What a "Stingray" does, in one paragraph
Cell-site simulators are devices that pretend to be a real cell tower. Every phone in range tries to connect. The simulator reads back the identifiers your phone sends and uses them to locate you, identify your device, and sometimes downgrade your connection so that voice or text content can be pulled out of the air. The ACLU calls them "invasive cell phone surveillance devices that mimic cell phone towers and send out signals to trick cell phones in the area into transmitting their locations and identifying information."[1] They have been in the hands of US police since 2006 and are now operated by at least 75 agencies in 27 states, plus federal agencies including ICE.[1] Most of what they do is hidden from judges, defense lawyers, and the public by an FBI-mandated non-disclosure agreement.[2][3]
What a cell-site simulator actually is
A cell-site simulator is a hardware box that impersonates a cell tower. The brand everyone knows is the StingRay, made by Harris Corporation; "Stingray" has become the generic name for the whole class of devices, the way "Kleenex" became the generic name for a tissue.[4] Harris sells a family of models under the same umbrella: the StingRay itself, which is the vehicle- or airborne-mounted unit, plus KingFish for handheld use, HailStorm as a newer upgrade, and FishHawk as the GSM encryption-key extraction module.[4]
In active mode, the device does what a tower does. It broadcasts a signal that nearby phones recognize, the phones try to attach to it, and the simulator records the identifiers they send.[4] In passive mode, the same hardware runs as a digital analyzer or a radio jammer. Passive mode is what an investigator uses for base-station surveys; active mode is what gets used in the field.[4]
The core trick is that your phone does not know the difference between the simulator and a real tower. Your phone just looks for the strongest signal and connects. The simulator is the strongest signal by design.
What gets pulled off your phone
The minimum the simulator captures is your device's identifying numbers. The first is the IMSI, the International Mobile Subscriber Identity, which is the unique identifier baked into your SIM card and tied to your cellular subscription. The second is the ESN, the Electronic Serial Number (or its modern equivalent), tied to the device hardware.[4] The active-mode operations listed in the technical literature include extracting those identifiers, writing cellular protocol metadata to internal storage, and forcing an increase in signal transmission power on the targeted phone.[4] If a phone in range is the target, those numbers get pulled. If a phone in range is not the target, those numbers still get pulled. There is no opt-in from the bystander.
Once the simulator knows a phone's identifiers, it can locate that phone. The standard method is signal-strength triangulation: the device takes readings from multiple points or vehicles and computes position from the relative signal strength of the target phone's transmissions.[4] Real-time location tracking is the function most operators have actually used in investigations, and it is the function most often at issue in the published court records.[4]
With the FishHawk upgrade, the simulator can go further. The unit can perform what the technical literature calls "GSM Active Key Extraction": instruct the target phone to downgrade to the older A5/2 cipher, collect the downgraded signals, and run cryptanalysis to recover the encryption key stored on the SIM. With that key, the device can sit between the phone and a real cell tower, forwarding your calls and texts while decrypting and recording the content.[4] The downgrade-to-A5/2 attack has been a documented vulnerability for years, not a fictional risk; the technical literature notes that even A5/1, the stronger cipher, can be broken with about $1,000 of computer hardware and 30 minutes of cryptanalysis on intercepted signals.[4]
The 4G and 5G standards fixed the downgrade problem in theory. The interception problem in practice has not gone away: the upgrade hardware has been carried forward, and the same Harris family of devices is sold into the present day. What changed is that the device can no longer pretend to be a 4G or 5G tower without an IMSI-catcher-aware phone noticing the protocol violations. Real-world deployments mix the legacy attack with the newer protocol impersonation, which is why EFF's own primers still warn about the older-generation interception today.
Who's actually running them
The ACLU's tracker, maintained for years through public records requests, has identified 75 law enforcement agencies in 27 states that own or operate cell-site simulators.[1] The earliest confirmed deployment in the public record was the LAPD in 2006, paid for by a Department of Homeland Security grant.[4] By 2014 the ACLU had documented use at 42 agencies in 17 states; by 2017 the count was 72 agencies in 24 states.[4] The number has kept climbing.
