Behind The Curve: When Will The UK Stop Pretending IMSI Catchers Don't Exist?

Thousands of innocent people in London have had their communications spied on and collected through the use of invasive mobile phone surveillance technology, called IMSI Catchers, according to a recent report by the Times.

IMSI Catchers are no longer, and have not been for a while, a law enforcement secret. They have been featured crime dramas like the Wire and in movies such as Zero Dark Thirty. For years, the German Parliament has publicly received the number of IMSI Catcher operations undertaken by the intelligence service, and other states are following suit, with the US Federal Communications Commission opening a task force into the use of the technology just months ago.

While the use of such technology by the Metropolitan Police had been suspected for some time, it is the first time that details of the operations they carry out have been revealed. The British police's refusal to confirm or deny their use is out of step with international trends and in sharp contrast to calls from the most senior police officer Keith Bristow to ensure "policing by consent" remains at the heart of British policing.

Now is the time to change, to come clean about the use of IMSI Catchers and stop relying on secret, out of date legal justifications for technologies never envisaged at its drafting.

Widenet surveillance

IMSI refers to the International Mobile Subscriber Identity, a unique number that is associated with a SIM card. IMSI Catchers work by using the fundamental operating requirements of mobile phones, specifically your phone's desire to connect to the strongest signal, against targets in order to identify them. When deployed, IMSI Catchers present themselves as base stations with the strongest signal in a given area, forcing all phones in the vicinity to automatically connect to the device. Once this connection happens, operators of IMSI catchers can collect revealing information of people in the areas using phones, including the subscriber's identity. Some IMSI Catchers can even intercept calls and SMS.

The interception occurs over the air, which means IMSI Catchers are portable and don't require direct physical connection to any mobile network tool to operate. This in turn gives the surveillance tool immense power -- they can be deployed anywhere, and often without the approval of network operators. They first appeared on the open market in the US under the name "StingRay" in 2003. And in the UK, the Metropolitan police were known to have purchased the technology in 2008/2009.

In spite of this, UK security services have refused time and again to provide the public with any information about the technology's use. Privacy International filed FOI requests to confirm the Met's use of IMSI Catchers in 2011, and just this year Vice magazine tried to acquire additional informationabout its deployment in London.

Behind the times

While the UK has done nothing, other countries have been more proactive in holding law enforcement accountable in their operation of IMSI Catchers. In the United States, for instance, the discussion around the use of mobile phone surveillance technologies is well underway. In a letter sent in July to the Federal Communications Commission, Senator Alan Grayson wrote:

Americans have a reasonable expectation of privacy in their communications, and in information about where they go and with whom they communicate. It is extremely troubling to learn that cellular communications are so poorly secured, and that it is so easy to intercept calls and track people’s phones.”

The American judiciary have also voiced concerns on the appropriate use of IMSI Catchers, in particular the detrimental impact of "collateral collection", where innocent passersby's information is captured in the wide net cast by the spy equipment. Texas District Court Judge Brian Owsley refused to grant an authorisation request by Drug Enforcement Administration to use an IMSI Catcher during an investigation, writing:

They [the Drug Enforcement Administration] did not address what the government would do with the cell phone numbers and other information concerning seemingly innocent cell phone users whose information was recorded by the equipment."

A growing tide against the use of IMSI catchers have led to the FCC to convene a task force to review "the illicit and unauthorized" deployment of the technology, initially only focusing on its use by criminals and foreign intelligence agencies on US soil. While it remains to be seen what will come out of the review, the official attention paid to IMSI Catchers at least acknowledges the invasive power of such devices and the need for a better informed understanding of its operation.

Germany: The public's right (and its opportunity) to know

In Germany, the state's use of IMSI Catchers is public information. Every six months, German intelligence agencies are required to report their use of IMSI Catchers to the Parliamentary Control Panel, which oversees the collection of personal information and the use of personal data by the agencies. The panel in turn reports to the Bundestag, which distributes the information to all Members of Parliament.

Though the panel has no oversight of police activities, that belongs to the individual states within Germany, this process blows up the argument that the state's use of surveillance technology needs to be secretive.

This method of review and transparency is what is needed in the UK and elsewhere. 

The UK: Worst of both worlds

In the UK, there is no information anywhere on the use of IMSI Catchers -- the numbers of times used, in what method, or to combat what crimes.

The Times article revealed for the first time law enforcement's legal justification for the use IMSI Catchers. When someone is targeted by an IMSI Catcher, it is considered a "property interference" under the Police Act 1997 Part III, according to the report. A "property interference" is designed to regulate the placing of bugs and breaking into someone's home, not mobile phone interception.

The proponents of the law at the time could have in no way anticipated that such a technology would exist or that potentially thousands of innocent individuals would be affected by it. Indeed, at the time mobile phones looked more like television remotes and operated in a similarly limited way. The "property interference" designation does not provide for adequate safeguards of the individual's communications and does not at all take into account the nature of technology used.

Currently the number of authorisations is mixed up with the 2,689 authorisations for property interference that took place over the year 2013-14. It is unclear what portion of the 2,689 authorisations for property interference represents the deployment of an IMSI Catcher. As a result, the public receives no assurances that the technology is used in a proportionate and necessary manner. 

The UK is dangerously behind the international curve in its response to IMSI Catchers. The longer this goes on, the greater the curve will grow. And all the while thousands of innocent people will be unfairly swept up in the use of broad, suspicionless surveillance.