IMSI Catchers Explained: Cell Site Simulators, 5G and Detection

An IMSI catcher, or cell site simulator, is a radio that poses as a cell tower so nearby phones connect and reveal identifiers such as the IMSI and IMEI, used to locate or track them. 5G hides the permanent identifier with SUCI, but downgrades to 2G keep the threat alive. Turning off 2G is the strongest practical defence.

This guide stays conceptual. It explains how these devices work, what each mobile generation changed, how detection works and where it fails, and what United States policy and courts say, using 3GPP specifications, NIST guidance, Android and Apple documentation, peer reviewed research and primary legal texts. It contains no build or operating instructions. For deeper protocol background, see our posts on 5G security architecture, SUCI and 5G AKA and cellular baseband firmware.

Key takeaways

• IMSI catchers work because phones choose cells largely by what a cell broadcasts and how strong it is, and older generations give the phone no way to check that a cell belongs to a real network.
• The core collection is identifiers (IMSI, IMEI) plus signal information that helps locate a device. After a forced downgrade to 2G, calls and SMS can also be exposed.
• 2G has no mutual authentication, no requirement to encrypt the air interface, and broken A5/1 and A5/2 ciphers, according to NIST SP 800-187.
• 3G and 4G added mutual authentication (AKA), but an identity request for the IMSI can still be sent before security is set up.
• 5G sends a SUCI, the permanent identifier encrypted with ECIES to the home network's public key (3GPP TS 33.501). It only works if the operator provisions the key, and it cannot help a phone that falls back to 2G.
• Android can switch 2G off at the modem level, lets administrators enforce that from Android 14, and can alert on unencrypted connections and identifier requests from Android 16. iPhone Lockdown Mode turns off 2G and 3G.
• Detection is hard: a 2017 study found none of five popular detection apps effective. Better tools watch control plane behaviour, not signal bars.
• The US Department of Justice's 2015 policy requires a search warrant for its agencies' use, and appellate courts in Maryland (2016) and the District of Columbia (2017) held warrantless use unconstitutional in the cases before them. Not legal advice.

What is an IMSI catcher or cell site simulator?

An IMSI catcher transmits as if it were a legitimate base station. Phones in range treat it as an attractive cell, connect, and hand over identifying information. The names overlap: "IMSI catcher" describes what it collects, "cell site simulator" what it imitates, "false base station" and "rogue base station" are the terms in standards and government guidance, and "stingray" is a nickname from one early commercial product, now used loosely for the whole category.

The Department of Justice's 2015 policy guidance describes the mechanism plainly. Cell site simulators "function by transmitting as a cell tower," and nearby devices identify the simulator as the most attractive tower in the area and send it the identifying signals they would send a real one. When looking for a known phone, the simulator first receives identifiers from multiple devices nearby, then focuses on the target. When identifying an unknown phone, it collects signalling information from non target devices to tell the target apart.

NIST's Guide to LTE Security (SP 800-187, December 2017) gives the radio side. Rogue base stations "broadcast a cellular network masquerading as a legitimate carrier network," and exploit the fact that handsets attach to whichever station broadcasts as their preferred network at the highest power. Because handsets are built to be backwards compatible so calls survive movement, a rogue station can lean on the weakest generation the phone still supports.

The threat models differ. The SeaGlass paper (PoPETs 2017) notes that cell site simulators are used "by governments and criminals to track and eavesdrop on cell phones." Google's Android security team, in August 2023, described uses from targeted surveillance to an alleged SMS phishing scheme said to have reached hundreds of thousands of users from a single false base station.

What can an IMSI catcher collect?

It depends on the device, its configuration, the generation it can force a phone onto and the law governing its operator. Conceptually:

Two points cause confusion. First, the DOJ policy says its agencies' simulators must be configured as pen registers and may not collect communication contents or phone data such as "emails, texts, contact lists, images." That is a rule for those agencies, not a technical limit of the device class. Second, Android's cellular security overview notes that voice calls and SMS rely on link layer encryption for over the air privacy, and that cellular protocols are not end to end encrypted, so calls and SMS are available to your home carrier unencrypted.

