Cell-Site Simulators
How Stingrays and other cell-site simulators identify and locate mobile devices, why the technology differs from carrier-provided location records, what information may be collected from nearby non-target devices, and what agencies should understand about warrants, probable cause, particularity, minimization, disclosure, emergency use, and the Fourth Amendment.
What this explainer does
A cell-site simulator is law-enforcement technology that transmits signals resembling those of a cellular base station. Nearby phones or other cellular devices may respond to the simulator as they would to legitimate cellular infrastructure.
Investigators can use those interactions to help identify an unknown cellular device or, when a target device's identifying information is already known, help determine its location.
The technique is powerful because investigators interact directly with devices in the physical vicinity rather than simply requesting existing historical records from a wireless carrier. That distinction creates important Fourth Amendment, statutory, privacy, technical, and evidentiary issues.
“StingRay” originally referred to a particular product. The term is now frequently used informally for the broader category of technology known as cell-site simulators or IMSI catchers.
Different systems and generations of equipment can have different capabilities. Agencies should describe the actual device and configuration used rather than assuming that every “Stingray” operates identically.
1. Overview
A cell-site simulator creates a temporary law-enforcement-controlled cellular signaling environment that can cause nearby mobile devices to identify themselves to the simulator.
Cellular phones routinely communicate with network infrastructure even when a user is not actively making a call. Those signaling exchanges allow cellular networks to identify devices and maintain connectivity.
A cell-site simulator takes advantage of that basic architecture. By presenting itself as attractive cellular infrastructure, the simulator can induce nearby devices to interact with it.
Investigators may then distinguish a target device from other devices in the area and use signal characteristics and repeated measurements to narrow the target's location.
2. How Cell-Site Simulators Work
Why the Phone Responds
Cellular devices are designed to locate and communicate with available network infrastructure. A properly configured simulator can present itself in a manner that causes compatible devices in the vicinity to respond.
The resulting signaling information can reveal identifying information associated with devices and provide measurements useful in distinguishing and locating the target.
Directional and Signal Measurements
Depending on the equipment, network technology, configuration, environment, and investigative procedure, operators may use relative signal strength, direction, repeated measurements, movement, or other signaling characteristics to narrow the target's location.
3. IMSI, IMEI, and Other Device Identifiers
Understanding cell-site simulators requires distinguishing a phone number from the identifiers used by cellular networks.
The familiar number used to address calls or messages. It is not necessarily the identifier the simulator uses to distinguish a cellular device.
International Mobile Subscriber Identity. An identifier associated with a cellular subscriber identity, traditionally linked to the SIM or equivalent subscriber credentials.
International Mobile Equipment Identity. An identifier generally associated with the handset or cellular equipment rather than the subscriber account.
4. Principal Investigative Uses
Investigators who already possess a target identifier may use the simulator to narrow the physical location of that particular device.
Investigators may compare device identifiers observed in a relevant area to determine which cellular device is associated with a person or location of interest.
The technique may help locate a wanted person when investigators know the cellular device associated with that person.
In appropriate emergency circumstances, device-location technology can be relevant to locating a victim or endangered person.
Investigators may seek a device believed to constitute evidence or to lead to other evidence of an offense.
In some investigations, cellular signaling may help corroborate whether a target device is present within a particular area.
5. What a Cell-Site Simulator Does — and Does Not Automatically Mean
Cell-site simulators are frequently described imprecisely. Several distinctions are particularly important.
