TAKING THE STING OUT OF STINGRAYS
People have been talking a lot about StingRays (see, for instance this report). The undercover, not the underwater kind. Some of those people are ALG lawyers: Bill Thompson at the CLA fall conference on October 29, 2016, and Megan Savard at the Garage Series on November 1. Canadians are starting to wonder what these devices are and why they keep popping up in major investigations and prosecutions. We think we have the answer.
StingRay is a brand-name for a Mobile Device Identifier (MDI). When you use a cell phone to call, text or tweet, your phone’s radio connects to a cell tower so the data can travel across the network. The phone pings out its unique digital fingerprints to the cell tower so the tower knows who you are. MDIs pretend to be cell towers and grab the fingerprint of the devices trying to send data to a tower.
The police use MDIs combined with physical surveillance to figure out what phone their suspect is using. They follow their target from place to place. At each place, they deploy the MDI, which forces all the phones in the area to connect to it. Sifting through that mass data grab, they look for a digital fingerprint to identify the device.
Are MDIs a legal problem? First, there’s the obvious quandary of innocent privacy invasion. Canadians have not invited law enforcement to grab and keep their data for no reason. If it happens once, no big deal. But if it happens enough, the state gets enough information about innocent Canadians to effectively track or uncover your day to day movements. MDIs, overused, are the informational equivalent of a GPS tracking bracelet.
Second, there’s the full answer and defence problem. The police have been notoriously stingy about sharing MDI information. That needs to change. If the police are going to use these devices to investigate crimes, they need to start telling the court what they are doing and why – the presumed-innocent accused needs the chance to figure out if the Crown’s case is accurate and reliable. Maybe the StingRay actually captured exculpatory information? Either way, the defendant needs to know and the judge needs to supervise. Right now, it’s a black hole of “trust us”.
This post scratches the surface of the StingRay privacy and civil liberties challenges. problem. Want to know more? Stay tuned for Megan’s paper on MDI devices in the next issue of For the Defence magazine.