The identifiers, explained

The design idea is constant: send the permanent identity rarely and use temporary ones otherwise. The weakness is the moment a network, or something posing as one, says it cannot recognise the temporary identity and asks for the permanent one.

How a cell site simulator works, at a conceptual level

Three properties of mobile networks do most of the work.

Phones pick cells by what cells advertise. A phone listens to broadcasts from nearby cells: which network they belong to, which neighbours and frequencies to consider, and signal strength. NIST explains how a nearby rogue station at high power becomes the preferred cell. Rayhunter's documentation adds that LTE system information broadcasts guiding reselection "are not encrypted or authenticated," so a false cell can advertise misleading priorities, including ones that steer phones to 2G.

Some messages arrive before security exists. When a phone attaches, no keys are agreed yet. NIST lists seven LTE messages that TS 24.301 permits without protection, including an identity request for the IMSI, an authentication request and several reject messages. A false base station can send them because no key is needed.

Phones keep old generations. If a phone supports 2G, a false cell can try to push it there, where the phone cannot verify the network and ciphers are weak or absent. Google's Android security team calls downgrade "the most common use" of false base stations and IMSI catchers.

The pattern detection researchers look for is short: a phone joins an unfamiliar cell, the cell asks for the permanent identity, no authentication follows, and the cell releases or redirects the phone. Rayhunter's heuristics documentation associates that chain with commercial IMSI catchers. It breaks no encryption; it only asks a question the standards allow.

We deliberately leave out hardware, software, frequencies, power and configuration. In the United States, operating an unlicensed transmitter and interfering with licensed radio are prohibited by the Communications Act, covered below.

Why 2G made IMSI catchers easy

GSM authenticates the subscriber to the network, but not the network to the subscriber. NIST SP 800-187 summarises: GSM lacks "mutual authentication between the handset and cellular network," lacks strong algorithms with keys of sufficient length, and has "no requirement mandating that the 2G GSM air interface is encrypted."

• No network authentication. A phone on 2G cannot tell a real tower from a fake one. AOSP makes the same point about roaming: because 2G lacks mutual authentication, genuine 2G roaming cannot be reliably detected.
• Optional encryption. On a false 2G cell, the choice to run without ciphering belongs to whoever runs it. Android 14's null cipher option exists because voice and SMS depend on the link cipher, which Google notes is "fully controlled by the network."
• Broken ciphers. NIST names A5/1 and A5/2 as broken. Google's 2023 post says that "since 2010, security researchers have demonstrated trivial over-the-air interception and decryption of 2G traffic."

Why downgrade attacks still matter after 2G shutdowns

Many carriers have switched off 2G. AOSP explicitly rejects the idea that this ends the risk: disabling 2G matters "even if the user's carrier no longer maintains 2G infrastructure," because the device still supports scanning for and connecting to 2G stations. A false base station brings its own 2G cell.

Security is set by the weakest generation your phone accepts, not the newest your carrier runs. A phone with excellent 5G and 2G still enabled can be steered down by unauthenticated broadcasts or by being released and redirected to a 2G cell. Rayhunter ships separate heuristics for both patterns.

What 3G and 4G LTE changed, and what stayed exposed

3G (UMTS) and 4G (LTE) introduced Authentication and Key Agreement (AKA), and the key word is mutual. NIST describes AKA as providing "mutual authentication between the UICC and the LTE network." The network proves it holds the subscriber's long term key, shared only by the home operator and the SIM. A false base station without that key cannot complete authentication, so it cannot establish a protected session the phone will accept.

LTE security is specified in 3GPP TS 33.401, the System Architecture Evolution security architecture. Once the Security Mode Command runs, signalling is protected, and NIST's summary lists only seven messages allowed without protection. LTE also uses GUTIs so the IMSI is sent rarely. NIST's 2017 assessment found no significant publicly known weaknesses in the UMTS air interface algorithms, unlike GSM.

