How Milwaukee Police Monitor Cell Phones

For police departments, tools of the trade sometimes come with big price tags. That certainly describes contracts and purchase orders for two sophisticated pieces of equipment used by the Milwaukee Police Department (MPD) to monitor cell phones and access their data.

According to documents obtained by Wisconsin Examiner via open records requests to the city’s purchasing division, a new cell site simulator system (CSS) purchased by MPD in May 2019 cost $498,900.

Cell site simulators trick cell phones by acting like cell towers. Once a phone connects, the CSS intercepts information from the phone and can track its location. With the right software it can also monitor calls and text messages, or send fake text messages. The devices are also known to cause malfunctions and interference in nearby phones as well as those with which they connect.

The CSS purchase contract itemizes different key aspects of the device including an eight-channel portable base station at $207,500; a seven-band transportable amplifier at $218,400, another $40,000 for a two-year warranty, a part of the device that fits on police vehicles for $23,000, and $10,000 for a week of on-site training. It also shows that MPD went through a different company to acquire the system than it had in years past.

For years, many police departments acquired their cell site simulators from the Harris Corporation. Harris’ products were so ubiquitous in American law enforcement that its Stingray model became shorthand for all cell site simulators. As 2020 approached, however, Harris announced that it would only be selling to federal agencies. Without vital updates and software, MPD and other agencies were left with obsolete technology.

Mike Katz-Lacabe, director of research at the Center for Human Rights and Privacy, told Wisconsin Examinerthat since Harris’ announcement, “all the law enforcement agencies have been scrambling to get new cell site simulators.” In Milwaukee, police settled on a CSS sold by Tactical Support Equipment. It’s the sole U.S. vendor for the Canadian company Octasic, which makes a line of cell site simulators called the Nyxcell.

Because CSS technology is treated as highly confidential, it’s unclear if Nyxcell just tracks cell phones, or whether it has other capabilities. The MPD will not discuss its strategies around Stingray, and has denied multiple open records requests pertaining to the technology. Katz-Lacabe, however, said he could  ascertain some of its capabilities based on the hardware listed on MPD’s purchase order.

“It has a wide range of support,” he says. ”Each cell tower is operated by one of these cellular companies, whether it’s AT&T, Verizon, Sprint, etc. And this gives them the ability to emulate a number of them at once. So, if you had somebody that you wanted to track who is perhaps using multiple cell phones, this makes it a bit easier to do that without any interruption.”

Katz-Lacabe noted that the hardware on the CSS is capable of intercepting calls and texts. In the past, when local police departments were using the Stingray produced by Harris, however, “although the equipment was capable of it, the version of software that they sold to local and state law enforcement agencies did not enable that capability in those cell site simulators. We believe the federal version of cell site simulators are able to intercept both calls and text messages.”

The Nyxcell CSS’s ability to emulate multiple types of cell towers at once may also affect the interference these technologies can cause to phones.

“If they’re impersonating a bunch of different cell phone towers at one time,” said Katz-Lacabe, “obviously, no matter what cell phone company you’re using, if you’re in range of this thing then your signal is going to get interrupted. And that may just be a brief thing. You might just chalk it up to poor service from your cellular phone company, and that wouldn’t be unusual. But this certainly has the potential to disrupt many more people at the same time, if it’s not used particularly carefully.”

MPD’s $15,000 GrayKey ‘iPhone unlocking tool’

The documents obtained by Wisconsin Examiner also show MPD purchased a GrayKey iPhone unlocking tool in Sept. 2018. The actual device came in at $15,000, along with an $18,000 contract for licenses. In Oct. 2019, the city renewed its licenses for GrayKey, purchasing three licenses for $54,000.

GrayKey is produced by the American company Grayshift, and is used to break into passcode-protected iPhones. Unlike a CSS, which traces phones from a distance, GrayKey needs to be physically plugged into the phone. This often occurs when phones are taken by police as part of an ongoing investigation.

