How Police Can Track Your Phone

Summary

The video explains how Stingrays, also called cell-site simulators or IMSI catchers, can impersonate cellular towers and trick nearby phones into connecting. A strong signal can encourage phones to connect, and the device can identify phones using an IMSI, a unique identifier associated with a SIM card. According to the interviewee, these systems may collect information about nearby phones and, depending on the attack, locate a target, interfere with a connection, or expose calls and messages.

The Electronic Frontier Foundation’s (EFF) Rayhunter project aims to detect suspicious cellular activity and help researchers understand how these devices operate. Rayhunter runs on supported, inexpensive mobile hotspots—small Linux-based devices flashed with its software—not as an ordinary phone app. A status light indicates alerts. Users can access a web interface, retrieve network-traffic PCAP files, and submit them for analysis.

Rayhunter checks for indicators such as suspicious requests for an IMSI, a downgrade to older cellular technology, and a null cipher—a connection without encryption. The interview discusses how an unauthenticated null-cipher request could potentially enable interception or a man-in-the-middle attack.

Findings and surveillance concerns

• After nearly two years, the project had received data from roughly 200 contributors, including laboratory captures and reports from real-world use. False positives helped the team improve its detection signatures.
• The team said it had not found evidence of IMSI catchers being used at the protests represented in its submissions. The interviewee suggested police may rely on other surveillance methods at protests and that IMSI catchers may be used more often by SWAT teams to check whether someone is home before a search.
• A reported case in the Philippines paired a Rayhunter detection with a suspicious SMS phishing message, giving researchers logs to examine.
• The speakers raised concerns about limited public information on when law enforcement uses these devices, what phone vulnerabilities may be involved, and whether their use is properly authorized. They also noted that spies and criminals could use similar capabilities.

Other topics and practical guidance

The interview also covers mobile forensic extraction tools, including Cellebrite and GrayKey, which can copy extensive data from an unlocked phone. The speakers question how extracted data is authorized, retained, and connected with other databases.

They discuss phone searches at borders and the legal uncertainty around compelling someone to unlock a phone with biometrics rather than a password. The interviewee’s practical suggestions include turning off biometric unlocking when expecting to interact with law enforcement and, for people attending protests, considering turning off their phone. These are general precautions, not guarantees of protection.

Guide and product mentions

• Rayhunter: An open-source EFF project for detecting suspicious cellular activity using supported mobile-hotspot hardware.
• EFF Surveillance Self-Defense guides: The interviewee recommends ssd.eff.org for continuously updated online safety guidance.
• ThreatLocker sponsor segment: The host describes ThreatLocker’s Zero Trust approach, which denies applications by default and lets organizations control which programs, scripts, and processes can run. This sponsor message is separate from the Rayhunter discussion.

Main speakers and sources

• David Bombal — host and interviewer.
• Cooper Quintin — EFF Senior Staff Technologist and Rayhunter contributor.
• Electronic Frontier Foundation (EFF) — source of Rayhunter and the Surveillance Self-Defense guides.
• ThreatLocker — sponsor featured in an advertisement.