Stingray devices are portable surveillance tools that impersonate legitimate cell towers, forcing every nearby phone to connect to them so operators can capture identifying numbers, location data, and in some configurations, call and text content. They are also called IMSI catchers or cell site simulators, and they are used by federal agencies, local police departments, and foreign intelligence services operating on US soil.
This guide is written for the people who need to understand this threat in practical terms: journalists protecting source confidentiality, activists organizing in public spaces, executives traveling to sensitive markets, and lawyers concerned about attorney-client privilege in the field. If you carry a phone that holds information other people want, you should know what a Stingray does, how to spot the signs, and how to make yourself a harder target.
By the end, you will have a working mental model of IMSI catcher technology, a realistic view of detection methods, and concrete countermeasures. For readers who already know they need offline protection, a shielded enclosure like the Faraday bag for phone and laptop remains the only guaranteed defense against a phone connecting to a rogue tower. Broader context on device hardening lives in the Spy-Fy privacy cases collection.
What are Stingray devices, exactly?
A Stingray is a suitcase-sized or vehicle-mounted device that broadcasts a stronger cellular signal than nearby real towers. Phones are engineered to connect to the strongest available signal, so they automatically hand off to the Stingray. Once connected, the device logs each phone's International Mobile Subscriber Identity (IMSI) and Electronic Serial Number (ESN), the two unique identifiers that link a handset and SIM to a specific person.
The name Stingray comes from a specific product line manufactured by Harris Corporation (now L3Harris Technologies), first sold to US federal agencies in the early 2000s. In common usage, "Stingray" is a genericized term for any cell site simulator, in the same way people say "Xerox" to mean any photocopier. Related devices in the Harris family include the KingFish (a smaller handheld version), the Harpoon (a signal amplifier), and the Hailstorm (upgraded for 4G LTE). Airborne versions carried by DEA aircraft are known as Dirtboxes, manufactured by Digital Receiver Technology.
Active mode vs. passive mode
Stingrays operate in two modes. In passive mode, the device only listens to signals in the area and records identifiers without interacting. In active mode, it broadcasts as a fake tower, forces connections, and can perform additional tricks: downgrading phones from 4G or 5G to 2G (which has weaker encryption), running a man-in-the-middle attack on communications, or denying service to specific handsets.
Who uses IMSI catchers?
The FBI, DEA, ICE, Secret Service, and US Marshals Service all operate cell site simulators. Documents obtained by the ACLU show that at least 75 federal, state, and local agencies across 27 states have acquired the technology, and the real number is almost certainly higher because purchases are frequently made under nondisclosure agreements with Harris Corporation.
Local police departments have deployed Stingrays for investigations ranging from murder cases to petty theft. In some jurisdictions, agencies have used the devices without obtaining warrants and, when challenged in court, dropped charges rather than reveal the technology. This pattern has been documented by the ACLU, the Electronic Frontier Foundation, and reporting from The Intercept.
Foreign intelligence services also operate IMSI catchers in US cities. In 2018, the Department of Homeland Security acknowledged detecting unauthorized cell site simulators near the White House and other federal buildings in Washington DC. The operators were not publicly identified, but the incident confirmed what security researchers had suspected for years: rogue Stingrays run by hostile services are active in American capitals and financial centers. For the broader legal framing, our overview of US surveillance and privacy laws explains where warrant requirements apply and where they do not.
What data can a Stingray actually collect?
The capabilities depend on the model, the operator's software, and the network generation being targeted. In general, cell site simulators can capture the following:
- IMSI and ESN identifiers for every phone in range, linking devices to subscribers
- Precise location of a targeted phone, often within a few meters, by triangulating signal strength as the operator moves
- Metadata including which numbers a phone is calling or texting, and the duration of communications
- Content of unencrypted calls and SMS when the phone has been downgraded to 2G
- Denial of service, blocking a target phone from making or receiving calls
What Stingrays generally cannot do is decrypt end-to-end encrypted messages sent through Signal, WhatsApp, or iMessage. The metadata around those messages (that your phone connected to a server, when, and from where) is still exposed, but the content is not.
Stingray vs. Dirtbox vs. KingFish: a quick comparison
| Device | Form factor | Typical operator | Range |
|---|---|---|---|
| Stingray / Hailstorm | Suitcase or vehicle-mounted | FBI, local police, federal agencies | Up to 1 mile in open terrain |
| KingFish | Handheld, backpack-portable | Undercover investigators, tactical teams | A few hundred meters |
| Dirtbox | Airborne, mounted on Cessna aircraft | DEA, US Marshals | Covers entire cities per flight |
| Harpoon | Signal amplifier accessory | Used with Stingrays for extended reach | Multiplies primary device range |
Can you detect a Stingray on your phone?
