https://www.eff.org/deeplinks/2025/03/meet-rayhunter-new-open-source-tool-eff-detect-cellular-spying Skip to main content * About + Contact + Press + People + Opportunities * Issues + Free Speech + Privacy + Creativity and Innovation + Transparency + International + Security * Our Work + Deeplinks Blog + Press Releases + Events + Legal Cases + Whitepapers + Podcast + Annual Reports * Take Action + Action Center + Electronic Frontier Alliance + Volunteer * Tools + Privacy Badger + Surveillance Self-Defense + Certbot + Atlas of Surveillance + Cover Your Tracks + Street Level Surveillance + apkeep * Donate + Donate to EFF + Giving Societies + Shop + Org. Membership + Other Ways to Give + Membership FAQ * Donate + Donate to EFF + Shop + Other Ways to Give * Search form Search [ ] --------------------------------------------------------------------- Email updates on news, actions, and events in your area. Join EFF Lists * Copyright (CC BY) * Trademark * Privacy Policy * Thanks Electronic Frontier Foundation Donate Electronic Frontier Foundation * About + Contact + Press + People + Opportunities * Issues + Free Speech + Privacy + Creativity and Innovation + Transparency + International + Security * Our Work + Deeplinks Blog + Press Releases + Events + Legal Cases + Whitepapers + Podcast + Annual Reports * Take Action + Action Center + Electronic Frontier Alliance + Volunteer * Tools + Privacy Badger + Surveillance Self-Defense + Certbot + Atlas of Surveillance + Cover Your Tracks + Street Level Surveillance + apkeep * Donate + Donate to EFF + Giving Societies + Shop + Org. Membership + Other Ways to Give + Membership FAQ * Donate + Donate to EFF + Shop + Other Ways to Give * Search form Search [ ] Meet Rayhunter: A New Open Source Tool from EFF to Detect Cellular Spying DEEPLINKS BLOG By Cooper Quintin and Will Greenberg March 4, 2025 Rayhunter logo depicting a purple orca with a sharp toothy smile, jumping over a green signal bar wi Meet Rayhunter: A New Open Source Tool from EFF to Detect Cellular Spying Share It Share on Twitter Share on Facebook Copy link Rayhunter logo depicting a purple orca with a sharp toothy smile, jumping over a green signal bar wi At EFF we spend a lot of time thinking about Street Level Surveillance technologies--the technologies used by police and other authorities to spy on you while you are going about your everyday life--such as automated license plate readers, facial recognition, surveillance camera networks, and cell-site simulators (CSS). Rayhunter is a new open source tool we've created that runs off an affordable mobile hotspot that we hope empowers everyone, regardless of technical skill, to help search out CSS around the world. CSS (also known as Stingrays or IMSI catchers) are devices that masquerade as legitimate cell-phone towers, tricking phones within a certain radius into connecting to the device rather than a tower. CSS operate by conducting a general search of all cell phones within the device's radius. Law enforcement use CSS to pinpoint the location of phones often with greater accuracy than other techniques such as cell site location information (CSLI) and without needing to involve the phone company at all. CSS can also log International Mobile Subscriber Identifiers (IMSI numbers) unique to each SIM card, or hardware serial numbers (IMEIs) of all of the mobile devices within a given area. Some CSS may have advanced features allowing law enforcement to intercept communications in some circumstances. What makes CSS especially interesting, as compared to other street level surveillance, is that so little is known about how commercial CSS work. We don't fully know what capabilities they have or what exploits in the phone network they take advantage of to ensnare and spy on our phones, though we have some ideas. We also know very little about how cell-site simulators are deployed in the US and around the world. There is no strong evidence either way about whether CSS are commonly being used in the US to spy on First Amendment protected activities such as protests, communication between journalists and sources, or religious gatherings. There is some evidence--much of it circumstantial--that CSS have been used in the US to spy on protests. There is also evidence that CSS are used somewhat extensively by US law enforcement, spyware operators, and scammers. We know even less about how CSS are being used in other countries, though it's a safe bet that in other countries CSS are also used by law enforcement. Much of these gaps in our knowledge are due to a lack of solid, empirical evidence about the function and usage of these devices. Police departments are resistant to releasing logs of their use, even when they are kept. The companies that manufacture CSS are unwilling to divulge details of how they work. Until now, to detect the presence of CSS, researchers and users have had to either rely on Android apps on rooted phones, or sophisticated and expensive software-defined radio rigs. Previous solutions have also focused on attacks on the legacy 2G cellular network, which is almost entirely shut down in the U.S. Seeking to learn from and improve on previous techniques for CSS detection we have developed a better, cheaper alternative that works natively on the modern 4G network. Introducing Rayhunter To fill these gaps in our knowledge, we have created an open source project called Rayhunter.1 It is developed to run on an Orbic mobile hotspot (Amazon, Ebay) which is available for $20 or less at the time of this writing. We have tried to make