LAWFUL INTERCEPTION, OR COVERT SURVEILLANCE?
Review Article Keywords: IMSI Catcher • Stingray • IMSI • 5G SUPI/SUCI • Downgrade Attack • CMK • Privacy ABSTRACT An IMSI Catcher is an electronic surveillance device that mimics a genuine mobile network base station, forcing all mobile devices in its coverage area to connect through it and thereby obtaining their IMSI/SUCI numbers, location information and, in certain configurations, communication content. While this technology is used by law enforcement agencies in legitimate criminal investigations, it can also be deployed by non-state actors, commercial surveillance companies and organised crime groups. This review article addresses comprehensively the technical operating principles of IMSI Catcher technology, the evolution of cellular network security from 2G to 5G, the persistent vulnerabilities in the 5G NSA and SA architectures, the mechanism of the downgrade attack, the limitations of the 5G SUPI/SUCI mechanism, the effect on the privacy rights of non-targeted individuals, the scale of the commercial surveillance market, detection tools and methodologies, international judicial developments, ECtHR case law, the impact of Carpenter v. United States, the legal frameworks of countries such as Germany and France, and the position under Turkish law.
Keywords: IMSI catcher, stingray, false base station, cell site simulator, 5G SUPI, SUCI, downgrade attack, 5G NSA, cellular network security, surveillance technology, CMK 135, ECtHR, Carpenter v. United States ABSTRACT An IMSI Catcher is an electronic surveillance device that mimics a genuine mobile network base station, forcing all mobile devices in its coverage area to connect through it, thereby obtaining IMSI/SUCI numbers, location information, and in some configurations, communication content. This technology is used by law enforcement agencies in legitimate criminal investigations, but can also be deployed by non-state actors, commercial surveillance companies, and organized crime. This review article comprehensively addresses the technical operating principles of IMSI Catchers, the evolution of cellular network security from 2G to 5G, persistent vulnerabilities in 5G NSA and SA architectures, the downgrade attack mechanism, limitations of the 5G SUPI/SUCI mechanism, the impact on privacy rights of non-targeted individuals, the scale of the commercial surveillance market, detection tools and methodologies, international judicial developments, ECtHR case law, the impact of Carpenter v. United States, legal frameworks in Germany and France, and evaluations in Turkish law. Keywords: IMSI catcher, stingray, false base station, cell site simulator, 5G SUPI, SUCI, downgrade attack, 5G NSA, cellular security, surveillance technology, CMK 135, ECHR, Carpenter v. United States, privacy, GDPR 1. Introduction Mobile communication constitutes the dominant form of personal and institutional communication today. Cellular networks, operating with more than six billion mobile subscribers worldwide, carry not only individual communication but also financial transactions, health systems and critical infrastructure. This dependency makes the security of mobile network infrastructure a strategic matter for individuals, institutions and states alike.
The IMSI Catcher — known commercially as Stingray, Hailstorm, DRTBox or Yellowstone — is one of the most contested technologies in this strategic security field. Initially accessible only to military and intelligence units, these devices have been opened to the commercial market since the mid-2010s; according to SkyQuest's (2024) market analysis the global IMSI Catcher market reached a value of USD 179.3 million in 2023 and is projected to rise to USD 402.5 million by 2032 at a compound annual growth rate of 9.4 per cent.
This growth does not reflect legitimate law enforcement use alone. Commercial IMSI Catcher systems produced by Gamma Group, Trovicor and various Israel-based companies are used by authoritarian governments against dissidents and journalists, deployed in corporate espionage operations and used by organised crime groups to track targets. InfiShark (2026) describes this picture as follows: 'IMSI Catcher deployment takes place with very little legal oversight in most jurisdictions.' The aim of this article is to set out IMSI Catcher technology in both its technical and its legal dimensions, and at its true depth. The evolution of the security architecture from 2G to 5G, the vulnerabilities that persist, the commercial surveillance market, detection methods and Türkiye's position in this picture are the principal axes structuring the article.
2. Technical Architecture: The Anatomy of a Man-in-the-Middle Attack 2.1 The Fundamental Security Flaw of the GSM Protocol The whole structure of IMSI Catcher technology feeds on the one-way authentication architecture built into the GSM (2G) protocol at the design stage. Palindrome Tech (2025) describes this fundamental weakness as follows: 'This fundamental architectural flaw went uncorrected for decades: the mobile device had to prove its identity to the network, but the network had no obligation to prove its identity to the device.' The absence of this two-way assurance opens the door for a false base station to be accepted as a genuine one. In the GSM protocol the IMSI (International Mobile Subscriber Identity) is a 15-digit number uniquely identifying the subscription on a SIM card. On first network connection and when a network connection is broken and re-established, the device as a rule transmits its IMSI over the air in plaintext. Zetier (2025) summarises the situation: 'In the 2G and 3G protocols IMSIs are transmitted in plaintext in three circumstances; this creates a personal identifier privacy vulnerability that allows the IMSI to be used for attribution and geolocation.' Entropy Survival (2026) makes the practical dimension of this vulnerability concrete: 'As of 2024 more than 850 million people worldwide remain predominantly connected to 2G networks. Even in regions of the United States with extensive 4G coverage, 2G networks remain active in rural areas and serve as an emergency backup system. In practice this means that every modern phone retains 2G capability and remains vulnerable to downgrade attacks.' 2.2 The Operating Cycle of an IMSI Catcher The operational cycle of an IMSI Catcher takes place in five stages. In the first stage the device emits a signal stronger than that of the genuine base stations around it; since mobile devices tend to connect to the strongest signal, they migrate to the false station. In the second stage the false station sends the connected device a request to transmit its IMSI and IMEI. In the third stage, once this information is received, the device may be reconnected to the genuine network, or kept connected while traffic is relayed through the genuine network by proxy. In the fourth stage, in advanced configurations, the IMSI Catcher moves on to decrypting encrypted or unencrypted 2G communications, intercepting SMS content or listening to voice communications. In the fifth stage the IMSI/IMEI data obtained is matched against operator records to establish the person's identity, and the location tracking process begins (InfiShark, 2026).