Detection is possible but difficult. Cell site simulators are designed to look like ordinary towers, and modern phones do not expose the low-level radio information that would make detection easy. That said, there are signs that suggest you might have connected to a rogue tower:
- Sudden downgrade from 5G or 4G to 2G in an area with normally strong coverage. This is the single most reliable indicator.
- Unexplained signal drops that recover the moment you move a block away
- Battery drain more aggressive than usual, because the phone is transmitting harder to reach a masquerading tower or repeatedly renegotiating connections
- Temperature spikes on the handset during periods of no active use
- Delayed or dropped calls and texts in specific locations, particularly near protests, courthouses, or federal buildings
Apps like SnoopSnitch (Android only, requires root on many devices) attempt to flag suspicious network behavior, but their accuracy is limited and they cannot see everything the baseband radio does. Treat detection tools as one signal among many, not as proof.
What 5G changes
5G standalone networks introduced the Subscription Concealed Identifier (SUCI), which encrypts the subscriber identity to prevent IMSI capture on the initial handshake. In theory, this makes IMSI catching harder on true 5G SA networks. In practice, most US carriers still operate hybrid 5G non-standalone deployments that fall back to 4G LTE for authentication, and phones can still be forced to downgrade. 5G is a partial improvement, not a solution.
How to protect your phone from IMSI catchers
No single tool eliminates the risk, but combining several measures raises the cost of surveillance significantly. If you handle sensitive conversations, source materials, or client information, work through this list.
Disable 2G at the OS level
Both Android (since version 12) and iOS 17 and later allow users to disable 2G connectivity, including through Lockdown Mode on iPhone. Because most active Stingray attacks depend on forcing the phone down to 2G, turning off 2G alone defeats a large share of real-world deployments. Check your cellular settings.
Use end-to-end encrypted communications
Signal, WhatsApp, and iMessage protect the content of your conversations even if your traffic passes through a rogue tower. For work that requires source protection or legal privilege, treat any regular SMS or voice call as compromised by default.
Store the phone in a Faraday bag when not needed
When the phone is powered but idle, it constantly checks in with nearby towers. That check-in is what a Stingray captures. A properly constructed Faraday bag blocks all radio frequencies, so the phone cannot connect to any tower, real or fake. This is the approach used by security teams protecting executives and by journalists meeting sources. For a broader look at why this matters, the breakdown of reasons a Faraday bag belongs in a modern security kit covers the specific scenarios where shielding is the only reliable answer.
Cover the cameras and audit device permissions
Cell site simulators handle the network side of the surveillance stack. The device itself is the other half. If a target is worth deploying a Stingray against, they are worth targeting with malware or lens-based observation too. A physical camera cover is the only defense that cannot be bypassed by software, which is why the iPhone 17 Pro Max privacy case with built-in camera cover is engineered for professionals who assume their devices are targets.
The legal picture in the United States
Stingray use exists in a legal gray zone. The Fourth Amendment requires warrants for searches, and in Carpenter v. United States (2018), the Supreme Court ruled that historical cell site location data requires a warrant. Cell site simulators arguably fall under the same principle, but many agencies have argued their use is analogous to a "pen register," which requires only a lower court order.
Since 2015, the Department of Justice and Department of Homeland Security have required federal agents to obtain warrants before deploying cell site simulators in most circumstances. State and local policies vary widely. Several states, including California, Washington, Illinois, and Utah, have passed laws requiring warrants at the state level. In many other states, no such requirement exists.
Who should actually worry about Stingrays?
Realistic threat modeling matters. Most people will never be targeted individually by a cell site simulator. However, bystander data collection is common: if you are near a protest, courthouse, embassy, or federal facility that is being surveilled, your identifiers may be captured even if you are not the target. The people who should treat this as an operational concern include:
- Journalists working on national security, organized crime, or corruption stories
- Activists organizing protests or civil disobedience
- Attorneys handling politically sensitive or high-value litigation
- Executives traveling to jurisdictions with active foreign intelligence surveillance
- Government and military personnel handling classified conversations off-base
If you fall into one of these categories, the combination of disabled 2G, encrypted messaging, physical camera covers, and a Faraday bag for high-risk moments covers the majority of the practical threat.
The bottom line on Stingray surveillance
Cell site simulators are not science fiction and they are not rare. They are commercially available hardware, widely deployed by law enforcement and intelligence agencies, and increasingly by unauthorized operators in major US cities. Modern network protocols have narrowed some attack surfaces, but not enough that anyone handling sensitive information should assume the problem is solved.
The right response is layered: encrypt your communications, harden your OS settings, cover your cameras with hardware you control, and when the situation demands it, take the phone off the network entirely with a shielded enclosure. Explore the Spy-Fy privacy cases collection for hardware-level camera protection built for professionals who work under real surveillance risk.