So why did IMSI catchers keep working?

The identity request comes first. Authentication can only start once the network knows the subscriber. If it claims not to recognise the temporary identity, the phone sends its IMSI. A false cell can ask, receive the IMSI, and never attempt authentication.

Reject messages and broadcasts are unprotected. NIST covers "unauthenticated REJECT messages." At NDSS 2016, Shaik, Borgaonkar, Asokan, Niemi and Seifert demonstrated practical attacks with commercial LTE phones on real networks: a semi passive attacker could locate a device within a 2 square kilometre area in a city, an active attacker far more precisely, and an attacker could persistently deny some or all services. They describe these as the first publicly reported practical attacks against LTE access network protocols, and proposed countermeasures.

Paging can leak linkability. Paging wakes a phone for incoming traffic and is broadcast across an area. If temporary identities are not refreshed often, a listener can link one to a person. Rayhunter's documentation notes networks periodically reassign temporary identities "to enhance security and avoid tracking," and the quality of that varies by operator.

Downgrade is still available. That is why NIST's LTE guide still discusses GSM: "real world deployments utilize GSM networks to connect with LTE networks, which bring this into scope."

What 5G changes: SUCI, SUPI and 5G authentication

5G security is specified in 3GPP TS 33.501, "Security architecture and procedures for 5G System." The version we checked is ETSI TS 133 501 V19.7.0 (August 2026), carrying Release 19. The headline change is clause 6.12, "Subscription identifier privacy."

SUPI and SUCI

The SUPI is the 5G permanent subscription identifier, which can contain an IMSI or take a network access identifier form. TS 33.501 states that "the SUPI is privacy protected over-the-air by using the SUCI." Its subscriber privacy requirements say the phone shall support 5G-GUTI and "the SUPI should not be transferred in clear text over NG-RAN except routing information," such as the Mobile Country Code and Mobile Network Code.

How concealment works, conceptually:

1. The home operator provisions a Home Network Public Key, its identifier and a protection scheme identifier into the USIM, as TS 33.501 requires.
2. The USIM or the phone (the operator decides, and records the choice on the USIM) encrypts the subscription identifier part of the SUPI, the MSIN for IMSI based identities, with that key.
3. The phone sends the SUCI: routing information in clear, identifier encrypted.
4. Only the home network's de concealment function, holding the private key, recovers the SUPI. A false base station sees ciphertext that changes every time.

Annex C defines the schemes, both based on the Elliptic Curve Integrated Encryption Scheme (ECIES). Profile A uses Curve25519 with X25519; Profile B uses secp256r1. Both use SHA-256 in the key derivation, and the specification says the phone and the de concealment function shall implement both. Each SUCI uses a fresh ephemeral key, so two SUCIs from one subscriber do not match, which defeats "ask for the identity and write it down."

The null scheme, and why provisioning matters

The phone must also support the null scheme, which conceals nothing. TS 33.501 says that if the home network has not provisioned the public key in the USIM, "the SUPI protection in initial registration procedure is not provided," and the null scheme shall be used. It also covers unauthenticated emergency calls where regulation allows them. SUCI protects you only if your operator has done the provisioning.

The specification flags a subtler leak in NOTE A to clause 6.12.2: variable length identifiers in network access identifier form "can result in leakage of length even if the username portion is confidentiality protected," and recommends fixed lengths or padding.

5G authentication and bidding down

TS 33.501 requires that the serving network authenticate the SUPI, and specifies two primary methods, 5G AKA and EAP-AKA', with Annex F giving the 5G profile for EAP-AKA'. As in 4G, a false base station lacks the subscriber's long term key and cannot complete authentication; our 5G security architecture post explains how the methods differ.

Clause 5.1.1 defines a "bidding down attack" as making the phone and network each believe the other lacks a security feature both support, and requires that it be prevented. That protects features within 5G. It cannot stop a phone choosing an older generation it still supports.

