The United States government for the first time publicly acknowledged the existence of what appear to be stingray devices used by a foreign intelligence service in the U.S. capital region.
U.S. Senator Ron Wyden wrote a letter to the Department of Homeland Security in November 2017 requesting information about the use of unauthorized foreign cell-site simulators, aka stingrays, in the area.
On March 26, 2018, Christopher C. Krebs, DHS Senior Official Performing the Duties of the Under Secretary, responded acknowledging that the agency had “observed anomalous activity in the National Capital Region (NCR) that appears to be consistent with International Mobile Subscriber Identity (IMSI) catchers.”
The DHS went on to say the agency has not validated or attributed the activity to any specific entities or devices and that the information was reported to unnamed “federal partners” at the time it was observed.
When questioned on whether or not the DHS has the technical capability to detect foreign stingray devices, Krebs told Sen. Wyden that the DHS doesn't have the capability and would require additional funding to obtain such capability.
An anonymous DHS official told the Associated Press the unauthorized stingray activity was detected during a 90-day trial beginning in January 2017 with equipment from ESD America, a Las Vegas-based DHS contractor.
This isn't the first time legislators have raised concerns about the use of stingray devices near the capital. In 2014 researchers conducted public sweeps that found suspected unauthorized devices near the White House, the Supreme Court, the Commerce Department and the Pentagon and other high profile buildings.
Krebs also said that the DHS is aware of rogue stingray activity outside the NCR and that the agency also doesn't have the technical capabilities to detect 4G/LTE IMSI catchers which are currently being openly advertised by surveillance technology companies.
“To support such a capability, DHS would require funding to procure, deploy, operate and maintain the capability, which includes the costs of hardware, software, and labor,” even though the malicious use of the devices may threaten U.S. national and economic security, Krebs said.
Krebs said IMSI catcher threats were addressed in the DHS's April 2017 Study on Mobile Device Security and that the report recommended areas for additional research or partnerships and that overall, the threat of rogue stingray devices is a real and growing risk.
“Leaving security to the phone companies has proven to be disastrous and shows yet again why it is critically important to protect strong encryption to safeguard Americans' private information,” Wyden told SC Media. “Despite repeated warnings and clear evidence that our phone networks are being exploited by foreign governments and hackers, FCC Chairman Pai has refused to hold the industry accountable and instead is prioritizing the interests of his wireless carrier friends over the security of Americans' communications.”