| Claim | Better Explanation |
|---|---|
| “It taps the suspect's phone.” | The ordinary locating function involves cellular signaling used to identify or locate a device. That is analytically different from intercepting the content of calls or text messages. |
| “It gets GPS from the phone.” | Cell-site simulator location techniques should not automatically be characterized as obtaining the phone's GPS coordinates. The technology generally relies on cellular radio interaction and related measurements. |
| “It only communicates with the suspect's phone.” | Nearby non-target devices may also respond to the simulated cell site, which creates important minimization and deletion obligations. |
| “It is the same as CSLI.” | CSLI generally refers to information generated through a device's interaction with legitimate cellular infrastructure and commonly obtained from the carrier. A simulator is government-deployed equipment. |
| “It identifies the person holding the phone.” | Locating a device does not by itself establish who physically possesses it at a particular moment. |
| “Finding the phone proves the crime.” | Device location is one evidentiary fact. Identity, possession, knowledge, intent, and criminal conduct normally require additional proof. |
6. Cell-Site Simulator vs. Other Location Technologies
| Technique | Who Generates / Holds the Information? | Typical Investigative Function |
|---|---|---|
| Cell-Site Simulator | Government-deployed equipment interacts with nearby cellular devices | Identify or refine the location of a cellular device |
| Historical CSLI | Wireless carrier records resulting from prior network interactions | Reconstruct historical device location over time |
| Prospective Carrier Location | Carrier provides current or future network-derived location information | Track or locate a known device through provider assistance |
| GPS Tracker | A tracking device itself determines or reports location | Track movement of a vehicle, object, or device |
| Geofence Search | A provider or database is searched for devices associated with a place and time | Identify previously unknown candidate devices |
| Tower Dump | Carrier provides records associated with devices communicating with specified cell sites | Identify devices associated with a particular tower during a period |
7. The Non-Target Device Problem
A major privacy issue is that the simulator operates within a physical area that may contain many phones unrelated to the investigation.
The equipment may therefore receive signaling information associated with devices belonging to residents, employees, customers, visitors, motorists, bystanders, or other uninvolved people before the system distinguishes the target.
Nearby devices may communicate with the simulator even though their users have no relationship to the investigation.
Simulator operation can potentially create temporary interference or disruption affecting devices in the vicinity.
Retaining non-target identifiers after they are no longer needed creates privacy and governance risks independent of the initial deployment.
8. When the Signal Leads to a Home
Cell-site simulators raise especially significant Fourth Amendment issues when investigators use the technology to determine that a device is located inside a residence.
Traditional carrier information might narrow a phone to a neighborhood or area. A simulator may allow investigators to progressively narrow the device's position and associate it with a particular structure or even a more specific area.
The constitutional concern becomes particularly strong when technology enables police to learn information about what is occurring inside a home that could not otherwise be determined through ordinary observation from a lawful public vantage point.
9. Fourth Amendment Framework
Courts analyzing cell-site simulators have focused on the privacy implications of government-created cellular interaction, precise location tracking, intrusion into private spaces, and the fact that the technology can cause a person's phone to reveal information without any affirmative action by the user.
Reasonable Expectation of Privacy
A key question is whether a person reasonably expects that the government will not use a device carried on the body to determine his or her location through direct, technology-induced cellular interaction.
Kyllo and Technology Directed at the Home
The Supreme Court's decision in Kyllo v. United States remains an important conceptual reference point when technology enables police to obtain information regarding the interior of a home that could not otherwise be obtained without physical intrusion.
Carpenter and Digital Location Privacy
Carpenter v. United States concerned historical CSLI rather than a cell-site simulator. But Carpenter's treatment of cellular location information as capable of revealing highly private information has become part of the broader constitutional landscape governing digital location surveillance.
10. Important Cell-Site Simulator Cases
| Case | Court / Year | Key Point |
|---|---|---|
| State v. Andrews | Maryland Court of Special Appeals, 2016 | Major state appellate decision treating use of a cell-site simulator to locate a phone as a Fourth Amendment search and emphasizing the need for constitutionally adequate judicial authorization. |
| United States v. Lambis | S.D.N.Y., 2016 | Federal district court suppressed evidence after agents used a cell-site simulator to determine that a target phone was located inside a particular apartment without a warrant specifically authorizing that technique. |
| Jones v. United States | D.C. Court of Appeals, 2017 | Court concluded that warrantless use of a cell-site simulator to locate the defendant's phone violated the Fourth Amendment. |
| State v. Copes | Maryland Court of Appeals, 2017 | Maryland's high court resolved the case through the good-faith exception rather than definitively deciding the underlying constitutional questions. |
| State v. Sylvestre | Florida Fourth District Court of Appeal, 2018 | Court affirmed suppression associated with warrantless cell-site simulator use where the prior CSLI authorization did not adequately authorize the more precise simulator technique. |
11. Department of Justice Policy
In 2015, the U.S. Department of Justice adopted department-wide policy governing cell-site simulator use in domestic criminal investigations.
Although DOJ policy does not itself establish the constitutional rule governing every state or local agency, it provides a useful risk-management benchmark.
DOJ policy generally requires agents to obtain a search warrant supported by probable cause before deploying a cell-site simulator.
Warrant applications should disclose that investigators intend to use cell-site simulator technology.
The policy does not authorize use of the covered technology to collect the contents of communications.
