The Internal Revenue Service is the latest in a growing list of US federal agencies known to have possessed the sophisticated cellphone dragnet equipment known as Stingray, according to documents obtained by the Guardian.
Invoices obtained following a request under the Freedom of Information Act show purchases made in 2009 and 2012 by the federal tax agency with Harris Corporation, one of a number of companies that manufacture the devices. Privacy advocates said the revelation “shows the wide proliferation of this very invasive surveillance technology”.
The 2009 IRS/Harris Corp invoice is mostly redacted under section B(4) of the Freedom of Information Act, which is intended to protect trade secrets and privileged information. However, an invoice from 2012, which is also partially redacted, reports that the agency spent $65,652 on upgrading a Stingray II to a HailStorm, a more powerful version of the same device, as well as $6,000 on training from Harris Corporation.
Stingrays are the best-known example of a type of device called an IMSI-catcher, also known as “cell-site simulators”. About the size of a briefcase, they work by pretending to be cellphone towers in order to strip metadata and in some cases even content from phones which connect to them.
Despite their extensive capabilities, they require only a low-level court order called a PEN register, also known as a “trap and trace”, to grant permission for their use.