Fake Stingray mobile base stations discovered spying on millions of Londoners

There are at least 20 fake mobile base stations being used in London to spy on the mobile communications of all mobile phone users in the city, a new investigation has found.

Fake mobile base stations or IMSI catchers are pieces of telecoms equipment used to mimic real mobile base stations, tricking users' phones to connect to them as they pass close to the areas where the fake base station is located.

In addition to gathering a mobile phone user's location and identifying information, data from text messages can easily be intercepted with an SMS server, without the user's mobile operator or the user themselves being any the wiser.

One of these devices is the Stingray and was initially developed by the Harris Corporation for the military and intelligence community but has seen widespread use by local law enforcement agencies around the world.

Who is watching us?

The Sky News investigation using software from GMSK Cryptophone software to search for Stingray units uncovered 20 instances of the technology in London alone.

There is no indication of who is using these Stingray devices in London, but they have been shown to be used by police forces as well as criminals in countries like the US and China.

In November 2014, The Times reported that the Metropolitan Police Force was using Stingray, but despite repeated Freedom of Information requests, to this day it has not confirmed whether it is using the technology.

Privacy International's deputy director Eric King told IBTimes UK just how the Stingray technology can be used for widespread, mass surveillance.

"With IMSI catchers, it's very difficult for them to be used in a targeted manner. In an urban space, thousands of people's mobile phones would be swept up in that dragnet. What they do with that data, we don't know. We know police have been using them for years, but this is the first time that it's been shown that they're being deployed in the UK," he said.

"When will the police stop pretending IMSI catchers don't exist? The spying tool has featured in everything from The Wire to Zero Dark Thirty. Companies are selling them on the grey market to anyone who can pay.

"The only thing we don't know about them, is what the police are doing to protect people from their use by criminals, and when they use them, what legal framework ensures they're properly used?"

Widespread use

Sky News data logs show all the attempts made by various fake base stations to connect and transmit data, and Cryptophone previously used its software to detect 17 fake mobile base stations across the US in September 2014.

The technology was first reported being used in China in March 2014, where authorities arrested 1,500 people who had been operating in criminal gangs sending out spam text messages charged at premium rates to users' phones.

However over the course of 2014, it was discovered that numerous county and state level police agencies in the US had been using Stingray to bulk collect citizens' mobile communications data without requiring search warrants.

Discussion of the issue has reached the national stage, with Washington state signing a new bill into law in May that forces law enforcement to obtain warrants before they can use the technology, and other states are considering following suit.

IBTimes UK has contacted the Metropolitan Police for comment and is waiting for a response.