Stingray Devices: What They Are, How They Work, and What You Can Do

Your phone is constantly looking for the strongest cell tower signal it can find. That's how cellular networks work. Your device connects, identifies itself, and starts passing data.

A Stingray exploits that process. It pretends to be a cell tower. Your phone connects to it. And now whoever is operating that device knows exactly where you are, what device you're carrying, and which SIM card is in it.

This is not theoretical. These devices are in active use by law enforcement agencies across the country.

The short version

• A Stingray impersonates a cell tower. Every phone in range connects to it and hands over its SIM and handset identifiers, whether or not that person is the target.
• End-to-end encrypted apps like Signal protect what you say. They do not hide where your phone is.
• A Faraday bag that is tested to block cellular signals keeps your phone from connecting to one at all.
• For detection, EFF's free Rayhunter software runs on a used mobile hotspot that costs about $20.

The rest of this guide covers how these devices work, what you can do, how to spot one, and what the law allows.

What Is a Stingray?

A Stingray is a cell-site simulator, also called an IMSI catcher. It's a piece of hardware that broadcasts a cellular signal mimicking a legitimate tower. When your phone connects, the device captures two critical identifiers: your IMSI (the unique number tied to your SIM card) and your IMEI (the unique number tied to your physical handset).

With those two numbers, someone can track a specific person across devices. Swap your SIM card, they still have your IMEI. Swap your phone, they still have your IMSI. Use a burner, they can correlate your location pattern to your real identity.

The name "Stingray" comes from a product line made by L3Harris Technologies. It became the generic term the way "Xerox" did for copiers.

How Do They Actually Work?

There are two types: passive and active.

Passive IMSI catchers work like a radio scanner. They pull cellular transmissions out of the air without broadcasting anything themselves. They're nearly impossible to detect because they don't interfere with the radio environment at all.

Active cell-site simulators are what most law enforcement agencies use. These transmit their own signal, and they're more capable. An active Stingray can force your phone to increase its transmission power, turning it into a more precise tracking beacon. It can also downgrade your connection from 4G or 5G down to 2G.

You'll often see 2G described as having "no encryption." That's not quite right, and the real story is worse. 2G's ciphers are weak and comprehensively broken — A5/1 and A5/2 have both been defeated — and the standard also permits a null-cipher mode a rogue tower can simply select. But the deeper flaw is that 2G has no mutual authentication. Your phone proves itself to the network; the network never has to prove itself to your phone. That asymmetry is what makes the whole attack work.

That downgrade attack is a textbook man-in-the-middle technique. Your phone thinks it's talking to a tower. The tower thinks it's talking to your phone. The Stingray sits between them, reading everything.

Why Should Communities Like Ours Care?

Stingrays are dragnet tools. They don't just capture data from the target. They capture data from every phone within range. If you happen to be near an operation, your identifiers get swept up too.

Operating a Stingray can also disrupt local cellular networks. By pulling phones off legitimate towers, EFF reports these devices "often disrupt cell phone communications within as much as a 500-meter radius," emergency calls included. There's no fixed number — the affected area depends on transmit power, antenna, band, and terrain, and public estimates run from roughly 200 meters to over a kilometer. In 2016 a group of senators formally asked the FCC to investigate simulator interference with 911 calls. The devices also push phones to transmit at maximum power, draining batteries. People in the area may lose the ability to call for help.

The deployment pattern is not random. A Baltimore detective testified that the department used Stingrays 4,300 times between 2007 and 2015. A coalition of civil rights groups then mapped deployment locations from logs obtained by USA Today against Census demographics in an FCC complaint, finding deployments concentrated in predominantly Black neighborhoods. Separately, DOJ's 2016 findings report on Baltimore PD documented that 44% of over 300,000 pedestrian stops occurred in two small, majority-Black districts holding 11% of the city's population.

When these devices are used at protests or political rallies, they create a surveillance record of who attended. That has a chilling effect on First Amendment activity.

LGBTQ+ organizations, civil rights groups, immigrant communities, political minorities. These are the communities that have always been surveilled first. That's not speculation. It's the documented pattern across decades of domestic surveillance programs, and newer tools are extending it (how AI surveillance reaches your community).

What Can You Actually Do?

End-to-end encrypted messaging apps protect the content of your communications. Signal's own terms state that its messages and calls "cannot be accessed by us or other third parties because they are always end-to-end encrypted", and a simulator sitting on your connection is one of those third parties. But Signal does not hide your location or the fact that your phone is present. Your IMSI and IMEI are exposed before any app-layer encryption matters.

