By Doug Hornig, Senior Editor
We’re now into Year 2 AS (After Snowden), and many Americans remain concerned about the security of their cellphone calls. They should be, especially considering a phenomenon that’s hit the news in the past few months.
Fake cell towers.
With most phones, you have no way of knowing whether someone might be listening in. You may believe that you’re safe because your calls are encrypted.
Trouble is, you may not be.
If you’d like to be informed when your call is being intercepted, one company that can put the proper tech in your hands is ESD America. It manufactures the CryptoPhone 500, which has a Samsung Galaxy SIII body, but with the standard Android OS hardened by the removal of 468 vulnerabilities.
The CryptoPhone will set you back $3,500. When it detects that your call has been compromised, it lights up and displays a warning message: “Caution: The mobile network’s standard encryption has been turned off, possibly by a rogue base station (‘IMSI Catcher’). Unencrypted calls not recommended.”
(IMSI stands for “international mobile subscriber identity” and is a unique identification number used by all cellular networks. It’s generally 15 digits in length, allotting the first three digits to country code and the next three to the mobile network code, with the remainder comprising the mobile subscription identification number within the network’s customer base.)
IMSI catchers are portable devices also known as “interceptors” or “stingrays.” They are not themselves actual towers, but they mimic the real thing and trick your mobile device into connecting to them even if you aren’t on a call. Once locked on to you, stingrays can be used for real-time location tracking, with the ability to pinpoint where you are within two meters. But they can also eavesdrop on and capture the contents of your communications.
Stingrays are not cheap—upwards of $150,000 each—but they’re portable. They can be hand carried or mounted on a vehicle or drone. While the abilities of these interceptors vary, the full-featured versions available to government agencies have a broad range of powers. For example, the VME Dominator can not only capture calls and texts, it can even take control of the intercepted phone. Yes, it can turn on your powered-down phone and essentially use it as a bug.
But didn’t the Supreme Court recently instruct police that they must obtain a warrant before they can search your phone? Not really. The ruling was more limited, stating that police must get a warrant “before searching a cell phone seized incident to an arrest.”
The 11th Circuit Court has also ruled that warrantless cellphone location tracking is unconstitutional. But that conflicts with an earlier judgment by the 5th Circuit, which stated that people have no expectation of privacy over location data collected by cell towers because they are nothing more than a business record. The Supreme Court has not yet resolved that one.
Stingrays, however, can basically serve as wiretapping devices. Shouldn’t a warrant be required for cellphone intercepts, as it would be if law enforcement wanted to tap your home phone or place a bug behind the painting in your office?
Technically, yes. The Wiretap Act of 1968 requires the police to get a court order whenever they want to intercept any oral, electronic communication, or wire communications. It’s also been established that that protection extends to cellphones that have been turned on remotely for eavesdropping purposes.
To what extent are authorities honoring that requirement? Decide for yourself after reading this excerpt from a recent Newsweek article:
In January, Tallahassee, Florida, police used [a stingray] to track a stolen cell phone to a suspect’s apartment. The police then entered the home without permission, conducted a search, and arrested the suspect in his home. Not only did the police not have a warrant, but they did not disclose to a judge that they were in possession of a stingray because the department had received it on loan from the manufacturer on condition of secrecy.
Only after a judge granted a motion filed by the ACLU to unseal the transcripts of the case (the federal government had previously demanded the proceedings be sealed, going so far as to try to invoke the Homeland Security Act as the reason) was it was revealed that between 2007 and 2010 the department used stingrays without getting warrants around 200 times.
One ACLU spokesperson put it like this: “They are essentially searching the homes of innocent Americans to find one phone used by one person … It’s like they’re kicking down the doors of 50 homes and searching 50 homes because they don’t know where the bad guy is.”
Even though data is obviously hard to come by, the ACLU has been able to determine that stingrays are in use in at least 18 states—by local police, state police, or both. They’re also widely employed by the federal government, so you might want to remember that if you’re using your phone in the vicinity of a government facility, particularly a military base.
And if you’re encrypting messages, don’t count on that to save you. A stingray can force your 4G service down to a 2G level to thwart encryption, and the best of them will do it so that you’re not even aware it’s happening. Support for 2G is going away—AT&T is phasing it out by 2017 and Verizon by 2020—but manufacturers of stingrays are hard at work on the next generation of product, which will feature the ability to crack 4G.
Mass surveillance of law-abiding citizens is just one aspect of the global cyberwar that’s red hot yet all but invisible to most of us. Casey Research has prepared an in-depth look at the subject in its white paper, Cyberwar: Threats to Your Money and Freedom, and How to Protect Yourself. We urge you to download a copy today.
