Remember those IMSI catchers? UK authorities play hide and seek with use of intrusive surveillance technology

An ‘IMSI catcher’ is a device that tricks all mobile phones in its vicinity to connect to it in order to track them, by ‘catching’ their unique IMSI number. IMSI’ stands for ‘international mobile subscriber identity’, a number unique to your SIM card. IMSI catchers are also known as ‘Stingrays’.

An IMSI catcher records IMSI numbers by pretending to be a mobile phone tower with superb signal strength, causing mobile phones nearby to connect to it, enabling it to then intercept the data from that phone to the cell tower without the phone user’s knowledge.

Why are IMSI catchers a problem?

As we have highlighted before, IMSI catchers are highly intrusive surveillance tools whose use is often under regulated. They are usually deployed in secret, sometimes without a clear legal basis, and without appropriate safeguards and oversight mechanisms. Their use infringes on our rights to privacy, freedom of expression, and freedom of assembly and association.

IMSI catchers, and intrusive surveillance technology more generally, are increasingly used during protests, permitting authorities to record everyone who attended and interfere with their communications.

How we got here

Our quest for transparency and regulation of the use IMSI catchers by law enforcement in the UK began back in 2016.  Starting with two freedom of information requests PI submitted to the Police and Crime Commissioner for Warwickshire and the Commissioner of Police for the Metropolis (The Metropolitan Police) in October 2016, PI eventually brought two appeals before the Information Rights Tribunal against the UK Information Commissioner (IC) as it upheld the police forces’ decision to withhold information in relation to the use of IMSI catchers. In December 2019, the Information Rights Tribunal found in favour of the IC and dismissed PI’s claims. Whilst the decisions of the Tribunal have been disappointing, we decided not to appeal them further and have explained our reasons before.

But our decision not to appeal did not end our fight to apply transparency and safeguards to the entire complex and growing ecosystem of surveillance technology, including IMSI catchers. As a next step, we sent letters to the National Police Chief's Council (NPCC), the Mayor of London Office for Policing and Crime (MOPAC), and the Investigatory Powers Commissioner's Office (IPCO).

What do we know about IMSI catcher use in the UK

All three bodies – the NPCC, MOPAC, and the IPCO – insist on maintaining "the NCND position of law enforcement on this matter".

We still disagree with this decision to maintain an NCND position considering numerous reputable and varied sources have previously reported on the use of IMSI catchers, including The Guardian, Times, Daily Mail, Sky News, BBC News, The Telegraph, The Intercept, Bristol Cable, Vice News and Motherboard. Our witness statement before the Information Rights Tribunal also set out information about public authorities that have confirmed their purchase and/or use of IMSI catchers, and confirmation by police forces in the UK of purchase and/or use of other surveillance technology and disclosure of relevant records.

In light of such wide-ranging public disclosure of information, maintaining the NCND position is not only unrealistic, but also threatens core democratic and rule of law values but restricting the ability of the public and Parliament to understand and debate the use of such intrusive technology.

And because all three bodies uphold the UK's position of NCND regarding the use of IMSI catchers, their responses do not directly address IMSI catchers' deployment during protests. The Investigatory Powers Commissioner does state, however, that he hopes his description of the regulatory regime that may govern IMSI catchers "allays Privacy International’s concerns that such equipment could be used ... for the purpose of monitoring those simply attending lawful protests." Unfortunately, it does not. As we describe below, the conflicting responses from the IPCO and MOPAC with regard to the appropriate regulatory regime leave us wondering whether the police are truly applying an appropriately high standard when determining when to deploy IMSI catchers.

What we learned regarding the UK legal framework for using IMSI catchers

The IPCO and MOPAC responses to our letter seek to clarify the legal framework that would regulate the use of IMSI catchers if they were used by the UK police forces. Yet they leave a lot of open questions that bolster the need for further transparency.

