The U.S. Marshals Service is reportedly spying on criminals — and law-abiding Americans, as well — by tricking their cell phones into relaying identification data to airplane-mounted devices. The government agency sends up Cessna aircraft equipped with devices that function like fake cell towers and intercept identifiers from phones on the ground. Tech Tuesday explores how this crime-fighting, but privacy-challenging, tool works.
- Devlin Barrett Reporter, The Wall Street Journal
MR. KOJO NNAMDIFrom WAMU 88.5 at American University in Washington, welcome to "The Kojo Nnamdi Show," connecting your neighborhood with the world. It's Tech Tuesday. On Tech Tuesday, today, airplanes and cellphones. Later in the broadcast, we look at the debate over lifting the federal ban on in-flight phone calls. But first, new revelations about a government spying program that mounts fake cell towers on small planes and grabs data from the phones of fugitives, drug dealers and law abiding Americans on the ground.
MR. KOJO NNAMDIThe Wall Street Journal reports that the US Marshals Service sends up planes equipped with a device that tricks cell phones below into identifying themselves. If the device finds the phone it's looking for, it can then hone in and locate it with great precision. Joining us to explain this seven-year-old crime fighting and privacy challenging program is Devlin Barrett. He's a reporter at the Wall Street Journal. He joins us from studios at the Wall Street Journal's Washington's bureau. Devlin, thank you for joining us.
MR. DEVLIN BARRETTHi Kojo.
NNAMDIIf you have comments or questions, give us a call, 800-433-8850. You can send email to email@example.com. Devlin, you wrote about the secret program of the US Marshals Service, it's part of the Justice Department. The program uses fake cell phone towers mounted on planes to try to locate criminals and fugitives. How do these fake cell phone towers communicate with cell phones below and ask them for their unique identifier?
BARRETTWell, they basically use the existing cell phone technology and essentially trick these phones into identifying themselves. What they do is they send out a signal that says, okay, this device is the nearest cell tower. Now, as you probably know, all cell phones are designed to connect with the nearest tower. Otherwise, it would be very hard to make calls most of the time. Now, this device isn't really a tower, but it sends out just enough information to make the phones believe that it is the nearest tower, even though it's not the nearest tower.
BARRETTAnd then all the phones that can hear that device send in their registration information, which the device then sorts through, looking for the special number that it's seeking.
NNAMDIThe technology lets the Marshals service make a broad sweep over an area and then zero in on the target phone by triangulating its location. How does that happen?
BARRETTRight. Well, it's pretty interesting technology. And what they've done is they've taken a technology that we've known about and they've added a new twist, which is to make it airborne. And making it airborne makes it much more effective and much more powerful. Essentially, what the technology does is because it registers the identifying information from the phone, it can then say, okay, now that I have the phone that I'm looking for, I want to focus on that signal and I want to figure out where that signal's coming from.
BARRETTThis usually means the plane will do sort of a long arc so that it will pick up the signal strength from a couple different locations in the sky and then it can give you a reading within, you know, two or three meters, as to exactly where that phone is.
NNAMDIAnd so, when I'm walking around with my cell phone, if this plane happens to be flying in the sky, it means that my cell phone, along with maybe thousands, maybe hundreds of thousands of others who are in that general area, I guess depending on how inhabited the area is, all of our cell phones will tell this cell tower, here I am. Here's my information.
NNAMDINow, the cell phone -- the, the fake cell tower then analyzes, or goes through that information.
NNAMDIWho is the government looking for with this technology? It's being used both domestically and overseas.
BARRETTCorrect. Domestically, what they're doing is they're looking for, largely, fugitives, but also just criminals who are wanted and haven't been caught. So, you know, everything from drug dealers to suspected murderers to folks who are, you know, frankly worth putting a plane up in the air to look for. What I'm told is that they rarely will go up looking for just one person as a function of like time and money, essentially. They'll often try and do 10 fugitives at a -- in a group, let's say. And search for all 10 of those numbers to justify the cost and expense of having the plane up and having people on the ground coordinating with them.
NNAMDIDo you know whether or not it has been successful?
BARRETTI'm told it's very successful. For finding fugitives, I'm told this is a very effective method. And, you know, some of the, some of the applications are obviously trickier overseas, because in overseas, you're talking about war zones and things like that. But I'm told it's a very effective method and the concerns that are raised, frankly, are concerns of what about all the innocent peoples' data that's being sort of filtered through this machine along the way.
NNAMDII -- that's what I was about to raise. Fine, I can say goodbye to my bookie, but this program raises civil liberties questions. One is how well judges understand the technology when they okay this type of search. Another is how much privacy is worth invading to find one, or as you point out, usually a few, criminal suspects.