If you are attending an event where surveillance is a concern, a Faraday bag is the hardware countermeasure (how to choose and use one). A bag only helps if it actually blocks cellular frequencies, so look for a published test result. One maker, MOS Equipment, publishes its test certification: 80+ dB attenuation from low MHz to 40 GHz, covering 5G, LTE, and 4G, tested to IEEE 299-2006. A phone that can't receive a simulator's broadcast can't connect to it. The tradeoff is obvious: while it's in the bag, your phone is a brick.

Awareness matters more than any single tool. Your phone broadcasts identifying information constantly. Being near a Stingray operation means your data gets collected whether you're the target or not. And metadata, where you were, when, which device you carried, tells a story even when content stays encrypted.

The same communities that benefit from knowing how to protect themselves physically benefit from understanding how they can be located, identified, and tracked before anything physical happens. That's what this is about.

Can You Detect a Stingray?

Sort of. There are detection methods, but none are perfect.

Stingray detectors look for specific signal anomalies. The main red flags include a sudden downgrade from 4G/5G to 2G, a tower broadcasting a Cell ID that doesn't match the surrounding network, a tower that doesn't provide a list of neighboring cells (which legitimate towers do for handover purposes), and unusual requests for your IMSI during the initial connection phase.

A few Android apps have tried to tackle this, and the honest assessment is that neither is a real option today.

SnoopSnitch is still maintained, but its IMSI-catcher detection needs root access, a Qualcomm baseband exposing the diagnostic driver, and a near-stock Android — a combination that describes a shrinking set of mostly older devices. Its patch-level analysis works anywhere without root; the surveillance detection doesn't. It also produces both false positives and false negatives, and it detects rather than blocks.

AIMSICD is effectively abandoned. No meaningful releases in years and not viable on modern Android. If you find a guide recommending it, that guide is old.

Because phone apps generally can't reach the baseband processor where the protocol manipulation actually happens, this whole category is fighting with one hand tied.

Enterprise systems like ESD Overwatch use dedicated radio sensors independent of any handset and are more reliable. They're also priced for corporate and government clients, not individuals.

Rayhunter: the cheapest real option

In March 2025, the Electronic Frontier Foundation released Rayhunter, an open-source tool for detecting cell-site simulators. Unlike the Android apps above, Rayhunter runs on dedicated hardware: originally the Orbic RC400L, a small mobile hotspot EFF notes is available for $20 or less used. Some third-party sellers offer pre-flashed units at a markup if you'd rather skip the setup.

Device support has expanded a lot since launch. EFF's supported-devices list now covers the TP-Link M7350 (their recommendation outside North America), the TP-Link M7310, Wingtech CT2MHS01, T-Mobile TMOHS1, Orbic, Moxee, and the PinePhone. If you read an older writeup naming only the Orbic, it's out of date.

Rayhunter works by intercepting and analyzing the control traffic between the hotspot and nearby cell towers. It doesn't capture your web traffic or personal data. It watches for the specific protocol-level behaviors that Stingrays use: forced downgrades to 2G, suspicious IMSI requests, rogue tower broadcasts.

A status line on the device stays green when everything looks normal and turns red if something suspicious happens. A web dashboard over Wi-Fi gives more detail, and logs export in PCAP format if you want to hand them to someone who can dig deeper.

Setup takes about 10 to 20 minutes: download the release from GitHub, connect the device to a computer, and run an install script. EFF officially supports macOS and Linux; Windows installs exist but are community territory.

Rayhunter is not perfect. It can't stop an attack, only detect signs of one. It requires a SIM card to function. And like any detection tool, it may not catch every technique a well-funded operator could deploy. But it runs on 4G networks, which is where most current Stingray operations happen. Unlike rooting your phone to run SnoopSnitch, carrying a separate hotspot doesn't require modifying your primary device.

For the price of a used hotspot and 20 minutes of setup, there isn't a lower barrier to Stingray detection right now. EFF also uses data from Rayhunter users to map where simulators are deployed, so running one adds to a public record of who is being surveilled and where.

Does 5G Fix This?

Partially.

5G standalone encrypts the permanent subscriber identifier — the SUPI gets wrapped into a SUCI before it's ever transmitted, which defeats the classic IMSI catcher. That's a real improvement.

The catch is in the word standalone. A lot of what's marketed as "5G" is non-standalone: 5G radio running on a 4G core, which inherits LTE's exposure. If your phone shows a 5G icon, that alone doesn't tell you which one you're on.

Even on true standalone 5G, pre-authentication messages remain a problem. A 2025 NDSS study identified 53 messages across 2G, 3G, 4G and 5G non-standalone that can elicit identity exposure before a secure connection is established — research that also informs several of Rayhunter's detection heuristics. And downgrade attacks still work: a simulator can push your phone down to LTE or 2G, where all the old problems apply. Encrypting the identifier does nothing to stop a downgrade.