UK authorities do not agree on the legal framework for IMSI catcher use

First, the UK authorities do not seem to agree on what the appropriate framework regulating the use of IMSI catchers equipment would be.

On the one hand, both the IPCO and MOPAC agree that the Investigatory Powers Act 2016 (IPA) could regulate the use of IMSI catchers by UK law enforcement. Yet they don't agree on exactly which provisions would be relevant.

The IPCO considers that the most relevant part of IPA is Part 5 that regulates equipment interference. Under this section, "a targeted equipment interference warrant issued under Part 5 of the IPA by a law enforcement chief and approved by a Judicial Commissioner" would be required to authorisation the aquisition of communications data (but not content) using an IMSI catcher.

The IPCO adds:

Such a warrant could only be issued where it was necessary on one of the statutory grounds, such as the prevention and detection of serious crime, and where the deployment of any equipment was proportionate. Any proportionality assessment would need to take into account the location of the deployment and arrangements for mitigating any collateral intrusion and safeguarding any product obtained.

Alternatively, according to the IPCO, if law enforcement wanted to use an IMSI catcher to intercept communications – something the Commissioner deems unlikey – then they would require "lawful authority as defined in s.6 IPA – specifically, it would require an interception warrant issued personally by the Secretary of State and approved by a Judicial Commissioner." While the IPCO seems to believe that the police forces would not need an IMSI catcher to intercept communications as they could obtain those from telecommunications operators, their response emphasises that it "would not be proportionate to issue such a warrant in circumstances where the purpose was simply to acquire communications data rather than the content."

MOPAC, however, states that the use of an IMSI catcher would fall under Part 3 of the IPA regulating "Authorisations for obtaining communications data". This disagreement with the IPCO is potentially troubling, as the safeguards for obtaining communications data under Part 3 are less robust than those provided for under Parts 2 (Interception) or 5 (Equipment Interference), particularly with regard to authorisation.

Moving beyond the IPA, MOPAC asserts s.93 of the Police Act 1997 may regulate IMSI catchers, while the IPCO does not contemplate use of IMSI catchers outside the IPA framework. This is despite the fact that section 14 of the IPA recognises the potential overlap between its own provisions and s.93 of the Police Act, and sets out the circumstances in which the IPA should prevail over the Police Act.

These differences could have a considerable impact when using highly intrusive technology such as IMSI catchers, as they point to distinct understandings regarding the nature of the technology's capabilities. The IPA and the Police Act also apply different conditions for permitting use.

MOPAC clearly construe s.93 of the Policy Act 1997 – which is a broad property interference provision – as allowing use of IMSI catchers, while the IPCO sees use of IMSI catchers as a form of targeted equipment interference under the IPA Part 5. Among other safeguards, the auhtorisation requirements are very different under s.93 of the Police Act versus s.106 of the IPA - the former requires simple authorisation by authorising officer, whereas the latter involves approval by a Judicial Commissioner.

The fact that the use of IMSI catchers could be lawfully authorised by not one but two Acts of Parliament with differing standards is concerning, not least because the IPCO letter states "I hope my confirmation of the legal framework that would apply to the use of IMSI catchers in the UK, which would include the need for approval by a Judicial Commissioner (other than in urgent cases), allays Privacy International’s concerns that such equipment could be used without proper oversight or for the purpose of monitoring those simply attending lawful protests."

Part 5 of the IPA would seem to be most appropriate to regulate the use of IMSI catchers. For starters, Part 5 - unlike Part 3 - covers conduct including equipment interference. Part 3 merely addresses what it calls the "obtaining of communications data", a phrase which does little to explain or legitimise the method by which such communications are actually obtained. The surreptitious nature of IMSI catchers, and the fact that they can collect the phone user's personal details without the user's knowledge, seems to make the provisions addressing equipment interference a better fit. While equipment interference is not defined by Part 5, s.99(2) sets out that a targeted equipment interference warrant is one which authorises interference with equipment for the purpose of obtaining communications, information or equipment data. Equipment data as defined in the IPA includes "identifying data" which, under s.263, encompasses data which can identify, or assist in identifying, any person or apparatus. To the extent that IMSI catchers enable the collection of the IMSI and IMEI numbers, each of which are unique, information collected by IMSI catchers would be of an identifying nature.

