Revealed: Bristol’s police and mass mobile phone surveillance

Evidence points to Avon and Somerset Constabulary and six other forces having bought devices that can spy on thousands of phones at a time
Words: Alon Aviram
Visuals: Luke Carter
Privacy International
‘IMSI-catchers’ are surveillance devices that can both track the movements of mobile phone users within a given area, and intercept texts and calls.
They mimic cell towers – what your mobile phone connects to in order to make and receive phone calls and text messages. When deployed, every mobile phone within an area up to 8km square will try to connect to the dummy-tower. IMSI-catchers trace your location and your International Mobile Subscriber Identity (IMSI), a unique number for each phone which can be used to identify you.
Suspicions have been raised in the past that IMSI-catchers are in use in the UK. These suspicions, until now, have focused on the Metropolitan Police’s purchase and use of the technology. Now, the Cable can exclusively reveal that at least six other forces appear to have contracted for IMSI-catchers, including Avon and Somerset (A&S) Constabulary.
This revelation comes from decrypting for the first time the acronym – CCDC, standing for covert communications data capture – in use by police forces across the country to obscure their apparent purchase of IMSI-catchers, and identifying police contracts with Cellxion, a firm that manufactures them. The Cable’s findings have “opened up a whole new avenue for investigation and debate”, according to Matthew Rice, advocacy officer for UK-based charity Privacy International.
Cracking the code
South Yorkshire police confirmed that ‘CCDC’ and ‘IMSI Covert Communications’ are the same budget item
IMSI-catchers have been reported internationally, including in Norway, the US, South Africa, Ukraine and China. In Germany, national intelligence agencies are required to report IMSI-catcher activity to the German Parliament. British police forces have consistently refused to acknowledge any use of the devices. But close examination of purchase data and other records obtained by the Cable sheds light on this previously shadowy area of policing.
We found that A&S police contracted with Cellxion, a UK-based firm, between 2015 and 2016. According to research by Privacy International, Cellxion focuses on mobile networks in two capacities. One is the facilitation of communications through mobile networks for law enforcement. The company’s other main product is IMSI-catchers. Our local force paid Cellxion £169,575.00 for “CCDC equipment”, as well as other “communications and computing equipment” from Cellxion, according to purchase data examined by the Cable.
A&S wasn’t alone in such actions. The Metropolitan Police paid more than £1m to Cellxion, also for ‘CCDC’, according to its records, in 2015. West Midlands Police also awarded a number of contracts to Cellxion in 2015.
None of the West Midlands contracts refer explicitly to CCDC. Yet unredacted minutes from a meeting in May 2016 between West Mercia and Warwickshire police both spell out the acronym’s meaning – via the subheading “Covert Communications Data Capture (CCDC)” – and state: “West Midlands and Staffordshire Police have recently purchased and operated 4G-compatible CCDC equipment.” Police and crime commissioners from Warwickshire and West Mercia also subsequently approved a decision to replace their existing equipment and purchase new CCDC technology.
IMSI-catchers in the UK press
• In May 2016 the Ferret, a Scottish investigative magazine, revealed that the Scottish Prison Service had trialled IMSI-catchers in order to block mobile phone in two Scottish prisons. The scheme was subsequently abandoned, with the number of smartphones in the jails actually increasing during the pilot period.
• In 2015 Vice News, with the support of Privacy International, identified strong indications of IMSI-catcher activity at a protest in London.
• A Sky News investigation in 2013 identified strong indications on 20 occasions of IMSI-catcher use in London.
• The Guardian reported in 2011 that the Metropolitan police had purchased IMSI-catcher equipment from Leeds-based firm Datong plc.
• Avon and Somerset police, the Metropolitan police and other territorial police forces, have refused to confirm or deny the use of the technology.
New line of enquiry
“This technological description, together with the connection to Cellxion, almost certainly describes IMSI-catcher equipment,” Richard Tynan, a technologist and specialist in covert surveillance for Privacy International, tells the Cable.
But an even more revealing piece of information is contained in a South Yorkshire Police report. A 2015/16 budget item called “IMSI Covert Communications” was earmarked £144,000. A separate line in the same budget – again called “CCDC” – was allocated an identical amount: £144,000. South Yorkshire police confirmed that ‘CCDC’ and ‘IMSI Covert Communications’ are the same budget item.
Breaking the acronym is significant, according to Privacy International’s Rice. “While journalists and activists [have] spent time requesting information about IMSI-catchers… the real question we should have been asking our police forces was about the term CCDC (covert communications data capture),” he says.
