Evidence points to Avon and Somerset Constabulary and six other forces having bought devices that can spy on thousands of phones at a time
Words: Alon Aviram
Visuals: Luke Carter
‘IMSI-catchers’ are surveillance devices that can both track the movements of mobile phone users within a given area, and intercept texts and calls.
They mimic cell towers – what your mobile phone connects to in order to make and receive phone calls and text messages. When deployed, every mobile phone within an area up to 8km square will try to connect to the dummy-tower. IMSI-catchers trace your location and your International Mobile Subscriber Identity (IMSI), a unique number for each phone which can be used to identify you.
Suspicions have been raised in the past that IMSI-catchers are in use in the UK. These suspicions, until now, have focused on the Metropolitan Police’s purchase and use of the technology. Now, the Cable can exclusively reveal that at least six other forces appear to have contracted for IMSI-catchers, including Avon and Somerset (A&S) Constabulary.
This revelation comes from decrypting for the first time the acronym – CCDC, standing for covert communications data capture – in use by police forces across the country to obscure their apparent purchase of IMSI-catchers, and identifying police contracts with Cellxion, a firm that manufactures them. The Cable’s findings have “opened up a whole new avenue for investigation and debate”, according to Matthew Rice, advocacy officer for UK-based charity Privacy International.
Cracking the code
South Yorkshire police confirmed that ‘CCDC’ and ‘IMSI Covert Communications’ are the same budget item
IMSI-catchers have been reported internationally, including in Norway, the US, South Africa, Ukraine and China. In Germany, national intelligence agencies are required to report IMSI-catcher activity to the German Parliament. British police forces have consistently refused to acknowledge any use of the devices. But close examination of purchase data and other records obtained by the Cable sheds light on this previously shadowy area of policing.
We found that A&S police contracted with Cellxion, a UK-based firm, between 2015 and 2016. According to research by Privacy International, Cellxion focuses on mobile networks in two capacities. One is the facilitation of communications through mobile networks for law enforcement. The company’s other main product is IMSI-catchers. Our local force paid Cellxion £169,575.00 for “CCDC equipment”, as well as other “communications and computing equipment” from Cellxion, according to purchase data examined by the Cable.
A&S wasn’t alone in such actions. The Metropolitan Police paid more than £1m to Cellxion, also for ‘CCDC’, according to its records, in 2015. West Midlands Police also awarded a number of contracts to Cellxion in 2015.
None of the West Midlands contracts refer explicitly to CCDC. Yet unredacted minutes from a meeting in May 2016 between West Mercia and Warwickshire police both spell out the acronym’s meaning – via the subheading “Covert Communications Data Capture (CCDC)” – and state: “West Midlands and Staffordshire Police have recently purchased and operated 4G-compatible CCDC equipment.” Police and crime commissioners from Warwickshire and West Mercia also subsequently approved a decision to replace their existing equipment and purchase new CCDC technology.
New line of enquiry
“This technological description, together with the connection to Cellxion, almost certainly describes IMSI-catcher equipment,” Richard Tynan, a technologist and specialist in covert surveillance for Privacy International, tells the Cable.
But an even more revealing piece of information is contained in a South Yorkshire Police report. A 2015/16 budget item called “IMSI Covert Communications” was earmarked £144,000. A separate line in the same budget – again called “CCDC” – was allocated an identical amount: £144,000. South Yorkshire police confirmed that ‘CCDC’ and ‘IMSI Covert Communications’ are the same budget item.
Breaking the acronym is significant, according to Privacy International’s Rice. “While journalists and activists [have] spent time requesting information about IMSI-catchers… the real question we should have been asking our police forces was about the term CCDC (covert communications data capture),” he says.
“The findings – by revealing the codename – show that many police forces in the UK have invested in covert communications surveillance technology, yet the secrecy around them does not inspire confidence that the police are willing to be subjected to the level of scrutiny these powerful capabilities ought to attract,” Rice adds. “If they have nothing to hide, they have nothing to fear.”
It is as yet unclear whether Avon and Somerset Police, or other forces, have used IMSI-catchers and, if so, in what operational context. A&S has delayed responding to a Freedom of Information Request request lodged by the Cable, citing security concerns.
This lack of transparency is to no one’s benefit, points out Rice. “The longer the policy of denial of existence of these capabilities go on, the worse it is for police, citizens, and civil liberties in the United Kingdom,” he says.
The potential scope of IMSI-catchers’ capabilities is frightening. The data they harvest creates a live-updating map of everyone in a certain area. Some models can intercept hundreds of mobiles a minute. The devices can also block communications, and in some cases can intercept the text messages and phone calls – and read or listen to them – of thousands of people in the vicinity.
Such powers may also fall outside of the law. “It is inconceivable that using devices built to indiscriminately intercept and hack up to 500 phones every minute within an 8km radius can be lawful,” says Silkie Carlo, a policy officer for human rights organisation Liberty.
Legal or not, our investigation has revealed strong indications that at least seven police forces are in possession of this invasive technology. But some key questions remain unanswered: exactly why are police forces purchasing IMSI-catchers, how are they being used and who is being targeted?
Spying on protestors
When police forces eventually come clean, they may justify IMSI-catcher use in cases of searching for missing persons, or tracking murderers at large. Some will accept that logic, and readily relinquish their privacy to aid the state in such cases. But with responsibility comes risk, especially when one considers how else the technology can be used – and that almost all of us carry mobile phones.
Picture a different scenario: the lawyer’s confidential conversation with their client being tapped. The journalist speaking to a whistleblower, unaware that they are being eavesdropped. Or demonstrators being spied on and added to a monitoring list.
“[There are] concerns IMSI-catchers are targeting peaceful protesters exercising their democratic rights,” says Carlo. Indeed, Vice News and Privacy International uncovered telltale signs of IMSI-catcher use at an anti-austerity demonstration in London last year. But without parliamentary debate and legal scrutiny we cannot hope to fully understand or, better, begin to dictate the contexts in which these devices are deployed.
“Refusal to come clean on the use of IMSI-catchers must trigger an urgent investigation by the Interception of Communications Commissioner,” concludes Carlo. “How else is the public to have any confidence in proportionate policing?” After all, if they have nothing to hide…