Stingray: Mass Surveillance Without a Warrant

"Stingray" is the brand name for a class of surveillance devices manufactured by Harris Corporation (merged into L3Harris Technologies in 2019). The technical term is IMSI-catcher or cell-site simulator (CSS). The device impersonates a legitimate cell tower, broadcasting a signal that forces every mobile phone within range to disconnect from the real network and connect to the fake tower instead. The phone doesn't know the difference. The user never gets a notification.

Once a phone connects, the Stingray captures its IMSI (International Mobile Subscriber Identity) and IMEI (International Mobile Equipment Identity) — the unique identifiers that fingerprint that phone and its owner. In passive mode, it captures these identifiers silently. In active mode, it can track precise location, intercept metadata (who you called, when, for how long), and in some configurations — depending on device model and cellular generation — capture communications content.

The indiscriminate capture is not a bug. It is the design. To find one targeted phone, you must sweep every phone in the coverage area. A Stingray deployed at a protest, a mosque, a union meeting, or a neighborhood captures every device present — regardless of whether any individual is the subject of investigation. Harris makes several models: Stingray, Stingray II, Hailstorm, AmberJack, KingFish. The capabilities vary; the indiscriminate design does not.

The ACLU's tracking project — built from public records requests across the country — has confirmed Stingray ownership and use in at least 75 law enforcement agencies across 27 states and the District of Columbia. The actual number is almost certainly higher: the NDAs attached to device purchases (detailed below) prevent agencies from confirming or denying ownership, meaning many agencies simply don't respond to public records requests about the technology.

Federal agencies with documented Stingray programs include the FBI, Drug Enforcement Administration (DEA), Department of Homeland Security (including ICE and Secret Service), and the US Marshals Service. The US Marshals have operated a program using aircraft-mounted Stingrays — "dirtboxes" — capable of sweeping entire city blocks or neighborhoods from the air. The Wall Street Journal first reported the airborne program in November 2014.

A 2023 Inspector General report found that both the Secret Service and ICE's Homeland Security Investigations unit repeatedly deployed cell-site simulators without obtaining the legally required court orders — using devices against people without judicial authorization at all.

Between 2018 and 2023, the ACLU and the Center for Human Rights and Privacy obtained — through FOIA litigation — multiple non-disclosure agreements between Harris Corporation and major police departments. The NDAs are remarkable: they require agencies not only to keep the existence of the devices secret, but to actively mislead courts and defense attorneys about surveillance methods used in criminal cases. When the existence of a Stingray becomes relevant to a prosecution, the NDA instructs agencies to obtain information through parallel construction — re-acquiring the same evidence through methods that can be disclosed.

When that fails, prosecutors drop the case. In a Baltimore robbery prosecution, police had used a Stingray to locate the defendant. When a judge threatened to hold an officer in contempt for refusing to testify about the technology, prosecutors dropped the charges. The murder case can be sacrificed; the secret cannot.

The FBI has intervened directly in state criminal trials to protect Harris NDA compliance. This creates a constitutional inversion: the government maintains that it can conduct surveillance and use the results in investigations, but that defendants have no right to know the surveillance occurred. The Brady obligation — the constitutional requirement that prosecutors disclose evidence material to guilt or punishment — is being systematically evaded to protect a corporate contract.

Because Stingrays capture every device in range, they are maximally useful for intelligence gathering at events where the surveillance target is not a specific individual but a group — protesters, worshippers, union organizers. The device doesn't distinguish between an organizer on a government watchlist and a journalist covering the event or a bystander who happened to be nearby.

In Chicago in 2014, protesters reported that their phones were behaving abnormally — losing signal, failing to send messages — in the presence of a police vehicle that appeared to be operating surveillance equipment. Contemporaneous police communications showed a local fusion center tracking cellphones within the protest area. During the 2016 Standing Rock protests, attendees reported similar anomalies. The Intercept reported in 2020 that Stingrays and "dirtboxes" were used extensively during the wave of BLM protests following the murder of George Floyd.

At the January 20, 2017 inauguration protests in Washington D.C. — the J20 arrests — police swept the protest area and arrested over 230 people in a mass kettling operation. Evidence in the J20 prosecutions raised questions about the surveillance methods used to document attendees. The chilling effect is structural: when attending a protest means your phone is logged by law enforcement, the First and Fourth Amendments are in direct conflict. That conflict is resolved, currently, in favor of the government.

In 2016, the Maryland Court of Appeals became the first state supreme court to hold that Stingray use requires a warrant. State v. Andrews applied the Fourth Amendment's protection against unreasonable searches to IMSI-catcher surveillance of a suspect's location. The ruling was significant — but applies only in Maryland.

The Supreme Court's 2018 ruling in Carpenter v. United States held that the government needs a warrant to obtain historical cell-site location information from carriers. But Carpenter addressed data held by third parties (phone companies), not real-time device-level interception. Stingray-specific case law remains patchy: some circuits require warrants; others permit use under a pen register order — a much lower legal standard that requires only "relevance" to an investigation, not probable cause.

At the federal level, the Cell-Site Simulator Warrant Act has been proposed multiple times (most recently in 2021) but has never passed. It would require a probable-cause warrant for use of any cell-site simulator by any government agency. Without it, federal agencies can and do use Stingrays under the lower standard — and as the 2023 OIG report confirmed, sometimes without any court order at all.

California, Washington, and Illinois have enacted state warrant requirements. The majority of states have not. The patchwork legal landscape means that identical surveillance activity is constitutionally protected in some states and uncontrolled in others.

Harris Corporation was founded in 1895 and grew into a mid-tier defense contractor headquartered in Melbourne, Florida. Its wireless surveillance division developed the Stingray product line initially for military and intelligence use — the technology is descended from SIGINT collection programs used in wartime. The domestic law enforcement market was a deliberate expansion: Harris licensed and sold the same surveillance architecture it built for the battlefield to police departments across the United States.

In 2019, Harris Corporation merged with L3 Technologies in a $33 billion transaction to form L3Harris Technologies, one of the largest defense contractors in the United States. The Stingray product line is now part of a company with $18+ billion in annual revenue, the majority of it from government contracts. The NDAs that gag police departments about Stingray use are standard terms in those contracts — secrecy is a product feature, sold alongside the hardware.

L3Harris connects to the broader surveillance-industrial complex: Palantir (data analytics), NSO Group (mobile spyware), Cellebrite (phone extraction), and dozens of smaller vendors that have monetized the state's appetite for mass surveillance. The common thread is that each of these companies profits directly from the erosion of Fourth Amendment protections — and each has secured those profits through government contracts funded by taxpayers, to surveil those same taxpayers.