Rayhunter: Device to Detect Cellular Surveillance – Source: www.schneier.com

Clive Robinson • March 7, 2025 2:39 PM

@ Bruce, ALL,

With regards

“It runs on a $20 mobile hotspot.”

Such are the joys of technology where the price to capability just keeps dropping.

But you need to consider,

“Is the use of the technology actually lawful?”

Because the main thing to remember is that,

“Technology is agnostic to use.”

And that it is,

“The directing mind that choses the “use” any given piece of technology is used for.”

But also note the “usage warning” about the legality of use in any given jurisdiction… Which emphasises the point that,

“Usage as ‘good or bad’ is seen by a supposedly impartial observer at some point after the usage event.”

(Where impartiality is far from certain).

In the UK for instance you are only allowed to monitor or listen to the,

“designated public broadcast bands”

Not anything else, so you get an interesting situation of how you are licensed for non public broadcasts which covers all other EM emissions / communications as they say,

“From DC to Daylight and beyond.”

Which covers all cordless, mobile and Smart Devices not using ISM or Broadcast bands.

In effect this makes actual usage or usage intent “licensed” so you use the “HotSpot” or other equipment only for what it has been certified and licensed for, anything else is technically an offence…

Yup I know it’s a silly way to carry on, but that’s the way many countries licencing authorities work.

Even in the US this is true… Use a piece of Ham gear to work the CB frequencies is illegal as the Ham gear is not licenced for the CB band. Likewise use a cheap Chinese Ham HT that covers a lot of the VHF and UHF frequencies including GMRS and other “Family Radio Service”(FRS) and again your usage of the equipment is not licenced.

So even in the US this usage of the hotspot is “not licenced” thus technically not lawful.

But the article mentions,

“CSS operate by conducting a general search of all cell phones within the device’s radius. Law enforcement use CSS to pinpoint the location of phones often with greater accuracy than other techniques such as cell site location information (CSLI) and without needing to involve the phone company at all. CSS can also log International Mobile Subscriber Identifiers (IMSI numbers) unique to each SIM card, or hardware serial numbers (IMEIs) of all of the mobile devices within a given area. Some CSS may have advanced features allowing law enforcement to intercept communications in some circumstances.“

As most of these “Cell Site Simulators”(CSS) are,

1, Not licenced as equipment.
2, Not licenced for use.
3, Operators are not licensed.

Their use is actually illegal by any entity not formally covered by Federal or State Legislation and quite specific Legislation / Regulation… Which means they are more often than not being used illegally as the “National Security” excuse / clause really does not apply.

But note what I’ve highlighted. It’s rather more than “intercept” in the way most might think of it, like old school passive “wire tapping”.

As I’ve mentioned before people need to look up “SMS 0” it’s just a small part of how the “Network Operator” does “Over The Air”(OTA) Interface control of the “Subscriber Interface Module”(SIM) in your device.

Your device actually does not logically “connect to the network” it connects to the SIM and it is the SIM that connects to the network.

The SIM is a fully fledged computer in it’s own right and thus it decides what your device can and can not do at any and all levels of communication.

You’ve probably all heard of CALEA well technically your SIM should in the US have a CALEA interface capability “built in” (and due to the extended OTA Interface it does).

The only thing protecting your SIM from unauthorised OTA Updates is a small amount of Encryption… In quite a few SIMs untill recently that was DES using a general “network key”. Whilst the algorithms have been updated a bit, the system they are used in has not.

As most here should be aware getting a network wide encryption key is not exactly difficult.

One way is by issuing a letter be it NSL in the US or TCL in the UK etc. Alternatively as was seen with stuxnet, people on the network suppler side usually do not take sufficient care. Thus a semi covert “Black Bag Job” will do it as well, or as with the “Greek Olympics Scandal” you just lean on an individual who has access then dispose of them afterwards.

Once that network encryption key is known, there is very little someone with “appropriate technical capability” can not do as they own you through the SIM that owns the Device you hold.

One way that has been suggested in the past is to use a mobile phone only without a SIM via WiFi etc. This did work once… But most mobile / Smart device OS’s have back doors built right in for the likes of Alphabet/Google to own your device to “own you” as “product”…

It’s time people realised that the “communications endpoint” you call a smart/mobile device is very much,

“Insecure by Design.”

thus you have to,

“Take off device mitigations.”

I’ve mentioned some before. Unfortunately as such,

‘The mitigations require a high degree of “Operational Security”(OpSec) to use.’

A part of which is,

‘Good “Key Material”(KeyMat) Management”(KeyMan).’

You only have to look at the various “faux-secure device” scams run by various LEO’s under “Mutual Assistance Instrument” that allows loop holes in one Nation’s legislation to be used by another Nations Law Enforcement in ways that would not otherwise be lawful (in the US think of the oft used running a call “off shore” so it comes under “Foreign Intelligence Surveillance Act of 1978″(FISA).

One such faux-secure device was EncroChat, and you can see the “hoops and loops” a tribunal had to jump through to make it “appear lawful”,

https://investigatorypowerstribunal.org.uk/judgement/sf-and-ors-v-nca-ipt-21-05-ch/

When,

“The authorities make it up as they go along”

And

“Can get the judiciary to ‘nod along’.”

You know you have “a tough journey ahead”.

And lookin at taking another path might be wise, even though at first it might appear harder to travel.