For more than a decade, law enforcement agencies across the United States deployed cell-site simulators — devices that impersonate cell towers to force nearby phones to connect and reveal their location — without obtaining warrants. The FBI required local police to sign nondisclosure agreements that instructed them to withhold information about the technology from courts, prosecutors, and defense attorneys. When judges asked how police located suspects, officers cited confidential informants or routine investigation rather than admitting they used Stingrays. The practice continued until 2015, when the Department of Justice finally issued a warrant requirement.
On a summer morning in 2008, police in a major American city received a tip about a suspect's location. Within hours, officers had pinpointed the target's apartment — not through traditional stakeouts or informants, but using a suitcase-sized device that impersonated a cell tower. The equipment, manufactured by Harris Corporation and marketed under the brand name StingRay, forced every cell phone within range to connect to it, revealing their unique identification numbers and locations. The suspect was arrested. The technology was never mentioned in court documents.
This scenario played out thousands of times across the United States between the early 2000s and 2015. Law enforcement agencies deployed cell-site simulators — also called IMSI catchers, after the International Mobile Subscriber Identity number they capture — in investigations ranging from murder to stolen cell phones. The devices operated in a legal gray zone, used routinely without warrants and hidden from judges, prosecutors, and defense attorneys under nondisclosure agreements mandated by the Federal Bureau of Investigation.
The secrecy was deliberate and systematic. FBI contracts with Harris Corporation required that any law enforcement agency purchasing Stingray equipment sign nondisclosure agreements prohibiting disclosure of the technology's existence or capabilities. When defense attorneys questioned how police located their clients, prosecutors attributed the discoveries to confidential informants or "routine investigative techniques." In jurisdictions from Florida to New York, prosecutors dropped serious criminal charges rather than reveal Stingray use in open court.
Cell phones continuously search for the strongest signal from nearby cell towers. A Stingray exploits this by broadcasting a signal more powerful than legitimate towers, causing phones in the area to connect to it instead. Once connected, the phone transmits its IMSI number — a unique identifier tied to the device and SIM card — along with its location. The Stingray then typically forwards the connection to an actual tower, acting as an intermediary while collecting data.
The technology raises three critical issues that distinguish it from conventional surveillance. First, Stingrays conduct active searches, forcing phones to reveal information rather than passively collecting records from phone companies. Second, the devices are indiscriminate, collecting data from all phones within range — potentially hundreds or thousands of devices — not just the target. Third, depending on configuration, Stingrays can interfere with legitimate cell service, potentially disrupting emergency calls in the area.
"The government has been hiding information about this technology from the public and the courts. If this technology is so great, why are they so afraid to tell us about it?"
Nathan Freed Wessler, ACLU Staff Attorney — Associated Press, 2014Harris Corporation marketed several models with different capabilities. The basic StingRay focused on location tracking. More advanced models like the KingFish could determine location with greater precision by measuring signal strength. The HailStorm operated on 4G LTE networks. Technical specifications remained classified, but court documents revealed that some models could be configured to intercept communications content, not just metadata, though the FBI maintained that police agencies used the devices only for location tracking.
The public first learned about law enforcement Stingray use through an unlikely source: a defendant representing himself from jail on charges of filing $4 million in fraudulent tax returns. Daniel David Rigmaiden had been living under false identities and operating from apartments rented using stolen credentials when police arrested him in 2010. But something about the arrest troubled Rigmaiden, who had technical expertise and access to legal research materials.
Rigmaiden realized that police had located him by tracking his wireless internet card — a device that connected only to data networks and had no phone number that could be traced through conventional methods. He concluded that law enforcement must have used a cell-site simulator. Filing pro se motions from jail, Rigmaiden demanded that prosecutors disclose the surveillance technology used to find him.
The government resisted for months, filing motions to seal proceedings and arguing that disclosure would compromise law enforcement techniques. Federal prosecutors invoked the FBI's nondisclosure agreement, stating they were contractually prohibited from revealing information about the technology. Only after sustained judicial pressure did prosecutors finally admit to using a cell-site simulator. The acknowledgment opened the door for Rigmaiden's attorneys — he eventually retained counsel — to demand technical specifications and operational procedures.
Rigmaiden's case became the legal foundation for challenges nationwide. His motions and the court documents they generated provided defense attorneys in other jurisdictions with language and precedents to demand disclosure. The case demonstrated that Stingrays were being used far more widely than the public knew and that the FBI had established a systematic framework for keeping the technology hidden from courts.
The FBI's nondisclosure agreements, revealed through public records requests by the American Civil Liberties Union and others, contained explicit instructions on concealing Stingray use. The template agreement obtained by the ACLU in 2015 stated that agencies must coordinate with the FBI before providing "any information to the public, the media, in judicial proceedings or in response to legal process" regarding cell-site simulators.
