First, it came out that the Justice Department was using Stingrays, a secretive cell-phone-tracking device that allowed it to scoop up identifying information from thousands of mobile devices at once in order to pinpoint the location of a target.
But it wasn't the only one. The revelations kept coming: Last month, documents showed that even the Internal Revenue Service is using the surveillance devices—often called "Stingrays" after a popular model—making it the 13th federal agency known to operate them, according to data from the American Civil Liberties Union.
Now, a bipartisan group of House lawmakers wants to know just how many federal agencies are using Stingrays.
In a letter sent Monday, House Oversight Committee Chairman Jason Chaffetz, ranking member Elijah Cummings, and the top two members of the panel's IT subcommittee—Reps. Will Hurd and Robin Kelly—asked 24 key agencies to share their policies for using the surveillance technology.
Known as cell-site simulators, Stingray devices pose as cell towers to force nearby cellular devices to establish a connection with them. Once a Stingray is connected to nearby mobile devices, it can scan them, usually to find a target or targets. The Stingray can use the direction and strength of a connection to a target device to figure out where the device is located.
Since the government use of Stingrays was first revealed last year, some agencies have moved to make public their policies for using them. Both the Justice Department and the Homeland Security Department have published internal guidance their agents must follow when using Stingrays, which include limits on the retention of the incidental data they gather during their wide sweeps and which establish that agents must obtain a warrant before using them.
But the policies only apply to those agencies and not to state and local law enforcement agencies, which are also known to own and operate Stingrays and similar devices.
Chaffetz has taken aim at Stingray technology before, with a bill he introduced earlier this month. The Stingray Privacy Act, co-sponsored by Democrats John Conyers and Peter Welch, would extend the DOJ's and DHS's warrant requirements to all Stingray users, including state and local agencies.
The letter he and his fellow committee members sent Monday asks for details about data-retention policies, Stingray use at the state and local level, nondisclosure agreements associated with Stingray use, and details about any alleged misuse of the technology.
The signers also asked for an inventory of Stingray devices in use by each of the 24 agencies and the cost of each device. They cast a wide net, targeting agencies likely to operate the devices—the Defense Department, for example—as well as agencies like the Agriculture Department, the Interior Department, the Veterans Affairs Department, and the General Services Administration.
The letter asks for a response within two weeks.