4 ms·

Something doesn’t seem to add up. First of all the story fails to mention that those devices do not only track the target, they track and record all phones in i

Something doesn’t seem to add up. First of all the story fails to mention that those devices do not only track the target, they track and record all phones in its range, which is a massive breach of privacy and the real issue with those devices. Furthermore, they allegedly already had his ip, so why bother with a stingray? They could simply tell his cell carrier to provide them with all his location data (as well as further dates). It seems to me that they went fishing with their stingrays because they didn’t in fact know his real IP address and only knew from a source or other mistakes his approximate whereabouts. It wouldn’t surprise me if they only had his VPN’s IP and were just looking for everybody connecting to the VPN in the stingray range and this is how they found him.

falsedan 8y ago
> Furthermore, they allegedly already had his ip, so why bother with a stingray? They could simply tell his cell carrier to provide them with all his location data Remember that getting subscriber data/metadata from ISPs requires a warrant, and that a single tower location could cover a 6-12 sq. km. area (plenty of space to hide in)
- Matt3o12_ 8y ago
  Can’t they use the towers to triangulate the exact position? So that area should be rather small. Furthermore, if they already had the IP of the offender, getting a search warrant should not be the problem at all. This tells me there is more to this story.
  - falsedan 8y ago
    I think triangulation works best when devices do handoff between towers, as they query each one to see which signal is strongest. For a stationary device like a mobile broadband dongle, I'd expect it to never handoff. Getting a search warrant is easy, but not getting one is even easier & leaves no paper trail.
    - swebs 8y ago
      That's not true. Cell phones have been using clock synchronized triangulation since the mid 2000s. https://en.wikipedia.org/wiki/Enhanced_9-1-1#Wireless_enhanced_911 https://en.wikipedia.org/wiki/Enhanced_9-1-1#Wireless_enhanc...
    - ThrowawaySR 8y ago
      My memories from flashing phones circa 2003-2004 may be a bit rusty (btw. back than "flashing" meant something completely different than nowadays ROM uploads, it was more akin to poking machine code memory locations in BASIC on 8-bits :) ), but if I recall correctly, the device periodically scans all the BTSs it can see and sends that list with signal strengths to the network (and the network decides which tower should the device connect to!). Something tells me that the device even stayed connected to multiple strongest BTSs at once, but that may be a false memory. Of course, that was old GSM days, it may be something completely different today in 3G/4G/LTE, but so is on the other hand the location hardware and algorithms of carriers. But no, no handoffs were needed to track you very precisely even back then. There were ways around, but given the poor opsec in the case, it is doubtful something like that was used here.
  - deleted 8y ago
    [deleted]
  - driverdan 8y ago
    Keep in mind this was 10 years ago. Phone triangulation was much less accurate then.
overlordalex 8y ago
From the article: > Rigmaiden eventually pieced together the story of his capture. Police found him by tracking his Internet Protocol (IP) address online first, and then taking it to Verizon Wireless, the Internet service provider connected with the account. Verizon provided records that showed that the AirCard associated with the IP address was transmitting through certain cell towers in certain parts of Santa Clara. Likely by using a stingray, the police found the exact block of apartments where Rigmaiden lived.
jolmg 8y ago
I don't know about Verizon, but all the cellphone carriers I know have carrier-grade NAT set up. That would mean the public IP they have would correspond with many customers with different private IPs. The article says Verizon matched the IP address with a particular AirCard, but maybe that was an oversimplification in the article.
- reaperducer 8y ago
  My guess is that Verizon matched the IMEI of the AirCard used on a particular IP address at a particular moment in time. Then the feds only had to scan for that IMEI within the geographic area provided by Verizon.

falsedan 8y ago

> Furthermore, they allegedly already had his ip, so why bother with a stingray? They could simply tell his cell carrier to provide them with all his location data Remember that getting subscriber data/metadata from ISPs requires a warrant, and that a single tower location could cover a 6-12 sq. km. area (plenty of space to hide in)

Matt3o12_ 8y ago
Can’t they use the towers to triangulate the exact position? So that area should be rather small. Furthermore, if they already had the IP of the offender, getting a search warrant should not be the problem at all. This tells me there is more to this story.
- falsedan 8y ago
  I think triangulation works best when devices do handoff between towers, as they query each one to see which signal is strongest. For a stationary device like a mobile broadband dongle, I'd expect it to never handoff. Getting a search warrant is easy, but not getting one is even easier & leaves no paper trail.
  - swebs 8y ago
    That's not true. Cell phones have been using clock synchronized triangulation since the mid 2000s. https://en.wikipedia.org/wiki/Enhanced_9-1-1#Wireless_enhanced_911 https://en.wikipedia.org/wiki/Enhanced_9-1-1#Wireless_enhanc...
  - ThrowawaySR 8y ago
    My memories from flashing phones circa 2003-2004 may be a bit rusty (btw. back than "flashing" meant something completely different than nowadays ROM uploads, it was more akin to poking machine code memory locations in BASIC on 8-bits :) ), but if I recall correctly, the device periodically scans all the BTSs it can see and sends that list with signal strengths to the network (and the network decides which tower should the device connect to!). Something tells me that the device even stayed connected to multiple strongest BTSs at once, but that may be a false memory. Of course, that was old GSM days, it may be something completely different today in 3G/4G/LTE, but so is on the other hand the location hardware and algorithms of carriers. But no, no handoffs were needed to track you very precisely even back then. There were ways around, but given the poor opsec in the case, it is doubtful something like that was used here.
- deleted 8y ago
  [deleted]
- driverdan 8y ago
  Keep in mind this was 10 years ago. Phone triangulation was much less accurate then.

overlordalex 8y ago

From the article: > Rigmaiden eventually pieced together the story of his capture. Police found him by tracking his Internet Protocol (IP) address online first, and then taking it to Verizon Wireless, the Internet service provider connected with the account. Verizon provided records that showed that the AirCard associated with the IP address was transmitting through certain cell towers in certain parts of Santa Clara. Likely by using a stingray, the police found the exact block of apartments where Rigmaiden lived.

jolmg 8y ago

I don't know about Verizon, but all the cellphone carriers I know have carrier-grade NAT set up. That would mean the public IP they have would correspond with many customers with different private IPs. The article says Verizon matched the IP address with a particular AirCard, but maybe that was an oversimplification in the article.

reaperducer 8y ago
My guess is that Verizon matched the IMEI of the AirCard used on a particular IP address at a particular moment in time. Then the feds only had to scan for that IMEI within the geographic area provided by Verizon.