Sen. Wyden Confirms Cell-Site Simulators Disrupt Emergency Calls

This is a very common situation.

It's an odd game-theoretic stalemate.

Along with Wyden, Harris and Heinrich voted against approving the renewal of Section 702, and while Feinstein didn't vote against renewal, she did before that join with Harris and others in supporting an amendment, which was defeated, which would have added a warrant requirement before accessing the contents of American’s communications pulled in in the course of surveillance under 702. So, while Wyden may be the strongest anti-surveillance voice, it is not th case that the rest of the Committee (particularly on the Democratic side) is unilaterally pro-surveillance anti-Wydens.

You're aware he does more than just "trying to understand"?

It's better than that, though. He and Udall have spent years talking about mass surveillance and telecoms abuses as major problems, and made very few friends doing so.

I agree that "in Congress but acting like a decent human" wouldn't be enough, and it frustrates me endlessly that positions like "was mostly against torture most of the time" are somehow laudable when they come out of Congress. But Wyden's access to confidential briefings means he's actually sounded a lot of alarm bells that other people couldn't, and that deserves some recognition.

Some, but the vast majority of criminals do not put that much effort into their crimes, and among those that do, most wind up botching things. When criminals gravitate toward a system law enforcement agencies have trouble with it is more survival of the fittest than active planning.

Law enforcement fought to keep stingrays a secret for two reasons: pressure from the manufacturer, and a desire to avoid public scrutiny (which is likely the reason the manufacturer pressured them to keep it secret). The police would greatly prefer that the general public not spend too much time thinking about stingrays to avoid the risk of a stricter warrant process being required. It is also helpful if judges and defense lawyers are not familiar with the device and do not know what questions to ask.

Stingrays (and presumably other IMSI catchers) don't actually act as a bridge to a legitimate network; they're a terminal connection, and effectively deny service to any devices connected to them. This is the default behavior, and it's how the FBI has claimed they're deployed domestically. The reason they don't cause major outages appears to be that they only accept connections from targeted phones; they could equally easily be used as mobile DoS beacons. And the reason they don't cause targets to abandon their 'broken' phone is that they don't have to run full-time for effective triangulation.

For Stingrays to collect calls, as outlined in your link, is effectively a whole new service on top of the basic behavior. The Stingray continues to be an endpoint for the targeted phone, but also extracts the GSM encryption key on the device. It then opens a new connection to a cell tower, and uses the IMSI and stolen encryption to impersonate the real device. From that point on, its a mitm attack.

So the only way a Stingray transfers calls is for targeted users, while configured in a mode that's supposedly not employed in the US. Harris is claiming they use a variant of this system to pass 911 calls, Wyden is pointing out that it's completely untested and doesn't even claim to support text-to-speech dialing.

(Source: Wikipedia is surprisingly comprehensive, primary source at: https://www.documentcloud.org/documents/1282642-07-08-29-200...)

Or we’d have to train every single officer to have the right skills all the time for something they’ll almost certainly never use.

Leaves the question what happens when they move or turn off the stingray.

There are many "social layers" - arguably more than the four Indian castes. They are treated very differently by everyone, including the legal system.

Or, more probably, locking up innocent people.

I guess almost all of the software developers here have never really built any features then. Imagine that, all that code and the features “don’t exist”. I didn’t realize the law had such ontological power. Not certified means not certified. Not believing you have a legal obligation to get certified is a great reason to avoid that expensive and bureaucratic process.