BARRETTRight. And that's the big question. One of the sort of great civil liberties questions that's been posed by this is all right, so how many peoples' privacy is it worth invading to find one criminal? Is it worth invading 100 peoples' privacy? Is it worth invading, you know, thousands of peoples' privacy? And even, and these are very small bytes of data they're taking. And they're taking them for very short periods of time. I think what concerns the civil liberties folks is the fact that even though you're taking a very small byte of data for a very short period of time. You know, add that, multiply that by 10,000, 20,000, 30,000 per flight and you've got a lot of information.
NNAMDIWe're talking with Devlin Barrett. He's a reporter with The Wall Street Journal about his story on airplane-mounted devices that are spying on Americans, courtesy of the US Marshals Service of the Justice Department. You can call us with your questions or concerns at 800-433-8850. You can send email to firstname.lastname@example.org. You can shoot us a tweet @kojoshow or you can go to our website, kojoshow.org and join the conversation. Ask a question or make a comment there. Devlin, how did the companies that provide cell phone service react to news of this program, which can momentarily hijack their customers' phone signal?
BARRETTI'm told they had no idea. Verizon says that when we called them was the first they'd heard of it. And the FCC, which actually regulates the airwaves, also said they had no idea this was going on. So, I think the folks who work in this space as commercial partners and regulatory agencies really were in the dark about this. And it will be interesting to see how they respond to the idea that, you know, look, the government is operating a device that basically pretends to be a Verizon tower, or pretends to be a Sprint tower, or pretends to be an AT&T tower. You know, over the long run, I don't know how the companies are going to feel about that.
NNAMDI800-433-8850. Do you feel it's appropriate for the government to be using this tactic in order to find fugitives and criminals? Or do you feel it might be an invasion of your privacy, 800-433-8850? You can send email to email@example.com. Devlin, do we know what happens to this phone identification data after it's collected? Is it saved for future reference? Is it immediately discarded?
BARRETTThe government says they don't keep a database of this information. We do know that the devices are built in such a way that the devices themselves can hold the information. So one of the questions I, as a reporter, have had is, you know, are people being careful to wipe these devices after every use, or are the machines just sort of sitting on a bunch of data? And frankly, we don't have an answer on that at this point. The government does say they don't keep an overall database, but I think, I think the sort of unanswered question at this point is are there a lot of, frankly, little databases sitting out there?
NNAMDIHere is Juanita in Washington, D.C. Juanita, you're on the air. Go ahead, please.
JUANITAYes, Kojo, thanks for taking my call. My thing is with the United States, and I've known this for a long time now, I watched it or listened to it. They tell everything that they do. How do you catch people with a device and you've already told them that you're trying to. Me, I don't care if they listen to my conversation, because I'm not doing anything wrong. But it seems to me that they divulge so many secrets of how they're doing things to catch people that the people are finding another way to, you know, do what they have to do so they can't get caught.
NNAMDIWell, there's a couple of aspects of that. This information was not voluntarily divulged. Devlin Barrett, tell us how you came up with this information.
BARRETTWell, you know, I'm a reporter, so I go digging for stuff. And sometimes, I find stuff. I mean, I think it's an interesting split that you see when you talk about surveillance issues in the general public. And I think people who trust the government tend to be essentially okay with it. And people who don’t trust the government tend to not be okay with it. Because with a lot of these programs, and I think this would be included in the broader category of surveillance programs.
BARRETTIf they're being careful and they're being smart, it's probably okay. But I think a lot of people think, you know, once you create a program for a good reason, it can be used for a bad reason too. And I think that's the fear that a lot of people have, that this could be abused or misused at some point down the road.
NNAMDIAnd in the past, there have been newspaper and news media reports over centuries of similar, of abuse taking place of such programs. So, that, I think those people who are skeptical about whether the government is always using this in their best interest do have some database, if you will, for their concerns.
BARRETTWell, right, and everything's a human enterprise, right? There's, you know, it's a little hard to swallow the notion that no one's ever going to screw this up. So I think one of the questions that you always have to ask is are judges monitoring this stuff carefully?
BARRETTOr are judges as in the dark as the general public is about exactly how this data is gathered and what's done with it?
NNAMDIOnto Andre in La Plata, Md. Andre, you're on the air. Go ahead, please.
ANDREHi guys. I have a question, putting aside the privacy concerns, what happens, if this is a fake tower, what happens when somebody is in real emergency trying to place an emergency call?