Network side detection in the standard

Annex E (informative), "UE-assisted network-based detection of false base station," explains that measurement reports from connected phones "have security values in being useful for detection of false base stations or SUPI/5G-GUTI catchers." Operators can choose, in an implementation specific way, which phones, areas or periods to analyse. The standard gives operators the hook to notice cells phones report but the operator never deployed. Whether they use it is up to them.

What gaps remain in 5G

• Non standalone deployments. Much early 5G was non standalone, with 5G radio anchored to a 4G core. Registration and identity procedures there are the 4G ones, so clause 6.12 protections do not apply to that registration.
• Older generations on the phone. A 5G phone that accepts 2G is only as private as 2G.
• Unprovisioned keys. Without the public key, the null scheme sends the SUPI unconcealed in initial registration.
• Residual identifiers and metadata. SUCI conceals the subscription identity; it does not make every identifier or signal trait unlinkable, as the length leak note shows.
• Unauthenticated early messages. Some signalling still precedes security, which is why Annex E focuses on detection rather than prevention.

2G, 3G, 4G and 5G compared

Each generation resists IMSI catchers better, but every phone inherits the exposure of the oldest generation it still accepts.

What phone settings actually do

The most useful control removes the downgrade path: turning off 2G.

Android: 2G toggle, administrator control and notifications

Android 12: user 2G toggle. Google's security blog (8 August 2023) says Android 12 launched an option to disable 2G "at the modem level," the Pixel 6 was first to adopt it, and it is supported by devices conforming to Radio HAL 1.6 or later. AOSP says it "stops a device from scanning or connecting to 2G networks" on devices implementing the required capability.

Two design choices matter. Emergency calling is never affected: the device still uses 2G for emergency services. And roaming does not undo the setting, because 2G cannot be authenticated and a false base station could spoof network identifiers to coax a phone into re enabling it. The trade off: in a region that depends on 2G, you have no service until you switch it back on.

Android 14: administrator control and null ciphers. Android 14 lets IT administrators using Android Enterprise restrict managed devices from downgrading to 2G, either always or, as Google describes, when staff travel to high risk locations. It also added a user option to disable null ciphered connections at the modem level, keeping emergency calls possible. Google noted this depends on devices adopting the latest radio HAL, so availability varies.

Android 16: Mobile network security. AOSP documents a "Mobile network security" section in Safety Center with two parts:

• Notifications, off by default, shown when the device connects to an unencrypted network or exchanges identifiers such as IMSI or IMEI with the network. It appears only if the modem supports IRadio 3.0 and specific reporting APIs. AOSP notes normal use involves occasional identifier exchange; the alerts matter when it happens frequently.
• Network generation, extra entry points for each SIM's 2G toggle, mirroring the setting under SIM settings.

Menu names vary by device maker and version; look for "Allow 2G" under SIM or mobile network settings.

iPhone: Lockdown Mode

Apple's support article states that in Lockdown Mode "2G and 3G cellular support is turned off for iPhone and iPad." It also stops automatic joining of non secure Wi-Fi, blocks configuration profiles and MDM enrollment, and keeps phone calls and plain text messages working. Lockdown Mode is available in iOS 16 or later, with additional protections from iOS 17. Apple calls it "an optional, extreme protection" for the very few individuals who might be personally targeted, so it suits high risk periods rather than everyday use.

What these settings do not do

None stops a 4G or 5G false cell from requesting identity in ways the standards allow, or from denying service. They remove the generation where a false cell can impersonate the network outright and potentially read or alter calls and SMS.

How detection research and tools work, and their limits

Detecting an IMSI catcher means spotting a cell that should not exist, or a network behaving as a real one would not. Three approaches stand out.

Approach 1: compare broadcast parameters against known cells

Early consumer apps compared what nearby cells advertise (identifiers, location area, neighbour lists) against crowdsourced databases of known cells, flagging unknown cells, sudden location area changes or unusually strong signals. No extra hardware needed.

