Before they could track cell phone data, police had to sign a NDA with the FBI

Advanced cell phone tracking devices known as StingRays allow police nationwide to home in on suspects or to log individuals present at a given location. But before acquiring a StingRay, state and local police must sign a nondisclosure agreement with the FBI, documents released last week reveal.

The document released by the Tacoma Police Department is heavily redacted — four of its six pages are completely blacked out — but two unredacted paragraphs confirm the FBI’s intimate involvement with StingRay deployment.

The StingRay family of trackers are manufactured by the Harris Corporation, a company with $5 billion in annual revenue and headquarters in Melbourne, Florida. As “cell site simulators,” the trackers trick mobile phones into connecting to a StingRay as if it were a cell tower. This allows police to determine the cell phone’s location, and thus its owner’s.

As documents released to the Electronic Privacy Information Center indicate, the FBI has been using StingRay devices since at least 1995. The Bureau has worked diligently to keep policy and operational particulars alike secret.

Civil liberties and open government advocates have fought to obtain basic details regarding which agencies use the technology, and what safeguards are in place to prevent abuses. A December 2013 investigation by USA Today found 25 state and local police with StingRays, while a report released this summer by the ACLU uncovered 43 agencies in 18 states with the devices.

In response to a records request by MuckRock user Phil Mocek, the Tacoma Police Department released documents in August regarding its own cell phone tracking. TPD invoices revealed that it first purchased a StingRay in 2007 via a Justice Department grant. The department then paid $251,752 in March 2013 to upgrade its StingRay and train on additional functionality, an expenditure that was heavily underwritten by federal homeland security funding.

Documents released in August referred to a nondisclosure agreement (NDA) between Tacoma and the Justice Department, but the agreement itself was not released until last Friday. The Tacoma document provides key insight into the close cooperation among the FBI, Harris Corporation and the Federal Communications Commission to bar StingRay details from public release.

Tacoma police chief Donald Ramsdell signed the NDA on January 3, 2013, along with special agent Laura Laughlin of the FBI’s Seattle field office and four Tacoma officers authorized to operate the StingRay system. While solid black rectangles obscure the extent of TPD’s nondisclosure obligations, the document’s opening paragraph cements details previously only guessed at.

Per the agreement, the FBI was “advised by Harris Corporation of the Tacoma Police Department’s request for acquisition of certain wireless collection equipment/technology manufactured by Harris Corporation.”

The fact that the FBI received notification from Harris that TPD was interested in a StingRay reveals a surprising level of coordination between a private corporation and a federal law enforcement agency. The agreement also makes clear that completing the NDA is compulsory by order of the FCC.

“Consistent with the conditions on the equipment authorization granted to Harris Corporation by the Federal Communications Commission (FCC),” the agreement continues, “state and local law enforcement agencies must coordinate with the Federal Bureau of Investigation (FBI) to complete this non-disclosure agreement prior to the acquisition and use of the equipment/technology authorized by the FCC authorization.”

Per this provision, then, each police department nationwide that seeks to operate a StingRay device must complete an identical agreement with the FBI.

“What is so fascinating about the beginning paragraph of the NDA you received,” writes Alan Butler of the Electronic Privacy Information Center, “is that it makes clear that Harris, the FCC, and the FBI are working together to facilitate the proliferation of these devices among state and local law enforcement agencies.”

“It’s not clear to me why the FCC would have an interest in requiring law enforcement agencies to sign NDA’s with the FBI, unless they were concerned that the spread of this technology could harm users of American communications networks.”