Guardian: IRS possessed Stingray cellphone surveillance gear, documents reveal

http://www.theguardian.com/world/2015/oct/26/stingray-surveillance-technology-irs-cellphone-tower

IRS possessed Stingray cellphone surveillance gear, documents reveal

Invoices reveal tax service, 13th federal agency to use secretive dragnet, upgraded device that pretends to be cellphone tower to gather metadata

Nicky Woolf in New York and William Green

26 October 2015

The Internal Revenue Service is the latest in a growing list of US federal agencies known to have possessed the sophisticated cellphone dragnet equipment known as Stingray, according to documents obtained by the Guardian.

Invoices obtained following a request under the Freedom of Information Act show purchases made in 2009 [1] and 2012 by the federal tax agency with Harris Corporation, one of a number of companies that manufacture the devices. Privacy advocates said the revelation "shows the wide proliferation of this very invasive surveillance technology".

The 2009 IRS/Harris Corp invoice is mostly redacted under section B(4) of the Freedom of Information Act, which is intended to protect trade secrets and privileged information. However, an invoice from 2012, which is also partially redacted, reports that the agency spent $65,652 on upgrading a Stingray II to a HailStorm, a more powerful version of the same device, as well as $6,000 on training from Harris Corporation.

Stingrays are the best-known example of a type of device called an IMSI-catcher, also known as "cell-site simulators". About the size of a briefcase, they work by pretending to be cellphone towers in order to strip metadata and in some cases even content from phones which connect to them.

Despite their extensive capabilities, they require only a low-level court order called a PEN register, also known as a "trap and trace", to grant permission for their use.

Immense secrecy has so far surrounded these devices, but a picture is slowly emerging which shows widespread use. Various revelations by the American Civil Liberties Union [2] and news outlets including the Guardian had shown that at least 12 federal agencies are already known to have these devices, including the National Security Agency and the Federal Bureau of Investigation. The IRS makes 13.

In November 2014, the Wall Street Journal [3] uncovered an operation run by the US Marshals Service using a Boeing-made IMSI-catcher known as "dirtbox". This is the first time that the IRS has been found to own the device.

The devices are also used by local and in some cases state police departments, across at least 20 states, though a culture of secrecy which surrounds Stingray devices has meant that the full scale of their use remains unknown.

A Guardian report [4] in April revealed a non-disclosure agreement that local police and prosecutors were forced to sign with the FBI before using Stingrays, which mandated them to withdraw or even drop cases rather than risk revealing their use, and in September it emerged [5] that this withholding of "discovery" evidence by police in Baltimore could lead to as many as 2,000 cases being overturned.

It remains unclear how the IRS used the Stingray devices. A spokesman for the agency did not respond to a request for comment.

Mark Matthews, a former deputy commissioner for services and enforcement at the agency who now works for the law firm Caplin and Drysdale, said that while he attends many conferences on IRS and tax law enforcement, he had not heard any "scuttlebutt" about the agency's use of Stingray.

Matthews said there are currently between 2,000 and 3,000 "special agents" in the IRS who form the criminal investigation division (CID). They have the ability to get PEN register orders -- the only authority needed to use Stingray devices.

He said the IRS on its own usually uses gentler investigation tactics. But increasingly, investigating agents from the agency are brought on board for joint operations with the FBI and other agencies when the latter need financial expertise to look at, for example, money laundering from drug organisations.

From these joint operations, he said, "the IRS had moved to drug work and had learned a lot of aggressive techniques in the money laundering and drug world, and these bad habits were leaking over into the tax world, which was supposed to be their real mission".

Federal agencies using surveillance technology that far outstripped the limits of what a PEN register was designed to do is not new. "That used to be a worry at the FBI with their PEN register [devices]," Matthews said. "There was always a little slot where you could put in a headphone jack" -- which could turn the device into a full wiretap, for which they did not have warrant clearance -- "and they said, 'Trust us.' Not very convincing for civil liberties groups."

Nate Wessler, a staff attorney with the speech, privacy and technology project at the ACLU, told the Guardian: "The info showing that they are using Stingrays is generally consistent with the kinds of investigative tactics that they are engaging in, and it shows the wide proliferation of this very invasive surveillance technology."

"It's used by dozens, perhaps hundreds, of local law enforcement, used by the usual suspects at the federal level, and if the IRS is using it, it shows just how far these devices have spread," Wessler said.

Matthews said that he had not heard anything about Stingrays despite speaking to his contacts in the tax industry. "So this either hasn't ripened yet in a tax case, 95% of which [end in a plea deal] so there would be no such disclosures, or this is saved more for money laundering/drug/terrorist-financing-like investigations."

"[It] could be as silly as [they] got to the end of the year, had some extra funds, and somebody said, 'We need some more of these devices,'" Matthews said. "It could literally be that silly. But it could be something different; it could be that they've decided to use them in cases where they're the primary detective agency, and we haven't seen it yet in the private sector."

IRS Foia document

[1] https://www.documentcloud.org/documents/2487350-2009-irs-contract.html

[2] https://www.aclu.org/map/stingray-tracking-devices-whos-got-them#agencies

[3] http://www.wsj.com/articles/americans-cellphones-targeted-in-secret-u-s-spy-program-1415917533

[4] http://www.theguardian.com/us-news/2015/apr/10/stingray-spying-fbi-phone-dragnet-police

[5] http://www.theguardian.com/us-news/2015/sep/04/baltimore-cases-overturned-police-secret-stingray-surveillance