Stingray Devices: What They Are, How They Work, and What You Can Do

Your phone is constantly looking for the strongest cell tower signal it can find. That's how cellular networks work. Your device connects, identifies itself, and starts passing data.

A Stingray exploits that process. It pretends to be a cell tower. Your phone connects to it. And now whoever is operating that device knows exactly where you are, what device you're carrying, and which SIM card is in it.

This is not theoretical. These devices are in active use by law enforcement agencies across the country.

What Is a Stingray?

A Stingray is a cell-site simulator, also called an IMSI catcher. It's a piece of hardware that broadcasts a cellular signal mimicking a legitimate tower. When your phone connects, the device captures two critical identifiers: your IMSI (the unique number tied to your SIM card) and your IMEI (the unique number tied to your physical handset).

With those two numbers, someone can track a specific person across devices. Swap your SIM card, they still have your IMEI. Swap your phone, they still have your IMSI. Use a burner, they can correlate your location pattern to your real identity.

The name "Stingray" comes from a product line made by L3Harris Technologies. It became the generic term the way "Xerox" did for copiers.

How Do They Actually Work?

There are two types: passive and active.

Passive IMSI catchers work like a radio scanner. They pull cellular transmissions out of the air without broadcasting anything themselves. They're nearly impossible to detect because they don't interfere with the radio environment at all.

Active cell-site simulators are what most law enforcement agencies use. These transmit their own signal, and they're more capable. An active Stingray can force your phone to increase its transmission power, turning it into a more precise tracking beacon. It can also downgrade your connection from 4G or 5G down to 2G.

You'll often see 2G described as having "no encryption." That's not quite right, and the real story is worse. 2G's ciphers are weak and comprehensively broken — A5/1 and A5/2 have both been defeated — and the standard also permits a null-cipher mode a rogue tower can simply select. But the deeper flaw is that 2G has no mutual authentication. Your phone proves itself to the network; the network never has to prove itself to your phone. That asymmetry is what makes the whole attack work.

That downgrade attack is a textbook man-in-the-middle technique. Your phone thinks it's talking to a tower. The tower thinks it's talking to your phone. The Stingray sits between them, reading everything.

Who Uses Them and How Much Do They Cost?

Federal procurement records give the clearest picture of scale. A 2016 House Oversight Committee report found that between 2010 and 2014 the Department of Justice spent more than $71 million on cell-site simulators, acquiring 310 devices, and the Department of Homeland Security spent more than $24 million on 124 devices. That's over 430 units across nine federal agencies, at unit costs ranging from $41,500 to half a million dollars. DHS also helps state and local agencies buy the equipment through federal grant programs.

(You'll find market-size projections for this industry quoted to the decimal place. We looked into the ones that circulate most and they trace to low-tier SEO market-research publishers with undisclosed methodology and wildly incompatible numbers. Precision like that, for products sold under NDA to police departments, is a tell. The procurement figures above are real government data; use those instead.)

That last part matters. This isn't just FBI and DEA. Mid-sized municipal police departments have access to this hardware, funded by federal grants.

L3Harris makes the best-known models. The StingRay II is a vehicular system — Rochester PD records show it needs a 2,000-watt inverter to run. The KingFish is the hand-carried version, compact enough for foot operations. Hailstorm adds LTE capability and is sold either standalone or as an upgrade bolted onto a StingRay or KingFish, so its form factor follows whatever it's attached to. ArrowHead is a real model in the family, but there's essentially no public technical detail on it.

That last part matters. This isn't just FBI and DEA. Mid-sized municipal police departments have access to this hardware, funded by federal grants.

What Does the Law Say?

The legal situation is messy.

Historically, law enforcement used pen register orders to deploy Stingrays. Those require a much lower standard than a warrant. You only need to show the information is "relevant" to an investigation, not that you have probable cause.

The 2018 Supreme Court ruling in Carpenter v. United States changed part of that picture. The Court held that people have a reasonable expectation of privacy in their physical movements as captured through cell-site location data, declining to extend the third-party doctrine to cover it. Worth being precise, though: Carpenter was about historical records held by your carrier, not about simulators. Courts have extended its reasoning to cell-site simulators, but the case itself didn't reach them. Real-time tracking with a simulator is arguably more intrusive than what Carpenter addressed — these devices can pinpoint a phone to within a few feet, including inside a home.

In 2015 both DOJ (September) and DHS (October) adopted policies requiring federal agents to get a probable-cause warrant before deploying a simulator. There are two exceptions, and the second is the one to watch. The first is exigent circumstances — protecting life, hot pursuit, preventing imminent destruction of evidence. The second is "exceptional circumstances where the law does not require a warrant," which the public policy never defines. DOJ's interim guidance carried that language forward unchanged.

State rules vary a lot. At least six states have simulator-specific warrant statutes: California, Illinois, Minnesota, Utah, Virginia, and Washington. Maryland got there through case law rather than statute. A larger group requires warrants for real-time cell tracking generally, which may or may not expressly cover simulators. Many states have minimal oversight.

