Ars Technica reports
Courts in recent years have been raising the evidentiary bar law enforcement agents must meet in order to obtain historical cell phone records that reveal information about a target's location. But documents obtained by civil liberties groups under a Freedom of Information Act request suggest that "triggerfish" technology can be used to pinpoint cell phones without involving cell phone providers at all.
Triggerfish, also known as cell-site simulators or digital analyzers, are nothing new: the technology was used in the 1990s to hunt down renowned hacker Kevin Mitnick. By posing as a cell tower, triggerfish trick nearby cell phones into transmitting their serial numbers, phone numbers, and other data to law enforcement. Most previous descriptions of the technology, however, suggested that because of range limitations, triggerfish were only useful for zeroing in on a phone's precise location once cooperative cell providers had given a general location.
This summer, however, the American Civil Liberties Union and Electronic Frontier Foundation sued
the Justice Department, seeking documents related to the FBI's
cell-phone tracking practices. Since August, they've received a stream
of documents--the most recent batch on November 6--that were posted on the Internet last week. In a post on the progressive blog Daily Kos,
ACLU spokesperson Rachel Myers drew attention to language in several of
those documents implying that triggerfish have broader application than
As one of the documents
intended to provide guidance for DOJ employees explains, triggerfish
can be deployed "without the user knowing about it, and without
involving the cell phone provider." That may be significant because the
legal rulings requiring law enforcement to meet a high "probable cause"
standard before acquiring cell location records have, thus far,
pertained to requests for information from providers, pursuant to
statutes such as the Communications Assistance for Law Enforcement Act
(CALEA) and the Stored Communications Act.
The Justice Department's electronic surveillance manual
explicitly suggests that triggerfish may be used to avoid restrictions
in statutes like CALEA that bar the use of pen register or
trap-and-trace devices--which allow tracking of incoming and outgoing
calls from a phone subject to much less stringent evidentiary
standards--to gather location data. "By its very terms," according to
the manual, "this prohibition applies only to information
collected by a provider and not to information collected directly by
enforcement authorities.Thus, CALEA does not bar the use of pen/trap
orders to authorize the use of cell phone tracking devices used to
locate targeted cell phones."
Perhaps surprisingly, it's only with the passage of the USA PATRIOT Act in 2001 that the government has needed any kind of court order to use triggerfish. While previously, the statutory language governing pen register or trap-and-trace orders did not appear to cover location tracking technology. Under the updated definition, these explicitly include any "device or process which records or decodes dialing, routing, addressing, and signaling information."