Federal agencies known to operate cell-site simulators include the FBI, the DEA, the Secret Service, and US Immigration and Customs Enforcement. ICE's use of the devices in deportation searches is documented in ACLU litigation: a December 2019 federal suit, ACLU v. CBP, sought records on CBP and ICE use of the technology.[1] ICE agents have also used the devices around protests against ICE raids, including an incident in Washington state in 2025 that drew on mobile-network anomaly analysis.[4]
The price tag puts it in reach of most medium-sized police departments. Hennepin County, Minnesota, requested $426,150 for a KingFish unit in FY 2011.[4] A Santa Clara County, California, agency cancelled its Harris contract in 2015 over the non-disclosure terms.[4] Federal spending tells the scale: between 2010 and 2014, the Department of Justice spent more than $71 million on cell-site simulation technology and the Department of Homeland Security spent more than $24 million.[4]
The secrecy layer: what judges and defense lawyers never see
Cell-site simulators have a unique feature no other common surveillance tool has: a federally required non-disclosure agreement that runs from the local police department to the FBI. Harris will not sell a department the device until the FBI signs off, and the FBI will not sign off until the agency signs the NDA.[5]
The NDA's text is a matter of public record. The Erie County Sheriff's Office version, signed on June 29, 2012 by FBI Special Agent in Charge Christopher M. Piehota and Erie County Chief Scott R. Patronik, sets out the terms.[5] The package "will not distribute, disseminate, or otherwise disclose any information concerning the wireless collection equipment/technology... to the public, including to any non-law enforcement individuals or agencies."[5] Disclosure to other law enforcement agencies requires "the prior written approval of the FBI."[5] On a public-records request, the package "will immediately notify the FBI of any such request telephonically and in writing in order to allow sufficient time for the FBI to seek to prevent disclosure."[5]
The NDA goes further in court. The package "shall not, in any civil or criminal proceeding, use or provide any information concerning the Harris Corporation wireless collection equipment/technology... without the prior written approval of the FBI."[5] At the FBI's request, the package "will... seek dismissal of the case in lieu of using or providing" the information.[5] The FBI has, in at least one case, instructed the US Marshals Service to seize a local police department's surveillance files before defense counsel could review them.[3]
The NDA's stated justification, also verbatim from the document, is that "disclosing the existence of and the capabilities provided by such equipment/technology to the public would reveal sensitive technological capabilities possessed by the law enforcement community and may allow individuals who are the subject of investigation wherein this equipment/technology is used to employ countermeasures to avoid detection by law enforcement."[5]
EFF, summarizing the practice in January 2015, wrote that "Harris requires police departments sign a non-disclosure agreement promising not to reference Stingrays" and that the US Department of Justice and the US Marshals Service have instructed local departments to keep details secret, with the Marshals physically intervening at least once to prevent information from becoming public.[3] In Tacoma, Washington, judges signed more than 170 orders between 2009 and 2014 unknowingly authorizing Stingray use; in Baltimore, prosecutors dropped Stingray evidence after a judge threatened to hold a police officer in contempt for not disclosing how it worked.[3] In Sarasota, Florida, police were told to refer to Stingrays as a "source" in official documents.[3]
The legal fight: warrants, the Constitution, and a state-by-state patch
The Supreme Court's 2018 ruling in Carpenter v. United States held that the government violates the Fourth Amendment when it accesses historical cell-site location information without a warrant.[4] That case did not involve a cell-site simulator directly, and the simulator question was left for later fights. The state-by-state answer since 2014 has been patchy.
