Dead End Surveillance - Stingrays and Civil Rights

Photo by Rob Wilson 

The terminus of a lonely dead end county road in North Dakota’s contested territory laid beneath one of the most terrifying civil rights moments in modern American history; an echo of historical injustices come around the canyon of time to ring again.

Water Protectors, a group of Native Americans and their allies lead by the Standing Rock Sioux, prayed for the end of the Dakota Access Pipeline (DAPL) at one of its construction sites in rural North Dakota on September 28, 2016. Elders, children, horse riders, and adults gathered in prayer. Some Water Protectors were live streaming the prayer on Facebook, until the signal suddenly stopped.

They feared the consequences of their prayer event was just coming around the corner.

In recent weeks, the police and oil company security have been escalating hostilities. At one prayer meeting a tribal grave site was dug up, resulting in an attempt by protestors to block the bulldozers. In response, the oil company’s security unleashed attack dogs and used pepper spray. Police said they were nowhere nearby during the prayer vigil which resulted in 30 people being pepper-sprayed, and about half a dozen people being bitten by dogs – including a child and a pregnant woman. The journalist who broke the story, Amy Goodman, has been hit with an arrest warrant for criminal trespass.

Police are dispatching ever larger contingents of officers to each action. It seems every police agency in North Dakota is taking its turn sending officers.

The Water Protectors on the dead end road were greeted by dozens of police officers who seemed to spring from the grass like a swarm of locusts, with automatic weapons, shotguns, and armored vehicles. Police helicopters and airplanes occupied the airspace overhead. Officers walked down through the hills, arriving on foot from over crests overlooking the Water Protector’s prayer location. Police SUVs rushed in across fields around the Water Protectors.

As the police moved in, the Water Protectors tried to leave. They looked around, panicked, trying to find the way out. They got in their cars, ran on foot, and tried to ride away. Soon they were surrounded by police loading shotguns in front of them, watching other Water Protectors being pulled from cars.

They were surrounded. The police positioned their vehicles so the protesters had no route of egress. The armored personnel carriers were facing the crowd on one side. Police lined up in front of the armored vehicles and after a short pause moved forward in sync – a line of riot gear and guns heaving and stomping across the road toward the Water Protectors.

Above the protestors police helicopters swung close to the ground, and a surveillance airplane circled.

A police officer raised his weapon and the crowd began to scream “GUN!” They raised their hands and screamed “We have no weapons,” and “We are not armed.”

A rider moved to the front of the crowd, to try to protect the group. The police officer pointed his gun at the rider.

Another Water Protector started to yell, calling the officer’s attention away from the rider and drawing the business end of the officer’s gun.

On the other side of the crowd, an automatic weapon was pointed at the crowd. People in front instinctively dodged and left the second row of people face to face with the cop’s gun.

Children and the elderly were at the protest. Their shouts of terror stung the ears of the able bodied who tried to get between the guns and the vulnerable, putting their lives on the line to protect them.

“It was pandemonium,” said a Water Protector who only identified himself as Paiute Ghost Warrior.

The Water Protectors were split in two. Twenty-one people were arrested, most for criminal trespass.

Around the sacred fire in the middle of camp after the dead end incident, the riders discussed what happened to them. Young men all, they were nearly brought to tears as they recounted their terror and anguish that their horses almost died.

Numerous people at the action who escaped arrest isolated themselves after the incident, trying to come to terms with how close to death they had just come.

“It was an ambush,” said Water Protector calling himself Paiute Ghost Warrior, “If you looked carefully on the way in, you could see them.”

“Ambush.”

“Ambush.”

“Ambush.”

In the days after the protest, ambush was the word of choice to describe the incident around camp. Water Protectors said it seemed like the police knew where they were going to be and when. Pictures of police coming over ridges began to circulate.

Everyone in camp is aware of the governmental monitoring. It is a semi-militarized zone. The most popular entries require passing through a one lane National Guard Checkpoint. Several times a day, North Dakota Highway Patrol helicopters circle over head. Surveillance airplanes are almost as fixed a feature of the aerial landscape as the moon. Police drive slowly around the camps when they are not standing over the ridges to watch camp activities. Everyone expects there are law enforcement moles in camp, sewing seeds of dissent and reporting activities. Electronic surveillance and interference is expected .

The Water Protector leaders keep their actions quiet. The routes are planned ahead of time. Most of the time the camp gets short notice of an action and goes with little notice; usually just enough time to get gas. Willing participants jump in their cars to drive, following the lead cars.

Dakota Access Pipeline construction slithers across the hills for miles around Standing Rock Sioux Reservation. Each place it crosses a road is a potential pray or protest location. Water protectors usually visit and pray at more than one location during each action.

The locations and route are not routine, advertised online, or written down in camp.

