In a letter obtained by the Associated Press from the Department of Homeland Security to Senator Ron Wyden (D-Oregon), the United States government formally acknowledges they have found unauthorized IMSI catchers in different parts of Washington DC and possibly other areas of the country.
IMSI catchers, commonly known as stingrays, are most commonly used by the FBI and other law enforcement agencies around the country to locate a particular phone by essentially acting as a legitimate cell tower that the targeted phone attaches to. Stingrays also have the capability to intercept text messages and even phone calls.
"Overall, [DHS' National Protection and Programs Directorate] believes the malicious use of IMSI catchers is a real and growing risk," wrote acting undersecretary, Christopher Krebs.
The news gets worse, however. The DHS is apparently "not aware of any current DHS technical capability to detect IMSI catchers." This is despite the fact that the DHS was able to observe the "anomalous activity" that lead to the discovery of the rogue stingrays.
Undersecretary Krebs also wrote that DC was not the only city where rogue stingrays were detected:
"NPPD is aware of anomalous activity outside the [National Capital Region] that appears to be consistent with IMSI catchers," Krebs also wrote. "NPPD has not validated or attributed this activity to specific entities or devices. However, NPPD has shared this information with Federal partners."
The DC Metro area is home to thousands of federal employees and contractors, many of whom work in the military and intelligence services with access to highly classified material. The presence of the devices that could exploit cellphone networks for nefarious purposes is certainly concerning.
For his part, Senator Wyden said in a statement that "leaving security to the phone companies has proven to be disastrous" and blamed the FCC for not doing its part to hold the telecommunications industry accountable. However, shutting down rogue stingrays can be expensive for the wireless industry and may lead to legal battles with the FBI, local law enforcement, and the intelligence community.
The FCC started a task force in 2015 to look into the illicit use of stingrays in the United States but doesn't look to have produced any meaningful reports or actions.