location tracking. The Declaration is now in the process of filing a new information request for any contractual agreements with Nebraska-based Pen-Link.

In addition to PSP’s Hailstorm upgrade, the agency also bought Harpoon “amplifier” antennae. This gives authorities the ability “to project its surveillance signal farther or from a greater distance depending on the location of the targets,” according to Ars Technica.

Organizations such as the ACLU have rightly criticized the use of these devices as legally problematic, citing its use by federal and local law enforcement as a violation of the Fourth Amendment’s “General Warrant” clause, because of its ability to scoop up phone data within a given radius from people not under investigation. An Electronic Frontier Foundation amicus brief submitted in a landmark case last year challenging the government’s use of the StingRay called the device “the biggest technological threat to cellphone privacy that you don’t know about.”

The device is quite often used without a warrant. Furthermore, its full capabilities are rarely disclosed when investigators seek warrants from judges.

A federal magistrate judge in the Southern District of Texas, when authorities approached him requesting use of the device for electronic surveillance in an ongoing investigation, became one of the few judges who denied a warrant on the grounds that law enforcement wasn’t specific enough about their intended use of the device. Crucially, Judge Brian L. Owsley also noted that the government provided no explanation regarding how they would handle captured cell data swept up from “seemingly innocent cell phone users.”

Linda Lye, a staff attorney for the ACLU of Northern California, says of the government’s willful obfuscation in front judges:

By withholding information about this technology from courts in applications for electronic surveillance orders, the federal government is essentially seeking to write its own search warrants.

It stands to reason that the same obfuscation by state and local police agencies could be occurring, including in Pennsylvania.

The questionable legality of these devices extends beyond authorities deceptively attempting to gain judicial permission for StingRay use. In 2003, Miami-Dade police purchased devices to surreptitiously monitor activists protesting at a world trade conference, according to procurement records obtained by Ars Technica.

The Declaration made repeated inquiries to a State Police media liaison seeking details including: Whether the agency is using the devices primarily for counter-terrorism purposes or a broader spectrum of investigations; what privacy and data retention policies the agency may or may not have implemented; and whether or not sharing agreements with other state law enforcement agencies exist. PSP has not responded.

Record requests filed by The Declaration to both the Pittsburgh Police Department and Philadelphia Police Department seem to indicate that Pittsburgh police have no contractual agreements with Harris Corporation; a response from Philadelphia police is pending.

We will continue our attempts to learn more about PA law enforcement’s use of this device, and will update our readers accordingly.