Sergey Nivens - Fotolia

US cracks down on mobile phone tracking by federal agencies

For years, the FBI has sought to keep secret information about stingrays that can be used to determine mobile phone location by spoofing a mobile cell tower

US federal agencies now have to obtain search warrants to use military-grade mobile phone tracking and surveillance technology under new rules announced by the department of justice.

The move comes in response to concerns about invasion of privacy through the unsupervised use of cell site simulators known as stingrays.

The policy follows moves to impose a state-level warrant requirement for the use of the devices by the states of Washington, Virginia, Minnesota and Utah.

For years, the FBI has sought to keep secret information about stingrays that can be used to determine mobile phone location by spoofing a mobile cell tower, according to Ars Technica.

The devices can also be used to intercept calls and text messages from targeted mobiles, as well as other phones in the same vicinity, which has prompted privacy concerns by civil liberties groups.

Rights campaigners say the stingrays are difficult to use in a targeted manner and typically collect details of thousands of mobile phones when used in urban areas.

But US agencies say stingrays have been an important tool in fighting crime in a broad range of investigations, including kidnappings, fugitive investigations and complicated narcotics cases.

“This new policy ensures our protocols for this technology are consistent, well-managed and respectful of individuals’ privacy and civil liberties,” US deputy attorney general Sally Quillian Yates said in a statement.

To enhance privacy protections, the policy includes a set of required practices with respect to the treatment of information collected through the use of cell-site simulators. 

This includes data handling requirements and an agency-level implementation of an auditing programme to ensure data is deleted according to the policy.

For example, the rules state that when a stingray is used to locate a known cellular device, all data must be deleted as soon as that device is located and this must be done at least once a day.

The policy, which comes into effect immediately, also states that cell-site simulators may not be used to collect the contents of any communication in the course of criminal investigations.

This means data on the device such as emails, texts, contact lists and images may not be collected using stingray technology.

The American Civil Liberties Union (ACLU) said that after “decades of secrecy” in which the US government hid the technology, the new rules are “a positive first step” but do not go far enough.

“Disturbingly, the policy does not apply to other federal agencies or the many state and local police departments that have received federal funds to purchase these devices,” said Nathan Freed Wessler, staff attorney at the ACLU.

“In addition, the guidance leaves the door open to warrantless use of stingrays in undefined ‘exceptional circumstances’, while permitting retention of innocent bystander data for up to 30 days in certain cases,” he said.

The ACLU has called on the justice department to close these loopholes, as well as the United States Congress to pass more comprehensive legislation to ensure citizens’ privacy is protected from these devices and other location tracking technologies.

Read more about surveillance

Read more on Privacy and data protection