BARRETTThat's a, that's a terrific question. And this was actually something that fascinated me when I figured it out. Is that they were so concerned about that issue when they were developing this system that they actually created sort of a little cutout so that anyone calling 9-1-1, their phone service won't be interrupted or messed with. Which is telling to me, because it suggests that there is some awareness that this is not a completely harmless activity, in terms of phone service.
BARRETTThat there is some degree of possible disruption for average people while they search the skies. But they did do a technical fix for that exact issue, because they wanted to make sure that in the course of doing law enforcement work, they weren't also doing something that hurt law enforcement work.
NNAMDIWhich raises a technology question that I know is puzzling for me, and that is the caller seems to suggest that if this is a fake cell tower and it tricks your phone into thinking it is a real cell tower, that your call is not necessarily going to the person or agency for whom it is intended.
BARRETTWell, remember, it tricks the phones into thinking it's a fake cell tower. But this device can't actually place any calls for you. So what happens is, as for the split second, essentially, that you are (cough) , excuse me, -- sending its data up to this device, it's essentially distracting your phone from doing the thing that the phone would normally be doing or should normally be doing. So, for that split moment, you're sort of, you know, cut out, to some degree. But then, when, assuming you're not the person they're looking for, the device lets go of your number, lets go of your information, and your phone goes back to looking for the regular cell towers.
NNAMDIOkay. Thank you. Here is Salil (sp?) in Arlington, Virginia. Salil, you're on the air. Go ahead, please.
SALILHi Kojo. Thank you. I was curious just to see -- you know, to me, it seems like the devil is in the details. What is the shape of the data that the device is collecting? Is it just collecting IMEI numbers and sorting through them and phone numbers? Or is it -- does it have like metadata that it's mapping to? You know, like, it seems like the invasion of privacy issue would be completely tied to that. If it's just a long registry of numbers, then it may be completely harmless. There's no way you can -- you could actually map it to a person, apart from that metadata.
NNAMDIWell, ultimately, Devlin, I guess the objective is to locate a person, but you can address the more technical aspects of that.
BARRETTRight. And that's a great question because it is just sucking up the registration number, that basic identifier of the phone. Now, it's absolutely right that that is, you know, sort of the most basic and general information about the phone. But that still tells you a little something about the person behind it because, you know, it's not hard to pair up that identifier with other identifying information if you want to.
BARRETTAnd even though you're in a plane and even though you're casting a wide net here, it also tells you come general information data. Right? Because, well, if you're over, you know, a Philadelphia suburb and you get a hit for a particular number, you know that that number is somewhere below you. So it is absolutely correct that this, you know, the most very basic identifying number for the phone. And with that you get an inference of location. And if someone wanted to, they could use that to develop out more information.
BARRETTOne of the makers of one of these products has marketed the devices -- their devices ability to go back and cross reference this information later and compare one sweep to another sweep. And so bit by bit, if you wanted to, you could develop out a lot more information. But the caller is right to suggest that, you know, you're talking about -- on the first pass, you know, a very basic piece of information and a very generalized piece of location.
NNAMDIThank you very much for your call. We move on now to Michael, in Reston, Va. Michael, your turn.
MICHAELHi -- taking my call. I just have a quick question. So why is it better for law enforcement to bypass what AT&T and Verizon should already have? I mean shouldn't law enforcement be able to go to these carriers and say, tell us where this is today? Why do they need to bypass them to do that? Thank you.
BARRETTGreat question. And it's one of the most fascinating parts of this to me, which is the government has today the ability to go directly to the phone company and get this sort of information. There's a couple reasons why they like this method better. One, this technology is fairly sophisticated and actually can generate more precise location data on a person. So by that I mean sometimes when they go to -- through the phone company, they will get a more blurry picture of where the phone is.
BARRETTThe second reason is sort of the more practical one, which is, you know, you cut out the middle man. You know, we decide today we are going up to search for this thing. We are not beholden to anyone else to go do this search. We, you know, we are taking it upon ourselves to, you know, send essentially a decoy into the telecommunication system and figure it out ourselves. That's appealing to law enforcement in some ways as well.
BARRETTI think, you know, I think one of the odd parts of this is that the law has long been based on the notion that you can look for people's information because people already share that information with the phone company so it's not private. But here they're doing something different. Here they're pretending to be the phone company and just taking the information.
NNAMDIDevlin Barrett, he's a reporter with the Wall Street Journal. Devlin, thank you so much for joining us.
BARRETTThanks. It was fun.
NNAMDIWe're gonna take a short break. When we come back it is Tech Tuesday. We'll be looking at the debate over lifting that federal ban on in-flight phone calls. You can start calling now, 800-4433-8850. I'm Kojo Nnamdi.