Data collected during use is subject to deletion requirements designed to prevent unnecessary retention.
Deployment is subject to approval, management, training, and oversight requirements.
DOJ policy contemplates auditing to ensure compliance with required data-handling practices.
12. Emergency and Exigent Uses
Cell-site simulator technology may be particularly valuable when police are trying to locate a kidnapped person, endangered missing person, fleeing violent suspect, or another person involved in circumstances presenting an immediate threat to life or safety.
But the existence of an emergency-use capability does not eliminate constitutional limits. The exigent-circumstances doctrine is fact specific, and statutes or agency policies may impose additional requirements.
What specific facts establish an immediate danger of death, serious injury, escape, or destruction of critical evidence?
Could investigators reasonably obtain judicial authorization without materially increasing the danger?
Does state law or policy require prompt judicial review, documentation, reporting, or deletion following emergency deployment?
13. Cell-Site Simulator Warrant Checklist
A strong application should tell the issuing judge what technology will actually be used and what the deployment will actually do.
| Element | What the Application Should Explain |
|---|---|
| Offense | The crime under investigation and facts establishing probable cause. |
| Target person | Identity of the target, if known, and connection to the investigation. |
| Target device | Telephone number and available subscriber, device, IMSI, IMEI, or other identifying information. |
| Device nexus | Facts supporting the conclusion that the target person possesses or uses the device. |
| Technology disclosure | Expressly state that investigators intend to deploy a cell-site simulator. |
| How it works | Provide an accurate description of the simulator's relevant operation without relying on misleading or obsolete terminology. |
| Information sought | Specify what signaling or identifying information investigators seek and what they do not intend to collect. |
| Location function | Explain how the technology will be used to narrow or identify the target's location. |
| Deployment area | Describe the anticipated geographic area and whether homes or other sensitive locations may be involved. |
| Duration | Specify the authorized deployment period and any renewal procedure. |
| Non-target devices | Explain that nearby devices may interact with the simulator and describe safeguards for unrelated information. |
| Minimization | Describe measures limiting collection, use, retention, and disclosure of non-target information. |
| Deletion | State when non-target information and operational data will be permanently deleted where required. |
| Service effects | Describe any material possibility of temporary interference with cellular service and procedures intended to minimize it. |
| Return / documentation | Identify what records of deployment, results, and execution will be maintained or returned to the court. |
14. Minimization and Data Handling
Because a simulator may interact with non-target devices, minimization should be designed into the deployment rather than addressed only after litigation.
Configure and operate the system to collect no more information than technically and operationally necessary to accomplish the authorized purpose.
Restrict simulator operation and access to collected information to trained personnel with an investigative need.
Do not repurpose unrelated device identifiers or information for secondary investigations without independent legal authority.
Establish short and clearly defined retention rules for non-target information.
Define whether raw simulator results can be exported and under what circumstances.
Use system logs, audit procedures, or supervisory review to verify that required deletion actually occurred.
15. Reports, Discovery, and Disclosure
Secrecy surrounding early cell-site simulator programs created substantial litigation risk. Agencies should distinguish legitimate protection of sensitive technical details from failure to disclose the existence or material use of the technology.
Warrant Disclosure
The issuing judge should receive an accurate explanation sufficient to understand the nature and scope of the requested search.
Police Reports
Reports should document the investigative use of the simulator with enough accuracy to preserve the chronology, legal authority, operational result, and evidentiary chain.
Prosecutor Disclosure
Prosecutors should know that the technology was used so that discovery, suppression, authentication, expert, and disclosure obligations can be evaluated.
Nondisclosure Agreements
Vendor, federal, or interagency confidentiality provisions should never be treated as authority to conceal material information from a court or to disregard binding discovery or disclosure requirements.
16. Agency Governance Framework
Establish a dedicated policy addressing authorized purposes, warrants, emergencies, supervision, retention, and reporting.
Require command-level and appropriate legal or prosecutorial approval before routine deployment.
Restrict operation to personnel trained in the equipment, cellular concepts, legal limits, and evidentiary requirements.
Document the manufacturer, model, software, supported networks, capabilities, upgrades, and material configuration changes.
Use agency-approved warrant language that accurately identifies the technology and is updated as law changes.
Define who can authorize emergency use, documentation requirements, and deadlines for subsequent judicial review where applicable.
Establish specific restrictions on acquisition, access, use, retention, export, and deletion of uninvolved-device information.
