(Originally posted on Daily Kos.)

The ACLU and Electronic Frontier Foundation have received several batches of Justice Department documents in response to our Freedom of Information Act (FOIA) request (and subsequent lawsuit) for records relating to the government's use of cell phones as tracking devices. What they tell us is that the government doesn't even need the help of a cell phone service provider to track us with our phones. The FBI now has what is called "triggerfish" technology — a cell site simulator that forces cell phones in the area to register its phone number, serial number and location — allowing it to track cell phones on its own. This raises the risk that they will do so without bothering to go to a court for permission first, since they no longer need to compel the provider to cooperate.

The documents do indicate that at least currently, the FBI's standard procedure is to seek a court order before using "triggerfish" to track cell phones. However, when obtaining those court orders — for "pen register and trap and trace" surveillance — the government doesn't show probable cause that a crime has been or is being committed, or even demonstrate to the court that the person being spied on is relevant to an ongoing investigation. The government simply tells the court that it thinks the target is relevant and then the court issues the order, a process offering little protection against the abuse of this powerful surveillance technology. In fact, the Department of Justice documents themselves suggest some government folks might be apprehensive: "The use of a triggerfish to locate cellular telephones is an issue of some controversy." People with questions or concerns are instructed to contact Mark Eckenwiler, Senior Counsel at the DOJ Computer Crime and Intellectual Property Section.

An earlier EFF FOIA lawsuit turned up documents detailing how a little-known FBI telephone intercept unit had developed triggerfish technology that agents use to monitor the physical movements of surveillance targets. Back then it seemed the process required assistance from the provider. But the new documents plainly say that triggerfish surveillance can be done without provider assistance, as at the top of page 18 in this document (PDF): "This can be done without the user knowing about it, and without involving the cell phone provider."

The Washington Post's Ellen Nakashima writes about the renewed call from magistrate judges for Congress to set a consistent legal standard for seeking cell phone tracking information today. All our related documents are here.

CORRECTION: An earlier version of this post mentioned the process of obtaining a pen-trap order from the FISA court. The documents uncovered by the ACLU/EFF FOIA are actually about pen-trap orders in the criminal context, and the second paragraph has been amended to reflect that.

Permalink |	National Security