At the first protest location on the day of the Dead End incident, the police presence was noticeable but smaller. The Dead End Incident occurred at the second location quickly after the Water Protectors arrived.

One of the two police armored vehicles was from Stutsman County, over 138 miles from the protest location; an over two hour drive. It arrived at the protest location in under an hour.

Law enforcement officers from Morton County Sheriff, North Dakota Highway Patrol, Burleigh County Sheriff’s Department, Border Patrol and Bismark Police Department have been present at protests recently.

Stingrays at the Dead End

The North Dakota plains used to be an ocean, teaming with sea creatures. Now instead of water, the remote plains community is a sea of electronic signals. Evidence is strong that Stingrays have made homes in the wash.

Stingray devices, also called cell site simulators or IMSI catchers, are small electronic devices which can record phone calls, collect the content of text messages and other communications, extract data from phones, track cellular devices, jam signals, perform denial of service attacks, and extract encryption keys. The devices can also collect meta-data including caller, recipient, and times and lengths of phone calls. Some models can change the software in a phone, and allow the Stingray user to use the microphone as a listening device.

Stingrays are so small they be deployed in fake cell phone towers, suitcases, cars, airplanes, helicopters, and drones.

Stingrays are available to the police, military, and anyone else who can afford to buy them. According to the ACLU’s website on Stingrays, the National Guard has and uses Stingray technology.

On September 8, North Dakota Governor Jack Dairymple activated the state National Guard in response to the Water Protectors.

Stingray Hunting

Detecting and locating a Stingray takes patience. The environment needs to be surveyed. Once you know the layout of the area, its tracks become visible.

The first step to finding out if a Stingray is in use is to run software which surveys the infrastructure and tracks changes to it. The survey process can take a few days because it has to learn the names and numbers of all the network equipment.

Late in the evening, September 26, 2016 a Stingray environmental survey started. Using Cell Spy Catcher app, cell phone infrastructure was tracked.

Understanding Stingray Environments

Stingray hunters have to know the electronic, digital and physical environment of the Stingray to find them.

CID stands for Cell ID. It is a number to identify a unique base transceiver station. A base transceiver station is a physical device which facilitates the connection between cell phones and cell phone provider networks. Cell phone towers have base transceiver stations. Under normal conditions, cell phone companies do not change out and move their CIDs often and certainly not several times a day.

Lac (LAC), an initialism for Location Area Code. Location Area Codes' unique number codes for are base stations, usually grouped together indicating the geographic location. It is used so companies know where a phone is to connect a call. In order to get a new LAC number, the geographical location of the CID has to change.

Think of a genuine LAC as the Golden Gate Bridge. Toll (text, call, data, etc) is paid to the toll taker (CID) for passage across the Golden Gate Bridge. If a Stingray has been put in place, a driver will drive up to the Golden Gate Bridge but the toll taker’s booth will say “Brooklyn Bridge”. The toll taker collects the toll and then then pass the money to the Golden Gate Bridge so the driver can still cross (phone call connects, text goes through, email sent). When the “Brooklyn Bridge” moves to take toll from the Bay Bridge, he would still be called Brooklyn Bridge but his LAC (geographic location) would have changed.

Stingrays Movements

Late in the evening, in the stillness after the Water Protectors had returned to camp, hugs and wishes of soothing were applied, the Stingrays made themselves visible.

Cell Spy Catcher started to see them swim.

AT&T

Wed, September 28, 2016 20:53:06

UNKNOWN Network Found

Network Operator Name:

Network Operator (MCC+MNC): 310410

Phone (Voice) Type: GSM

Network (Data) Type: LTE

Cell Id Type (Technology): LTE

CID: 8501783, LAC: 45696, PSC: 0

LAC was changed

Network operator number 310410 is AT&T, formerly Cingular.

This warning is indicating that the AT&T LAC had changed. The toll taker found a new bridge to intercept toll.

Sixteen minutes and thirty three seconds later, another LAC was changed.

Unknown Network

Wed. September 28, 2016 21:09:33

UNKNOWN Network Found
Network Operator Name:

Network Operator (MCC+MNC):

Phone (Voice) Type: Unknown

Network (Data) type: Unknown
Cell Id Type (Technology): Unknown

CID: 8501783 LAC 0, PSC: 0
(LAC was Changed!)

An hour and fourty-four minutes later, another new LAC.

AT&T

Wed. September 28, 2016 22:53:33

UNKNOWN Network Found
Network Operator Name:

Network Operator (MCC+MNC): 311480

Phone (Voice) Type: GSM

Network (Data) type: Unknown
Cell Id Type (Technology): Unknown

CID: 49551884 LAC 65534, PSC: -1
(LAC was Changed!)

