extremetech.com

US Government Confirms Unauthorized Cell Phone Surveillance in Washington

The federal government has been loath to discuss the use of rogue cell phone surveillance devices in the US. But the Department of Homeland Security has finally acknowledged that such devices are likely in operation in Washington DC. This revelation comes by way of a letter to US Senator Ron Wyden dated March 26. In it, the DHS confirms it has detected cell site simulators near important government agencies.

These eavesdropping devices are technically known as “IMSI-catchers,” but they’re usually just called Stingrays, after devices from Harris Corporation commonly used by police departments and federal authorities. All IMSI-catchers operate in the same basic fashion — they pretend to be a cell tower, forcing nearby phones to connect before passing the signal along to a real tower. This allows the Stingray to gather data from the device and listen in on conversations.

The current cellular standards were robust and difficult to crack when they were developed, but technology has advanced. It’s now possible to listen in on phone calls with the right hardware using attacks like the GSM Active Key Extraction. Stingrays can also track a phone’s location and block it from connecting to the real cellular network.

In the letter to Wyden, DHS admitted it could not determine the type of devices in operation. While it did know these devices were not operated by any legitimate law enforcement organization, it could not tell who was running the equipment. Security researchers and government officials have long suspected that foreign intelligence agencies have conducted cell phone surveillance in and around the nation’s capital. These signals are probably not from your average mobile hobbyist — Stingrays and similar devices cost between $1,000 and $200,000. Some are only good for short range and fit inside a small backpack or briefcase. Others are the size of a microwave and need a continuous power source.

DHS officials have told the AP that the agency detected unauthorized Stingray activity during a 90-day sweep that started in January 2017. Tracking down the locations of Stingrays would be a time-consuming and expensive undertaking. It would probably also require the cooperation of wireless carriers to implement new technologies, on which they aren’t anxious to spend money. Law enforcement is also suspected of dragging its feet as many departments and agencies rely on Stingrays to surveil suspects.

Government officials with certain hardened, ultra-secure cell phones won’t be affected by Stingray activity, but most people are just using off-the-shelf smartphones. They could easily be picked up by illicit eavesdropping devices.