BOLSTERING DATA PRIVACY AND MOBILE SECURITY: AN ASSESSMENT OF IMSI CATCHER THREATS HEARING BEFORE THE SUBCOMMITTEE ON OVERSIGHT COMMITTEE ON SCIENCE, SPACE, AND TECHNOLOGY HOUSE OF REPRESENTATIVES ONE HUNDRED FIFTEENTH CONGRESS SECOND SESSION JUNE 27, 2018 Serial No. 115–68 Printed for the use of the Committee on Science, Space, and Technology ( Available via the World Wide Web: http://science.house.gov U.S. GOVERNMENT PUBLISHING OFFICE 30–878PDF WASHINGTON : 2018 COMMITTEE ON SCIENCE, SPACE, AND TECHNOLOGY HON. LAMAR S. SMITH, Texas, Chair FRANK D. LUCAS, Oklahoma EDDIE BERNICE JOHNSON, Texas DANA ROHRABACHER, California ZOE LOFGREN, California MO BROOKS, Alabama DANIEL LIPINSKI, Illinois RANDY HULTGREN, Illinois SUZANNE BONAMICI, Oregon BILL POSEY, Florida AMI BERA, California THOMAS MASSIE, Kentucky ELIZABETH H. ESTY, Connecticut RANDY K. WEBER, Texas MARC A. VEASEY, Texas STEPHEN KNIGHT, California DONALD S. BEYER, JR., Virginia BRIAN BABIN, Texas JACKY ROSEN, Nevada BARBARA COMSTOCK, Virginia CONOR LAMB, Pennsylvania BARRY LOUDERMILK, Georgia JERRY MCNERNEY, California RALPH LEE ABRAHAM, Louisiana ED PERLMUTTER, Colorado GARY PALMER, Alabama PAUL TONKO, New York DANIEL WEBSTER, Florida BILL FOSTER, Illinois ANDY BIGGS, Arizona MARK TAKANO, California ROGER W. MARSHALL, Kansas COLLEEN HANABUSA, Hawaii NEAL P. DUNN, Florida CHARLIE CRIST, Florida CLAY HIGGINS, Louisiana RALPH NORMAN, South Carolina DEBBIE LESKO, Arizona SUBCOMMITTEE ON OVERSIGHT RALPH LEE ABRAHAM, LOUISIANA, Chair BILL POSEY, Florida DONALD S. BEYER, JR., Virginia THOMAS MASSIE, Kentucky JERRY MCNERNEY, California BARRY LOUDERMILK, Georgia ED PERLMUTTER, Colorado ROGER W. MARSHALL, Kansas EDDIE BERNICE JOHNSON, Texas CLAY HIGGINS, Louisiana RALPH NORMAN, South Carolina LAMAR S. SMITH, Texas (II) C O N T E N T S June 27, 2018 Page Witness List ............................................................................................................. 2 Hearing Charter ...................................................................................................... 3 Opening Statements Statement by Representative Ralph Lee Abraham, Chairman, Subcommittee on Oversight, Committee on Science, Space, and Technology, U.S. House of Representatives ................................................................................................ 4 Written Statement ............................................................................................ 6 Statement by Representative Eddie Bernice Johnson, Ranking Member, Com- mittee on Science, Space, and Technology, U.S. House of Representatives .... 8 Written Statement ............................................................................................ 10 Statement by Representative Donald S. Beyer, Jr., Ranking Member, Sub- committee on Oversight, Committee on Science, Space, and Technology, U.S. House of Representatives ............................................................................ 12 Written Statement ............................................................................................ 14 Witnesses: Dr. Charles H. Romine, Director, Information Technology Laboratory, Na- tional Institute of Standards and Technology Oral Statement ................................................................................................. 17 Written Statement ............................................................................................ 19 Dr. T. Charles Clancy, Director, Hume Center for National Security and Technology, Virginia Tech Oral Statement ................................................................................................. 25 Written Statement ............................................................................................ 27 Dr. Jonathan Mayer, Assistant Professor of Computer Science and Public Affairs, Princeton University Oral Statement ................................................................................................. 33 Written Statement ............................................................................................ 35 Discussion ................................................................................................................. 