The White-Stingray study (Park, Shaik, Borgaonkar, Martin and Seifert, USENIX WOOT, August 2017) measured the limits. The authors built a framework for 2G and 3G IMSI catcher techniques and tested five popular Android detection apps, concluding that "none of the tested apps are able to detect the ICs effectively," and that many app techniques could be circumvented. Ordinary apps see only broadcast parameters, which must be checked against unreliable public sources, and operator configurations vary enough to produce both false positives and false negatives. NIST SP 800-187 cites the study.

Approach 2: sensor networks that learn a city's normal

SeaGlass, by Ney, Smith, Cadamuro and Kohno at the University of Washington (PoPETs 2017), installed sensors in 15 ridesharing vehicles across two cities, collecting two months of data in each. The system learns a city's network properties and flags anomalies consistent with portable cell site simulators: cells whose presence or parameters do not fit the stable picture built over weeks. Its strength is context. Its limit is that it finds signatures consistent with simulators, not proof, and it needs deployment and expertise individuals lack.

Approach 3: watch the control plane

The newer approach watches what the network asks the phone to do, which a false base station cannot hide because the asking is the attack. The Electronic Frontier Foundation's Rayhunter, introduced in March 2025, runs on an inexpensive mobile hotspot (first supported: the Orbic RC400L) and analyses "the control traffic (but not user traffic, such as web requests)" between the hotspot and its cell. When something is suspicious, a line on the screen turns from green to red, and logs download as PCAP files for expert review.

The documentation says watching the full chain is "much less prone to false positives than naively looking for any time the IMSI/IMEI is sent," since identity requests also follow power on after a long time off, an expired temporary identity, a SIM swap or a tracking area change. Android 16's notifications follow the same idea from inside the phone.

Limits of every approach

• Detection is not prevention. By the time you see an alert, the identifier has usually been sent.
• False positives are common. Identity requests, redirects and odd cells all have legitimate causes. One alert is a prompt to look.
• False negatives happen. A device that stays within normal looking behaviour may trigger nothing.
• Coverage is local. A sensor reports on its own connection, not every phone nearby.
• Expert review matters, which is why Rayhunter exports PCAP logs.
• Law varies. EFF states it believes running Rayhunter does not currently violate US laws and advises people elsewhere to consult an attorney. Passive monitoring of your own connection is very different from transmitting.

What US rules and court decisions say

This section describes primary legal texts and opinions factually. It is not legal advice, and law varies by state and changes.

The Department of Justice policy (2015)

The DOJ published "Policy Guidance: Use of Cell-Site Simulator Technology" in September 2015, governing its own components:

• Warrant. Although the Department had previously relied on Pen Register Statute orders, "as a matter of policy, law enforcement agencies must now obtain a search warrant supported by probable cause," with exceptions for exigent and very limited other circumstances.
• No content. Simulators must be configured as pen registers under 18 U.S.C. 3127(3) and may not collect communication contents, phone data or subscriber account information.
• Location. They provide relative signal strength and general direction and do not function as a GPS locator.
• Deletion. When locating a known device, data must be deleted once it is located "and no less than once daily"; when identifying an unknown device, once it is identified and no less than once every 30 days. Equipment must be cleared between missions, under an auditing program.
• Approval. Operators must be trained and supervised; deployment needs approval from at least a first level supervisor, and emergency use from a second level supervisor.

The Department of Homeland Security lists its own "DHS Policy Regarding the Use of Cell-Site Simulator Technology," dated 19 October 2015, among its internal directives.

The statutes involved

18 U.S.C. 3127(3) defines a pen register as a device or process that records or decodes "dialing, routing, addressing, or signaling information," which "shall not include the contents of any communication." Two Communications Act provisions, administered by the Federal Communications Commission, frame transmitting: 47 U.S.C. 301 bars operating radio transmission apparatus except under the Act and a license granted under it, and 47 U.S.C. 333 provides that "no person shall willfully or maliciously interfere with or cause interference to any radio communications" of licensed or authorized stations or those operated by the US Government.