“The findings – by revealing the codename – show that many police forces in the UK have invested in covert communications surveillance technology, yet the secrecy around them does not inspire confidence that the police are willing to be subjected to the level of scrutiny these powerful capabilities ought to attract,” Rice adds. “If they have nothing to hide, they have nothing to fear.”
Unanswered questions
It is as yet unclear whether Avon and Somerset Police, or other forces, have used IMSI-catchers and, if so, in what operational context. A&S has delayed responding to a Freedom of Information Request request lodged by the Cable, citing security concerns.
This lack of transparency is to no one’s benefit, points out Rice. “The longer the policy of denial of existence of these capabilities go on, the worse it is for police, citizens, and civil liberties in the United Kingdom,” he says.
The potential scope of IMSI-catchers’ capabilities is frightening. The data they harvest creates a live-updating map of everyone in a certain area. Some models can intercept hundreds of mobiles a minute. The devices can also block communications, and in some cases can intercept the text messages and phone calls – and read or listen to them – of thousands of people in the vicinity.
Such powers may also fall outside of the law. “It is inconceivable that using devices built to indiscriminately intercept and hack up to 500 phones every minute within an 8km radius can be lawful,” says Silkie Carlo, a policy officer for human rights organisation Liberty.
Legal or not, our investigation has revealed strong indications that at least seven police forces are in possession of this invasive technology. But some key questions remain unanswered: exactly why are police forces purchasing IMSI-catchers, how are they being used and who is being targeted?
Spying on protestors
When police forces eventually come clean, they may justify IMSI-catcher use in cases of searching for missing persons, or tracking murderers at large. Some will accept that logic, and readily relinquish their privacy to aid the state in such cases. But with responsibility comes risk, especially when one considers how else the technology can be used – and that almost all of us carry mobile phones.
Picture a different scenario: the lawyer’s confidential conversation with their client being tapped. The journalist speaking to a whistleblower, unaware that they are being eavesdropped. Or demonstrators being spied on and added to a monitoring list.
“[There are] concerns IMSI-catchers are targeting peaceful protesters exercising their democratic rights,” says Carlo. Indeed, Vice News and Privacy International uncovered telltale signs of IMSI-catcher use at an anti-austerity demonstration in London last year. But without parliamentary debate and legal scrutiny we cannot hope to fully understand or, better, begin to dictate the contexts in which these devices are deployed.
“Refusal to come clean on the use of IMSI-catchers must trigger an urgent investigation by the Interception of Communications Commissioner,” concludes Carlo. “How else is the public to have any confidence in proportionate policing?” After all, if they have nothing to hide…
Report a comment. Comments are moderated according to our Comment Policy.
It’s not much defence but if you want to avoid the most intrusive element of reading our texts and listening to our phone calls many would recommend highly:
https://whispersystems.org/
Signal (the name of the program) allows you to encrypt messages and is really easy!
An alternative to the suggestion, by mat h, above, to encrypt one’s communications using mobile phones, is for our police forces to explain their policy regarding use of CCDC technologies particularly in respect of the privacy implications of bulk surveillance. For example are operations warranted or not, and if they are who are the accountable persons for issuing and supervising warrants ? Additionally what is done with captured data from citizens who are not the target of such operations ?
Has the Cable begun a conversation with the A&S PCC about this matter ?
Definitely would be better if they explained them selves, after all if they have nothing to hide!
for the mega geeks wanting a demo see:
https://m.youtube.com/watch?v=xKihq1fClQg
This is from 2012 so who know what A&S are driving around with!
I would like to add Canterbury Police to the list of IMSI catchers. It’s not being used to keep the 1000’s of students safe. It’s being used on county line drug gangs.
Opportunity:JoinMe@whispersystems.org
could using a VPN, anonymous email service, Tor browser and search engine help to prevent Johnny law from being able to read or listen to conversations? as I understand there operation they encrypted everything through the VPN which also changes your physical access location and ip address. the Tor software as I understand it also will route you through a dozen servers each in a different nation and at each server will ínturn change your physical location and ip address each time it goes to a new server. which as a i understand it makes it impossible to decrypt since it requires the encryption keys for each server which means they will need search warrants for most countries. and then it’s off to the next country in the list of countries that are impossible to hunt down. as i understand it, it took the FBI year’s to find the head of silkroad black market site and then only because he posted a picture of himself with a background that gave him away. the biggest issue is the anonymous email service it needs to be one that doesn’t require the use of a name and country when signing up and uses just a made up recipient name and a pin to access the account. I’ve been thinking about using one more to see if it’s hard to use or not. I would think if used when planning protests and the likes would help you and the rest of the time you don’t say or do anything suspicious and if they intercept your communications they have no idea what is really going on.