In The Pandemic, Vallejo PD Buys $750K Cell Site Simulator

Update 3/25/20: The Vallejo City Council voted unanimously to approve purchase of $766,000 cell site simulator without significant discussion. Captain Potts, who oversees the Crime Reduction Team for VPD, said that the cell site simulator does not interrupt cell phone service, which seems to indicate that he does not know how the technology works. Apparently, they do have a policy; it just wasn’t provided as part of the agenda material, so the City Council hasn’t seen it. Chief says that it includes a usage log that will be posted publicly and annual reporting.

On the consent agenda for the March 24, 2020, Vallejo City Council meeting is $766,018 to purchase a KeyW cell site simulator.

If approved, Vallejo Police would become the fourth local Bay Area law enforcement agency with this device, after the San Francisco Police Department, San Jose Police Department, and the Alameda County District Attorney (which shares its device with the Oakland Police Department and Fremont Police Department). These other departments own cell site simulators manufactured by Harris Corporation.

The agenda item includes implementation of a usage and privacy policy, but no policy was provided as part of the background material because the policy will be created at the direction of the Chief of Police, and not by the City Council. California’s Electronic Communications Privacy Act, which went into effect on January 1, 2016, requires that a search warrant be obtained before using a cell site simulator.

Policies in the City of Oakland and Alameda County require annual reporting on the usage of their shared cell site simulator. In 2017, the cell site simulator was used three times, in 2018, it was used four times, and it was used once in 2019. Without public input and city council oversight, Vallejo’s policy is unlikely to require any annual reporting.

A cell site simulator pretends to be a cell phone tower, to which cell phones connect in order to initiate a phone call. Once a cell phone connects to the cell site simulator, the cell phone’s IMSI number can be obtained and used to track the location of the cell phone.

According to the staff report, the cell site simulator will be used by the Crime Reduction Team, which is “tasked with the tracking and apprehension of serious violent offenders, covert surveillance during criminal investigations, human trafficking, and other plain clothes investigative operations…” The desire to obtain a cell site simulator appears to be motivated by an unnamed agency assisting Vallejo by using its own cell site simulator. “In November of 2019, an outside agency used a cellular site simulator for the Vallejo Police Department on several occasions.”

The staff report fails to note that cell site simulators can disrupt “the target cellular device (e.g., cell phone) and other cellular devices in the area might experience a temporary disruption of service from the service provider,” according to guidance from the US Department of Justice. In other words, it could interfere with normal operation of other cellular phones and devices near the cell site simulator, including emergency calls.

The staff report claims that “The equipment does not retain data and is not capable of intercepting and listening to calls, text messages, dialed numbers or any other such content.” However, other cell site simulators are able to eavesdrop on calls and messages and are limited only by the installed software, not the hardware’s capabilities.

The $766,018 price includes the following:

• $415,000 for the base station
• $1,400 for two Shark Fin antennas
• $40,000 for five-day on-site training
• $60,000 for additional two-year warranty
• $120,000 for standard vehicle integration (a 2020 Chevrolet Suburban)
• $32,000 for a Trachea 2 device, a stand alone direction finding system
• $15,000 for two Jugular 4 devices, a handheld direction finding system
• $17,760 for two Jugular 4 field kits

The vehicle containing the cell-site simulator (a 2020 Suburban) will drive around to track a cell phone to a building or similar area. Then the handheld Jugular 4 or Trachea 2 devices can be used to track a cell phone to a specific apartment of room. Although little is known about these devices, an earlier version of the Jugular was detailed in a document obtained the Intercept. The Jugular 2 was capable of tracking GSM, CDMA, and UMTS cellular signals. The Jugular 4 and Trachea 2 are likely capable of tracking 4G cellular signals.

The Vallejo City Council meeting takes place on March 24, 2020, at 7pm via teleconference. Since there is no physical access for the public to the meeting, members of the public who wish to comment on the item are required to register to use Open Town Hall at http://www.opentownhall.com/8413.

Documents:

• Staff Report
• KeyW purchase agreement, quotation, and non-disclosure agreement