2.3 Passive and Active IMSI Catcher Types IMSI Catchers fall into two basic categories according to mode of operation. Passive IMSI Catchers collect IMSI/IMEI information merely by listening to the signal traffic circulating over the air, without impersonating a base station. This mode is effective only on networks that are unencrypted or use weak encryption (2G, and some 3G configurations). Active IMSI Catchers draw devices to themselves using the base station impersonation method. The advanced configuration capabilities offered by active devices are: interception of unencrypted voice and SMS content (only in 2G/A5-0 mode), disabling the device (Denial of Service), redirecting a false SMS or call to the target device, and forcing the device down to 2G (downgrade attack). The vehicle-mounted IMSI Catcher system released by Shoghi Communications in 2024 combines in a single platform the capacity to operate across all generations from 2G to 5G, GPS-based target location and high-speed scanning of the radio environment (SkyQuest, 2024).
2.4 The Downgrade Attack: Forcing 5G Devices Down to 2G The downgrade attack is the technical mechanism for forcing modern 4G or 5G phones to connect to vulnerable 2G networks. Entropy Survival (2026) explains the mechanism: 'The attacker emits signals claiming that 4G is unavailable or unreliable. The phone's automatic network selection interprets this as a valid network condition and voluntarily falls back to 2G. The user is unaware of the change; the device continues to function normally.' Palindrome Tech (2025) stresses the persistence of this attack in 5G NSA configurations: 'The first widespread deployment of 5G takes place in 5G Non-Standalone (NSA) mode, which uses the existing 4G core. Much of 4G's vulnerability is therefore inherited and the threat of downgrade attacks persists.' Zetier (2025) makes this dynamic concrete: '5G is a multi-stage deployment process, and all 5G NSA deployments have the same vulnerabilities as 4G.' The technical mechanism operates as follows: the false base station broadcasts in its system information blocks (SIB) false parameters stating that the 4G network is unavailable or that signal quality is inadequate. The device accepts this information as lawful network conditions and moves to 2G; but during that transition the IMSI is transmitted in plaintext in the authentication process (Preeß Mattsson and Nakarmi, 2021; Dabrowski et al., 2014). Table 1. Comparison of IMSI Catcher Capabilities by Generation Capability 2G (GSM) 3G (UMTS) 4G (LTE) 5G NR IMSI/IMEI collection Yes (plaintext) Yes (via attack) Limited SA: Very Hard / NSA: Hard Location determination Yes Yes Yes SA: Limited / NSA: Yes SMS content interception Yes (A5/0) Hard No No Voice content interception Yes (A5/0) Hard No No Downgrade attack N/A Possible to 2G Possible to 2G NSA: Possible / SA: Difficult DoS (service denial) Yes Yes Partial Reduced but present Note. Compiled on the basis of 3GPP (2019); Palindrome Tech (2025); Zetier (2025); Entropy Survival (2026); InfiShark (2026).
3. The Evolution of Cellular Network Security: From 2G to 5G 3.1 GSM (2G): Security Design Choices and Persistent Vulnerabilities The GSM standard was designed in the late 1980s; its security requirements were shaped with regard to the computing capacity of the period, regulatory concerns and the priority goal of network interoperability. The A5/1 encryption algorithm attracted strong cryptographic criticism, while A5/2 was deliberately weakened because of export restrictions. The A5/0 mode applies no encryption at all.
The combination of these design choices left GSM networks with only limited protection against passive interception. As regards active IMSI Catcher attacks, the fundamental vulnerability is structural: because the network is not required to authenticate itself, there is no cryptographic mechanism distinguishing a false base station from a genuine one (Dabrowski et al., 2014).
3.2 UMTS (3G): Mutual Authentication and Remaining Weaknesses The third-generation UMTS standard introduced the requirement of mutual authentication to remedy GSM's most critical shortcoming: both the device and the network must prove their identity to the other cryptographically. This advance theoretically makes mere base station impersonation impossible.