Internal guidance documents instructed officers to use parallel construction — developing alternative explanations for how they discovered evidence. If a Stingray led police to a suspect's location, reports would attribute the discovery to a confidential informant, an anonymous tip, or "investigative means." Search warrant applications would omit any mention of electronic surveillance or would describe it vaguely enough to avoid identifying the specific technology.
The agreements created a conflict between the FBI's interest in protecting surveillance capabilities and defendants' constitutional right to examine evidence against them. Defense attorneys argued that defendants could not challenge the legality of their arrests if they did not know how police found them. Courts could not assess whether searches complied with the Fourth Amendment if prosecutors withheld information about surveillance methods.
When judges demanded explanations, FBI guidance instructed prosecutors to seek dismissal of charges rather than disclose Stingray use. In Tallahassee, prosecutors dropped charges in multiple robbery and drug cases after judges ordered disclosure. In Baltimore, prosecutors moved to seal entire case files to prevent defense access to Stingray information. The FBI's Technical Operations Group provided operational support and coordinated the disclosure response across jurisdictions.
While local police used ground-based Stingrays in targeted investigations, the U.S. Marshals Service operated a more expansive aerial surveillance program. Beginning around 2007, the Marshals deployed Cessna aircraft equipped with cell-site simulators manufactured by Digital Receiver Technology, a Boeing subsidiary. These "dirtboxes" — named after the manufacturer's initials — flew over major metropolitan areas, collecting data from tens of thousands of phones per flight.
The Wall Street Journal revealed the program's existence in November 2014, reporting that airborne devices were significantly more powerful than ground-based units and could scan entire cities during a single flight. Unlike targeted ground operations, the aerial program conducted broad sweeps, collecting identification data from phones throughout the coverage area whether their owners were suspects or not. The Marshals Service used the data to locate fugitives by triangulating their positions when their phones connected to the airborne simulator.
The program operated without explicit statutory authority or meaningful oversight. The Marshals Service did not obtain warrants for flights, arguing that collection of IMSI numbers did not constitute a search under the Fourth Amendment because phone users had no reasonable expectation of privacy in information transmitted to cell towers. The Department of Justice's Office of Inspector General opened an investigation into the program only after media disclosure.
As defense attorneys became aware of Stingray use, legal challenges emerged on multiple fronts. The primary constitutional question was whether cell-site simulator use constitutes a Fourth Amendment search requiring a warrant supported by probable cause. Secondary issues included whether nondisclosure agreements violated defendants' due process rights and whether mass data collection from non-suspect phones violated the privacy rights of innocent third parties.
The Supreme Court's 2012 decision in United States v. Jones provided the legal framework. In Jones, the Court held that police violated the Fourth Amendment by attaching a GPS device to a suspect's vehicle and tracking his movements for 28 days without a warrant. Justice Antonin Scalia's majority opinion focused on the physical trespass involved in installing the device, but concurring opinions by Justices Sonia Sotomayor and Samuel Alito questioned whether prolonged electronic surveillance violated reasonable expectations of privacy even without physical contact.
"I would ask whether people reasonably expect that their movements will be recorded and aggregated in a manner that enables the Government to ascertain, more or less at will, their political and religious beliefs, sexual habits, and so on."
Justice Sonia Sotomayor, United States v. Jones — Supreme Court, January 2012Legal scholars including Orin Kerr at UC Berkeley argued that Stingrays went beyond the collection of business records from phone companies — a practice courts had generally allowed under the third-party doctrine. Stingrays actively compelled phones to reveal information, constituting government action that more closely resembled a search than a records request. The devices also collected real-time location data, which Jones had suggested might warrant greater constitutional protection than historical records.
State courts diverged in their responses. Some required warrants for Stingray use; others allowed deployment under pen register orders — court orders authorizing collection of non-content communication data — that did not require probable cause. The inconsistency created a patchwork of standards across jurisdictions, with the scope of Fourth Amendment protection depending on geography.
Facing mounting legal challenges, media scrutiny, and bipartisan congressional pressure, the Department of Justice announced a policy change in September 2015. Deputy Attorney General Sally Quillian Yates issued a memorandum requiring federal law enforcement agencies to obtain a search warrant supported by probable cause before using cell-site simulators, except in exigent circumstances involving risk of death or serious bodily harm.
The policy also required agencies to delete information collected from non-target phones immediately and to implement privacy safeguards. However, significant exceptions remained. The warrant requirement did not apply to national security investigations or to circumstances where agents reasonably believed exigent circumstances existed. The policy applied only to agencies receiving Department of Justice funding, potentially excluding some state and local operations.
