An IMSI catcher is a surveillance device that pretends to be a cell tower so that every mobile phone within range connects to it instead of the real network, handing over unique identifiers and location data in the process. The best-known brand name is Stingray, made by L3Harris Technologies. Federal agents have been required to get a probable cause warrant before using one since 2015, and the Department of Justice reaffirmed that requirement in an interim policy update issued in December 2023.1U.S. Department of Justice. Use of Cell-Site Simulator Technology Private use by anyone else is a federal crime under several overlapping statutes.
How It Works
Your phone is designed to lock onto whichever cell signal nearby looks strongest and most legitimate. An IMSI catcher takes advantage of that by broadcasting a signal that beats the real towers in the area. The phone disconnects from your carrier and connects to the simulator with no notification, no prompt, and no indication anything changed. Every phone in range does the same thing at the same time.
The operator sits between the phone and the real network in what security researchers call a man-in-the-middle setup. Your phone thinks it’s talking to a normal tower. The real network thinks the simulator is a normal phone. The simulator passes traffic between the two while monitoring everything that moves through it. The hardware can be run from an unmarked vehicle, from inside a neighboring building, or from a small aircraft overhead.
The 2G Downgrade That Makes Interception Possible
Modern 4G and 5G networks use encryption that makes unauthorized interception difficult, so the simulator forces the target phone off its secure connection and onto the much older 2G (GSM) protocol. There are a few ways to do this. The device posing as a tower can simply request a protocol downgrade in its configuration. The operator can jam 4G and 5G frequencies with noise, leaving 2G as the only option. Or the simulator can send a rejection message telling the phone that LTE service is unavailable, which causes the phone to delete its LTE connection data and hunt for an older network until it reboots.
Once the phone is on 2G, interception is straightforward. GSM networks don’t require mutual authentication, so the phone never verifies that the tower it’s connecting to is real. Even when 2G encryption is on, it uses algorithms that can be broken in real time. The simulator can also tell the phone that it doesn’t support encryption at all, which means voice calls, text messages, and other data travel in plaintext.
What an IMSI Catcher Captures
The primary harvest is identity. Every SIM card carries an International Mobile Subscriber Identity, or IMSI, that identifies you to your carrier. The phone hardware itself carries a separate International Mobile Equipment Identity, or IMEI. Collecting both lets law enforcement confirm that a specific person’s phone is present in a specific area without ever involving the carrier.
Location work goes beyond “in the area.” By measuring signal strength and return time, the operator can triangulate a device down to a particular room in a building or a specific vehicle in a parking lot. Advanced configurations capture metadata like the numbers dialed for outgoing calls. After a successful 2G downgrade, high-end models can intercept the audio of a call or the text content of messages. Whether a given deployment stops at identifiers or reaches into content depends on the model and how the operator configures it.
Why Everyone Nearby Gets Swept In
An IMSI catcher cannot target one phone. Every device in range connects and surrenders its identifiers. In a dense urban deployment, that can mean hundreds or thousands of uninvolved people have their data collected.
DOJ policy addresses this with deletion timelines. When a simulator is used to identify an unknown device, all data must be deleted once the target is identified, and at minimum every 30 days. When the device is used to locate a known phone, all data must be deleted as soon as that phone is found, and at minimum once daily. Before any new deployment, the operator has to verify that the equipment has been cleared of previous data.2Department of Justice. Department of Justice Policy Guidance: Use of Cell-Site Simulator Technology A growing number of states have passed their own statutes requiring warrants and the destruction of bystander data, sometimes on faster timelines than the federal rules.
The Warrant Rules
Courts have increasingly treated IMSI catcher use as a Fourth Amendment search that requires a warrant.3Legal Information Institute. Fourth Amendment For years, federal agents sidestepped that by relying on the Pen Register and Trap and Trace Statute, which only required a certification that the information sought was “relevant to an ongoing criminal investigation.”4Office of the Law Revision Counsel. 18 U.S. Code 3121 – General Prohibition on Pen Register and Trap and Trace Devices That bar is far lower than probable cause.
In September 2015, the DOJ issued a policy requiring federal agents to obtain a search warrant supported by probable cause before using a cell site simulator, with the warrant describing the place to be searched and the items to be seized with specificity.5U.S. Department of Justice. Justice Department Announces Enhanced Policy for Use of Cell-Site Simulators The December 2023 interim update kept the warrant requirement in place and continued to require both a search warrant and a pen register order before deployment.1U.S. Department of Justice. Use of Cell-Site Simulator Technology
The Supreme Court’s 2018 decision in Carpenter v. United States reinforced the constitutional ground. The Court held that individuals maintain a legitimate expectation of privacy in their physical movements as captured through cell-site location information, and that the government generally needs a warrant to obtain those records.6Supreme Court of the United States. Carpenter v. United States An important limit: Carpenter addressed historical location records held by wireless carriers, and the Court explicitly declined to rule on real-time tracking or tower dumps. Lower courts have applied the reasoning to IMSI catcher cases anyway. When a simulator is used without a proper warrant, evidence it produces is subject to suppression.
