Detecting Covert Cellular Surveillance: Rayhunter‘s global Findings & Future Directions
The use of cellular site simulators (CSS), often referred too as “Stingrays” or “IMSI catchers,” remains a significant privacy concern. At the Electronic Frontier Foundation (EFF), we’ve been actively tracking their deployment through Rayhunter, a tool designed to detect these devices. This report details recent findings, ongoing concerns, and our push for broader international monitoring.
Beyond Protests: Emerging CSS Activity
while initial concerns focused on CSS use during protests, our data reveals activity in unexpected locations. Rayhunter users recently identified potential CSS operation at a cruise port in the Turks and Caicos Islands, with detailed packet captures now available for public research (https://github.com/ZeroChaos-/rayhunter-traces). This highlights that surveillance isn’t limited to demonstrations.
We’ve also received reports from Chicago and New York City. These triggered our “IMSI Sent without authentication” signature multiple times over a short period before ceasing.While lacking definitive secondary evidence, we believe these incidents strongly suggest the presence of a CSS.
These findings underscore a crucial point: CSS deployment patterns are dynamic and geographically varied.
Continued US Surveillance & Recent Legal Challenges
Law enforcement agencies continue to utilize CSS technology within the United States. Fontana, California, for example, reportedly used their CSS over 300 times in just two years (https://www.documentcloud.org/documents/24733508-2024_ma-state-police_css-proposal_jacobs/?mode=document#document/p14).
Moreover, U.S. immigration and Customs Enforcement (ICE) continues to renew contracts for CSS technology (https://www.forbes.com/sites/the-wiretap/2025/09/09/how-ice-is-using-fake-cell-towers-to-spy-on-peoples-phones/).Interestingly, the FBI recently attempted to obtain a warrant to use a CSS through the Foreign Intelligence Surveillance Court (FISC) – and was denied (https://www.intelligence.gov/ic-on-the-record-database/declassified/odni-releases-january-2025-fisc-opinion-on-fisa-title-i). This marked the first such request since 2015, when warrant requirements were established.
We remain vigilant. If you observe potential CSS activity during protests or othre public gatherings, reporting it is indeed critical.
Expanding Rayhunter’s Reach: A Call for International Collaboration
Our current data is heavily skewed towards the United States. To build a comprehensive understanding of global CSS deployment, we urgently need data from other countries. CSS usage patterns likely differ substantially worldwide.
Furthermore, signatures effective in the US can produce false positives in regions with different cellular infrastructure – especially those still utilizing 2G networks.
Rayhunter now supports a growing list of devices (https://efforg.github.io/rayhunter/supported-devices.html). If you don’t see a compatible device for yoru country, please let us know (https://efforg.github.io/rayhunter/support-feedback-community.html).
Critically important Legal Disclaimer: Before deploying Rayhunter in any country, we strongly advise consulting with legal counsel to determine the legality of such activity within that jurisdiction. Laws regarding signal interception and privacy vary significantly.
We are actively developing new features for Rayhunter and are excited to share our progress soon. Though, expanding our international data collection