By Jenna McLaughlin, The Intercept

The Chicago Police Department has acquired and used several varieties of advanced cellphone trackers since at least 2005 to target suspects in robberies, murders, kidnappings, and drug investigations. In most instances, officers only lightly described the devices’ advanced technical surveillance capabilities to courts, which allowed the police to use them, often without a warrant.

Now, after a lengthy legal battle waged by Freddy Martinez, a Chicago software technician, court orders and case notes were released, painting a more detailed picture of how the second-largest police precinct in the U.S. uses surveillance technology to track cellphones.

Martinez, who leads the Lucy Parson Labs, a Chicago-based nonprofit that advocates digital rights and transparency, originally sued for records in September 2014. He provided the released documents to The Intercept.

The Chicago Police Department did not respond to request for comment.

Cell-site simulators, or IMSI catchers, are typically suitcase-sized devices that emit signals over the wireless spectrum, masquerading as legitimate cellphone towers. When a nearby phone attempts to connect to a tower either to make a call or to check for service, it will instead link-up to the rogue device, beaming back information about its location, its owner, and sometimes the contents of communications.

While tracking one cellphone, the device also often sweeps up information about all the other phones in the area and can disrupt cell service. It’s unclear exactly how long the disruption lasts, or how far the range of each device extends. Activists are currently challenging the Federal Communications Commission to step in and regulate how law enforcement uses IMSI catchers, because they interrupt wireless service without authorization — posing a danger to emergency communications.

The Tools

According to the purchase records, some of which Martinez had previously obtained in more redacted form, the Chicago Police Department’s Organized Crime Division spent hundreds of thousands of dollars over more than 10 years buying multiple different models of IMSI catchers, as well as upgrades, training programs, software, and attachments.

The department purchased Harris Corporation’s Stingrays — a popular model used by many police departments across the country, and King Fish — a more powerful cellphone tracker. It also bought DRT boxes, known as dirt boxes — military grade trackers made by Digital Receiver Technology Inc., a subsidiary of Boeing.

The King Fish, which cost $157,300, gave investigators the capability “to enter large structures and pinpoint a device” digitally, essentially spotting a specific cellphone behind walls.

The device was purchased using a combination of drug money, civil forfeiture, and money laundering funds — a secret reserve Martinez and the Chicago Reader, Chicago’s alternative weekly, wrote about in September in an article portraying the people whose seized possessions contributed to purchasing this type of equipment.

The surveillance equipment is purportedly used in what is called “exigent circumstances,” i.e. investigations into “kidnappings, homicides, endangered missing juveniles, suicidal subjects, etc.,” according to a 2011 purchase request. However, the author of the request, Sargent James Washburn, also wrote it would be used “during narcotics related investigations” — justifying the use of money obtained during the city’s war on drugs.

In an attached purchase justification letter, Washburn indicates that “project buildings” — slang for subsidized housing often occupied by poor and minority communities — and other large residential dwellings are a problem for investigators, because Stingrays can’t locate cellphones within specific apartments. The King Fish, however, can.

Washburn cites an example of a case where it took several extra days to apprehend suspects, because they needed to obtain phone records rather than simply track the phone — though he cited no real repercussions for the delay.

“Had the Technical Services Group been equipped with the portable ‘King Fish’ tracking unit, the offenders would have been apprehended that evening,” Washburn wrote. “Although this is a large disbursement of [civil forfeiture] funds, the R/Sgt. believes that the 2nd largest police department in the United States should be equipped to handle any and all law enforcement related situations.”

Washburn also encouraged the Organized Crime Division to keep quiet about the technology, as it is “proprietary in nature” and “knowledge of its existence could jeopardize the integrity and success of these types of investigations.”

Police departments, the FBI, and manufacturers like Harris have fought for years to keep records of the cellphone trackers secret — opting to throw out court cases rather than reveal specific details about their use.

The King Fish isn’t the only device the Chicago Police Department bought from Harris. An upgrade of the department’s Stingray device in 2009 cost $164,500, and included a “hand held” portable device “for use in multi-unit buildings.” The Stingray II would be used in a majority of narcotics investigations, or 60 percent of the time. The police paid another $18,000 for an “Amberjack” in 2009 — a small circular device that acts as an antenna monitoring signal strength of nearby phones.

In 2005, a technician in the Gang Intelligence Division told his Commander that the unit needed upgrades on several cellphones trackers — revealing which types of phones are tracked by which device. The Stingray, whose update cost $23,500, could track Verizon, U.S. Cellular, and Sprint phones, while the DRT Box could track Cingular, T-Mobile, and Nextel devices.

Additionally, it’s likely the Chicago Police Department is hiding other surveillance equipment it’s using. One document separately obtained by Martinez mentions an item “of a covert nature” manufactured by KEYW Corporation costing $7,500. The name is redacted. Based on the manufacturer and the price, it’s likely the item purchased by the CPD was a Jugular: a cheaper, smaller cellphone tracker that may not require a court order to use, because it passively monitors radio waves rather than conducting active surveillance and recording data. KEYW didn’t respond to request for comment.

Court Records:

The Chicago PD also turned over 43 records of times they deployed cellphone trackers in the past 10 years — which Martinez suggests is likely still lower than the actual amount of times the devices were used.