Policy carves out limited exceptions. Agents can deploy without a warrant in exigent circumstances, meaning someone is in immediate danger, such as a kidnapping or an active threat to life. The possibility that a suspect might flee does not by itself qualify. A second category covers exceptional circumstances where the law doesn’t require a warrant and getting one would be impracticable.5U.S. Department of Justice. Justice Department Announces Enhanced Policy for Use of Cell-Site Simulators Searches for a missing or suicidal person often fall into a separate category that department policies treat as not requiring a warrant, because the purpose is rescue rather than evidence gathering.
Why Defendants Often Never Hear About It
Agencies that buy these devices sign non-disclosure agreements with the FBI and with L3Harris. The FBI’s standard agreement prohibits the agency from disclosing anything about the technology’s capabilities in court proceedings, including search warrant affidavits, discovery, grand jury hearings, and trial testimony, without prior written FBI approval.
The practical effect is severe. The NDAs instruct agencies to seek dismissal of a case rather than risk disclosing how the technology works. Prosecutors have dropped key evidence or offered favorable plea deals specifically to avoid being ordered by a judge to explain their surveillance methods. In some cases, police have described the source of their information as a “confidential informant” or an “anonymous tip” rather than reveal that a simulator was used. Defendants may never learn one was deployed in their case, which makes challenging the legality of the search close to impossible.
Federal Penalties for Private Use
Operating an IMSI catcher outside of authorized law enforcement use is a federal crime under several statutes at once. The DOJ has stated that any private use of a cell site simulator is inconsistent with federal law. A single unauthorized deployment can trigger charges under more than one of these provisions.
- Wiretap Act (18 U.S.C. § 2511): intercepting electronic communications without authorization carries up to five years in federal prison and fines up to $250,000.7Office of the Law Revision Counsel. 18 U.S. Code 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Prohibited
- Surveillance Device Statute (18 U.S.C. § 2512): manufacturing, assembling, possessing, or selling a device primarily useful for surreptitious interception of communications carries up to five years.8Office of the Law Revision Counsel. 18 USC 2512
- Pen Register Statute (18 U.S.C. § 3121): using a pen register or trap and trace device without authorization is punishable by up to one year.4Office of the Law Revision Counsel. 18 U.S. Code 3121 – General Prohibition on Pen Register and Trap and Trace Devices
- Communications Act (47 U.S.C. § 301): operating a radio transmission device without an FCC license is illegal, and no private entity can lawfully operate something that mimics a cell tower. Criminal violations carry up to one year for a first offense and up to two years for a second, with fines up to $10,000.9Office of the Law Revision Counsel. 47 USC 501 – General Penalty
- Radio Interference (47 U.S.C. § 333): willfully interfering with licensed radio communications, which is exactly what a simulator does when it jams legitimate cell signals, is separately prohibited.10Office of the Law Revision Counsel. 47 USC 333
Does 5G Fix This?
The 5G standard was designed with IMSI catchers in mind. On older networks, your phone transmits its permanent identity in plain text during the initial connection, which is exactly what a catcher harvests. Under 5G, the permanent identifier (now called the SUPI) is encrypted using the carrier’s public key before transmission. The encrypted version, called the SUCI, can only be decrypted by your home carrier. An eavesdropper intercepting the SUCI cannot extract the real identity from it. 5G also uses temporary identifiers for subsequent connections, which avoids repeated transmission of even the encrypted identity.
In practice, the protection has significant holes. SUPI encryption is optional, and carriers can choose not to enable it. Researchers have demonstrated a “SUCI-Catcher” attack that can confirm whether a specific known subscriber is nearby even when encryption is active, by exploiting weaknesses in the authentication handshake. And as long as a phone still supports 4G or 2G, an attacker can jam 5G and force a downgrade to an older protocol where the traditional attack works perfectly. True 5G-only networks, where downgrade attacks are impossible, remain years away from widespread deployment.
How to Protect Your Phone
No consumer tool fully prevents an IMSI catcher from interacting with your phone, but you can close the vulnerability that makes content interception possible: the 2G downgrade.
On Android devices running version 12 or later, you can disable 2G at the hardware level. The setting is typically found under Settings → Network & Internet → SIMs → Allow 2G. Turning it off stops your phone from connecting to 2G networks entirely, which blocks the downgrade attack. Emergency calls still work; the phone will connect to 2G for 911.11Android Open Source Project. Disable 2G Apple added a similar protection in iOS 17 under Settings → Cellular → the relevant SIM → Voice & Data, where you can select a mode that excludes 2G. Both features address the same vulnerability from different interfaces.
Detection apps exist for Android that try to identify suspicious cell towers by watching signal strength anomalies, tower identifier consistency, and unusual protocol downgrades. They produce false positives regularly and cannot definitively confirm a simulator’s presence. Professional-grade detection equipment costs tens of thousands of dollars and isn’t practical for everyday use. Disabling 2G remains the single most effective step an ordinary person can take.