There's a secrecy problem too. The FBI requires local police departments that use Stingrays to sign non-disclosure agreements. The published Erie County, New York template states that at the FBI's request the agency will seek dismissal of the case rather than disclose the technology — and Baltimore's NDA carried the same provision, agreed to by the State's Attorney's office. In a November 2014 Baltimore robbery trial, a detective refused to explain how he'd located the suspect — "I can't discuss it, sir. It's a nondisclosure agreement" — and prosecutors withdrew the evidence rather than answer.

In United States v. Lambis (S.D.N.Y. 2016), a federal judge suppressed simulator-derived evidence for the first time. Judge Pauley: "Absent a search warrant, the Government may not turn a citizen's cell phone into a tracking device." The DEA had a pen register order — what it lacked was a warrant covering simulator use. An agent had walked the building's hallways with a handheld unit to isolate which apartment the phone was in.

Florida produced the same fact pattern earlier. In Thomas v. State, Tallahassee police tracked a stolen phone to a specific apartment and deliberately did not seek a warrant because, as an officer testified, they did not want to reveal information about the technology — citing an NDA with the vendor. The trial court closed the courtroom and sealed the transcript; the ACLU later got it unsealed.

Why Should Communities Like Ours Care?

Stingrays are dragnet tools. They don't just capture data from the target. They capture data from every phone within range. If you happen to be near an operation, your identifiers get swept up too.

Operating a Stingray can also disrupt local cellular networks. By pulling phones off legitimate towers, EFF reports these devices "often disrupt cell phone communications within as much as a 500-meter radius," emergency calls included. There's no fixed number — the affected area depends on transmit power, antenna, band, and terrain, and public estimates run from roughly 200 meters to over a kilometer. In 2016 a group of senators formally asked the FCC to investigate simulator interference with 911 calls. The devices also push phones to transmit at maximum power, draining batteries. People in the area may lose the ability to call for help.

The deployment pattern is not random. USA Today obtained Baltimore PD's surveillance log showing more than 2,000 deployments. A coalition of civil rights groups then mapped those locations against Census demographics in an FCC complaint, finding deployments concentrated in predominantly Black neighborhoods. Separately, DOJ's 2016 findings report on Baltimore PD documented that 44% of over 300,000 pedestrian stops occurred in two small, majority-Black districts holding 11% of the city's population.

When these devices are used at protests or political rallies, they create a surveillance record of who attended. That has a chilling effect on First Amendment activity.

LGBTQ+ organizations, civil rights groups, immigrant communities, political minorities. These are the communities that have always been surveilled first. That's not speculation. It's the documented pattern across decades of domestic surveillance programs.

Can You Detect a Stingray?

Sort of. There are detection methods, but none are perfect.

Stingray detectors look for specific signal anomalies. The main red flags include a sudden downgrade from 4G/5G to 2G, a tower broadcasting a Cell ID that doesn't match the surrounding network, a tower that doesn't provide a list of neighboring cells (which legitimate towers do for handover purposes), and unusual requests for your IMSI during the initial connection phase.

A few Android apps have tried to tackle this, and the honest assessment is that neither is a real option today.

SnoopSnitch is still maintained, but its IMSI-catcher detection needs root access, a Qualcomm baseband exposing the diagnostic driver, and a near-stock Android — a combination that describes a shrinking set of mostly older devices. Its patch-level analysis works anywhere without root; the surveillance detection doesn't. It also produces both false positives and false negatives, and it detects rather than blocks.

AIMSICD is effectively abandoned. No meaningful releases in years and not viable on modern Android. If you find a guide recommending it, that guide is old.

Because phone apps generally can't reach the baseband processor where the protocol manipulation actually happens, this whole category is fighting with one hand tied.

Enterprise systems like ESD Overwatch use dedicated radio sensors independent of any handset and are more reliable. They're also priced for corporate and government clients, not individuals.

What About Rayhunter?

This one is worth its own section.

In March 2025, the Electronic Frontier Foundation released Rayhunter, an open-source tool for detecting cell-site simulators. Unlike the Android apps above, Rayhunter runs on dedicated hardware: originally the Orbic RC400L, a small mobile hotspot EFF notes is available for $20 or less used. Some third-party sellers offer pre-flashed units at a markup if you'd rather skip the setup.

Device support has expanded a lot since launch. EFF's supported-devices list now covers the TP-Link M7350 (their recommendation outside North America), the TP-Link M7310, Wingtech CT2MHS01, T-Mobile TMOHS1, Orbic, Moxee, and the PinePhone. If you read an older writeup naming only the Orbic, it's out of date.

Rayhunter works by intercepting and analyzing the control traffic between the hotspot and nearby cell towers. It doesn't capture your web traffic or personal data. It watches for the specific protocol-level behaviors that Stingrays use: forced downgrades to 2G, suspicious IMSI requests, rogue tower broadcasts.

A status line on the device stays green when everything looks normal. If something suspicious happens, it turns red. You can connect to the hotspot over Wi-Fi and pull up a web dashboard for more detail. Logs export in PCAP format if you want to dig deeper or hand them to someone who can.