49 Appendix I: Answers to Post-Hearing Questions Letter submitted by Representative Ralph Lee Abraham, Chairman, Sub- committee on Oversight, Committee on Science, Space, and Technology, U.S. House of Representatives 62 Articles submitted by Representative Donald S. Beyer, Jr., Ranking Member, Subcommittee on Oversight, Committee on Science, Space, and Technology, U.S. House of Representatives 64 (III) BOLSTERING DATA PRIVACY AND MOBILE SECURITY: AN ASSESSMENT OF IMSI CATCHER THREATS WEDNESDAY, JUNE 27, 2018 HOUSE OF REPRESENTATIVES, SUBCOMMITTEE ON OVERSIGHT COMMITTEE ON SCIENCE, SPACE, AND TECHNOLOGY, Washington, D.C. The Subcommittee met, pursuant to call, at 2:17 p.m., in Room 2318 of the Rayburn House Office Building, Hon. Ralph Abraham [Chairman of the Subcommittee] presiding. (1) 2 LAMAR S SMITH. Te~., EOOIE BERNICE JOHNSON RANKING MEMBER cr::ongress of the ~nited ~totes t1ousc of Rcprcscntatincs COMMITTEE ON SCIENCE, SPACE. AND TECHNOLOGY 2321 RAYBURN HOUSE OFFICE 8U!LD!NG WASHINGTON, DC 20515-6301 (202) 225-6371 Subcommittee on Oversight Bolstering Data Privacy mul Mobile Security: An Assessment of IMSI Catcher Threats Wednesday, June 27. 2018 2:00p.m. 2318 Raybum House Office Building Dr. Charles H. Romine, Director, Information Technology Laboratory, National Institute of Standards and Technology Dr. T. Charles Clancy. Director. Hume Center for National Security and Technology, Virginia Tech Dr.• Jonathan Mayer, Assistant Professor of Computer Science and Public Atfairs, Princeton University 3 U.S. HOUSE OF REPRESENTATIVES COMMITTEE ON SCIENCE, SPACE, AND TECHNOLOGY HEARING CHARTER June 27, 2018 TO: Members, Subcommittee on Oversight FROM: Majority Staff, Committee on Science, Space, and Technology SUBJECT: Oversight Subcommittee hearing: Bolstering Data Privacy and Mobile Security: An Assessment ofIMSI Catcher Threats The Subcommittee on Oversight will hold a hearing entitled Bolstering Data Privacy and Mobile Security: An Assessment ofIMSI Catcher Threats on Wednesday, June 27, 2018, at 2:00 p.m. in Room 2318 of the Rayburn House Office Building. Hearing Purpose: The purpose of this hearing is to examine and assess the threats to mobile security and user privacy presented by international mobile subscriber identity (IMSI) catchers and similar technology. IMSI catchers, known colloquially as "Stingrays", exploit cellular vulnerabilities by intercepting and collecting data and information transmitted to and from mobile devices. In the hands of malicious or nefarious actors, the technology can be leveraged to gain access to calls, texts, and other information sent to and from the mobile devices of unwitting Americans. Officials with DHS recently disclosed signs of sophisticated technology, including IMSI catchers, near sensitive facilities including the White House. The hearing will focus on the threats this technology poses to data security and privacy, as well as the steps industry and government can take to better mitigate such threats in the future. Witness List: Dr. Charles H. Romine, Director, Information Technology Laboratory, National Institute of Standards and Technology • Dr. T. Charles Clancy, Director, Hume Center for National Security and Technology, Virginia Tech Dr. Jonathan Mayer, Assistant Professor of Computer Science and Public Affairs, Princeton University Staff Contact: For questions related to the hearing, please contact Tom Connally or Duncan Rankin of the Majority Staff at 202-225-6371. 4 Chairman ABRAHAM. The Subcommittee on Oversight will come to order. Without objection, the Chair is authorized to declare re- cesses of the Subcommittee at any time. Good afternoon and welcome to today’s hearing entitled ‘‘Bol- stering Data Privacy and Mobile Security: An Assessment of IMSI Catcher Threats.’’ I recognize myself for five minutes for an opening statement. Good afternoon again. Welcome to today’s Oversight Sub- committee hearing ‘‘Bolstering Data Privacy and Mobile Security: An Assessment of IMSI Catcher Threats.’’ The purpose of today’s hearing is to examine the threats that IMSI catchers and other similar technologies pose to mobile security and user privacy. IMSI catchers and rogue base stations, commonly known by their brand name ‘‘Stingray,’’ are devices used for intercepting cellular traffic and data. Today we will hear from government and aca- demic experts about the basics of the technology, the ways in which it can be used by both legitimate and illegitimate actors, and poten- tial methods to mitigate the risks these devices pose. Regrettably, although they were invited, the Department of Homeland Security, DHS, declined to provide a witness today and instead provided a briefing to Members and staff last week. While this was helpful in giving some context to the matter, it was no substitute for a public discussion on such a serious issue. It would have been substantially more helpful for DHS to have been present today, to be part of the dialogue, inform the American public, and answer questions about their work in this area. With that said, I would like to thank our witnesses for participating today and tak- ing time out of their schedules to testify on this very important matter. Historically, the use of IMSI catcher technology has been limited to law enforcement, Department of Defense, and intelligence serv- ices. This was