Stingray trackers

Be aware that government and law enforcement agencies, as well as some private organizations or individuals, operating in a legal gray zone, may be use 'Stingray' phone trackers to intercept cellular phone communications.

The devices can intercept International Mobile Subscriber Identity (IMSI) signals. They mimic wireless cell phone towers and force mobile phones to connect to them. The Stingray devices can be used to conduct denial of service attacks; detect the content of communications; and determine the location of cell phone users.

Stingray devices work by forcing cellular devices to communicate with them by sending out a stronger signal than actual cell sites in the immediate area. Journalists have reported, that Stingrays have been used frequently by local police departments and the FBI to track down criminal suspects.

Hand held stingray devices may be referred to as a 'Kingfish' device, and are often carried in patrol vehicles. Stingray and Kingfish are brand names used by the Harris Corporation.

Subpoenaing Unnamed Defendants Known by IP Addresses

On April 9, 2018, Judge Steven Locke issued a decision, In re Strike 3 Holdings, LLC, 17-cv-5606, 2018 U.S. Dist. LEXIS 59961 (E.D.N.Y.), granting a motion for expedited discovery under FRCP 26(d)(1) to served subpoenas on ISPs to obtain the identity of unnamed defendants identified only by their IP addresses.

The plaintiff is the copyright owner of adult movies which are distributed on the web. The Doe defendants are alleged to have pirated the films using BitTorrent. A forensic investigator employed by the plaintiff was able to identify IP addresses in the BitTorrent file distribution network and determine how many copies of the movies were made.

A second consultant used the Wireshank program to verify the IP addresses.

While the Court found good cause for expedited discovery, and agreed to issue Rule 45 subpoenas, it limited the plaintiff to requesting the names and addresses of the individuals to whom the IP addresses were assigned but barred disclosure of their phone numbers and email addresses. The ISPs were instructed not to directly provide the plaintiff with names and addresses but instead serve the subscribers with a copy of the subpoena and the court’s order. The subscribers will then have 60 days to file a motion to quash. After 60 days a failure to contest the subpoena means the ISP has to disclose the names and addresses in 10 days to Strike 3 or file it’s own motion to quash.

TONIGHT IS THE THIRD ANNIVERSARY OF LITIGATION SUPPORT TIP OF THE NIGHT. TIPS APPEAR EACH NIGHT, 365 NIGHTS A YEAR.

United States v. Rodriguez

On February 20, Judge Hugh Scott of the Western District of New York issued an opinion with some significance for case law on best practices in preparing forensic images.   In United States v. Rodriguez, 2018 U.S. Dist. LEXIS 26963,0" a mortgage fraud case he declined to rule on a defendant’s motion to compel the production of a hard drive.    He did however comment on the government’s accusation that it was an irrelevant discovery motion used as a delaying tactic.   Citing the Western District of Georgia’s decision in United States v. Sharp and other authorities, Judge Scott stated that, “ the Burford hard drive as it was in 2013 no longer exists, because a failure to create a forensic image [*24] has changed the hard drive's metadata forever; that, in turn, has raised some questions about whether alterations to the hard drive's contents have occurred since 2013. How much the law enforcement agent's error matters remains to be seen. See, e.g., United States v. Heiser , 473 F. App'x 161, 166 (3d Cir. 2012) (unpublished opinion) (destruction of digital evidence requires bad faith before it rises to a due process violation). But an error it was, and pointing it out is hardly "irrelevant."”

Good to see the court’s awareness of how copying data can alter it.  It’s a good tip that calling out a party on the failure to forensically Image a drive can buy you some time.