Setup takes about 10 to 20 minutes. You download the release from GitHub, connect the device to a computer, and run an install script. EFF officially supports macOS and Linux only — Windows binaries do exist in the GitHub releases and people have documented Windows installs, but that's community territory, not supported. There's also a blue status-line mode for color-blind users.

Rayhunter is not perfect. It can't stop an attack, only detect signs of one. It requires a SIM card to function. And like any detection tool, it may not catch every technique a well-funded operator could deploy. But it runs on 4G networks, which is where most current Stingray operations happen. The project is actively maintained on GitHub, and the community has already added support for devices beyond the original Orbic. Unlike rooting your phone to run SnoopSnitch, carrying a separate hotspot doesn't require modifying your primary device.

For the price of a used hotspot and 20 minutes of setup, there isn't a lower barrier to entry for Stingray detection right now. The EFF is also using data collected by Rayhunter users to map where cell-site simulators are being deployed. So running one doesn't just tell you what's happening around you. It adds to a public record of who is being surveilled and where.

Does 5G Fix This?

Partially.

5G standalone encrypts the permanent subscriber identifier — the SUPI gets wrapped into a SUCI before it's ever transmitted, which defeats the classic IMSI catcher. That's a real improvement.

The catch is in the word standalone. A lot of what's marketed as "5G" is non-standalone: 5G radio running on a 4G core, which inherits LTE's exposure. If your phone shows a 5G icon, that alone doesn't tell you which one you're on.

Even on true standalone 5G, pre-authentication messages remain a problem. A 2025 NDSS study identified 53 messages across 2G, 3G, 4G and 5G non-standalone that can elicit identity exposure before a secure connection is established — research that also informs several of Rayhunter's detection heuristics. And downgrade attacks still work: a simulator can push your phone down to LTE or 2G, where all the old problems apply. Encrypting the identifier does nothing to stop a downgrade.

5G makes interception harder. It does not make tracking impossible.

What Can You Actually Do?

Signal and other encrypted messaging apps protect the content of your communications. If a Stingray intercepts your connection, it can't read Signal messages. But Signal does not hide your location or the fact that your phone is present. Your IMSI and IMEI are exposed before any app-layer encryption matters.

If you are attending an event where surveillance is a concern, a Faraday bag is the only reliable hardware countermeasure. It blocks all radio signals to and from your device. Your phone can't connect to anything, real or fake. The tradeoff is obvious: while it's in the bag, your phone is a brick.

Airplane mode is not equivalent. Some devices continue to communicate at the baseband level even with airplane mode enabled.

Awareness matters more than any single tool. Your phone broadcasts identifying information constantly. Being near a Stingray operation means your data gets collected whether you're the target or not. And metadata, where you were, when, which device you carried, tells a story even when content stays encrypted.

The same communities that benefit from knowing how to protect themselves physically benefit from understanding how they can be located, identified, and tracked before anything physical happens. That's what this is about.

Frequently asked questions

What is a Stingray device?

A cell-site simulator: hardware that impersonates a cell tower so nearby phones connect to it, revealing their IMSI (the identifier tied to your SIM) and IMEI (the identifier tied to your handset). "Stingray" is an L3Harris trade name that became the generic term, the way Xerox did for copiers.

Do police need a warrant to use a Stingray?

Federal agents do under DOJ and DHS policies adopted in 2015 — but those carry an exigent-circumstances exception and a second, undefined exception for "exceptional circumstances where the law does not require a warrant." At the state level, at least six states have simulator-specific warrant statutes: California, Illinois, Minnesota, Utah, Virginia, and Washington. Many states have little oversight.

Can a Stingray read my text messages?

Not if you use encrypted messaging. Signal and similar apps protect message content, and a simulator can't read them. What it does get is arguably more revealing: that your phone was in a particular place at a particular time, and which device and SIM it was. That metadata is exposed before any app-layer encryption applies.

Can I detect a Stingray?

Imperfectly. EFF's Rayhunter runs on an inexpensive mobile hotspot and watches for the protocol behaviors simulators use — forced 2G downgrades, suspicious IMSI requests, rogue tower broadcasts. Phone apps are largely a dead end: AIMSICD is abandoned, and SnoopSnitch's detection needs root plus specific hardware. No detector blocks an attack; they only tell you something happened.

Does 5G protect me from Stingrays?

Partly, and only on true 5G standalone networks, which encrypt your permanent identifier before transmitting it. Much of what's sold as 5G is non-standalone — 5G radio on a 4G core — and inherits LTE's weaknesses. Downgrade attacks work regardless, and researchers have documented dozens of pre-authentication messages that can still expose identity.

What actually stops a Stingray?

A Faraday bag. It's the only reliable hardware countermeasure, because a phone that can't receive the simulator's broadcast can't connect to it. The tradeoff is that your phone is unreachable while bagged. Airplane mode is not equivalent — some devices continue baseband activity with it enabled.