The Department of Homeland Security issued a similar policy in October 2015. Together, the policies represented a significant shift in government surveillance practices, acknowledging that cell-site simulators implicate privacy interests requiring judicial oversight. Yet civil liberties advocates noted that the policies were administrative, not legislative, meaning they could be revised by future administrations without congressional action.
Some states and municipalities went further. In 2016, Baltimore became one of the first cities to pass local legislation requiring warrants for Stingray use and mandating public reporting of deployments. Washington and California enacted state laws establishing warrant requirements and data retention limits. The state-level reforms often provided stronger protections than federal policy, closing loopholes and creating enforcement mechanisms.
Public records obtained through ACLU litigation and media investigations documented the scope of Stingray deployment. USA Today's 2014 analysis identified cell-site simulator use in at least 24 states and the District of Columbia, with devices purchased by more than 75 agencies. Records showed that police used Stingrays not only for serious crimes but also for routine investigations including stolen phones and low-level drug offenses.
Internal police emails revealed the operational culture surrounding Stingrays. Officers referred to the devices using code names or vague terms in reports. Departments trained officers to avoid mentioning the technology in testimony. FBI agents provided guidance to local police on managing disclosure requests and working with prosecutors to conceal surveillance methods. The records documented a coordinated, multi-jurisdictional effort to keep the technology hidden from public view.
Financial records showed that agencies spent between $60,000 and $400,000 per device, with some departments purchasing multiple units and upgrading to newer models. Harris Corporation's contracts included maintenance agreements and training, creating ongoing revenue streams. The company's customer list included not only federal agencies and major metropolitan police departments but also small-town sheriff's offices and campus police forces.
Despite policy reforms and increased transparency, significant questions about cell-site simulator use remain unresolved. The technical capabilities of modern devices have expanded beyond simple location tracking, but manufacturers and law enforcement agencies continue to withhold detailed specifications. Whether newer devices can intercept communications content, not just metadata, remains unclear. The scope of "exigent circumstances" exceptions is broad and subject to agency interpretation.
The fate of data collected before the 2015 policy change is uncertain. Agencies collected IMSI numbers and location data from millions of phones between the early 2000s and 2015 without warrants. Whether that data was deleted, how long it was retained, and whether it was shared with other agencies remains largely unknown. No comprehensive audit of historical Stingray use has been conducted.
International use of cell-site simulators presents additional concerns. Harris Corporation and other manufacturers exported the technology to foreign governments, some with records of human rights abuses. Whether U.S. surveillance technology has been used to track dissidents, journalists, or political opponents abroad has not been systematically investigated. Export controls on surveillance technology remain limited.
The broader implications for privacy in an age of ubiquitous mobile devices extend beyond Stingrays. If phones constantly broadcast signals that can be intercepted, spoofed, or tracked, what expectation of privacy can users reasonably maintain? The third-party doctrine — the legal principle that individuals have limited privacy in information shared with companies — was developed in an era of landlines and paper records. Whether it remains coherent when phones generate continuous location data and reveal associations, movements, and habits remains contested.
The Stingray story is not simply about a surveillance device. It documents a decade-long effort by federal law enforcement to deploy new technology while preventing judicial review, legislative oversight, and public awareness. The FBI's nondisclosure agreements created a legal structure designed specifically to keep information from courts. Prosecutors made strategic decisions to drop cases rather than submit to judicial scrutiny. Officers were trained to provide false or misleading testimony about surveillance methods.
This architecture of secrecy raises questions about the relationship between law enforcement innovation and constitutional accountability. When agencies develop new investigative techniques, who decides whether they comply with the Fourth Amendment? If courts cannot evaluate surveillance methods because agencies refuse to disclose them, what check exists on executive power? The warrant requirement is meaningless if judges do not know what they are authorizing.
The eventual policy change came not from internal law enforcement deliberation but from external pressure — defendant litigation, ACLU records requests, media investigation, and congressional inquiry. Without Daniel Rigmaiden's pro se motions, the technology might have remained secret longer. Without Nathan Freed Wessler and ACLU colleagues filing public records requests in dozens of jurisdictions, the scope of deployment would have remained unknown. Without journalists at USA Today, the Wall Street Journal, and local newspapers connecting documents and sources, the public would not have learned about airborne surveillance or the extent of warrantless tracking.
The Stingray case established that surveillance transparency requires external advocates. Law enforcement agencies, left to self-regulate, chose secrecy over accountability for more than a decade. The pattern has implications for emerging technologies — facial recognition, automated license plate readers, predictive policing algorithms — that agencies are deploying today. What surveillance capabilities are being used now under nondisclosure agreements that will be revealed years from now? What will the next Daniel Rigmaiden discover?