Even so, two critical vulnerabilities persist in 3G. First, at the initial connection stage the device must transmit its true identity (IMSI) in plaintext; this transmission takes place before the network's identity has been authenticated. Second, 3G's mandatory support for fallback to 2G enables attackers to move devices from 3G down to 2G. These vulnerabilities mean that 3G provides only partial protection against active IMSI Catchers (Preeß Mattsson and Nakarmi, 2021). 3.3 LTE (4G): Strong Encryption, Weakened Identity Privacy The fourth-generation LTE standard substantially strengthened encryption and integrity protection algorithms, largely leaving behind 3G's weak encryption options. LTE also makes mutual authentication standard at the start of a connection. These developments markedly improved content interception resistance and transmission security. LTE nevertheless cannot eliminate the IMSI Catcher threat entirely. In certain circumstances — particularly when the device connects to the network for the first time or when temporary identity (TMSI) information is absent — the IMSI can be transmitted in plaintext. In addition, the downgrade attack vector can operate over 4G as well: a false LTE base station can manipulate the security negotiation so as to select weak algorithms identifying the device (MDPI, 2024).
From a practical perspective Zetier (2025) offers this assessment: 'Over the years I have come across many misconfigured towers; I would therefore assume that a downgraded connection is vulnerable. Mobile operators may also not use SUCI at all. I am not sure how widespread this vulnerability is in practice, but I believe it is not zero.' 3.4 5G NR: The SUPI/SUCI Mechanism and Remaining Vulnerabilities 3.4.1 SUPI and SUCI: Conceptual Framework The 5G New Radio (NR) standard brought a fundamental innovation at design level against the IMSI Catcher threat. Thales Group (2021) explains the mechanism: '5G created a new identifier: the SUPI (Subscription Permanent Identifier). Devices do not transmit the SUPI over the air. Instead an encrypted key called the SUCI (Subscription Concealed Identifier) is transmitted. Even if an attacker intercepts the SUCI, that information is useless and cannot be used to collect data. It is a kind of mask; it changes every time.' Technically the SUCI is formed by encrypting the SUPI with the network's public key using the Elliptic Curve Integrated Encryption Scheme (ECIES) and is regenerated on each use. This one-time ephemeral key structure also protects the SUCI against replay attacks. According to the assessment of InfiShark (2026), '5G in its Standalone (SA) form makes IMSI collection and interception attacks significantly harder.' 3.4.2 The SUCI Length Vulnerability: The Ericsson/Nori Study A significant weakness in the 5G SUCI mechanism was documented in the 2021 'Nori' study by Ericsson researchers Preeß Mattsson and Nakarmi. That research found that the ECIES profiles specified in the 3GPP TS 33.501 standard contain a critical security vulnerability: because SUCI encryption uses AES-CTR mode, the ciphertext is the same length as the plaintext. Where Network Specific Identifiers (NSI) use variable lengths, this property gives rise to a 1-anonymity problem: individual subscribers can easily be identified and tracked.
The recommendation of the Nori study is this: it is strongly recommended that 3GPP and the GSMA standardise and recommend a padding mechanism for the SUCI before variable-length identifiers come into wider use. In Ericsson's (2024) response to these findings the following solution is put forward: 'that 3GPP recommend CSPs use fixed-length subscription identities or pad variable-length codes to the same length.' 3.4.3 The 5G SUCI-Catcher Attack: The ACM WiSec 2021 Proof That even the 5G architecture does not provide full protection against SUCI-based tracking attacks was shown by a proof-of-concept study presented at the ACM WiSec 2021 conference. In that study researchers demonstrated that a SUCI-based attack is possible on a 5G Standalone network. The researchers capture encrypted SUCIs and establish a connection through the Authentication and Key Agreement (AKA) procedure. If the identity of the target person is already known, the attacker can carry out a probe targeting that person and determine whether they are within the area (ACM WiSec, 2021).
This finding reveals a critical limitation: the 5G SUCI mechanism is highly successful at preventing the bulk collection of IMSIs of individuals whose identity is unknown. But in tracking a person whose identity is already known, linkability through the AKA procedure remains possible. This shows that 5G does not offer a complete security guarantee in the context of targeted surveillance.
3.4.4 The Security Difference Between 5G SA and NSA Two basic architectures exist in 5G deployment. In Non-Standalone (NSA) mode the 5G radio access network operates together with the existing 4G (LTE) core. This structure means that all of 4G's security vulnerabilities are inherited. The experimental study conducted by MDPI (2024) on 5G NSA confirmed that in the test environment developed, IMSI leakage, Numb and Downgrade attacks work in practice on a 5G NSA network.
In Standalone (SA) mode 5G comprises both the radio and the core network, and SUPI concealment and other advanced security features come fully into play. Lightreading (2023) assesses the security features of Standalone 5G as follows: 'Foremost among them is the privacy provided by mandatory temporary and randomised phone identities. But some features specified in the current Release 16 specification remain optional, which allows operators to choose which protections to implement.' Table 2. Security Comparison of the 5G SA and NSA Architectures Security Feature 5G NSA 5G SA SUPI concealment (SUCI) Partial (limited by the 4G core) Full (mandatory with ECIES) Mutual authentication Inherited from 4G (weak) Strong with 5G AKA Downgrade attack risk High Low (but not zero) IMSI leakage risk Moderate-High Low (except the Nori vulnerability) SUCI Catcher attack Possible Possible in a targeted attack 2G/3G legacy vulnerabilities All applicable Neutralised Note. Compiled on the basis of Palindrome Tech (2025); MDPI (2024); Zetier (2025); Preeß Mattsson & Nakarmi (2021); Lightreading (2023).
