Let me be clear: Homeland, I love you.
I’ve seen every episode. And with the introduction of subjects near and dear to my heart this season, you’ve sucked me in further. It’s been a seductive spiral of spycraft.
But Homeland, if you’re going to invoke real-world surveillance technology, let’s at least aim for mild accuracy, OK?
When my wife and I watched Sunday’s episode of Homeland and the words “I need to get a hold of a stingray” were uttered, I could barely believe it. And although any work of fiction can take some liberties with reality, the show’s depiction of how a stingray is actually deployed left a lot to be desired.
Here’s how it went down in the world of Homeland:
Midway through the episode, Peter Quinn (CIA black ops character—an assassin) tells Astrid, who works for the German intelligence agency known as the BND, that he wants to borrow a stingray. Specifically, Quinn requests “a handheld one, if you can swing it.” He’s in the process of staking out Carrie Mathison (our now ex-CIA protagonist), presumably for the purposes of killing her. (Wait, the writers wouldn’t really kill off our beloved lead character at the beginning of Season 5, would they? THE SUSPENSE IS KILLING ME!)
Soon after meeting with Astrid, Quinn orchestrates a fake child kidnapping in order to get Mathison’s boyfriend, Jonas Happich, to pick up his phone. Happich hears his “burner” cell ringing, noticing his ex-wife is calling and that something must be an emergency. Despite Mathison’s plea, Happich picks up…
…and Quinn is parked right outside the ex-girlfriend’s house. Happich has unintentionally revealed Mathison’s location, an undisclosed cabin away from Berlin. Quinn uses the stingray not only to listen to the entire call, but the device also reveals Happich’s location within seconds. And with that in hand, Quinn drives off, hunting for Mathison.
Stingrays ftw, amirite?
While the term “stingray” isn’t explained in the episode directly, astute Ars readers will recall our extensive coverage of this mobile phone surveillance technology. The device, known more generically as a “cell-site simulator” spoofs a cell tower, tricking a phone into at least giving up its location.
Actual stingrays used by overseas military and intelligence agencies are believed to be able to conduct a “full intercept” of all calls and texts. In the real world, American local police have even falsely claimed the existence of a confidential informant while in fact deploying this particularly sweeping and intrusive surveillance tool. Just this month, California’s governor signed a bill into law requiring that cops get a warrant before orchestrating a stingray-based operation.
Admittedly, neither I nor most civilians have ever seen a stingray in person. But from what we do know, stingrays are typically used to locate near-distant targets—not to use local targets as a means for determining some faraway location of the real target on the other line in under a minute.
I ran all this by Chris Soghoian, a technologist with the American Civil Liberties Union and another leading authority on available stringray information. When I asked if this is how stingrays worked, he didn’t hedge. “No way… but I have no idea what the stingray or accompanying laptop interface looks like,“ he said.
In the show, the GPS location revealed is obviously fake (Bergstrasse 4, Wildemann / LAT: 51.8, LONG: 10.3), though Wildemann is an actual German city about 300 kilometers away from Berlin. However, in the show, it doesn’t take more than a few minutes for Quinn to arrive at Mathison’s secret hideaway in what seems to be a semi-rural location.
After discussing the scene with Soghoian, it does seem plausible that using an intelligence-grade stingray—which can reveal the location of the local target and also intercept incoming and outgoing calls—in conjunction with another surveillance tool may be able function in the way that Homeland depicts a solitary stingray. Quinn would need to utilize what’s known as SS7 tracking, which allows an attacker to monitor a particular phone as it moves around. SS7 refers to the network protocol that allows for phone, text, and data handoffs between mobile phone providers.
As The Washington Postreported in 2014:
The system was built decades ago, when only a few large carriers controlled the bulk of global phone traffic. Now thousands of companies use SS7 to provide services to billions of phones and other mobile devices, security experts say. All of these companies have access to the network and can send queries to other companies on the SS7 system, making the entire network more vulnerable to exploitation. Any one of these companies could share its access with others, including makers of surveillance systems.
The tracking systems use queries sent over the SS7 network to ask carriers what cell tower a customer has used most recently. Carriers configure their systems to transmit such information only to trusted companies that need it to direct calls or other telecommunications services to customers. But the protections against unintended access are weak and easily defeated, said Engel and other researchers.
By repeatedly collecting this location data, the tracking systems can show whether a person is walking down a city street or driving down a highway, or whether the person has recently taken a flight to a new city or country.
So it’s conceivable that someone like Quinn could use the stingray against the ex-girlfriend to get the number that she called. Next, Happich’s location could be narrowed via the SS7 attack, and then the CIA could even more precisely find Happich with yet another use of the stingray. As Soghoian warned, “I’ve seen people pull SS7 data before. It is quick.” But in the real world, all of that would probably take longer and require more than one person to execute.
It was airgapped, right?
Unlike last week, episode three did contain at least one piece of anti-surveillance tech that the show’s creators got right—the use of TAILS OS.
This Linux distribution is designed to leave no digital trace of its use. In the show, American expatriate journalist Laura Sutton (a Laura Poitras/Glenn Greenwald-type character) takes what she believes to be a USB stick containing thousands of leaked CIA files from Beardy, the previous episode’s hacker. His name, or at least alias, is revealed to be “Newman.”
Rather than pop it into her regular MacBook, she opens up a safe where she pulls out a Dell laptop (hopefully airgapped?) that is shown to be running TAILS for a brief moment. That seems to suggest that Sutton understands operational security pretty well.
Henrik Moltke, a real-world Berlin-based journalist who shared a New York Times byline with a bevy of reporters as part of the Snowden leaks, noticed. He then joked on Twitter with well-known security researcher and Tor developer Jacob Appelbaum about whether Appelbaum would make an appearance (likely in some sort of inspired but fictitious form).
@moltke I can’t even say my joking response on the internet.
— Jacob Appelbaum (@ioerror) October 20, 2015
Again, if you’d like to experience this episode for yourself, you can trial the Showtime app free for 30 days.
