What is an IMSI catcher? Fake cell towers and surveillance

What is an IMSI catcher? The question surfaces whenever there is news of phones being spied on near a parliament, or of soldiers receiving threatening texts on the front line. The short answer: it is a device that poses as a legitimate cell tower so that nearby phones connect to it and give away who they are. To make sense of that, it helps to start with something more mundane — how the network knows, at every moment, where your phone is.

Like the rest of our cybersecurity coverage, this is a descriptive and historical piece. It explains the phenomenon, the public cases and the legal framework — not how to build or use such equipment.

How does the network know where a phone is?

A switched-on phone is in constant conversation with the network, even when nobody is using it. It registers with the base station — the 'tower' — offering the best signal, and checks in when it moves to a new area so that calls and messages can reach it. That is why the operator always knows which cell each handset is in.

Precision varies widely: in the countryside a cell may cover several kilometres; in a dense city, just a few blocks. Records of those connections are kept for a period and, in most countries, can be handed to courts and police under legal safeguards. In the EU, how long such data may be retained has been the subject of repeated rulings by the Court of Justice.

IMSI vs IMEI: what's the difference?

• IMSI (International Mobile Subscriber Identity): the number that identifies the subscriber, stored on the SIM card.
• IMEI (International Mobile Equipment Identity): the number that identifies the physical handset.
• Swap the SIM and the IMSI changes but the IMEI does not; swap the phone and the opposite happens. That is why investigators tend to cross-reference both.

What does an IMSI catcher actually do?

An IMSI catcher — also called a fake base station or cell-site simulator — mimics a legitimate tower. Nearby phones, designed to latch on to the most convenient signal, may connect to it and hand over their identifiers. That can show which phones are in a given place, confirm whether a particular one is present, or follow it as it moves. Some devices, particularly against older networks, have also been described as able to intercept communications.

The best-known name is Stingray, a product line from the US firm Harris Corporation that became shorthand for the whole category in the United States.

Why do they work? It depends on the generation

The underlying weakness is historical. Mobile networks were designed when the priority was for the phone to prove its identity to the network, not the other way round. Each generation has fixed part of the problem, though researchers still argue about how much.

Who uses IMSI catchers?

Police and intelligence agencies

In the United States, the civil liberties group ACLU has documented their use by dozens of federal, state and local agencies. For years that use was kept quiet: court cases revealed non-disclosure agreements that local police signed with the FBI. In 2015 the Justice Department adopted a policy requiring its agencies, as a general rule, to obtain a warrant before using a cell-site simulator.

Other democracies regulate the practice in their own way. Spain, for example, amended its criminal procedure code in 2015 to allow police, during an investigation, to use technical means to capture a handset's identifying codes — such as the IMSI or IMEI — before asking a judge to authorise interception.

Espionage in capital cities

IMSI catchers are also a counter-intelligence worry. In December 2014 the Norwegian newspaper Aftenposten reported detecting signals consistent with fake base stations near parliament and the prime minister's office in Oslo. In 2018 the US Department of Homeland Security told Senator Ron Wyden it had observed anomalous activity in Washington consistent with such devices, without being able to attribute it.

Cell towers in wartime

In a conflict the mobile network is at once civilian infrastructure, an intelligence source and a propaganda channel. The war in Ukraine shows all three.

• Texts to the front: from 2014, Ukrainian soldiers in the Donbas reported receiving intimidating text messages. Western analysts linked them to Russian electronic warfare systems such as the Leer-3, which Russia has displayed publicly and which pairs drones with airborne base stations.
• Towers as targets: strikes on the power grid knock many base stations off air. In 2022 Ukrainian operators switched on national roaming so customers could hop between networks.
• Cyberattacks: in December 2023 an attack on Kyivstar, Ukraine's largest operator, cut mobile service for millions of people. Ukraine's security service attributed it to Sandworm, a group linked to Russian military intelligence.

The military lesson echoes that of radio direction finding: a phone is a transmitter, and a transmitter that connects to an unknown or hostile network may reveal far more than its owner realises.

What limits their use?

• Technology: 5G conceals the subscriber's permanent identifier, and operators can monitor their networks for anomalies.
• Law: in democracies, communications surveillance generally requires judicial authorisation and proportionality.
• Collateral capture: these devices also sweep up the phones of bystanders, which fuels the privacy debate.