4. Bulk Data Collection: Disproportionate Impact and Sensitive Contexts 4.1 The Collection of Data on Non-Targeted Individuals The most contested dimension of the IMSI Catcher is that it collects data from every mobile device in its coverage area. When a law enforcement body deploys an IMSI Catcher targeting a particular suspect, the IMSI/IMEI information and location data of hundreds or thousands of innocent people in the same area are also collected. In the Baltimore case documented by the EFF (SLS, undated), police used an IMSI Catcher more than 4,300 times between 2007 and 2015, mostly without judicial authorisation.
The legal implication of this conflicts directly with the prohibition on 'general searches'. The EFF (SLS, undated) states the problem as follows: 'Cell site simulators violate the privacy of everyone in the coverage area, including the great majority who are not alleged to have committed any crime. These amount to general searches, in conflict with the requirement that warrants describe "particularly" the person or thing to be searched.' 4.2 Particular Risks in Sensitive Contexts The use of IMSI Catchers in certain places carries especially grave risks of privacy violation. These risks take concrete form in five critical contexts. Healthcare facilities: patients' location information carries the risk of disclosing health information relating to the department visited. An IMSI collected in the corridor of a hospital oncology, psychiatry or HIV clinic may amount to a disclosure of information about that person's state of health. Law firms and court buildings: the confidentiality of lawyer–client communication may be jeopardised. In this context the use of an IMSI Catcher also damages the right to legal representation.
Places of religious worship and political meeting venues: special category data such as belief and political opinion may be obtained indirectly. The EFF has documented that state officials in the United States deployed Stingray devices during mass protest demonstrations and compiled the identity information of thousands of people (ESPLawyers, undated). Press conferences and journalists' meeting points: there is a risk that source confidentiality will be broken. An IMSI Catcher deployed while journalists meet their sources physically can expose the source's identity.
The parallel construction risk: in the United States, confidentiality agreements signed with Harris Corporation have driven police units to conceal their use of IMSI Catchers from the courts. That practice is termed 'parallel construction'; evidence is presented as though obtained by a route other than its actual source. InfiShark (2026) describes the practice as follows: 'Harris Corporation's non-disclosure agreements have led prosecutors to drop cases, misrepresent how evidence was obtained, or withhold information from defendants about the surveillance methods used.' 5. The Commercial Surveillance Sector and Market Size 5.1 The Global IMSI Catcher Market IMSI Catcher technology has ceased to be a field exclusive to state institutions and has become an ever-growing commercial industry. According to SkyQuest (2024) market research, the global IMSI Catcher market was worth USD 179.3 million in 2023 and is expected to reach USD 402.5 million by 2032 at an annual growth rate of 9.4 per cent. Business Research Insights (2024) estimates this figure at USD 196.1 million for 2024 and forecasts 7 per cent growth to 2033.
Among the principal drivers of this growth are the rise in national security demand, the deepening of intelligence-gathering requirements and the desire to increase law enforcement capacity for the prevention of criminal activity. Artificial intelligence integration is transforming this sector too: as noted in SkyQuest's (2024) report, AI-integrated IMSI systems can identify high-value targets more quickly, improve real-time threat detection and increase surveillance precision.
The vehicle-mounted IMSI Catcher system released by Shoghi Communications in 2024 is emblematic of this transformation: capable of operating across all generations from 2G to 5G and offering GPS-based target location and high-speed radio environment scanning, the system is officially declared to be offered 'for government agencies and law enforcement bodies' (SkyQuest, 2024). 5.2 Commercial Surveillance Companies and Export Concerns Gamma Group (UK/Germany), BAE Systems Applied Intelligence, Trovicor (Germany) and various Israel-based companies produce and market commercial IMSI Catcher systems. Human rights organisations have documented extensively that these systems are used by authoritarian governments against opposition figures, journalists and activists. The EU export control regulations that entered into force in July 2023 introduced restrictions on the export of commercial surveillance technologies to third countries.
Another critical concern in the commercial use of IMSI Catchers is corporate espionage. IMSI Catchers deployed for competitive intelligence purposes or during business negotiations can provide access to company secrets and to personnel's personal data. Although this use is clearly unlawful in almost every jurisdiction, it is extremely difficult to detect. 6. The Legal Framework: The International Position 6.1 ECtHR Case Law and Basic Standards The European Court of Human Rights determines the limits of state practice in the field of telecommunications surveillance through the case law it has developed. Zakharov v. Russia (Grand Chamber, 2015) is one of the most comprehensive ECtHR judgments in this field. In that judgment the court held that for covert surveillance practices to be compatible with Article 8 of the Convention, a legal basis is required that is accessible, foreseeable and protected against arbitrary application. Bulk surveillance systems in particular cannot meet these criteria, since they carry the capacity to monitor millions of people in the absence of individual suspicion. The judgment in Szabó and Vissy v. Hungary (2016) established clearly that bulk and untargeted telecommunications surveillance gives rise to a violation of rights under Article 8 of the Convention. This case law sets out the criteria that are mandatory for the use of an IMSI Catcher: a specific legal basis for individual interference, judicial or independent administrative supervision, an assessment of necessity and proportionality, and a clear procedure for the destruction of non-target data. These criteria indicate that bulk IMSI Catcher use is by its nature in conflict with ECtHR case law.