Preserve records showing deployments, operators, authorization, searches, exports, configuration changes, and deletion.
Establish procedures for informing prosecutors when simulator-derived information contributes to an investigation.
Identify what records, logs, training materials, reports, or technical information may become discoverable.
Monitor federal and state constitutional decisions, statutes, court rules, and local restrictions.
Reevaluate policy whenever hardware, software, network architecture, or analytical capabilities materially change.
17. Questions Every Agency Should Answer
18. The Future of Cell-Site Simulation
Cell-site simulator doctrine cannot be separated from changes in cellular technology. Modern wireless networks increasingly use stronger authentication, encrypted signaling, multiple radio technologies, virtualized infrastructure, and rapidly evolving device protocols.
New network architecture can change which identifiers are exposed and how simulator equipment interacts with devices.
Cellular standards increasingly attempt to reduce exposure of permanent subscriber identifiers.
Phones may simultaneously rely on cellular, Wi-Fi, Bluetooth, satellite, and other location-relevant technologies.
Advances may permit more targeted or portable deployment while simultaneously increasing precision.
Device-location results may increasingly be combined with ALPR, video, facial recognition, digital records, or other investigative systems.
Modern systems should make it easier to record searches, configurations, operator activity, exports, and deletion events.
19. Key Terms
20. Related ShieldPST.ai Resources
Supreme Court treatment of historical CSLI and the privacy implications of cellular location information.
Read case analysis →GPS tracking, physical trespass, and the constitutional significance of persistent location surveillance.
Read case analysis →Reverse-location searching, digital location databases, and the post-Chatrie Fourth Amendment framework.
Open explainer →Networked vehicle detection, historical movement databases, and investigative searching.
Open resource →Research Fourth Amendment cases addressing digital surveillance, location tracking, searches, and emerging police technology.
Browse case library →Return to the Shield Technology Reference Library.
Browse explainers →21. Selected Primary Sources
Department-wide policy describing how the technology functions, the general probable-cause warrant requirement, warrant disclosures, privacy protections, deletion requirements, supervision, and emergency exceptions.
Read DOJ policy
Significant appellate decision holding that warrantless cell-site simulator use to locate the defendant's cellular phone violated the Fourth Amendment.
Major state appellate decision addressing how cell-site simulators function, expectations of privacy, judicial authorization, and the constitutional implications of using a phone as a real-time location beacon.
Maryland high-court decision addressing simulator use and resolving suppression through the good-faith exception while discussing the developing constitutional framework.
Federal district-court decision suppressing evidence following use of a cell-site simulator to locate a target phone within a particular apartment without sufficiently specific warrant authority.
Florida appellate decision addressing the distinction between carrier-derived cellular location authority and the more precise use of a cell-site simulator.
Supreme Court decision addressing historical CSLI and the Fourth Amendment significance of detailed cellular location information.
Read Supreme Court opinion
Supreme Court decision addressing technology-assisted acquisition of information concerning the interior of a home.
Review decision
22. Key Takeaways
- A cell-site simulator is government-deployed equipment that transmits cellular signaling resembling legitimate network infrastructure.
- The technology can be used to identify an unknown cellular device or help locate a known target device.
- Cell-site simulator use is fundamentally different from simply obtaining historical CSLI or other records already maintained by a wireless carrier.
- “StingRay” is commonly used as shorthand, but different models and generations of cell-site simulators may have materially different capabilities.
- Nearby non-target devices may interact with the simulator, making minimization, access limits, deletion, and auditing central governance issues.
- Courts have recognized significant Fourth Amendment concerns when police use simulator technology to locate a person's phone, particularly when the technique reveals that the device is inside a home.
- DOJ policy generally requires federal agents to obtain a probable-cause search warrant before deployment, subject to limited exceptions.
- A warrant application should expressly disclose use of a cell-site simulator and accurately explain what information the equipment will obtain.
- Pen-register, CSLI, or generic cellular-location authorization should not automatically be assumed to authorize a cell-site simulator.
- Agencies should establish written rules governing emergency use, non-target information, deletion, operator training, supervision, audit logs, prosecutor notification, discovery, and technology upgrades.
- State constitutions and statutes may impose protections exceeding the federal constitutional floor.
- As cellular networks and simulator technology evolve, agencies should periodically reassess whether older warrants, policies, training materials, and judicial decisions still accurately address current capabilities.