Court decisions

• State of Maryland v. Kerron Andrews, Court of Special Appeals of Maryland, filed 30 March 2016, held that "the use of a cell site simulator requires a valid search warrant, or an order satisfying the constitutional requisites of a warrant, unless an established exception to the warrant requirement applies."
• Prince Jones v. United States, District of Columbia Court of Appeals, decided 21 September 2017, held that "the government violated the Fourth Amendment when it deployed the cell-site simulator against him without first obtaining a warrant based on probable cause," and reversed the trial court's inevitable discovery ruling.

Other courts have addressed the question and state law differs. Read the opinion or statute for your jurisdiction, or ask a lawyer.

Step by step: what individuals and organisations can do

No setting makes a phone invisible to the radio network around it. The goal is to remove easy paths, protect content separately and know what an alert means.

For individuals

1. Update your phone. Protections depend on OS version (Android 12, 14, 16; iOS 16 and 17) and on modem firmware shipped with updates. See our baseband firmware post.
2. On Android, turn off 2G. In SIM or mobile network settings, switch off "Allow 2G" if offered; on Android 16 it also appears under Mobile network security. Emergency calls still work.
3. On Android 14 and later, turn off null ciphers where offered. Availability depends on radio hardware.
4. On Android 16, consider the network notifications in higher risk situations, knowing occasional identifier requests are normal.
5. On iPhone, consider Lockdown Mode for high risk periods. Apple's steps: open Settings, tap Privacy & Security, scroll to Lockdown Mode, tap Turn On Lockdown Mode, then Turn On & Restart and enter your passcode. Try it before an event, not during one.
6. Use end to end encrypted apps for sensitive content. They protect content even if the radio hop is compromised, but do not hide that your phone is present.
7. Act on repeated alerts. Note time and place, avoid sensitive calls and SMS there, and share logs with your security team. EFF suggests options such as turning off the phone and advising people nearby to do the same.

For organisations

1. Enforce 2G off on managed Android devices. Android 14 added a user restriction for this, usually set from a device management console. In a device policy controller it looks like this:

// Device policy controller (device owner or profile owner), Android 14+
DevicePolicyManager dpm = context.getSystemService(DevicePolicyManager.class);
ComponentName admin = new ComponentName(context, MyDeviceAdminReceiver.class);
dpm.addUserRestriction(admin, UserManager.DISALLOW_CELLULAR_2G);

Confirm it applies on a test device and record which models do not support it.

2. If you build Android devices or system apps, check capability first. AOSP's guidance has a privileged component confirm the radio supports allowed network type bitmasks, then remove 2G for the "enable 2G" reason. Since Android 14 this needs a privileged phone state permission; carrier privileges do not suffice.

// Privileged system component, per AOSP "Disable 2G" guidance
TelephonyManager tm = context.getSystemService(TelephonyManager.class);
if (tm != null && tm.isRadioInterfaceCapabilitySupported(
        TelephonyManager.CAPABILITY_USES_ALLOWED_NETWORK_TYPES_BITMASK)) {
    long allowedWithout2g = 0xFFFF & ~TelephonyManager.NETWORK_CLASS_BITMASK_2G;
    tm.setAllowedNetworkTypesForReason(
        TelephonyManager.ALLOWED_NETWORK_TYPES_REASON_ENABLE_2G, allowedWithout2g);
}

3. Write a travel and event profile for staff where surveillance is plausible: which devices go, which settings are enforced, which apps carry sensitive conversations.
4. Move sensitive workflows off SMS and plain calls, including SMS one time passcodes for high value accounts.
5. Treat alerts as signals to investigate. Collect logs, correlate with time and place, rule out maintenance, and escalate with evidence.
6. Ask your carrier whether it provisions the Home Network Public Key on 5G SIMs, runs standalone 5G where you operate, and analyses measurement reports for false base stations as TS 33.501 Annex E describes.
7. Keep it legal. Never transmit, jam or interfere; 47 U.S.C. 301 and 333 apply in the United States, and other countries have equivalents.