Rayhunter as easy as possible to install and use, regardless of your level of technical knowledge. We hope that activists, journalists, and others will run these devices all over the world and help us collect data about the usage and capabilities of cell-site simulators (please see our legal disclaimer.) Rayhunter works by intercepting, storing, and analyzing the control traffic (but not user traffic, such as web requests) between the mobile hotspot Rayhunter runs on and the cell tower to which it's connected. Rayhunter analyzes the traffic in real-time and looks for suspicious events, which could include unusual requests like the base station (cell tower) trying to downgrade your connection to 2G which is vulnerable to further attacks, or the base station requesting your IMSI under suspicious circumstances. Rayhunter notifies the user when something suspicious happens and makes it easy to access those logs for further review, allowing users to take appropriate action to protect themselves, such as turning off their phone and advising other people in the area to do the same. The user can also download the logs (in PCAP format) to send to an expert for further review. The default Rayhunter user interface is very simple: a green (or blue in colorblind mode) line at the top of the screen lets the user know that Rayhunter is running and nothing suspicious has occurred. If that line turns red, it means that Rayhunter has logged a suspicious event. When that happens the user can connect to the device's WiFi access point and check a web interface to find out more information or download the logs. A picture of Rayhunter running on the orbic hotspot. Orbic is about the size of a small cell phone and the rayhunter UI is a single green line at the top Rayhunter in action Installing Rayhunter is relatively simple. After buying the necessary hardware, you'll need to download the latest release package, unzip the file, plug the device into your computer, and then run an install script for either Mac or Linux (we do not support Windows as an installation platform at this time.) We have a few different goals with this project. An overarching goal is to determine conclusively if CSS are used to surveil free expression such as protests or religious gatherings, and if so, how often it's occurring. We'd like to collect empirical data (through network traffic captures, i.e. PCAPs) about what exploits CSS are actually using in the wild so the community of cellular security researchers can build better defenses. We also hope to get a clearer picture of the extent of CSS usage outside of the U.S., especially in countries that do not have legally enshrined free speech protections. Once we have gathered this data, we hope we can help folks more accurately engage in threat modeling about the risks of cell-site simulators, and avoid the fear, uncertainty, and doubt that comes from a lack of knowledge. We hope that any data we do find will be useful to those who are fighting through legal process or legislative policy to rein in CSS use where they live. If you're interested in running Rayhunter for yourself, pick up an Orbic hotspot (Amazon, Ebay), install Rayhunter, and help us collect data about how IMSI catchers operate! Together we can find out how cell site simulators are being used, and protect ourselves and our communities from this form of surveillance -- Legal disclaimer: Use Rayhunter at your own risk. We believe running this program does not currently violate any laws or regulations in the United States. However, we are not responsible for civil or criminal liability resulting from the use of this software. If you are located outside of the US please consult with an attorney in your country to help you assess the legal risks of running this program * 1. A note on the name: Rayhunter is named such because Stingray is a brand name for cell-site simulators which has become a common term for the technology. One of the only natural predators of the stingray in the wild is the orca, some of which hunt stingrays for pleasure using a technique called wavehunting. Because we like Orcas, we don't like stingray technology (though the animals are great!), and because it was the only name not already trademarked, we chose Rayhunter. Related Issues Cell Tracking Tags Cell-site simulators threat lab Street Level Surveillance CSS Share It Share on Twitter Share on Facebook Copy link Join EFF Lists Discover more. Email updates on news, actions, events in your area, and more. Email Address [ ] Postal Code (optional) [ ] Anti-spam question: Enter the three-letter abbreviation for Electronic Frontier Foundation: [ ] Don't fill out this field (required) [ ] [Submit] Thanks, you're awesome! Please check your email for a confirmation link. Oops something is broken right now, please try again later. Related Updates An animated image showing location pins dropping onto a street map from above, tracing several paths Deeplinks Blog by Andrew Crocker | July 19, 2024 EFF Tells Minnesota Supreme Court to Strike Down Geofence Warrant As Fourth Circuit Court of Appeals Takes the Wrong Turn We haven't seen the end of invasive geofence warrants just yet, despite Google's big announcement late last year that it was fundamentally changing how it collects location data. Today, EFF is filing an amicus brief in the Minnesota Supreme Court in State v. Contreras-Sanchez, involving a warrant... [og-stingrayfcc_6] Deeplinks Blog by Beryl Lipton, Cooper Quintin | June 12, 2024 The Next Generation of Cell-Site Simulators is Here. Here's What We