Is the use of an IMSI catcher bulk surveillance?

Second, neither the IPCO nor MOPAC seem to consider IMSI catchers could be used under the IPA's bulk surveillance powers. They do not invoke any of the powers that would permit such forms of surveillance – particularly Parts 6 and 7 of the IPA. Yet this doesn't exclude the use of IMSI catchers for mass surveillance purposes. As mentioned above, an IMSI catcher tricks all mobile phones in its vicinity to connect to it in order to track identify and track the phones. This is indiscriminate and generalised surveillance.

As noted above, according to the IPCO, IMSI catcher use can be authorised with a "targeted equipment interference warrant issued under Part 5 of the IPA" yet this is understood to include thematic warrants. Thematic warrants can include permission to interfere with equipment in a broad geographic area, like for example during a protest or other public gathering. They are, in essence, bulk warrants. The IPCO's 2020 Annual Report confirmed the increasing use of broad thematic warrants by both the Secret Service (MI5) and the Secret Intelligence Service (MI6) (paras. 9.16 and 10.5 respectively).

To conclude

While we welcome the IPCO's and MOPAC's attempts to clarify the legal framework applicable to IMSI catchers, we are still concerned. Their conflicting answers leave open questions regarding what regulatory framework should apply to this very instrusive surveillance.

More transparency is urgently needed surrounding the use of surveillance technologies, such as IMSI catchers, especially when they facilitate mass surveillance. This lack of transparency threatens core democratic and rule of law values.

We believe that:

1. The public interest in maintaining the NCND position with regard to IMSI catchers is outweighed by the public interest in confirming or denying their use. This is particularly due to the potential for arbitrary and indiscriminate use of this intrusive technology and the need for informed public debate;
    
2. Such reasoning has implicitly been acknowledged in the avowal of other law enforcement surveillance methods in the past, including mobile phone extraction and predictive policing; and
    
3. Our arguments are supported by the regulatory frameworks in other countries, such as the US and Germany, where much more stringent transparency requirements relating to IMSI catchers are in place.

Timeline

• October 2016: The Bristol Cable publishes evidence that a number of UK police forces purchased “Covert Communications Data Capture Equipment”, which from the available information was understood to be a reference to IMSI catchers
• November 2016: PI submits freedom of information requests to various police forces, the Home Office and the National Police Chiefs’ Council seeking records related to UK police purchase and use of IMSI catchers
• July 2018: the UK Information Commissioner (UK IC) issued its decisions partially agreeing with PI but also upholding police forces position to withhold information, including internal policy guidance as well as contracts and other records regarding the purchase of IMSI catchers
• August 2018: PI, represented by Liberty, appeals this part of the ICO’s decisions to the First-tier Tribunal (Information Rights Tribunal)
• December 2019: the Information Rights Tribunal issued two disappointing decisions, one relating to Metropolitan Police and the other the Police and Crime Commissioner for Warwickshire,  refusing appeals brought by PI against the UK IC
• June 2020: PI decides not to appeal but continues to advocate for transparency and safeguards to apply to use of IMSI catchers by law enforcement
• May 2021: PI sents letter to the National Police Chief's Council (NPCC) and National Crime Co-Ordination Committee (NCCC) calling for more information and transparency
• June 2021: PI sents similar letters to the Mayor of London Office for Policing and Crime (MOPAC) and the Investigatory Powers Commissioner's Office (IPCO). NPCC responds to PI's letter
• July 2021: MOPAC responds to PI's letter
• November 2022: IPCO responds to PI's letter

For further information see the case page and PI's decision not to appeal