Beau Hodai
July, 2014
Part 1: Introducing the fish
Harris Corporation, a Delaware corporation headquartered in Melbourne, Florida, is a true corporate behemoth– reporting $5.11 billion in total revenue for 2013, with subsidiaries spanning the globe; from Afghanistan, Iraq and Qatar, to Romania, Russia, China, Chile, Papua New Guinea, the United Kingdom, and on.
Harris has its fingers in many pies– from NASA communications systems to healthcare services– though, arguably, the corporation’s forte falls in the realm of defense/intelligence technologies.
Harris Government Communications Systems Division (Harris GCSD)– a division which holds classified contracts with such defense intelligence heavies as the National Security Agency (NSA), and other intelligence agencies (not all of which are agencies of the United States)– is home to Harris Wireless Products Group (Harris WPG).
Harris WPG produces a set of “cell site simulator” technologies used in interrogating data from and tracking cell phones.
Put simply, a cell site simulator is a device that impersonates the base stations (or “cell towers”) of cellular service providers and forces cell phones within its area of operation to register and share information with it. Through this deception and forced registration, cell site simulator technologies interrogate phones for call data (who the phone has called, who has called the phone– and the times and locations of such calls), device and cellular customer identifying data, registration data (i.e. what towers has the phone been in communication with, and at what times) and Global Positioning System (GPS) data. The contents of communications may also be intercepted through the use of these, and similar, technologies.
Cell site simulators have been in use by such agencies as the U.S. Department of Justice’s (DoJ) Federal Bureau of Investigation (FBI) since at least the mid 1990’s. However, in recent years– thanks in large part to U.S. Department of Homeland Security (DHS) grant revenue streams available to local law enforcement agencies for the purported aims of “counter-terrorism,” “emergency preparedness,” or “all-hazards” mitigation, Harris WPG cell site simulators have experienced a renaissance of use in the domestic law enforcement/’intelligence’ marketplace.
The most common set of Harris WPG cell site simulators that has been popping up in the hands of local law enforcement personnel nationwide has been some configuration of the following devices.
A Stingray cell site simulator produced by Harris WPG.
“Stingray:” according to Harris WPG documents, Stingray is a “transportable [cellular device] interrogation, tracking and location, and signal information collection system” that “performs network base station surveys, dialed number and registration collection, mobile interrogation, and target tracking and location.”
As stated in the Harris WPG documents, “[Stingray’s] active interrogation capability emulates base station to collect MINS [Mobile Identification Number] and ESNs [Electronic Serial Number] through forced [customer cell phone] registration [with the Stingray cell site simulator].”
Stingray, and other Harris WPG products, may also be operated with a “PC interface” and Harris geolocation software that allows the operator to observe real-time geolocation data of phones within the device’s area of operation.
[Note: the Harris WPG documents discussed in this section are Harris WPG law enforcement sales brochures, not intended for distribution outside of law enforcement/intelligence circles. The documents cite Title 18 of the U.S. Code, Section 2512, pertaining to criminal restrictions on the publication of advertising materials for communications intercept devices. Under 18 USC 2512, such advertisements may only be published, transmitted or possessed by lawful communications industry manufacturers of such devices and government employees/government contractors.
The documents are referenced by DBA Press as they appear in the federal court record court record of litigation between Daniel David Rigmaiden and the Federal Bureau of Investigation (FBI) concerning Freedom of Information Act (FOIA) requests filed by Rigmaiden with the FBI seeking records pertaining to these technologies and other related issues.]
A Stingray II cell site simulator produced by Harris WPG.
“Stingray II:” while the exact distinction between Stingray and Stingray II is not known, photographs of the device suggest that Stingray II is capable of simultaneously operating multiple channels on multiple networks, using multiple direction finding and GPS antennae.
A Kingfish cell site simulator produced by Harris WPG.
“Kingfish:” as described in Harris WPG documents, Kingfish is a “portable [cellular device] interrogation, direction-finding, and collection system” that “provides investigators with a tool that extracts the telephone number (MIN) and Electronic Serial Number (ESN) from a […] mobile telephone. The active direction-finding (DF) capability enables location of a powered-on phone without depending on the suspect to be involved on a call. Additionally, Kingfish provides passive dialed number recorder (DNR) and registration collection capabilities. Passive operations identify calling patterns and provide information on the suspect’s area of operation.” The system also “provides [a] real-time display of interrogation and passive collection results.”
“Amberjack:” according to Harris WPG documents, Amberjack is a “direction finding antenna system capable of tracking and locating mobile phone users and base stations,” designed for use with Stingray, Stingray II, Kingfish and a number of other Harris WPG cell site simulator-based technologies.
An Amberjack direction finding antenna pictured with a Harris WPG PC interface.
The antenna resembles a large frisbee (17 inches by 4.2 inches, weighing in at 14 pounds) and is outfitted with magnetic mounts for ease of placement on tracking vehicles.
