The Cell Site Simulator Census has uncovered more previously undisclosed records, this time from the Oakland Police Department and the Alameda County District Attorney’s Office. Among these documents is a Memorandum of Understanding (MOU) dated December 27th 2016, and enters Oakland Police into a five year no-cost contract for utilization access of the Alameda County District Attorney’s cell site simulator.
A vote by the Oakland City Council was unanimous in approving the resolution. While OPD had a StingRay for over a decade, the model quickly became outdated as telephone companies dropped the GSM (2G) cell network, leading to the device’s retirement in 2013. Cell site simulators that operate on 3G systems can force a 4G phone down to 2G, and access its data, which might explain their desire for an upgrade to a more powerful and 4G fluent cell site simulator, such as the Harris Corporation’s HailStorm.
Alameda County law enforcement agencies have long been planning this move, and in 2015 the Alameda County Board of Supervisors voted to complete the upgrade. Further back, in 2014, it was Fremont Police, OPD and the ACDA who jointly applied for a grant from the Department of Homeland Security. It is unclear as to why it took so long for the ACDA to complete the purchase, or which IMSI catcher model the upgrade was used for, though it stands to reason it was a HailStorm. We have sent a public records request in an effort to better understand the matter.
While federal agencies are known to at times loan out IMSI catchers, it’s rare to see a local agency expressly state that they are offering the device up to other law enforcement agencies operating in their jurisdiction. However this is exactly what the agenda report asserts, just a month after the election.
All a fellow agency has to do is agree to a similar MOU, and the device can be theirs too. This serves as further evidence why the borrowing of this technology at the state and local level warrants closer oversight.
California has been a hotbed of both cell site simulator use by law enforcement, and privacy activism. This has produced legislation which in theory intends to clip cellular surveillance, including requiring warrants, and mandating each California law enforcement agency that procures an IMSI catcher create its own internal policy regulating its use.
The recently adopted resolution appears to be in this vein and has strong language curtailing usage and potential abuse of cell site simulators. While these devices can be so intrusive that any attempts to limit this can be circumvented, many of the policy planks within the framework below are very strong, and set a clear benchmark that law enforcement agencies nationwide would do well to heed.
Crucially, OPD has agreed to limit their use of the cell site sim to search and rescue operations, locating mass casualty event victims, missing persons searches, and apprehending fugitives. This sets down a legal avenue where if the department does not comply with these directives, they can be held accountable.
The agreement also seeks to limit the kinds of content that can be intercepted, but remains unclear how they are accomplishing this - either deleting it near instantly or configuring the device in such a way as to intercept only very limited types of information.
Data wipes of the machine must be done once every 24 hours unless being used on an active mission, in which the rule is once every 10 days. Mandatory data scrubbing is a good start in protecting the information of bystanders, which is sucked up by the device when in the process of locating phones.
Some of this is surely the work of the new Oakland Privacy Advisory Commission, established in January 2016 as one of the nation’s first government bodies regulating surveillance and advocating for the privacy rights of citizens. They are cited several times in the MOU and agenda report as helping to craft the language of both the MOU, and the Oakland PD privacy policy. Something to watch for in the coming years is whether or not the creation of privacy commissions in local government will spread.
Read Oakland PD’s full release below, or on the request page.
Image via Wikimedia Commons and is licensed under CC BY 2.0