“The number of documents related to the deployment of Stingrays seems dubious at best. CPD continues to maintain that no logs of IMSI catchers being checked in and out of the Tech Lab exists, even though they are required to keep such records,” he wrote in an encrypted text message.

Even so, the various court orders and requests reveal how investigators presented their use of Stingray devices to judges.

In most applications to use an IMSI catcher, officers identified the device as “a pen register in the form of a digital analyzer.” In identical footnotes in each case, a digital analyzer is depicted as nothing more than a simple antenna that detects “signals emitted by the target telephone.” According to the filings, the device “does not intercept any content of communications” but instead locates a phone by a number already known to investigators while in the same general area. (However, it only takes a simple software upgrade to allow the Stingray to track the contents of calls and text messages.)

The judge in Martinez’s Freedom of Information case, Cook County Circuit Judge Kathleen Kennedy, disparaged the Chicago Police Department for trying to argue that the cell-site simulators qualified as pen registers and trap and trace devices, or simple devices that record numbers dialed in and out by a phone — and therefore qualified for protection from disclosure.

“Because IMSI catchers’ capabilities are broader, it is improper to equate them to and treat them as pen registers and trap and trace devices,” she wrote. “The record reflects that IMSI catchers, also known as cell-site simulators or Stingrays, can capture a cellphones unique serial number, its location, and the content of calls, text messages, and webpages visited.”

However, a simple “pen register” device was exactly how the police explained the technology to the court in the past.

A court order to install a pen register requires less oversight than a warrant, because its installation is not regarded as a search, the Supreme Court has held. However, police now have to get a warrant to use Stingrays in Baltimore after a Maryland appellate court decision in March recognized the invasiveness of the device.

Each pen register request also contains the caveat that any information obtained besides the location of the targeted phone cannot be retained or used during the investigation. This suggests the officers understand that the device is capable of sweeping up more information than the location of their target. However, the requests go into almost no detail on how much information is collected, how it’s disposed of, and how cellphone service will be impacted in the area.

Multiple approved court orders include authorization for police to actually contact the suspect in order to force his or her phone to connect to the cellphone tower and allow them to track it. However, with upgrades to the trackers in recent years, that is likely no longer necessary.

In some of the cases where it deploys Stingrays, Chicago police, according to the documents, works alongside other federal agencies, including the FBI, the DEA, the U.S. Marshall’s Service, and the Secret Service.

Chicago’s internal case database revealed multiple uses of Triggerfish devices — another Harris product that allows law enforcement to eavesdrop and intercept conversations without the phone company or the target’s knowledge. It’s reportedly capable of tracking over 60,000 people in a neighboring area. Chicago police used the device to track a target’s phone number during a home invasion investigation with the DEA, a drug case with the FBI, an armed robbery, a murder, and several other cases. The notes in each case file are not detailed, and don’t always reveal what information was obtained from the Triggerfish device.

Supplementary case reports describing investigations where “digital analyzers” were used are also incredibly vague. One document simply mentions that an officer “utilized electronic means to locate the cellular phone.”

The Chicago Police Department included in the batch of documents an affidavit from a gang related drug investigation where the police officer argued there was probable cause to use a cell-site simulator, or “digital analyzer” because the suspects, already tied to drug sales through police surveillance, kept switching out new burner phones. During a wiretap, police overheard one suspect say it only takes a few phone calls and “your ass is gone” — referring to the surveillance. The officer requested use of a “digital analyzer” to locate the new burner phones at “any time of the day or night … without geographical limitation in the State of Illinois.” The request was approved.

In another affidavit from November 2010, a police officer explained to the judge that the “digital analyzer” will reveal information about other “cellular telephones in the immediate area.” He suggests that to make sure he picked up on the right phone, the device would be pointed in multiple directions around the target, and “through process of elimination” determine which one the target phone is — revealing how invasive the search might actually be to the neighboring homes and people.

During “Operation Bird Cage” in March 2010, a case included in the file with almost no detail, a tech specialist used a “digital analyzer” multiple times near a suspect’s car, continuously tracking the area to separate out one person’s phone data.

While these court records reflect how Stingrays and other cellphone trackers were authorized for use in serious criminal cases — such as murders, kidnappings, and aggravated battery — they also demonstrate how little judges knew about the devices prior to approval. The documents also demonstrate the ties surveillance technology has to the money and possessions seized during the war on drugs — which is in turn used to track people in impoverished areas of Chicago.

“The use of Stingrays as a part of the war on drugs, which were purchased with civil asset forfeiture funds,” demonstrates how “militarized equipment” is disproportionately used against “poor and brown communities,” Martinez wrote.

Jenna McLaughlin is a reporter and blogger covering surveillance and national security. She previously covered national security and foreign policy at Mother Jones magazine as an editorial fellow. There, she recently published a deep-dive investigation into the self-proclaimed “freedom fighter” Matthew VanDyke and his mission, entrenched in problems, to train the Assyrian Christians of Iraq to fight ISIS. She routinely covered the Pentagon’s sexual assault problem, putting pressure on Lackland Air Force base and others to address issues with reporting and preventing assaults. Her coverage of the Islamic State, ISIS, has been cited by recent novels and other stories on the subject, and her coverage of Twitter and its relationship to privacy and counterterrorism has been referenced in congressional testimony. She has also published multiple freelance articles with the National Journal, and previously worked for Baltimore City Paper and DC Magazine.

Reprinted with permission from The Intercept.