A Harpoon cell site simulator amplifier produced by Harris WPG.
“Harpoon:” according to Harris WPG documents, Harpoon is a “high-power filtered amplifier that maximizes the multichannel transmit capability of the Stingray II and significantly improves the performance of the single-channel Stingray and Kingfish systems.” The amplifier is capable of boosting the total output power of these devices up to 30 watts per band, significantly increasing the area of interrogation/tracking.
“Hailstorm:” this device began appearing in local law enforcement procurement documents in early 2013, generally as an “upgrade” to Stingray II. According to a March, 2014 Harris Corporation General Services Administration (GSA) price list, Hailstorm is also available as an upgrade to Kingfish and Stingray. Hailstorm is available as a standalone product as well.
Very little is known about Hailstorm, aside from the fact that this technology costs agencies approximately $65,000 to $330,000 (the lower end of this price spectrum applies to purchases of Hailstorm upgrades to existing technology), that it stands on the shoulders of Stingray II and Kingfish cell site simulators, and that purchases of Hailstorm also are commonly accompanied by amplifier upgrades and new “cellular utilization” software purchases.
According to procurement documents, Hailstorm is also compatible with hardware manufactured by another contractor that allows for “close quarter and foot tracking [of suspects]”– though this “foot tracking” ability does not appear to be a feature exclusive to Hailstorm, as Stingray systems and Kingfish appear to have similar capabilities.
A number of other Harris WPG accessory technologies to this core set of cell site simulators allow their users to intercept the contents of cellular communications and block/disrupt cellular use.
Accessorize your fish: supplemental surveillance resources
Pen-Link, a Lincoln, Nebraska-based producer of law enforcement Communications Assistance for Law Enforcement Act (CALEA)-based intercept/surveillance software and hardware products, produces a number of products that Harris Corporation (according to procurement documents) recommends for use with their cell site simulators Stingray, Stingray II, Hailstorm, and, very likely, Kingfish. However, Harris cell site simulators and Pen-Link equipment are not mutually dependent; these are stand alone products that are often used in conjunction with each other to form a powerful intelligence gathering and analysis system.
CALEA, as passed in 1994, in response to a direct congressional request from the FBI, essentially mandated that all telecommunications carriers in the United States ensure that their networks be open to, and compatible with, law enforcement communications surveillance/interception techniques. In 2006, the Federal Communications Commission (FCC) issued further orders based on CALEA, requiring that “facilities-based broadband internet access providers” (as opposed to wireless internet providers– already covered under CALEA 1994) and Voice Over Internet Protocol (VOIP) service providers (such as Skype) come into compliance with CALEA.
Under CALEA, communications carriers are required to provide law enforcement (having obtained appropriate court orders, or citing “exigent circumstances”) with ongoing, recent or historical communications content (CALEA-compliant carriers must be able to provide government agencies with communications “concurrently with their transmission,” or “at such later time as may be acceptable to the government”), as well as non-communications-content “communications identifying information” (such as dialed and received numbers/internet protocol addresses, dates/times of communications, et cetera). Under CALEA, carriers must be able to provide this information electronically, in formats decipherable to law enforcement agencies.
As such, some law enforcement agencies believe that the are entitled, through CALEA, to a direct line of all cellular customer data, and that Pen-Link is, as it describes itself, the key to the kingdom (Pen-Link’s registered trade mark slogan is “[Pen-Link]It’s the Key”).
As stated by the Tennessee Bureau of Investigation in a September, 2013 Pen-Link wiretap system purchase memorandum: “[CALEA] requires telecommunications providers to have a means to deliver call data directly to law enforcement computers […] Law Enforcement must have compatible technology in order to be able to make use of this service.” And, as stated by the Oakland County (Michigan) Sheriff’s Office in an April, 2013 Harris Hailstorm/Pen-Link software purchase order: “[Pen-Link software] connects the Hailstorm equipment to all cellular phone companies through a direct internet connection.”
Pen-Link equipment (which often includes both software packages and dedicated Pen-Link servers/computers– presumably needed for the massive amounts of data storage entailed by Pen-Link use), used in conjunction with Harris WPG cell site simulator technologies, essentially allows law enforcement officers to apply both geolocation (either GPS or cellular base station registration) data and other cellular customer data (i.e. logs of calls and callers, including base station registration data associated with thee calls) to multiple matrices of data– including CALEA cellular service provider data.
For example, according to Pen-Link Territory Sales Manager Shelley Sorensen (procurement records show that Sorensen has been the PenLink representative in a number of Florida law enforcement Pen-Link purchases, so her “territory” is likely the southeast portion of the nation), it is often vitally important for officers employing cell site simulators in tracking cell phone users to be able to place their subject phone within a certain geographical area prior to the deployment of a cell site simulator.
This is done, according to Sorensen, with cellular customer data “streamed down” to Pen-Link from cell service providers …
monitoring of activists, Part 4″).