What network signals mean

Common mistakes

• Trusting a full signal bar. High transmit power is exactly how rogue stations attract phones, per NIST. Signal strength is not authentication.
• Assuming 2G risk ended with your carrier's shutdown. The phone still speaks 2G unless you turn it off.
• Assuming 5G means protected. SUCI helps only on standalone registration with a provisioned key, and only if the phone does not fall back.
• Assuming encrypted apps hide metadata. They protect content, not presence, timing or radio identifiers.
• Treating one alert as proof, or trusting apps that only compare broadcast parameters.
• Leaving 2G off or Lockdown Mode untested before travel to a 2G only area.
• Confusing policy limits with technical limits. The DOJ content rule binds those agencies, not every device.
• Trying to fight back with transmitters or jammers. Illegal in the United States and harmful to everyone nearby, including emergency callers.

FAQ

How do I know if an IMSI catcher is near me?

Usually not from the phone alone; signal bars and generic apps are unreliable. Meaningful signals are control plane behaviours such as an identity request without authentication or a forced redirect to 2G. Android 16 can notify you about unencrypted connections and identifier requests on supported hardware, and EFF's Rayhunter watches for these patterns on a separate device.

Does turning off 2G stop IMSI catchers?

It removes the most damaging technique, being pushed to a generation where the network cannot be verified and calls and SMS may be readable. It does not stop a 4G false cell requesting your identity or denying service. It is still the most effective setting available to individuals.

Can an IMSI catcher read WhatsApp, Signal or iMessage messages?

Apps with end to end encryption protect message content even if the radio link is compromised. A false base station can still learn your phone is present and block service. Plain SMS and standard calls rely on the link cipher and are most at risk after a downgrade.

Does 5G stop IMSI catchers?

5G standalone stops the simplest technique by sending a SUCI instead of the permanent identifier. It does not help if the operator has not provisioned the key, on non standalone 5G with a 4G core, or if the phone is pushed to an older generation.

What is the difference between SUPI and SUCI?

SUPI is the permanent 5G subscription identity, which can contain an IMSI. SUCI is the concealed form sent over the air, produced with ECIES using the Home Network Public Key in the USIM. Only the home network can recover the SUPI, and each SUCI looks different.

Does iPhone Lockdown Mode block 2G?

Yes. Apple says Lockdown Mode turns off 2G and 3G cellular support on iPhone and iPad, alongside many other restrictions.

Is it legal for police to use a cell site simulator in the US?

It depends on agency and jurisdiction. The DOJ's 2015 policy requires its agencies to get a search warrant, with limited exceptions, and Maryland's Court of Special Appeals (2016) and the DC Court of Appeals (2017) held warrantless use in the cases before them unconstitutional. This is not legal advice.

Is it legal to detect IMSI catchers?

Passive detection on your own device differs from transmitting. EFF believes running Rayhunter does not currently violate US laws and advises people elsewhere to consult a lawyer. Operating radio transmission apparatus without a license is prohibited in the US under 47 U.S.C. 301.

Do carriers detect fake cell towers?

TS 33.501 Annex E describes using phones' measurement reports to detect false base stations. It is informative and implementation specific, so ask your carrier whether and how it does this.

Where Safeguard fits

Safeguard does not detect IMSI catchers, monitor radio networks, manage mobile devices, configure 2G settings or scan baseband or modem firmware. Phone OS and modem fixes come from device makers and chipset vendors, and SUCI key provisioning and false base station detection sit with your carrier.

The fit is indirect and sits in the software your team builds. Mobile apps that carry sensitive conversations, their backends, cellular measurement tooling and device management integrations all ship open source dependencies. Safeguard can scan those repositories, container images and SBOM files with safeguard scan --dir ., --image <name> or --sbom <file>, match components against vulnerability databases, show which projects contain a given component and version, rank findings with reachability analysis, and evaluate policies and gates. Autonomous remediation can open fix pull requests, and it ships switched off.

