News

The FBI is testing out an old but controversial spy technology for smartphones on cars. It appears to be working for the agency.

getty The FBI is using a controversial technology traditionally used to locate smartphones as a car tracking surveillance tool that spies on vehicles’ on-board WiFi.

Known as a Stingray or a cell-site simulator, the tool masquerades as a cell tower in order to force all devices in a given area to connect into it. Agents can then pick the number they’re interested in and locate the device. Normally that would be a mobile phone, but a search warrant application discovered by Forbes shows it can also be used to find vehicles, as long as they have onboard Wi-Fi. That’s because car Wi-Fi systems act like a phone, in that they reach out to mobile networks to get their data. So it makes sense that police would use it to find a car, though this appears to be the first case on record of it happening.

The application to use the Stingray was filed by the FBI in Wisconsin in May, as it sought to locate a vehicle – a Dodge Durango Hellcat – it believed was being used by a man indicted for drug dealing and firearms possession crimes.

The FBI had already been given permission to use other kinds of surveillance to locate another vehicle, a “black Jeep,” associated with the suspect, according to the warrant application. Again, they were surveillance techniques traditionally used to track cellphones, the first being a pen register, which gets data from a cellphone provider to monitor connections made by the device to other phones or electronic devices. The second was a so-called “ping warrant,” which shows the locations of cell towers used by a device. That gave them the location of a car dealership, where they learned the suspect had traded in the Jeep for the Dodge, the FBI wrote in its application.

After that, the FBI decided to use the cell-site simulator. Towards the end of the warrant application, a federal agent explained why, noting that cars like the Dodge were “frequently equipped with cellular modems inside their vehicles. These cellular modems are assigned a unique cellular identifier and generate historical and prospective records similar to a traditional cellular phone.”

“These records can assist law enforcement in identifying the location of the vehicle including patterns of travel and areas where the subject may reside or frequent. Most Original Equipment Manufacturers (OEMs) have partnered with AT&T or Verizon to provide cellular connectivity within their vehicles. A check of open source information from AT&T identifies the 2021 Dodge Durango Hellcat as a vehicle that has a built-in WiFi hotspot that is serviced by AT&T.”

The Stingray tool appeared to have helped, with another government document showing the warrant had been executed and that the cell-site simulator had indicated there was a “high probability” the Dodge was located inside a garage.

The suspect in the case, Shaft A. Darby, has pleaded not guilty to the three charges he is facing. Having been indicted in March, he was arrested in mid-July.

Stingrays have been controversial in the past as they suck up data from all devices that connect into them, meaning information on many innocents’ phones or cars will be hoovered up. That’s why lawmakers have proposed legislation to mandate warrants with strong probable cause before the surveillance technology is deployed, and why warrant applications come with boilerplate disclaimers like the one in Wisconsin: “The investigative device may interrupt cellular service of phones or other cellular devices within its immediate vicinity. Any service disruption to nontarget devices will be brief and temporary, and all operations will attempt to limit the interference with such devices.” It also promises to delete data recorded from non-suspects.

The case highlights how cars are no longer just vehicles, but networks on wheels, and all that data can be useful to government agencies. As Forbes recently reported, police can and have acquired location data from a car’s airbag system or brake light module. They’ve also previously requested location data from companies that have in-car systems that track millions of vehicles’ GPS coordinates every day, including GM OnStar, and fleet management providers Geotab and Spireon.

“Many people don’t realize that modern cars aren’t just wheels and an engine anymore, they are computers and cellphones too,” says Nate Wessler, deputy director of the ACLU Speech, Privacy, and Technology Project. “These features offer convenience and efficiency to drivers, but they also generate sensitive information about where we go and what we do. Strong privacy protections are important for this kind of vehicle information, just as they are for information generated by our cell phones and laptops.”

Follow me on Twitter. Check out my website. Send me a secure tip.