Another LAC changed nine minutes later.

AT&T

Wed. September 28, 2016 23:02:50

UNKNOWN Network Found
Network Operator Name:

Network Operator (MCC+MNC): 311480

Phone (Voice) Type: Unknown

Network (Data) type: Unknown
Cell Id Type (Technology): Unknown

CID: 49551884 LAC 65534, PSC: -1
(LAC was Changed!)

An hour later, yet another LAC change.

MetroPCS

Thu, September 29, 2016 00:02:23

UNKNOWN Network Found

Network Operator Name: MetroPCS

Network Operator (MCC+MNC): 310260

Phone (Voice) Type: Unknown

Network (Data) type: Unknown
Cell Id Type (Technology): Unknown

CID: 8501783 LAC 45696, PSC: 0
(LAC was Changed!)

This data shows the geographic location associated with the of the base transceiver station labeled AT&T 49551884 changed two times, and the base transceiver station labeled 8501783 once within 3 hours. For this to be AT&T, AT&T would have sent someone out to get the base transceiver station 49551884 in the middle of the night, move it to a new location. Then take a lunch break for two hours then move it to the other to a new location. Then drive to get the second base transceiver station 8501783 and move it.

All this while techs from MetroPCS, and another unknown network provider were also out moving equipment around in the same 4 hour time period, at night, in rural North Dakota.

Subsequent tests found changes on T-Moble in the following days, and continued changes to AT&T, unknown networks, and MetroPCS.

Stingray Stings

Stingray devices are used by police and government agencies to monitor and disrupt cellular traffic during protests.

Water Protectors have complained numerous times about their internet communications dropping off in the middle of a protest. Thomas Joseph was transmitting on Facebook Live, a live streaming method during the Dead End Incident. In the video below, you can see he complains that his live stream capability stopped just before police arrived.

https://www.facebook.com/ThomasH.JosephII/videos/10210794487923484/

Water Protectors have noticed decreased service whenever police helicopters and planes fly over head. During actions, helicopters will fly just above power lines.

Overkill

Stingrays are not selective. Everyone who has visited the casino, the camp, traveling through the area, lives in the area, works in the area, or has visited the area were subjected to a Stingray search.

The camp has housed or been visited by several dozen tribal heads of state, a presidential candidate, international tribal leaders, and protestors from all over the world. Cellular information from persons unrelated to the Water Protectors would be culled including casino goers, highway travelers, and event oglers.

If the cell tower changes are caused by some sort of Stingray device, the private information of tens of thousands of users in the area could have been compromised.

The Electronic Frontier Foundation, an electronic and internet civil rights group, has worked on Stingray efforts. They explained the potential impact on the public, “And when police use a Stingray, it’s not just the suspects’ phone information the device sucks up, but all the innocent people around such suspect as well. Some devices have a range of “several kilometers,” meaning potentially thousands of people could have their privacy violated despite not being suspected of any crime.”

The government uses the terminology “legal gray area” to describe the lawfulness of Stingray devices.

The Electronic Frontier Foundation does not use the term “gray area”. On their website they described a Stingrays’ legality directly, “A Stingray—which could potentially be beamed into all the houses in one neighborhood looking for a particular signal—is the digital version of the pre-Revolutionary war practice of British soldiers going door-to-door, searching Americans’ homes without rationale or suspicion, let alone judicial approval. The Fourth Amendment was enacted to prevent these general fishing expeditions. As the Supreme Court has explained, a warrant requires probable cause for all places searched, and is supposed to detail the scope of the search to ensure ‘nothing is left to the discretion of the officer executing the warrant’.”

The Department of Justice has suggested that lawful configuration of police agencies does not allow for using bugs, or culling some specific information without a warrant but it is a faith based ordinance – relying on agencies and their agents to not overstep and only concerns itself with the ability to convict someone of a crime.

Worry about convictions is not necessary if your goal is not law enforcement, but terrorizing protestors away from protest locations.

Companies and private agents are under no such restrictions and are free to share any information they gain with the police. While the information may or may not be admissible in court, it still can be used to threaten Water Protectors with military weapons surplussed to tiny plains cities in North Dakota.

Stingray Killer

We may never know if the ambush was just good luck for police, or carefully planned and executed to exact the most effective terrorism. What we can know is on the day of the Dead End Incident, rural North Dakota’s infrastructural was moving around like a two year old on espresso, Water Protectors experienced cellular disruption, and police showed up in record time.

Water Protectors left The Dead End Incident shaken by the events and filled with concerns for their missing members. They stay resolved to continue to revive and exercise the rights killed on the public dead end North Dakota road.

Documents obtained by ACLU showing Stingrays can be used for recording phone calls:
https://www.aclunc.org/docs/20151027-crm_lye.pdf