Who Is Tracking D.C. Cell Phones? Homeland Security Confirms Finding Surveillance Devices in Washington

An undisclosed number of surveillance devices known as "Stingrays"—used to track and intercept smartphone communications by posing as legitimate cell towers—are suspected to be in operation across Washington D.C., leading to fears foreign governments are using them to snoop on the capitol.

Homeland Security revealed in a March 26 response to Democratic senator Ron Wyden that its National Protection and Programs Directorate [NPPD] had spotted "anomalous activity…that appears to be consistent with International Mobile Subscriber Identity [IMSI] catchers,"—the formal name for the technology.

The NPPD acknowledged that the "malicious use of IMSI catchers is a real and growing risk" and said use by foreign spies would be unlawful and has the potential to threaten the security of communications and personal privacy of U.S. citizens.

The DHS letter was obtained and first reported by the Associated Press, which said, citing a DHS official, that the alleged devices were found in a 2017 audit. It remains unclear exactly how many devices were discovered or at what locations.

The surveillance equipment is used by law enforcement to track and monitor the phone calls of targets by duping the handset into believing it is connected to an authorized cell tower. According to the EFF, cell-site simulators, another name for the technology, are now used by the FBI, DEA, NSA, Secret Service and ICE, as well as the U.S. Army, Navy, Marine Corps and the National Guard.

The cost varies depending on the capability needed, but one Stingray device in a marketing brochure published by The Intercept in 2015 is valued at $134,950. The previous year, a team of mobile security analysts raised concerns that cell phone tracking equipment was in place across sensitive areas in Washington D.C.

Supreme Court Woman on Phone
A woman checks her cell phone as she waits in line to enter the U.S. Supreme Court to view a hearing November 29, 2017 in Washington, DC. IMSI devices were suspected to have been found in the city. Alex Wong/Getty Images

At the time, experts suggested that foreign governments could be spying on the city, which is home to a slew of political and law enforcement entities, from the FBI to the White House. Based on Wyden's letter, sent on November 17 last year, it is a suggestion the senator deemed alarming. He said such activity, if found, would "pose a significant threat to our country's national and economic security."

The Democratic official noted that despite the Federal Communications Commission (FCC) establishing a task force to investigate the experts' claims, it had issued no further guidelines on the issue of IMSI cell-catcher surveillance.

Hide and Seek

Homeland Security official Christopher Krebs noted in his response to Wyden that his agency does not currently have the ability to locate IMSI devices.

He wrote: "NPPD is not aware of any current DHS technical capability to detect IMSI catchers. To support such a capability, DHS would require funding to procure, deploy, operate and maintain the capability, which includes the costs of hardware, software and labor." He said the findings had always been shared with federal partners (which were not named) and that work with the FCC remains ongoing.

Mobile security expert Aaron Turner, who was involved in the 2014 D.C. study, told the Associated Press that foreign embassies were likely involved in the use of Stingray technology. He claimed that equipment used by Russia can snoop on targets up to a mile away from the source. Meanwhile, privacy advocates complain that official use of the devices is still "shrouded in government secrecy."

The EFF, which has worked with the ACLU on legal cases involving IMSI use, states on its website: "Some cell-site simulators are small enough to fit in a police cruiser, allowing law enforcement officers to drive to multiple locations, capturing from every mobile device in a given area—in some cases up to 10,000 phones at a time.

"Cell-site simulators invade the privacy of everyone who happens to be in a given area [although] the vast majority have not been accused of committing a crime."