Cell-site Simulators

Cell-site simulators (CSS) or IMSI catchers, sometimes referred to as Stingrays, are controversial cellphone surveillance devices. They operate by masquerading as a cellphone tower, forcing any phones in the vicinity to connect to them.

Very little information about how CPD uses CSS is available to the public. Documents obtained through FOIA lawsuits by LPL and ACLU have revealed that the CPD, FBI, and Harris Corporation have gone to great lengths to maintain secrecy around the purchase and use of CSS. Most recently, a North Carolina vendor named Tactical Support Equipment has become the sole provider of cell-site simulators to local police agencies under the brand name Nyxcell.

Where

The locations of these devices are unknown as they are mobile and some are as small as to be easily concealed. However there do exists some efforts to detect them.

According to documents obtained through FOIA, the CPD’s CSS system is stationed in the back of an unmarked Black SUV sits at Homan Square, the CPD facility in North Lawndale.

Costs

Over the last ten years, CPD has spent over $700,000 on cell tracking equipment including Harris Corporations's Stingray, KingFish, and AmberJack and Digital Receiver Technologies' DRTBox. The details of cell-site simulator purchases is known from work by Freddy Martinez, who first revealed that Chicago police had purchased Stingray devices from Harris corporation and Ali Winston, who revealed that cell-site simulators had been first purchased by Chicago police as far back as 2005.

The CPD has used “1505 funds,” money seized through civil forfeiture in drug related investigations, to finance these purchases. The CPD has also sought to obscure the costs of CSS technology from the public by censoring invoices and excluding expense records from their inventory asset management system.

In addition, the CPD has spent hundreds of thousands of dollars fighting a lawsuit over a FOIA request for records surrounding cell-site simulators, which it eventually lost.

Capabilities

Depending on the model and upgrades available on the specific cell-site simulator, these devices can be used to get the International Mobile Subscriber Identities (IMSI) of those near the cell-site simulator, can be used to interfere with a cellphone's ability to make calls and send texts (denial of service), and in some cases can enable the interception of the content of messages and calls. Read more at the EFF's excellent FAQ about cell-site simulators.

Efficacy

Unknown. It is also unclear how often these devices have been used in the city, though there are reports that they have been used at political protests.

Legal and Privacy Concerns

There are serious legal questions surrounding cell-site simulators. The manner in which these devices operate involves the indiscriminate data collection from phones of innocent bystanders.

The largest concern surrounding cell-site simulators is the deliberate secrecy around their use. The CPD does not keep a log of CSS use, and there are no directives in place outlining protocols for CSS related activity, as there are with most other surveillance technologies. The CPD has also signed a non-disclosure agreement (NDA) with the FBI requiring them to inform the bureau if there are any Freedom of Information Act (FOIA) requests from the public seeking information about this technology, enabling the FBI to “seek to prevent disclosure through appropriate channels.”

In 2017 the Citizen Privacy Protection Act (CPPA) went into effect in Illinois. This law requires any use of a CSS to be validated by a court order, and restricts CSS use to locating, tracking, and identifying communications devices, rather than capturing the content of communications. CPD officers claim that CSSs are almost never used without a court order, and that each order is carefully reviewed for compliance with the CPPA. However, the CPD, Cook County State's Attorney, and City Clerk have denied numerous FOIA requests by the ACLU and LPL for court orders and warrants relating to CSS use. Without adequate recordkeeping or avenues for the public to access those records, it is impossible to tell whether CPD employs CSS lawfully and ethically.

Recently, the Department of Homeland Security and the Department of Justice have both published new policies on the use of these devices at the federal level, requiring warrants for their use. In Chicago, these devices have been used with Pen Register/Trap and Trace orders but not warrants.

These devices are also potentially in violation of state level protection from local surveillance regulation.