DHS Oversight Report Says ICE, Secret Service Illegally Deployed Stingray Devices

For years, Stingray devices (the most famous brand name for cell site simulators) flew under the radar. Law enforcement had them and used them, but often hid their use under court orders and subpoenas designed to obtain phone records, rather than the precise location of phone owners.

Once information about Stingray devices went mainstream, the feds finally decided to start respecting the Fourth Amendment. In 2015, the DOJ instituted a policy requiring warrants for cell site simulator (CSS) deployment. Sure, it wasn’t codified and it was riddled with exceptions, but it at least created a paper trail for this new-ish form of snooping.

The FBI was far from the only federal agency deploying CSS devices. Documents obtained by Buzzfeed showed DHS agencies were deploying Stingrays hundreds of times a year — all of it happening with very little oversight, guidance, or established policies.

As it turns out, the DHS has its own rules for CSS deployment. But it doesn’t have many rules. And the rules it has, it often ignores. Also, it failed to get the proper paperwork in order before sending agents out with cell tower spoofing equipment.

That’s all contained in a recently released report from the DHS Inspector General. The report [PDF] opens with the bad, but pretty much expected, news that agents working for ICE and the Secret Service have been illegally deploying Stingray devices. (h/t EFF)

The United States Secret Service and U.S. Immigration and Customs Enforcement, Homeland Security Investigations (ICE HSI) did not always adhere to Federal statute and cellsite simulator (CSS) policies when using CSS during criminal investigations involving exigent circumstances. Separately, ICE HSI did not adhere to Department privacy policies and the applicable Federal privacy statute when using CSS. For the cases we reviewed, the Secret Service and ICE HSI obtained required search warrants for [redacted] CSS uses, respectively. However, the Secret Service and ICE HSI did not always obtain court orders required by CSS policies and Federal statute when using CSS during investigations that included exigent circumstances.

It’s unknown how many times policies were violated. That information has been withheld. But what’s in the report still shows a whole lot of abuse.

First, it appears the agencies may have utilized equipment owned by local law enforcement to bypass internal warrant requirements. Second, when exigent circumstances were cited, agents were still required to seek pen register orders within 48 hours of deployment — something they apparently regularly chose not to do. Third, the DHS and its component agencies went ahead with CSS device purchases and deployments without a federally required privacy impact assessment (PIA) in place.

It’s unknown how long these agencies have owned and deployed Stingray devices. What is known is that the DHS followed the DOJ’s lead and instituted a warrant requirement on October 19, 2015, roughly a month after the DOJ put its policy in place. This policy was adopted and written into ICE and Secret Service policies in 2017.

While the DHS agrees with the Inspector General’s recommended fixes, the report shows the agencies examined by the IG making excuses for their failure to follow law and policy. Here’s the Secret Service attempting to pass the buck on its failure to obtain a required court order following an “exigent circumstances” deployment.

Of the [redacted] exigent uses of CSS without warrant or court order, [redacted] were conducted by a field office in support of a local law enforcement agency. In these [redacted] instances, the Secret Service explained that, according to the county prosecutor’s office, the county judges did not understand why the prosecutor’s office sought to file an “emergency pen trap order” and believed it to be unnecessary. Therefore, moving forward, the county prosecutor’s office decided it “would not file” emergency pen trap orders following exigent missions. Although Secret Service explained that the prosecutor’s office sought to file an “emergency pen trap order” for these investigations, its investigative records did not indicate that the exigent circumstances were also emergencies as defined by the Pen Register Statute and included in CSS policies.

It also chose to blame the US Attorney’s Office for its failure to seek pen register orders in cases like these. According to the Secret Service, the USAO felt pen register orders weren’t needed because the collection (via cell site simulator) did not involve cell service providers in any way. That’s an interesting interpretation of the policy, given that nothing in the court order requirement specifies that cell service providers must be part of the process. The warrant/court order allows the search of people’s cell phones. It has nothing to do with searches of cell provider records.

The report notes ICE did the same thing: failed to seek pen register orders following exigent circumstances deployment. Unlike the Secret Service, ICE did not attempt to shift the blame to others. Instead, it offered no comment at all about these failures, nor its apparent unwillingness to properly follow the chain of command when seeking to deploy cell tower spoofers.

ICE HSI’s CSS policy states that supervisory approval should be documented if circumstances permit and requires data deletion following each mission. We identified [redacted] instances in which ICE HSI did not document supervisory approval and [redacted] instances in which ICE HSI did not document data deletion. ICE HSI addressed the supervisory approval issue with an update to its reporting system to ensure CSS approvals are documented.

Unfortunately, the report redacts anything that would show how frequently policies and warrant requirements are ignored. And the counts shown here are only representative of the whole. The IG only took a sampling of investigative records. Depending on what it picked, whatever the numbers are may be under-representative of the overall problem.

While it’s good the IG chose to take a look at this, the decision to prevent the public from knowing how often these illegal searches took place is far less helpful. The public is both paying for these legal violations and being subjected to them. Taxpayers deserve to know just how often these things are happening. But what’s clear is these agencies can’t be trusted with the powers they’ve been given. Some of this broken trust could be rebuilt by simply allowing the entire truth to be told, rather than hidden behind self-serving black bars.