6.2 Developments in US Law and the Carpenter Decision IMSI Catcher law in the United States has historically been deeply inconsistent. InfiShark (2026) summarises the fundamental contradiction: 'In 2015 the US Department of Justice issued a policy requiring federal agencies to obtain a warrant before using cell site simulators outside emergencies or national security cases. Previously many agencies used IMSI Catchers through lower-threshold pen register orders rather than the higher standard of proof required for a warrant.' The decision regarded as the turning point in this picture is Carpenter v. United States (2018). The Supreme Court held that the collection of long-term cell site location information (CSLI) constitutes a search and requires a warrant. According to the assessment of the National Security Law Brief (undated): 'This case now essentially requires police officers to obtain a warrant every time they use an IMSI catcher, since an IMSI catcher collects CSLI and more.' The widespread acceptance of this interpretation has begun to reshape federal and state practice in the United States.
According to ESPLawyers' (undated) analysis of the case law, in United States v. Andrews in 2015 the court excluded the evidence on the basis of Fourth Amendment privacy protection because police had used a Stingray without a warrant. In Baltimore it was documented that police conducted more than 4,300 IMSI Catcher operations between 2007 and 2015, that the great majority of those operations lacked judicial oversight, and that many convictions were subsequently reopened for review.
The Cell-Site Simulator Warrant Act of 2021 aims to establish a legal framework requiring a warrant at federal level and providing for the deletion of data collected on persons who are not the target. Even so, implementation of the law remains inconsistent, and some states such as California have adopted more comprehensive regulation (EFF-SLS, undated).
6.3 Germany: StPO 100i and Europe's Reference Model Germany is among the countries that regulate IMSI Catcher use explicitly, in section 100i of the Code of Criminal Procedure (Strafprozessordnung — StPO). Under that provision an IMSI Catcher may be used only in the investigation of serious offences, by court order and subject to the principle of last resort. The immediate destruction of data on non-target individuals in the coverage area is a legal requirement.
German practice is regarded as an international reference model for reflecting two fundamental principles in the text of the law: the requirement of individualised judicial authorisation, and the obligation of immediate destruction of non-target data. This model makes bulk IMSI Catcher use legally impossible, since each use requires a separate court order.
6.4 The Turkish Legal Context 6.4.1 CMK 135 and the Individualisation Contradiction There is no specific legal framework in Türkiye directly regulating IMSI Catcher technology. The principal legal basis applicable in this gap is Article 135 of the Code of Criminal Procedure (CMK), which governs the interception of telecommunications. That article makes interception subject to a judicial order, allows a decision by the prosecution where delay would be prejudicial, but requires that decision to be submitted for judicial approval within twenty-four hours.
The critical tension in applying CMK 135 to IMSI Catcher use may be stated as follows: while the article provides for the interception of the communications of a particular person, an IMSI Catcher by definition affects every device in its coverage area. Its bulk data collection character appears incompatible with the individualised interception requirement of CMK 135. This contradiction makes it difficult to define a legitimate area of use for the IMSI Catcher within the existing legal framework.
6.4.2 The KVKK Dimension Assessed under Law No. 6698 on the Protection of Personal Data (KVKK), IMSI and IMEI numbers have the status of personal data as data serving to identify a person. The 2024 Annual Report of the KVKK Board (2025) shows that the KVKK continues to apply the principle that personal data may not be processed without explicit consent or a legal obligation.
It is assessed that bulk IMSI collection conducted through an IMSI Catcher without a judicial order may constitute a personal data breach under the KVKK. The processing of telecommunications and location data in particular may stand in indirect relation to the biometric and health data defined as special category data in Article 6 of the KVKK, which makes the protection obligations still heavier.
6.4.3 Law No. 5651 and the Evolution of Digital Surveillance In Türkiye, Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed by Means of Such Publications regulates predominantly online content control, but also provides ground for broad interpretations relating to digital surveillance infrastructure. Under the most recent amendments adopted by the Grand National Assembly in April 2026, identity verification and content obligations directed at social media platforms were expanded. It appears that the dimension of integrating digital surveillance infrastructure with tools such as IMSI Catchers has not yet been debated in relation to these amendments. Even so, addressing the legal framework of digital surveillance technologies and of the categories of personal data collected in an integrated manner remains a significant gap facing Turkish legislation.
6.4.4 Proposals for a Regulatory Framework in Türkiye Türkiye's lack of a legal framework explicitly regulating IMSI Catcher use leaves legitimate security operations in uncertainty and weakens individuals' privacy guarantees. To remedy this deficiency the following regulatory components are proposed.
