After a six-month investigation, TheBlot Magazine obtained a heavily redacted copy of a top-secret manual detailing StingRay and KingFish surveillance gear.
The Florida-based manufacturer of computer hardware and communications equipment used by government agencies attempted to block the public release of documents last year related to a once-secret cellphone surveillance device distributed to federal, state and local law enforcement.
TheBlot filed the FOIA request with the FCC last September. A heavily redacted copy of a 2010 user manual covering both StingRay and KingFish devices was delivered by the FCC last week and is being published here for the first time.
A StingRay is a radio interception device that, when deployed, forces cellphones in a given area to connect to it instead of a legitimate communications tower. A computer attached to a StingRay allows investigators access to a trove of data from intercepted cellphones, including call and messaging logs, geolocation data and handset information.
A KingFish is a less-expensive, more-portable version of a StingRay. Some records indicate that, while a StingRay is intended to be mounted in and controlled from a vehicle, a KingFish can be remotely controlled and can even be worn by its user.
Records reviewed by TheBlot reveal Harris first began manufacturing the devices for use by U.S. military analysts in the early 2000s. One of the company’s earliest buyers of cellphone spy equipment was the U.S. Navy, which could explain how the Harris-made surveillance gear got its aquatic nicknames.
In the mid-2000s, Harris began distributing its battleground intelligence equipment to federal and local law enforcement for use in domestic criminal investigations. A purchase order obtained by LA Weekly showed the Los Angeles Police Department (LAPD) obtained cellphone surveillance equipment using federal grant money in 2006. The application specifically mentioned StingRay and KingFish devices by name.
In records obtained by LA Weekly, the LAPD said the spy gear was purchased for use in “regional, terrorist-related investigations.” Numerous other grant applications obtained since then show a number of law enforcement agencies making the same argument in its request for federal money earmarked for homeland security initiatives.
But law enforcement agencies are not limiting their use to terrorism investigations. Documents obtained last year by Sacramento TV station KXTV found that Northern California police are using StingRays in routine criminal cases. And last July, a Georgia law enforcement official admitted to TheBlot that his officers were permitted to use a StingRay device obtained by the Gwinnett County Sheriff’s Department for “criminal investigations with no restriction on the type of crime.”
In some cases, police have been caught using StingRay and other cellphone surveillance devices without securing a warrant and without disclosing its use to a defendant at trial. Such incidents have resulted in judges tossing out the convictions of a number of criminal defendants, including a Florida man who argued that the Tallahassee police department’s secret use of a StingRay violated the Fourth Amendment.
Last August, the American Civil Liberties Union (ACLU) accused Harris of misleading the FCC after it obtained e-mails from 2010 that showed Hanna and FCC official Bruce Romano discussing an equipment authorization application for Harris surveillance gear, including its StingRay and KingFish devices. The ACLU suggested Harris misled the FCC by asserting its StingRay and KingFish devices would be used only in “emergency situations” by law enforcement officials.
But a source familiar with Harris’ 2010 application told TheBlot that the company had received authorization from the FCC several years before to manufacture and sell the devices specifically as an anti-terrorism tool, and that its application to the FCC’s Office of Engineering and Technology (OET) was intended to expand that authorization so that police could use legally use the devices beyond terrorism investigations.
The definition of what constituted an “emergency” was intentionally left vague so that the authorization would cover law enforcement in a wide range of criminal investigations, the source said.
The 2010 authorization, which Harris was eventually awarded, was spearheaded by the Federal Bureau of Investigation (FBI). The federal law enforcement agency now requires that local and state police sign a non-disclosure agreement with Harris before equipment is purchased and used. The intention of the non-disclosure agreement is unclear, though local law enforcement agencies have routinely cited it as a reason for withholding StingRay-related documents from public inspection.
