Mobile network anomalies consistent with cell phone surveillance were detected at a July 4 protest at an Immigration and Customs Enforcement field office in Washington state. Those anomalies, according to an independent analysis by Straight Arrow News, suggest that a device known as an IMSI catcher may have been used to collect identifying information on cell phones at the protest site.
ICE did not respond to requests for comment from SAN. It is not clear whether ICE or any other law enforcement agency obtained a warrant to use an IMSI catcher — commonly referred to as a “Stingray” — to conduct surveillance.
Download the SAN app today to stay up-to-date with Unbiased. Straight Facts™.
Point phone camera here
The ICE field office in Tukwila, Washington, a Seattle suburb, has been the site of repeated protests over President Donald Trump’s immigration policies. When an estimated 200 protesters gathered outside the facility on June 14, local police officers used pepper spray to break up the demonstration. Far fewer protesters came to the facility on July 4.
Federal law enforcement agencies may use IMSI catchers without a warrant only in “exigent” or “exceptional circumstances,” according to a 2023 report by the Department of Homeland Security’s inspector general. Those circumstances include immediate threats to national security and situations where a person is in danger of death or serious injury.
The inspector general found that ICE’s Homeland Security Investigations unit and the Secret Service had used the devices for surveillance without proper court authorization. The report redacted the number of instances the inspector general cited or the reasons for not obtaining a warrant.
Nathan Freed Wessler, deputy director with the ACLU’s Speech, Privacy and Technology Project, said the use of a Stingray device “to identify or track people exercising their First Amendment right to protest would raise grave concerns.”
“There is good reason why courts have held that this invasive technology can only be used in limited circumstances after securing a valid warrant,” Wessler told SAN. “If evidence were to show these devices being targeted at protesters, the government would have a lot to answer for.”
Device used by law enforcement, criminals
An IMSI catcher is a type of cell-site simulator designed to mimic a cell tower. When activated, it can force a connection with mobile phones as far as a third of a mile away, tricking them into revealing their IMSI, or International Mobile Subscriber Identity.
An IMSI is a unique 15-digit number tied to a cell phone’s SIM card that cellular networks use to identify users. Law enforcement and intelligence agencies use IMSI catchers to pinpoint the location of a specific phone or to record the presence of all phones in a designated area.
Criminals have also been known to leverage the technology, which can be built with publicly available components and software. They can deliver malware to targeted devices, potentially compromising sensitive information and enabling further attacks.
More advanced IMSI catchers can force cell phones to downgrade to less secure protocols, such as 2G, enabling the collection of unencrypted text messages and phone calls.
Anomalies suggest surveillance
SAN analyzed LTE cellular traffic at an anti-ICE protest in Tukwila, using a tool called Marlin that was developed by teams at the University of Florida and Switzerland’s ETH Zurich. About 20 people attended the protest, organized by the local chapter of the progressive grassroots organization Indivisible.
The analysis uncovered unusual bursts of data, known as “IMSI-exposing messages,” across several LTE frequency bands. Normally, cell phones are provided Temporary International Mobile Subscriber Identities, or TIMSIs, by networks for privacy purposes. Legitimate cell towers rarely request a cell phone’s permanent IMSI, which can be used to identify and track individuals.
At 8:58 a.m., just before the protest began, SAN began monitoring eight LTE bands present in the area and found no anomalous behavior. At 9:06 a.m., however, a burst of 57 IMSI-exposing commands was detected.
Other bursts, present on four of the LTE frequency bands, appeared roughly every 10 minutes over the next hour, causing Marlin to issue numerous real-time alerts. A post-scan analysis confirmed the detection of 574 IMSI-exposing messages.
It also flagged two “attach reject” messages, a type of cellular rejection sent when a cell phone tries to connect to a network. Attach rejects can occur for valid reasons, such as when a phone with an expired SIM card tries to connect to a network but such messages are rare on properly configured networks. IMSI catchers may use attach reject messages to block or downgrade connections and obtain an IMSI before it is encrypted. SAN observed the two suspicious messages at 9:55 a.m. and 10:04 a.m. at the height of the protest but did not encounter others before or after the demonstration ended.
SAN conducted a follow-up scan during the same time period, the following day, when no protesters were present. Unlike the day prior, Marlin did not issue real-time alerts.
A week before the protest, SAN carried out multiple field tests in high-traffic urban environments. No anomalies were flagged in any of the locations.
While it is not possible to definitively attribute the source of the suspicious cellular activity, the timing, location and nature of the anomalies are indicative of deliberate surveillance.
“Especially when compared to the results of the scan from the next day, the high number of IMSI-exposing messages seen during the event are strongly suggestive of the presence of an IMSI-catching device,” said Patrick Traynor, a professor in the Department of Computer and Information Science and Engineering at the University of Florida and one of Marlin’s inventors.
Site of repeated protests
The July 4 protest in Tukwila was organized by Southend Indivisible, a local affiliate of the national Indivisible organization. The protest was far more peaceful than the June 14 demonstration. During that protest, a crowd assembled over fears that immigrants, who had been ordered by the Department of Homeland Security to appear that weekend when the building was closed, would be taken into custody.
The Tukwila Police Department clashed with protesters, and the ICE building was vandalized with white spray paint during the protest, according to KOMO News in Seattle. In the end, ICE officers detained four of the 40 immigrants who had been asked to appear, according to an email from federal officials to the Tukwila police.
In a statement to SAN, Josh Castle, the chair of Southend Indivisible, called the potential surveillance alarming.
“ICE under Trump more closely resembles a secret police force in an authoritarian regime,” he said, “with their masked agents and unmarked vehicles abducting people off the street, than a legitimate agency within a co-equal branch of government accountable to voters in a constitutional democracy.”
Editor’s Note: This story has been edited since initial publication to correctly spell Mr. Castle’s name.
contributed to this report.