• Individualised judicial authorisation: a judicial order based on concrete suspicion of an offence should be mandatory for each use.
• Non-target data obligation: data collected in the coverage area belonging to non-target individuals should be destroyed within forty-eight hours at the latest, and this obligation should be guaranteed by law.
• Sensitive context restriction: use in the vicinity of law firms, hospitals, places of worship and press events should require special judicial approval. • A transparent oversight mechanism: annual usage statistics should be reported to an independent supervisory body.
• Incentivising the 5G transition: encouraging operators to shut down 2G/3G infrastructure in stages will narrow the IMSI Catcher attack surface.
7. IMSI Catcher Detection: Technical Defence Mechanisms 7.1 Software-Based Detection Tools Software tools for detecting the presence of an IMSI Catcher fall into three basic categories. The first comprises open-source mobile applications. SnoopSnitch runs on rooted Android phones containing a Qualcomm chipset, alerting the user by detecting unexpected signal drops, silent SMS connections and connections to rogue base stations (Cloudwards, 2025). AIMSICD (Android IMSI-Catcher Detector) monitors cell network parameters and compares them against known base station databases. Suspicious indicators include missing neighbour lists, unusual location area codes and timing advances that may indicate distant tower behaviour. According to Zimperium (undated), SnoopSnitch stands at between 100,000 and 500,000 downloads, while AIMSICD, with a download count of just two, is almost devoid of active maintenance.
The EFF's Crocodile Hunter project is a hardware tool based on Software Defined Radio (SDR) and a Raspberry Pi or Linux system. It continuously monitors the broadcast signals of nearby base stations and can upload them to a database for analysis (InfiShark, 2026).
7.2 The Limitations of Detection Tools The serious limitations of detection applications must be borne in mind. Entropy Survival (2026) summarises these under three headings. First, limited hardware access: modern smartphones deliberately restrict applications' access to low-level radio hardware on security and battery management grounds. This significantly reduces applications' capacity to detect the basic indicators of an IMSI Catcher. Second, false positive and negative rates: real network conditions — varying signal strength, handoff (base station transition) and service area boundaries — can overlap with IMSI Catcher indicators. According to the application's assessment of AIMSICD, the application can produce false positives by identifying legitimate networks as exhibiting IMSI Catcher activity (Cloudwards, 2025). Third, advanced IMSI Catchers may be designed to make such detection harder, preventing detection by keeping signal parameters close to those of a genuine base station.
7.3 Hardware-Based and Enterprise Detection Systems Hardware-based solutions come into play for IMSI Catcher protection at enterprise scale. Zimperium (undated) describes the approach in this field as follows: 'More reliable hardware options make sense for protecting several smartphone users in a single location (such as a business centre or a military base). The typical configuration involves a fixed embedded system that continuously monitors the broadcast signals of nearby base stations and can upload the data to a database for analysis.' For large companies and high-security environments, enterprise solutions such as FirstPoint, ComSec and SecurCube are designed both to monitor network parameters and to report suspicious activity in real time. The integration of these systems into corporate security policies is of strategic importance particularly for the critical infrastructure, banking and defence sectors.
Table 3. Comparison of the Principal IMSI Catcher Detection Tools Tool Type Platform Accuracy Basic Constraint SnoopSnitch Mobile application Android (Qualcomm) Moderate Requires root access + Qualcomm AIMSICD Mobile application Android (rooted) Moderate-Low Unmaintained; false positives EFF Crocodile Hunter Hardware + software Raspberry Pi/Linux High Requires technical expertise FirstPoint / ComSec Enterprise hardware Fixed system High Corporate cost; selective coverage Spectrum analyser Hardware Dedicated device High Expertise + expensive equipment Note. Compiled on the basis of InfiShark (2026); Entropy Survival (2026); Zimperium (undated); Cloudwards (2025).
8. The 2G/3G Sunset Timetable and the Security Dimension of the Transition Period The most important long-term determinant of the IMSI Catcher threat is the timetable for shutting down 2G and 3G networks. This process follows a highly varied course from region to region. Entropy Survival (2026) sets out the picture as follows: 'While operators in the United States plan to shut down 3G completely by 2025, 2G will remain active in most areas until 2026–2027. European countries are targeting 2G/3G shutdown between 2025 and 2030. Many developing countries will retain 2G infrastructure for another decade. Global roaming requirements oblige even countries that have shut down domestically to support these networks for international visitors.' Türkiye's 5G transition timetable is decisive for the course of the IMSI Catcher threat in the country. Within the 5G frequency planning published by the BTK, it is foreseen that Türkiye's transition to 5G SA infrastructure will be completed over the long term. Since NSA deployment will be widespread in that process, 2G/3G networks will also remain active and a transitional period in which downgrade attacks continue to be effective is unavoidable. The practical consequence of this picture is that for 5G to eliminate the IMSI Catcher threat entirely, SA infrastructure must become widespread, 2G/3G networks must be shut down and NSA security vulnerabilities must be remedied. Meeting these three conditions simultaneously will require a process extending beyond the coming decade.
