Tracking Your Phone: A look into the technology

This is Part Four in a Capital News Service series, “Tracking Your Phone.” It examines the use of cell phone simulators to track phones, a practice employed by local and state police but veiled in secrecy. Parts One, Two and Three were posted this week.

By Courtney Mabeus

Capital News Service

Cell site simulators rely on signal strength and direction finding to locate a target device, said Heath Hardman, a former signals analyst for the U.S. Marines Corps.

Hardman used the devices while deployed in Iraq and Afghanistan in 2007 and 2008 and also taught troops how to operate them. If done incorrectly an operator could kick users off a network, forcing them to power their phone off and on before reconnecting, he said.

Or, if an operator broadcasts too broad of a signal, it can overload a network with too many devices looking to jump from one cell tower to another.

“It’s a little bit of an art and a science,” Hardman said.

For these reasons, the Federal Communications Commission must authorize a manufacturer to sell the device. But that authorization only signifies that the equipment meets FCC standards to control radio frequency interference, FCC officials said.

Cell site simulators were initially used overseas by intelligence agencies and federal law enforcement. Homeland Security agencies including the Secret Service and Immigration and Customs Enforcement also now use the devices, as does the Internal Revenue Service.

As the technology improved and spread through federal agencies, local and state agencies learned of them, too. DHS and DOJ officials have said that domestically, their devices only scoop up metadata. They do not gather content, like emails or text messages.

Melbourne, Fla.-based Harris Corp produces the StingRay, which has become a generic name for similar devices. Harris spokesman Jim Burke said it is company policy not to comment on its product. A spokeswoman for Germantown-based Digital Receiver Technologies, Inc., a Boeing subsidiary that produces a cell site simulator referred to as DRTbox, also declined to comment.

How police use the devices

Many agencies say national security and the need to protect an investigatory tool prevents them from talking about cell site simulators. That extends to the cases themselves. It’s unclear how many cases had links to national security. Logs released by some agencies do not explicitly cite national security but instead include violent crimes such as homicides and rape; others were more routine crimes, including burglaries, assaults and auto theft.

One case involved the theft of chicken wings.

“It’s supposed to be used for terrorism,” Meckler, the Baltimore public defender, said. “It’s not being used for the purpose for which it’s being designed.”

Montgomery and Baltimore counties

Montgomery County Police spokesman Capt. Paul Starks said the agency used its cell site simulator 80 times from April 1, 2015 through March 31. The number indicates uses, not individual cases, he said. About 30 percent, or 24, of those uses were for homicides and another three were kidnappings, Starks said.

The county may also use its cell site simulators to find critically missing people, like runaway children or those with mental, physical or emotional disabilities but the agency doesn’t track those, Starks said. The agency does not track how many times it successfully locates its target, Starks said. County police usually obtain a court order before using its devices or seek one soon afterwards, he said.

“We absolutely use it to go after the worst criminals or the worst criminal offenses,” Starks said. “We use it for violent felonies and do not use it for minor crimes and property crimes.”

Baltimore County Police spokeswoman Elise Armacost said the tool has been effective in local crimes. They successfully located 63 of 72 targets they sought using the device in 2015, according to a log released to CNS. In 2014, county police located 110 of the 119 targets they sought while using the device. The investigative unit that handles the device got 99 requests from county police to use it in 2015. In 2014, the unit got 150 requests, according to county logs.

The “technology is useful at helping us find missing persons and wanted suspects, thus furthering our public safety mission,” Armacost said in an email. “We use this equipment only when there is law enforcement need and probable cause.”

Success rates in other counties were not as high.

A tool in drug cases, theft, kidnappings

Since 2011, Howard County has investigated more drug cases with its devices than any other type of crime. Of the 41 drug cases, which represent a little more than 30 percent of the investigations, police made only one arrest. Several of those cases were to develop targets for wiretaps, according to a log released to CNS.

Howard police also used the device in suicides, kidnappings and in at least three cases where threats were made to public officials.

Annapolis’ log shows police located their target in seven of the 17 cases in which the equipment was used since late 2011.

But Annapolis Police couldn’t find their target in the case of a Pizza Boli’s employee who reported being robbed of 15 chicken wings and three subs while out on delivery in March. In that case, police got a court order, according to the police log.

The value of the wings and subs totaled $56.77.

No evidence of terrorism cases

Ricke, a Prince George’s County assistant public defender, still questions the use of an invasive surveillance device in tracking his client, Stephon Summers. When he questioned whether U.S. Marshals, accompanied by county police, had used a cell site simulator to locate his client in a Laurel apartment in January 2015, his response was a plea deal.

Summers is serving seven years for violating probation in addition to a concurrent five years for a weapons violation he was charged with when police found him in January 2015. Without the plea, he faced up to 25 years, Ricke said.

“He’s not a terrorist, he’s just a kid from the neighborhood,” Ricke said.

Jennifer Lynch, of the Electronic Frontier Foundation, did not know of any cases in which local police had uncovered terrorism using their cell site simulators.

“I don’t think it’s happened at all,” she said.