L3Harris StingRay

Technical capabilities

StingRay and its successors are cell-site simulators, also known as IMSI catchers. They impersonate legitimate cellular base stations and force nearby mobile devices to connect, allowing the operator to identify devices by their International Mobile Subscriber Identity (IMSI), International Mobile Equipment Identity (IMEI), location, and depending on configuration, intercept metadata and force downgrade attacks against 2G and 3G connections.

Hailstorm extends StingRay capabilities to LTE networks. Public technical analysis of the exact capability set is limited because L3Harris customer agreements include non-disclosure clauses that restrict even court testimony, a practice criticized in multiple US judicial opinions.

Documented use

ACLU FOIA work identified more than 75 US federal, state, and local agencies operating cell-site simulators as of mid-2018. Confirmed federal operators include the FBI, US Secret Service, US Marshals Service, US Drug Enforcement Administration, US Immigration and Customs Enforcement and Department of Defense components. Confirmed state and local operators include New York Police Department, Los Angeles Police Department, Maryland State Police, Florida Department of Law Enforcement and many others.

Documented use cases extend beyond targeted criminal investigations. Reuters and ACLU reporting between 2014 and 2019 demonstrated routine use at the US-Mexico border, at large public events, and during protests. The September 2020 Department of Homeland Security Inspector General report concluded that ICE had operated cell-site simulators without consistent legal-process compliance.

Customer states

Public reporting identifies confirmed StingRay-family deployments in the United States, Canada, Australia, the United Kingdom, Israel, and reported in unspecified Middle Eastern and Asian states. Export is restricted under US ITAR and EAR. Bahrain, Saudi Arabia, the United Arab Emirates and other authoritarian states have been documented as customers of comparable IMSI catchers from other vendors.

Legal and sanctions status

• Not on the US Department of Commerce Entity List.
• US Department of Justice policy (September 2015): warrant required for federal cell-site simulator use absent specific exceptions.
• Carpenter v. United States (June 22, 2018, US Supreme Court): historical cell-site location information requires a warrant. Indirectly relevant to ongoing cell-site simulator jurisprudence.
• State laws in California (SB-741, 2015), Washington, Utah, Virginia and others impose warrant or notice requirements.
• L3Harris customer non-disclosure clauses have been litigated, with mixed outcomes.

Technical countermeasures

• 5G Standalone (SA): deployment of 5G SA on a modern device blocks the most common downgrade-to-2G attacks. Verify your carrier and handset support SA, not only non-standalone.
• Disable 2G in handset settings: Android (Settings, Network, Allowed network types: LTE/5G only). iOS does not natively expose this control. GrapheneOS exposes a 2G toggle.
• Airplane mode in sensitive contexts: protests, sensitive meetings, border crossings. Cellular off plus Wi-Fi off plus Bluetooth off.
• Faraday-bag transport: for confiscation or seizure scenarios.
• Burner device with separate SIM: compartmented identity in high-risk situations.
• Network identifier monitoring: research apps (CellSpy, AIMSICD on Android) provide indication of suspicious base-station activity. Reliability is partial. Treat as awareness, not authoritative detection.

There’s no perfect setup. Anyone selling you perfect is selling fear. The goal is simple: make yourself a harder target than the person next to you.