5G makes interception harder. It does not make tracking impossible.

Who Uses Them, and What Do They Cost?

Federal procurement records give the clearest picture of scale. A 2016 House Oversight Committee report found that between 2010 and 2014 the Department of Justice spent more than $71 million on cell-site simulators, acquiring 310 devices, and the Department of Homeland Security spent more than $24 million on 124 devices. That's over 430 units across nine federal agencies, at unit costs ranging from $41,500 to half a million dollars. DHS also helps state and local agencies buy the equipment through federal grant programs.

That last part matters. This isn't just FBI and DEA. Mid-sized municipal police departments have access to this hardware, funded by federal grants.

L3Harris makes the best-known models: the vehicle-mounted StingRay II, the hand-carried KingFish, and Hailstorm, which adds LTE capability either standalone or as an upgrade to the other two.

What Does the Law Say?

The legal situation is messy.

Historically, law enforcement used pen register orders to deploy Stingrays (the DHS directive discussed below describes this past practice). Those require a much lower standard than a warrant. The applicant only has to certify that the information likely to be obtained is "relevant to an ongoing criminal investigation" (18 U.S.C. § 3122), not show probable cause.

The 2018 Supreme Court ruling in Carpenter v. United States changed part of that picture. The Court held that people have a reasonable expectation of privacy in their physical movements as captured through cell-site location data, declining to extend the third-party doctrine to cover it. Worth being precise, though: Carpenter was about historical records held by your carrier, not about simulators. The Court expressly declined to rule on real-time tracking or other tools. Real-time tracking with a simulator is arguably more intrusive than what Carpenter addressed — these devices can pinpoint a phone to within a few feet, including inside a home.

In 2015 both DOJ (September) and DHS (October, Policy Directive 047-02) adopted policies requiring federal agents to get a probable-cause warrant before deploying a simulator. Both policies carry two exceptions, and the second is the one to watch. The first is exigent circumstances. The second is "exceptional circumstances where the law does not require a warrant."

State rules vary a lot. A few states name the device in statute and require a court order based on probable cause before police use one: Illinois, Washington, and Maryland. Maryland's courts had already required a warrant in State v. Andrews (2016). Other states, including California, Minnesota, and Utah, require a warrant for electronic location data in general, without naming simulators. Many states have minimal oversight.

There's a secrecy problem too. The same 2016 House Oversight Committee report found the FBI required state and local agencies to sign a non-disclosure agreement with the FBI in order to obtain the devices. The example NDA language it quotes commits the agency and prosecutors, at the FBI's request, to seek dismissal of the case rather than disclose information about the equipment.

Frequently asked questions

What is a Stingray device?

A cell-site simulator: hardware that impersonates a cell tower so nearby phones connect to it, revealing their IMSI (the identifier tied to your SIM) and IMEI (the identifier tied to your handset). "Stingray" is an L3Harris trade name that became the generic term, the way Xerox did for copiers.

Do police need a warrant to use a Stingray?

Federal agents do under DOJ and DHS policies adopted in 2015 — but those carry an exigent-circumstances exception and a second, undefined exception for "exceptional circumstances where the law does not require a warrant." At the state level, Illinois, Washington, and Maryland name simulators in statute and require a probable-cause court order. Several others, including California, Minnesota, and Utah, require warrants for electronic location data generally. Many states have little oversight.

Can a Stingray read my text messages?

Not if you use end-to-end encrypted messaging. Signal's terms (cited above) state its messages cannot be accessed by third parties. What it does get is arguably more revealing: that your phone was in a particular place at a particular time, and which device and SIM it was. That metadata is exposed before any app-layer encryption applies.

Can I detect a Stingray?

Imperfectly. EFF's Rayhunter runs on an inexpensive mobile hotspot and watches for the protocol behaviors simulators use — forced 2G downgrades, suspicious IMSI requests, rogue tower broadcasts. Phone apps are largely a dead end: AIMSICD is abandoned, and SnoopSnitch's detection needs root plus specific hardware. No detector blocks an attack; they only tell you something happened.

Does 5G protect me from Stingrays?

Partly, and only on true 5G standalone networks, which encrypt your permanent identifier before transmitting it. Much of what's sold as 5G is non-standalone — 5G radio on a 4G core — and inherits LTE's weaknesses. Downgrade attacks work regardless, and researchers have documented dozens of pre-authentication messages that can still expose identity.

What actually stops a Stingray?

A Faraday bag that is tested to block cellular frequencies. A phone that can't receive the simulator's broadcast can't connect to it. Check for a published test result, like the MOS Equipment certification cited above. The tradeoff is that your phone is unreachable while bagged.