9. Patents and Next-Generation 5G IMSI Catcher Systems It is known that the 5G SUPI/SUCI mechanism blocks the traditional IMSI Catcher technique; but it is striking that next-generation systems aiming to overcome that block are documented in patent records. US Patent No. 12328588 covers a system and method for IMSI catching in 5G networks. According to the patent description, the system contains two separate transmitters mimicking both 5G and lower-generation base stations.
The patent's basic technical approach is as follows: the system obtains from the core network, over the Lawful Interception (LI) communication interface, the 5G identifier corresponding to the relevant SUPI. It then causes the target device to connect to the false station with that 5G identifier; if the match is confirmed it registers the device on a lower-generation system (4G or 2G) and thereby becomes able to apply traditional IMSI Catcher techniques (USPTO, 2025).
This patent raises three important implications. First, it is on record that IMSI Catcher-like systems can operate even on 5G SA infrastructure where access to the lawful interception interface can be secured. Second, development activity on such systems is clearly continuing. Third, the presentation of the patent within a 'lawful interception' framework indicates that the design purpose of this technology is to remain within a legal framework; but how control is to be maintained once it leaves the commercial chain remains a separate question. 10. A Proposed Regulatory Framework and Policy Recommendations A comprehensive regulatory framework is essential if IMSI Catcher use is to be confined to legitimate forensic and security purposes. In the light of international practice and the academic literature, the components of that framework are presented systematically below. 10.1 Legal Safeguards • Individualised judicial authorisation: a court order based on concrete suspicion and confined to the investigation of serious offences. General or preventive IMSI Catcher use should be prohibited by law.
• A 48-hour non-target data destruction obligation: data collected in the coverage area belonging to non-target individuals must be securely destroyed within forty-eight hours at the latest, and the process documented with an audit record.
• A sensitive context special approval requirement: use in healthcare facilities, law firms, places of worship, press conference areas and political event venues should require the approval of a higher judicial authority.
• A ban on non-disclosure agreements (NDAs): confidentiality agreements between manufacturers and law enforcement bodies cannot override the obligation to inform the judiciary. 10.2 Transparency and Oversight Mechanisms • An annual usage statistics report: which institutions used an IMSI Catcher, how many times and in which offence categories should be reported annually to an independent supervisory body.
• An obligation to inform the accused: where IMSI Catcher evidence is used against defendants, the defence must have the right to be informed of that method. • Parliamentary oversight: security bodies should report the total scope of use and its evidential effect to the relevant parliamentary committee at regular intervals. 10.3 Technical Safeguards • Priority transition to 5G SA infrastructure: operators' transition to 5G Standalone infrastructure and the phased shutdown of 2G/3G networks should be encouraged.
• SUCI padding standardisation: regulatory pressure should be applied for the SUCI length padding mechanism proposed by the Ericsson/Nori study (2021) to be incorporated into the 3GPP standard.
• Enterprise IMSI Catcher detection infrastructure: hardware-based IMSI Catcher detection systems should be made mandatory for sensitive facilities (courts, parliament, health institutions).
11. Conclusion IMSI Catcher technology is a surveillance tool that feeds on a design flaw in cellular communication infrastructure left unremedied for decades and that has evolved along with it. The one-way authentication gap created by 2G was partly addressed in the 3G and 4G generations; but the threat could not be eliminated entirely because of the downgrade attack vector, the requirement of backward compatibility and the inheritance of 4G vulnerabilities by 5G NSA deployment. The SUPI/SUCI mechanism introduced by the 5G SA architecture effectively renders the traditional bulk IMSI collection attack inoperative in Standalone deployments. Even so, developments such as the length vulnerability revealed by the Nori study, the 5G SUCI-Catcher proof of concept demonstrated at ACM WiSec 2021 and Patent No. 12328588 show clearly that 5G does not offer a complete security guarantee. Moreover, the global spread of 5G SA infrastructure will require a process of at least a decade.
The commercial IMSI Catcher market continues to grow, exceeding USD 400 million by 2033. That growth encompasses not only legitimate law enforcement use but also authoritarian surveillance, corporate espionage and organised crime applications. This broad spectrum of potential abuse makes the need for strong legal frameworks unavoidable. For Türkiye the importance of this picture is very great. The contradiction between the individualisation requirement of CMK 135 and the bulk data collection inherent in the IMSI Catcher deepens legal uncertainty. Although the KVKK's personal data protection framework may partly cover this gap, the absence of regulation specific to the IMSI Catcher remains a serious deficiency both for legal certainty and for the guarantee of human rights. In conclusion, the IMSI Catcher question has moved beyond a technical security problem to become a question touching the fabric of the democratic state: can the legitimate aim of pursuing offenders legitimise a means of collecting the data of innocent people in bulk? International case law gives a clear answer: only individualised judicial oversight, the principle of proportionality and the guaranteed destruction of non-target data can place this tension on legitimate ground. References 3GPP. (2012). Security architecture (TS 33.102, Release 11). 3rd Generation Partnership Project.
3GPP. (2019). Security architecture and procedures for 5G system (TS 33.501, Release 15). 3rd Generation Partnership Project.