The defences in this post depend on software at every layer: the encrypted messaging app you move sensitive conversations to, the backend it talks to, and open source detection tools all pull open source components that need patching like anything else. Keeping those dependencies current is the part your own team controls, even though the radio, the modem and the network are patched by others.

Fix it without waiting for upstream

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation categories include dependencies, licenses, security posture and findings, and each one is set separately. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds.

3. Gold Registry: start from components that are already fixed

Gold Registry provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs and a completed license check, with signed build provenance (signed with Safeguard's key and verifiable with cosign, SLSA Build Level 3 as the design target) and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. Ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

These demos show dependency, SBOM and remediation workflows, not radio monitoring or IMSI catcher detection. You can download Safeguard and follow the CLI docs to try them on your own projects.

This demo is a real Android session: you send work from the phone to a computer running the Safeguard CLI and approve each command with Allow once, Allow for turn or Deny. For a security lead travelling with 2G off, it is a way to approve a dependency fix without opening a laptop on an untrusted network.

Click through it at your own pace, or open it full screen.

This demo is a real CLI session: asked to fix the lodash CVE in a repository, it reads the finding and the advisory, asks before any command that changes something, moves lodash to 4.17.21, runs npm install and npm test with your approval, and pushes nothing. The same flow applies when a library in your messaging backend or a cellular measurement tool your team maintains has a published fix.

Click through it at your own pace, or open it full screen.

This demo sets up the Safeguard runner on your own machine, approves it with its device code and scans from the terminal. Pointed at a service your team builds, the scan lists the packages and versions inside it and their known vulnerabilities, so you know what to rebuild after an advisory.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• 3GPP: TS 33.501, Security architecture and procedures for 5G System
• ETSI TS 133 501 V19.7.0 (2026-08), 3GPP TS 33.501 Release 19 (PDF)
• 3GPP: TS 33.401, System Architecture Evolution (SAE); Security architecture
• NIST SP 800-187, Guide to LTE Security (December 2017)
• Android Open Source Project: Cellular security overview
• Android Open Source Project: Disable 2G
• Android Open Source Project: Mobile network security
• Google Security Blog: Android 14 introduces first-of-its-kind cellular connectivity security features (8 August 2023)
• Apple Support: About Lockdown Mode
• EFF: Rayhunter repository
• EFF: Meet Rayhunter, a new open source tool from EFF to detect cellular spying (March 2025)
• Rayhunter book: Heuristics
• Ney, Smith, Cadamuro, Kohno: SeaGlass, Enabling City-Wide IMSI-Catcher Detection, PoPETs 2017(3)
• Park, Shaik, Borgaonkar, Martin, Seifert: White-Stingray, Evaluating IMSI Catchers Detection Applications, USENIX WOOT 2017
• Shaik, Borgaonkar, Asokan, Niemi, Seifert: Practical Attacks Against Privacy and Availability in 4G/LTE Mobile Communication Systems, NDSS 2016
• US Department of Justice: Policy Guidance, Use of Cell-Site Simulator Technology (2015)
• US Department of Homeland Security: DHS Policy Regarding the Use of Cell-Site Simulator Technology
• 18 U.S.C. 3127, definitions (Cornell LII)
• 47 U.S.C. 301, license for radio communication or transmission of energy (Cornell LII)
• 47 U.S.C. 333, willful or malicious interference (Cornell LII)
• Court of Special Appeals of Maryland: State v. Andrews, No. 1496, September Term 2015 (filed 30 March 2016)
• District of Columbia Court of Appeals: Prince Jones v. United States, No. 15-CF-322 (21 September 2017)

Last reviewed: 25 October 2026. Phone settings, 3GPP releases and state laws change; check the linked documentation and opinions for the current position before relying on a specific detail.