IMSI catcher detection: what works and what only looks like it does

An interception device works by being a convincing cell. It broadcasts the identifiers of a real network, presents a signal the handset prefers, and waits to be chosen. Nothing about that is anomalous from the handset’s point of view, because choosing the best available cell is precisely the behaviour the handset was built for, as the mechanism page sets out in more detail.

That leaves detection with an awkward starting position. There is no field in any message that says whether the cell on the other end is genuine, and the handset has no way to ask the network it thinks it is talking to whether it agrees. What a detector can do instead is build a picture of what the radio environment normally looks like and flag departures from it. This works, in the sense that a crude interception device does produce departures. It also produces a great deal of noise, because radio environments depart from normal constantly and for entirely mundane reasons.

The consequence is worth stating before any list of techniques: a detector that never raises a false alarm is almost certainly missing real events, and one that catches most real events will raise alarms in ordinary places. Where a given tool sits between those two is a design decision its authors made, and it is rarely documented.

The strongest available signal is a change of generation. Interception is substantially easier on second-generation service, where the network is not obliged to prove itself to the handset, so a device that wants an easy time will try to get the handset there. A modern handset in a city that suddenly reports second-generation service, and stays there, is describing something that needs an explanation. The signal is strong because an attacker has a reason to want the downgrade.

Next is the shape of the cell itself. A real cell is one of many, and it tells the handset about its neighbours so that handover can work. A device that exists only to capture attachments often has no neighbours to describe and no interest in handing anyone over, so an unusually attractive cell that lists no neighbours and never hands off is describing an unusual situation. Related properties behave the same way: an identifier that appears in a location where the operator has never had one, a cell that appears and vanishes within an hour, a transmit power that does not match the distance.

Then there is the state the handset reports about protection of the link. Historically some handsets surfaced whether the connection was encrypted, and its absence is a direct indicator, not a circumstantial one. This has become much less useful in practice, because the platforms stopped exposing it, which is the general shape of the problem described on the detector apps page: the most informative signals are the ones a modern operating system is least willing to hand over.

Finally there is timing. Interception has to happen while the target is present, so the events cluster: at a demonstration, outside a particular building, along a route. A single anomaly is weak evidence and a repeated anomaly in the same place is considerably stronger, which is why the tools that keep history are more useful than the ones that only report on the current cell.

A warning from a detector establishes that the radio environment is unusual. It does not establish that anyone is being intercepted, and it does not identify who would be doing it. The gap between those two statements is where most public confusion about this subject lives, and it is not closed by better software, because the missing information was never available to the handset in the first place.

What makes the difference in practice is context that the tool does not have. A downgrade to older service in a rural valley is coverage. The same downgrade on a street with four modern cells in range is not. A cell that appears for one afternoon at a stadium is capacity for the crowd. The same cell outside a courthouse on a hearing day is a different proposition. The tool supplies the anomaly; the person supplies the reason to care about it, and neither half is much use alone.

There is also a category of interception that detection of this kind will not reach at all. A device that only listens, and never transmits, presents nothing for a handset to notice, because the handset’s view of the world is built entirely from what is transmitted at it. Passive collection of what is already being broadcast in the clear is invisible by construction, and the defence against it is not detection but concealment, which is what identity concealment in 5G was introduced to provide.