Know. Dozens of policing agencies are currently using cell-site simulators (CSS) by Jacobs Technology and its Engineering Integration Group (EIG), according to newly-available documents on how that company provides CSS capabilities to local law enforcement. A proposal document from Jacobs Technology, provided to the Massachusetts State Police (MSP)... An animated image showing location pins dropping onto a street map from above, tracing several paths Deeplinks Blog by Karen Gullo | March 15, 2024 Location Data Tracks Abortion Clinic Visits. Here's What to Know Our concerns about the selling and misuse of location data for those seeking reproductive and gender healthcare are escalating amid a recent wave of cases and incidents demonstrating that the digital trail we leave is being used by anti-abortion activists.The good news is some states and tech companies... The banner for the 2022 Year in Review blog series Deeplinks Blog by Bill Budington, Cooper Quintin | December 24, 2022 EFF's Threat Lab Sharpens Its Knives: 2022 in Review EFF's Threat Lab is dedicated to deep-dive investigations that examine technology-enforced power imbalances in society. In 2022 we've sharpened our knives and honed our skills in an effort to bring down the stalkerware industry, taken aim at invasive surveillance by police, raised red flags around the security and privacy... [og-stingrayfcc_6] Press Release | October 26, 2022 Police Can't Keep Records of Electronic Surveillance Secret Indefinitely, EFF Argues to California Supreme Court SAN FRANCISCO--The Supreme Court of California should review a lower court's decision that allows police to indefinitely keep court records about widespread electronic surveillance secret from the public, the Electronic Frontier Foundation (EFF) argued in a brief filed Tuesday.EFF, along with co-counsel from the Law Office of Michael T.... [mobile-privacy] Deeplinks Blog by Karen Gullo | August 26, 2022 TechCrunch Launches Lookup Tool to Help Android Users Know if Their Device Was Compromised by a Family of Stalkerware Apps The scourge of stalkerware--malicious apps used by perpetrators of domestic violence to secretly spy on their victims--is not going unchallenged or unaddressed.Antivirus makers are increasingly adding stalkerware to the list of apps their products detect on devices; victim support groups help people figure out whether their devices are... [mobile-surveillance] Deeplinks Blog by Karen Gullo | August 17, 2022 Arrest of a Stalkerware-maker in Australia Underscores Link Between Stalkerware and Domestic Abuse The ease with which bad actors can find a worldwide market for malicious apps that spy on people's digital devices is at the center of an Australian Federal Police case against a man who, starting at the age of 15, wrote a stalkerware application and sold it to 14,500 people... [mobile-surveillance_2] Deeplinks Blog by Cooper Quintin | January 12, 2022 VICTORY: Google Releases "disable 2g" Feature for New Android Smartphones Update: This feature is only available on certain phones running Android 12. So far we have only confirmed it is available on the Pixel 6. Last year Google quietly pushed a new feature to its Android operating system allowing users to optionally disable 2G at the modem level in their... [eff-pr-og] Press Release | November 19, 2020 Find Out How Ad Trackers Follow You On the Web With EFF's "Cover Your Tracks" Tool San Francisco--The Electronic Frontier Foundation (EFF) today launched Cover Your Tracks, a interactive tool that teaches users how advertisers follow them as they shop or browse online, and how to fight back against corporate trackers to protect their privacy, mitigate relentless ad targeting, and improve the web ecosystem for... Atlas of Surveillance branding on blue Press Release | July 13, 2020 EFF Launches Searchable Database of Police Agencies and the Tech Tools They Use to Spy on Communities San Francisco--The Electronic Frontier Foundation (EFF), in partnership with the Reynolds School of Journalism at the University of Nevada, Reno, today launched the largest-ever collection of searchable data on police use of surveillance technologies, created as a tool for the public to learn about facial recognition, drones, license plate readers,... Discover more. Email updates on news, actions, events in your area, and more. Email Address [ ] Postal Code (optional) [ ] Anti-spam question: Enter the three-letter abbreviation for Electronic Frontier Foundation: [ ] Don't fill out this field (required) [ ] [Submit] Thanks, you're awesome! Please check your email for a confirmation link. Oops something is broken right now, please try again later. Share It Share on Twitter Share on Facebook Copy link Related Issues Cell Tracking Related Tags Cell-site simulators threat lab Street Level Surveillance CSS Back to top EFF Home Follow EFF: * x * facebook * instagram * youtube * flicker * linkedin * mastodon * tiktok * threads Check out our 4-star rating on Charity Navigator. Contact * General * Legal * Security * Membership * Press About * Calendar * Volunteer * Victories * History * Internships * Jobs * Staff * Diversity & Inclusion Issues * Free Speech * Privacy * Creativity & Innovation * Transparency * International * Security Updates * Blog * Press Releases * Events * Legal Cases * Whitepapers * EFFector Newsletter Press * Press Contact Donate * Join or Renew Membership Online * One-Time Donation Online * Giving Societies * Shop * Other Ways to Give * Copyright (CC BY) * Trademark * Privacy Policy * Thanks JavaScript license information *