The Intercept: How Cops Can Secretly Track Your Phone

Kim Zetter writes a fantastic article in The Intercept about Stingrays, Dirtboxes and how law enforcement use these technologies to spy on cell phone usage. While there isn’t a lot of new technical information, it’s worth reading and reviewing as a guide to how local and federal agencies use the technology.

Stingrays have been used on the ground and in the air by law enforcement for years but are highly controversial because they don’t just collect data from targeted phones; they collect data from any phone in the vicinity of a device. That data can be used to identify people — protesters, for example — and track their movements during and after demonstrations, as well as to identify others who associate with them. They also can inject spying software onto specific phones or direct the browser of a phone to a website where malware can be loaded onto it, though it’s not clear if any U.S. law enforcement agencies have used them for this purpose.

As Zetter points out, while Stingray-type devices have been used by law enforcement since the 1990s, they’re getting a lot of attention now as protests and rebellions continue from Portland to Minneapolis and beyond. Police at many levels of government have been using the devices to surveil people engaged in legitimate protest and resistance.

It’s practically impossible, while on the ground at an event, to know if your phone is connecting to a legitimate tower or to a Stingray device. But there are steps you can take to protect yourself and your communications:

1. If you can’t be associated with being in the area at all, don’t bring your phone. The IMSI number – a unique identifier for the SIM card in your phone – is broadcast in plain text for anyone watching the airwaves to see. This includes your cell provider’s towers – and yes, law enforcement using a stingray. If you absolutely need to have a phone but can’t use your own, use cash to buy a burner and pre-paid phone.
2. Turn your cellular antenna off. You won’t be able to make phone calls or get text messages, but your phone won’t be trying to connect to cell towers or Stingray devices either. If you find a trusted network, you can try to use WiFi to catch up in a place that it’s safe. You should keep WiFi off when you’re not using it otherwise.
3. If you’re comfortable using your phone – or you have to have it – but are still concerned about eavesdropping: Use encrypted messaging apps. Signal is the most secure and the app’s developers don’t even have the ability to give law enforcement any information.

Everyone’s threat model is unique. Just like deciding if you’re on the front lines or not while facing off with cops, choosing the technology you bring to the event depends on your concerns.