Stingray Devices and IMSI Catchers: What Law Enforcement Documents Reveal

For years, the existence of Stingray devices was itself classified. Police agencies across the United States signed non-disclosure agreements — drafted by the Harris Corporation and approved by the FBI — that prevented officers from disclosing even to judges and defence attorneys whether a cell-site simulator had been used in a criminal investigation. That secrecy has been progressively dismantled by Freedom of Information Act requests, federal litigation, and investigative journalism.

What the released documents reveal is a surveillance architecture far broader than the public was led to believe.

How Cell-Site Simulators Work

A cell-site simulator — Stingray is the brand name of the most common Harris Corporation model — functions by broadcasting signals that mimic a legitimate cell tower. Mobile phones within range, operating according to their normal protocols, connect to the device instead of the network. In doing so, they transmit their IMSI (International Mobile Subscriber Identity), a unique number associated with every SIM card.

This data capture is not targeted. Every phone within the device's operational radius — typically up to 500 metres — connects to the simulator and transmits its IMSI. The operator then filters the captured numbers against a known target. All other data collected from non-target devices is, in theory, discarded — though court documents have raised questions about whether this actually occurs.

More advanced models can also intercept the content of calls and text messages, and can interfere with nearby cellular communications, including emergency calls to 911.

What FOIA Documents Have Confirmed

The EFF's Street Level Surveillance project, ACLU FOIA litigation, and multiple investigative journalists have extracted thousands of pages of law enforcement documents detailing Stingray use. Key findings from released records include:

• FBI use since 1995. Documents obtained by the Electronic Privacy Information Center (EPIC) via FOIA litigation confirmed the FBI has operated cell-site simulators for approximately three decades, with usage described as dramatically increasing.
• Federal agency deployment. Confirmed users include the FBI, DEA, ATF, ICE, U.S. Marshals Service, Secret Service, IRS, and multiple military branches, including the Army, Navy, Marine Corps, and National Guard.
• ICE Crossbow upgrade. ACLU FOIA requests forced ICE to release over 1,000 pages of documents revealing an upgrade from the Stingray II to a new model called Crossbow — whose existence and capabilities were previously unknown publicly. Between January and October 2019, ICE deployed cell-site simulators 134 times.
• Chicago: no logs kept. ACLU of Illinois litigation revealed that Chicago Police Department technicians were instructed by lawyers not to keep usage logs — presumably to prevent FOIA disclosure. CPD spent hundreds of thousands of dollars defending two lawsuits rather than releasing records.
• NDAs survived FBI reform. In 2023, ACLU FOIA requests confirmed that the FBI continues to require local police to sign non-disclosure agreements when deploying FBI-owned cell-site simulators — even after publicly abandoning the practice for agency-owned devices. Court documents in multiple jurisdictions have ruled these NDAs unconstitutional when they prevent disclosure to defence counsel.
• 2023 Congressional findings. A Congressional Oversight Committee report confirmed that ICE, DHS, and the Secret Service deployed cell-site simulators multiple times without following their own deployment rules or obtaining required warrants.

The Constitutional Problem

The core legal tension is straightforward. The Fourth Amendment requires probable cause and a warrant for searches that intrude on a reasonable expectation of privacy. Courts have increasingly held that location tracking of this precision qualifies. In Carpenter v. United States (2018), the Supreme Court held that accessing historical cell-site location data constitutes a Fourth Amendment search requiring a warrant.

Cell-site simulators operate differently — they do not request data from carriers but capture it directly. This technical distinction was used for years to argue that no warrant was required. Multiple courts have rejected this reasoning. California, Washington, and several other states now require warrants for Stingray deployment except in genuine emergencies.

Detection and Countermeasures

The Surveillance Countermeasures guide covers detection methods in detail. Briefly: research published in 2023 demonstrated timing-based approaches to detecting Stingray attacks, and security applications such as GSMK's Cryptophone incorporate firewalls specifically designed to identify and alert users to IMSI capture events. The EFF developed its own detection system. Network-level countermeasures — including encrypted messaging via Signal and HTTPS communications — do not prevent IMSI capture but substantially reduce the value of any intercepted content.