E-mails released by the ACLU also show Harris requested the FCC remove any mentions of the words “StingRay” and “KingFish” from publicly released documents, including engineering tests and diagrams showing the placement of FCC labels. Instead, Harris requested those documents mention the surveillance equipment by using a unique equipment identifier called an FCC ID. It asked to treat other documents bearing the StingRay and KingFish names — including photographs and manuals — as confidential material.
Using the FCC ID numbers, TheBlot filed a FOIA request with the FCC last September seeking copies of the user manuals for the StingRay, StingRay II and KingFish devices. One month later, the FCC notified Harris that the manuals had been requested and asked the company to provide justification for keeping the documents confidential.
On Oct. 20, Harris executive Hanna reiterated the company’s request for confidentiality, saying the documents could be withheld under various FOIA exemptions and federal statutes dealing with business records, trade secrets and law enforcement techniques.
“As you are aware, public disclosure of certain material … could reasonably put public safety officials at risk, jeopardize the integrity and value of investigative techniques and procedures, reveal Harris trade secrets due to the nature of the equipment, and harm Harris’ competitive interests,” Hanna wrote.
In addition, Hanna wrote that the documents did not need to be released because they had been withheld before in criminal cases. Specifically, Hanna noted the case of Daniel Rigmaiden, who challenged law enforcement’s use of a StingRay after being charged with tax fraud in 2010. In that case, a judge ruled police did not need to disclose to Rigmaiden how they used a StingRay to catch him.
Later in the letter, Hanna asserted that the documents did not need to be disclosed by the FCC because “the FOIA requestor in this case has not made any showing, much less a ‘persuasive showing,’ as to the reason for inspection of this information.” (The FOIA law does not require individuals to give a reason for requesting public records.)
If the agency found against Harris, Hanna requested the FCC “return all materials for which confidentiality cannot be provided.” It is unclear if the agency returned any material to the company. Hanna did not return a request from TheBlot seeking comment on the issue.
In January, an FCC official told TheBlot by phone that the commission had enlisted another government agency to help redact the StingRay and KingFish user manuals for eventual public release. The official, who initially requested specific details of the call not be disclosed, refused to identify the outside agency, but said the manuals would likely be delivered within two weeks of the call.
The manual, which appears to be the same copy submitted to the FCC by Harris in 2010, reveals the StingRay and KingFish equipment are likely individual components that comprise a cellphone surveillance kit marketed and sold to police.
The manual indicates the StingRay and KingFish devices are sold as part of a larger surveillance kit that includes third-party software and laptops. Tables that contain the names of the other equipment is redacted in the copy provided by the FCC, but other records reviewed by TheBlot indicate the laptops are manufactured by Dell and Panasonic, while the software is designed by Pen-Link, a company that makes programs for cellphone forensics.
Numerous warnings note that the manual is “confidential,” “not for public inspection” and contains information that falls under the purview of the International Traffic in Arms Regulation (ITAR), a federal statute that prohibits certain defense information and equipment from being distributed outside the United States.
Harris also warns that the manual “may be provided only to … government law enforcement agencies or communication service providers,” and that the document contains material related to a “restricted use item” that is “associated with the monitoring of cellular transmissions.” (The latter phrasing appears clearly in one section of the manual, despite being redacted on other pages.)
None of the redactions made to the document were explained by the FCC as information withheld pursuant to national security interests. Instead, the FCC explained its redactions through Exemption 4 of the FOIA law, which protects the release of trade secrets and certain confidential business information submitted to the government.
The FCC’s redactions under Exemption 4 include packaging details, charts, diagrams and operational instructions for the StingRay and KingFish devices. The redactions also apply to seemingly inconsequential information — the letters “A,” “C” and “P” in the manual’s appendix — as well as information that has already been publicly released in other documents.
The obvious answer as to why the FCC chose to redact public and seemingly benign information is also the most-depressing: Given the choice between the government keeping its top-secret spy toy and encouraging public discourse on civil liberties, protection of privacy and due process for those accused of breaking the law, the feds would very much like to keep their toy — even if it means breaking the law and keeping the public in the dark.