Given the amount of mobile phone traffic that cell phone towers transmit, it is no wonder law enforcement agencies target these devices as a rich source of data to aid their investigations. Standard procedure involves getting a court order to obtain phone records from a wireless carrier. When authorities cannot or do not want to go that route, they can set up a simulated cell phone tower—often called a stingray—that surreptitiously gathers information from the suspects in question as well as any other mobile device in the area.

These simulated cell sites—which collect international mobile subscriber identity (IMSI), location and other data from mobile phones connecting to them—have become a source of controversy for a number of reasons. National and local law enforcement agencies closely guard details about the technology’s use, with much of what is known about stingrays revealed through court documents and other paperwork made public via Freedom of Information Act (FOIA) requests.

One such document recently revealed that the Baltimore Police Department has used a cell site simulator 4,300 times since 2007 and signed a nondisclosure agreement with the FBI that instructed prosecutors to drop cases rather than reveal the department’s use of the stingray. Other records indicate law enforcement agencies have used the technology hundreds of times without a search warrant, instead relying on a much more generic court order known as a pen register and trap and trace order. Last year Harris Corp., the Melbourne, Fla., company that makes the majority of cell site simulators, went so far as to petition the Federal Communications Commission to block a FOIA request for user manuals for some of the company’s products.

The secretive nature of stingray use has begun to backfire on law enforcement, however, with states beginning to pass laws that require police to obtain a warrant before they can set up a fake cell phone tower for surveillance. Virginia, Minnesota, Utah and Washington State now have laws regulating stingray use, with California and Texas considering similar measures. Proposed federal legislation to prevent the government from tracking people’s cell phone or GPS location without a warrant could also include stingray technology.

Scientific American recently spoke with Brian Owsley, an assistant professor of law at the University of North Texas Dallas College of Law, about the legal issues and privacy implications surrounding the use of a stingray to indiscriminately collect mobile phone data. Given the invasive nature of the technology and scarcity of laws governing its use, Owsley, a former U.S. magistrate judge in Texas, says the lack of reliable information documenting the technology’s use is particularly troubling.

[An edited transcript of the interview follows.]

When and why did law enforcement agencies begin using international cell site simulators to intercept mobile phone traffic and track movement of mobile phone users?

Initially, intelligence agencies—CIA and the like—couldn’t get local or national telecommunications companies in other countries to cooperate with U.S. surveillance operations against nationals in those countries. To fill that void companies like the Harris Corp. started creating cell site simulators for these agencies to use. Once Harris saturated the intelligence and military markets [with] their products, they turned to federal agencies operating in the U.S. So the [Drug Enforcement Administration], Homeland Security, FBI and others started having their own simulated cell sites to use for surveillance. Eventually this trickled down further to yet another untapped market: state and local law enforcement. That’s where we are today in terms of the proliferation of this technology.

Under what circumstances do U.S. law enforcement agencies use cell site simulators and related technology?

There are three examples of how law enforcement typically use stingrays for surveillance: First, law enforcement officials may use the cell site simulator with the known cell phone number of a targeted individual in order to determine that individual's location. For example, officials are searching for a fugitive and have a cell phone number that they believe the individual is using. They may operate a stingray near areas where they believe that the individual may be, such as a relative's home.

Second, law enforcement officials may use the stingray to target a specific individual who is using a cell phone, but these officials do not know the cell phone number. They follow the targeted individual from a site to various other locations over a certain time period. At each new location, they activate the stingray and capture the cell phone data for all of the nearby cell phones. After they have captured the data at a number of sites they can analyze the data to determine the cell phone or cell phones used by the targeted individual. This approach captures the data of all nearby cell phones, including countless cell phones of individuals unrelated to the criminal investigation.

Third, law enforcement officials have been known to operate stingray at political rallies and protests. Using the stingray at these types of events captures the cell phone data of everyone in attendance.

How does law enforcement get permission to perform this type of surveillance?

Federal law enforcement agencies typically get courts to approve use of something like stingray through a pen register application [a pen register is a device that records the numbers called from a particular phone line]. With that type of application, essentially the government says, we want this information. We think it’s going to be relevant to an ongoing criminal investigation. As you can imagine, that’s a pretty low bar for them to satisfy in the eyes of the court. Just about anything could fit into that description. You don’t even have to show that such an investigation would lead to an arrest or prosecution. Law enforcement is telling the court, look, we’re in the middle of this investigation. If we get this information, we think it might lead to some other important information