Once the passcode is broken, GrayKey can access and download the phone’s contents. It emerged as competition for Cellebrite technology, which for years was the main vendor to law enforcement. “The advantage that GrayKey has is it’s much cheaper than Cellebrite,” said Katz-Lacabe. The company’s four founders include an engineer who formerly worked for Apple.

The cell tower simulator and the cellphone unlocking tool access different forms of phone information, and in different ways. “They’re not both accessing cell data,” noted Katz-Lacabe. “One of them, a [CSS system], is basically tracking down the radio communication between your phone and a cell site tower. So that communication means your voice traveling over that, potentially, and your text messages. But it’s not intercepting, say, your web traffic. Or your traffic from encrypted communication or web browsing. That stuff is still protected by other layers of encryption.”

By contrast, “Cellebrite and GrayKey are going after the data that’s stored in your phone. So think about everybody in your contacts, all of your photos, the history of any text messages you have stored on the phone, any other data that you have on the phone, including potentially access to cloud services. So, a lot of people now have their photos automatically uploaded to say, Google Drive, Google Photos, or iCloud.”

That extends GrayKey’s reach well beyond data stored on the phone itself, and means vast swaths of a person’s digital life could be analyzed. Few agencies have rules about what data can be accessed, for how long it can be stored, and whether it can be shared. As it turns out, the technology is also ahead of the courts’ interpretation of Fourth Amendment protections.

Why should you care?

Both CSS technologies and devices like GrayKey pose their own unique privacy concerns. A GrayKey data extraction, for example, could capture or access data that has nothing to do with any criminal investigation.

“The other question,” Katz-Lacabe told Wisconsin Examiner, “is what do the police do with the data? Do they share it with people? Does that data live on long after the investigation is over, and you’re released and found not guilty? Most police departments don’t have policies around it.”

A further issue is consent, when people allow their phones to be searched, without knowing that all their data is up for grabs. “I would suggest that it is an unwise idea for you to ever give permission for the police to search your phone,” Katz-Lacabe said.

Cell site simulators are a whole different animal. Katz-Lacabe feels that if used properly, under a warrant and with a judge’s oversight, they pose fewer problems. “But in many cases,” he said, “search warrants are either not required, or the judges signing off on search warrants don’t realize exactly what they’ve signed off on. For years, the exact nature of what the police were doing was hidden from the criminal justice system. So even defendants who were charged with some crime based on these pieces of equipment tracking their location were unaware that this was used to track them.”

Both the GrayKey and CSS purchased by MPD were also linked back to the department’s fusion center, which brings together federal, state, local, and military law enforcement with private sector entities to share information and collaborate. The purchase order shows that the CSS was specifically addressed to be delivered to the MPD Fusion Division.

Fusion centers were created after 9/11 as a Homeland Security strategy to fight terrorism. Over time, they have increasingly been used to focus on street crime and protests. In addition to having its own Intelligence Fusion Division (IFC), the Milwaukee PD is also host to the state-run fusion center called the Southeastern Threat Analysis Center (STAC).

Expensive surveillance equipment that might be beyond the reach of a small police department could become more affordable it it’s shared by multiple entities through a fusion center. How that equipment is used, particularly cell site simulators, may depend on which agency it belongs to. Fusion centers blur the lines, with federal, state, and local law enforcement collaboration.

Both CSS technology and GrayKey can be extremely useful in criminal investigations. They can also be used in less clear-cut ways, such as during protests. Cell data extraction became an issue during the Wauwatosa protests. It has been a recurring concern for Wisconsin’s Black Lives Matter movement. As Katz-Lacabe explains, just as surveillance technology  can solve criminal cases, it can also, “grab the phone information of everyone who’s at a protest. … It can be used to essentially go after people or identify people who are engaged in non-criminal First Amendment protected activity.”

“These things are not mysterious. Those budgets are public record,” says Milwaukee County Supervisor Ryan Clancy, who objects to police use of military surveillance equipment and refused to give police access to information on his cell phone after they arrested him at a protest. “I’m concerned that they’re using individual officers to try to access individuals’ data.”

Reprinted with permission of Wisconsin Examiner.