The Minnesota Department of Public Safety’s operation of Kingfish and Stingray II devices – cellular exploitation equipment that mimics local phone towers and grabs data from phones – has come under fire in recent months, as the department’s Bureau of Criminal Apprehension (BCA) has used them in investigations. But legislators are concerned about who has access to the data and how long it is being kept.
In December, a bipartisan group of state senators and representatives, led by Senate Transportation and Public Safety Committee Chair Sen. Scott Dibble, DFL-Minneapolis, sent a letter asking for details about the department’s policies and practices concerning cell phone data tracking to Minnesota Department of Public Safety Commissioner Ramona Dohman. A six-page response followed on Jan. 6, revealing the cost and capabilities of the department’s tracking technology and examples of when the devices were used.
But lawmakers weren’t satisfied with the answers they received. In an interview with Government Technology earlier this month, Sen. Branden Petersen, R-Andover, explained that Dohman’s reply wasn’t sufficient to satisfy concerns, and legislation is being discussed to codify when and how the devices can be used.
“The unfortunate part is that, as has been the case with law enforcement, they don’t entirely give you all of the information under the guise that it is security information, or it's investigative techniques information,” Petersen said, adding that Dohman “did acknowledge these techniques are being used to target individuals without a search warrant, which is a problem for myself and I know for others.”
According to the letter from Dohman – acquired by Government Technology through Petersen – only the BCA operates the equipment, which is done “lawfully and with data privacy protections in place.” The letter also stipulates that Stingray II and Kingfish devices are only used in criminal investigations to locate the cell phone of a victim or in missing person cases. In addition, the technology does not enable law enforcement to listen to phone conversations or read text messages.
Like this story? If so, subscribe to Government Technology's daily newsletter.
The letter also states that a court order is obtained in the “vast majority” of cases where the equipment is used, but not in cases where there is a “serious threat to life or exigent circumstances,” such as an abducted child or an armed murder suspect.
When contacted by Government Technology, Minnesota Department of Public Safety spokesman Bruce Gordon declined to further address the issue, saying via email that the response letter is the extent of the department’s comments about the topic.
Technical Details
The Kingfish has been around since the early 2000s. According to an overview of the technology by Ars Technica, Kingfish is a surveillance transceiver that enables data tracking and mining from mobile devices over a defined target area. While it can’t intercept communications, it shows a user connections between various phones and the numbers being dialed by them.A Stingray sends out a signal that captures data by fooling a phone into connecting into it. Like the Kingfish, a Stingray also collects various codes that help law enforcement officials triangulate a phone’s position. Unlike a Kingfish, however, Stingrays can intercept actual conversations, when used in combination with various other technologies. The Stingray II, which is used by the Minnesota BCA, appears to be more advanced with additional USB inputs and a GPS antennae.
Dohman’s letter to Dibble explained that the equipment is used in conjunction with cell towers and wireless carriers to reduce the location area investigators have to search to locate a specific phone. The commissioner also stated that the devices used by BCA have no ability to listen or monitor voice or text communications.
Petersen, however, felt the invasive nature of the technology makes it a risk, particularly when a warrant isn’t needed.
“A lot of people say, ‘We’re not reading text messages,’ or, ‘We’re not listening to the phone calls,’ but mapping out all those data points, you don’t really need to listen to the phone calls,” Petersen said. “Certainly that would provide more context, but you can still get a very clear picture of somebody’s everyday life.”
Despite the privacy concerns, Petersen was aware that phone-tracking technology without a warrant is at times necessary, and said that future legislation to regulate how the devices are used will take that into account. For example, he noted a situation such as a missing child would be one instance where using the Kingfish or Stingray II would be acceptable.
Petersen admitted that he and his legislative colleagues haven’t “fleshed out” all the emergency situations where the technology could be used at law enforcement discretion, but they’re aware that police need flexibility to solve time-sensitive crimes. He does, however, feel that there must be limits.
“That does not include ongoing surveillance of an individual over the course of weeks, months or even days,” Petersen added.