The EFF reported in January 2015 that Florida and Massachusetts state Supreme Courts had ruled warrants were necessary for real-time cell-phone tracking, and that eight states had put warrant requirements on the books at the statutory level: Illinois, Indiana, Maryland, Minnesota, Tennessee, Utah, Virginia, and Wisconsin.[2] Subsequent litigation has expanded the warrant rule into other states, and the federal rule has been narrowing in parallel. The doctrine is not uniform across the country. Some courts still allow warrantless simulator use in exigent circumstances or for pen-register orders; others require a full probable-cause warrant.[4]
The constitutional theory behind the warrant requirement is straightforward. A cell-site simulator is a search of your phone. The phone is an "effect" within the meaning of the Fourth Amendment. The simulator pulls unique identifiers from your SIM card, reads metadata about your device, and tracks your location in real time. EFF calls the practice "an unconstitutional, all-you-can-eat data buffet" because the device collects bystander data along with target data.[4]
The Fourth Circuit case law, "United States v. Rigmaiden" (CR08-814-PHX-DGC), produced the rare instance in which a StingRay's specific effect on a phone was put on the record: the device "caused a brief disruption in service to the aircard."[4] That disruption is not just a curiosity. Senator Ron Wyden's August 21, 2018 letter to DHS confirmed that Stingrays disrupt 9-1-1 calls, with implications for emergency response that go beyond the privacy question.[4]
How to know if a cell-site simulator is being used near you
There is no reliable consumer-level detector for a StingRay. The closest thing the consumer market has is the GSMK Cryptophone, a hardened handset that can identify the protocol anomalies a simulator relies on and alert the user to IMSI capture.[4] Academic papers have begun to propose timing-based detection that works on ordinary smartphones; that research is real but not yet shipped as a feature anyone can rely on day-to-day.[4]
What that means practically: if you see your phone show "no signal" or "emergency calls only" while you are in a place that should have service, and you are not in a basement or a tunnel, that is one of the few behavioral tells. The simulator forces your phone to downgrade; the downgrade often produces a service blip. Do not read a single blip as proof. Read it as a reason to look into where the next logger uses cell-site simulators and to make your phone harder to track in the next case.
You can also do the less-flashy version of the work. Read the public records. The ACLU's interactive map of "Who's Got Stingrays?" lists the agencies and states known to operate the devices, and the FOIA-produced documents behind it are the same ones the ACLU used to sue in ACLU v. CBP.[1] EFF's 2015 retrospective, the CEHRP-published copy of the actual NDA, and the Wired and Guardian reporting from 2014 and 2015 are the public-record sources. If you want to know if your local department uses one, those are the public-record sources you start from.
What you can do
The structural answer is that you cannot make a cell-site simulator unable to see your phone with the settings on a normal handset. There is no toggle, no app, no setting that says "do not connect to fake towers." Your phone connects, and what that means in a given moment depends on what the operator does with the data.
The practical answers are the ones that work on the rest of the model.
Limit the phone's identifiers. The IMSI is tied to your SIM. There is no way to change your IMSI without changing your SIM, and changing your SIM every few days is not a plan a normal person can run. The IMSI is not the only identifier, though. The IMEI, the device identifier, is also broadcast and also read. There is no consumer way to rotate an IMEI short of buying a new phone. The realistic move is to recognize that the identifiers will be read if a simulator is in range, and to plan around the fact that they will be read.
Limit the phone's metadata. Apps that strip location from your phone's connections when you do not need them are the practical lever. The fewer connections your phone makes to a tower, the fewer times it identifies itself to whatever is acting as the tower.
Encrypt the content that is in transit. End-to-end encrypted messaging apps do not save you from a FishHawk-style key extraction, but they do raise the cost. Signal and other modern messengers do not depend on cellular encryption at all; the message stays encrypted on your device and on the recipient's device regardless of which sector the cellular traffic crosses. That is the structural answer to the content-collection question.
Support the litigation. EFF, the ACLU, and a small set of defense-side civil liberties groups are the ones litigating the warrant requirement. The 2018 Carpenter ruling, the state-by-state warrant statutes, and the Florida and Massachusetts supreme court rulings are the public-record products of that litigation. If you want the legal answer to the next Stingray in the building, it will come from those cases.
You will not see the next Stingray coming. The point of the secrecy layer is that you are not supposed to. The point of reading this is that you know what the device is doing when the device is in range.