ACM WiSec. (2021). 5G SUCI-catchers: Proof-of-concept attack in 5G standalone networks. Proceedings of the 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks. https://dl.acm.org/doi/abs/10.1145/3448300.3467826 Business Research Insights. (2024). IMSI catcher market size and forecast 2024-2033. https://www.businessresearchinsights.com/market-reports/imsi-catcher-market- 106084 Carpenter v. United States, 585 U.S. 296 (2018).
Cell-Site Simulator Warrant Act of 2021, S. 2122, 117th Cong. (2021). Chapman, R. C. (2017). The outer limits: IMSI-catchers, technology, and the future of the Fourth Amendment. Pepperdine Law Review, 44(4), 1101–1142.
Cloudwards. (2025, November 21). How to block StingRay surveillance: Detection and protection. https://www.cloudwards.net/how-to-block-stingray-surveillance/ Dabrowski, A., Pianta, N., Kleissner, C., Shulman, H., Steiner, M., & Weippl, E. (2014). IMSIcatch me if you can: IMSI-catcher-catchers. Proceedings of the 30th Annual ACSAC, 246–255. https://doi.org/10.1145/2664243.2664272 Electronic Frontier Foundation (EFF) / Street Level Surveillance. (undated). Cell-site simulators / IMSI catchers. https://sls.eff.org/technologies/cell-site-simulators-imsicatchers Entropy Survival. (2026, March 5). IMSI catcher explained: How cell surveillance works. https://entropysurvival.com/blogs/news-views/imsi-catcher-guide Ericsson. (2024, April 4). Privacy by subscription ID length variation. Ericsson Blog. https://www.ericsson.com/en/blog/2024/4/privacy-by-subscription-id-length-variation ESPLawyers. (undated). Stingray device cases in court: Privacy, surveillance, and legal battles. https://esplawyers.com/judicial-developments/stingray-device-cases-in-court-privacysurveillance-and European Court of Human Rights. (2015). Roman Zakharov v. Russia, Application No. 47143/06 (Grand Chamber).
European Court of Human Rights. (2016). Szabó and Vissy v. Hungary, Application No. 37138/14.
InfiShark. (2026, March 26). Stingray devices: How IMSI catchers work. https://infishark.com/blogs/learn/stingray-devices-how-imsi-catchers-work KVKK. (2025). 2024 Yılı Faaliyet Raporu. Kişisel Verileri Koruma Kurumu, Ankara. Lightreading. (2023, November 14). 5G defends against IMSI catchers — but implementation is critical. https://www.lightreading.com/security/5g-defends-against-imsi-catchers--- but-implementation-is-critical/d/d-id/771471 MDPI. (2024). Security vulnerabilities in 5G Non-Stand-Alone networks: A systematic analysis and attack taxonomy. Electronics, 13(1), Article 2. https://www.mdpi.com/2624-800X/4/1/2 National Security Law Brief. (undated). IMSI catchers and potential 4th Amendment violations. https://www.nationalsecuritylawbrief.com/post/imsi-catchers-and-potential-4thamendment-violations Palindrome Tech. (2025, August 1). An evolutionary analysis of cellular network security: Vulnerabilities and protections from 2G to 5G. https://palindrometech.com/appliedsecurity-research-blog Park, C., Park, J., Nyang, D., & Yeom, D. (2017). White-Stingray: Evaluating IMSI catcher detection applications. Proceedings of WOOT 2017, USENIX.
Preeß Mattsson, J., & Nakarmi, P. K. (2021). Nori: Concealing the concealed identifier in 5G. arXiv preprint arXiv:2105.10440. https://arxiv.org/pdf/2105.10440 Shaik, A., Borgaonkar, R., Asokan, N., Niemi, V., & Seifert, J.-P. (2016). Practical attacks against privacy and availability in 4G/LTE mobile communication systems. Proceedings of NDSS 2016. https://doi.org/10.14722/ndss.2016.23236 SkyQuest. (2024). IMSI catcher market size and share 2025-2032. https://www.skyquestt.com/report/imsi-catcher-market Thales Group. (2021, May 26). 5G SIM, security and privacy for IMSIs. https://www.thalesgroup.com/en/worldwide-digital-identity-andsecurity/mobile/magazine/5g-sim-security-and-privacy-imsis Total Secure Defence. (2024, March 14). Are IMSI catchers legal? Legal implications of using IMSI catchers. https://totalsecuredefence.com/2024/03/are-imsi-catchers-legal-legalimplications-of-using-imsi-catchers/ United States Patent and Trademark Office. (2025). US Patent No. 12328588: System and method for IMSI catching in 5G networks. https://image-ppubs.uspto.gov/dirsearchpublic/print/downloadPdf/12328588 Wikipedia. (2026, February 25). IMSI-catcher. https://en.wikipedia.org/wiki/IMSI-catcher Zetier. (2025, April 28). Did 5G kill the IMSI catcher? https://zetier.com/5g-imsi-catcher/ Zimperium. (undated). IMSI catcher. Mobile Security Glossary. https://zimperium.com/glossary/imsi-catcher
