Lesson 6 of 9 · about 16 minutes
Phones: Cell-Site Simulators, Location Requests and Extraction Tools
You'll be able to
- Explain what a cell-site simulator does and what DOJ policy requires
- Tell apart historical cell-site records, tower dumps, real-time tracking and geofence requests
- Describe phone extraction tools and the consent search problem Upturn documented
- Match each technique to the legal process it usually requires
Your phone talks constantly. It checks in with towers, logs your location in apps, backs up photos, and stores years of messages. Police have tools for each of those habits. Some work on the phone in your pocket, some on the company records about your phone, and some on the phone itself after it is seized. They need different legal process, and public arguments often blur them together.
Cell-site simulators
A phone connects to whichever tower gives the strongest signal. A cell-site simulator takes advantage of that. It is a suitcase-sized box, often in a vehicle or on an aircraft, that pretends to be a tower. Nearby phones connect to it and give up their identifying numbers. Operators can then find a specific phone's location precisely enough to pick out a building, and sometimes a room. You may know the name StingRay, one early brand.
Bystanders are the issue. Every phone in range connects, not only the target's. Older models could also interrupt calls. For years many agencies used these devices under nondisclosure agreements and described them vaguely in court filings, which is why most early public knowledge came from records requests and leaked documents.
On September 3, 2015, the Justice Department set a policy for its agencies, including the FBI, DEA and U.S. Marshals:
- A search warrant supported by probable cause is required, with exceptions for emergencies and for rare cases where the law does not require a warrant and getting one is impractical.
- Agencies must track and report uses under those exceptions.
- When locating a known phone, all collected data must be deleted as soon as the phone is found, and no less than once a day.
- An agency-level audit must confirm the deletions.
That policy binds federal agents. State and local police follow their own state law and policy. Some states require warrants by statute, and many local agencies borrow simulators from state police or federal task forces. Ask who owns the device and whose policy applies when it is used locally.
Records from the phone company and apps
Police often do not need to touch your phone. They ask the companies.
| Request | What police get | Usual legal process |
|---|---|---|
| Subscriber information | Name, address, account details | Subpoena |
| Historical cell-site records (7 days or more) | Which towers the phone used, when | Warrant (Carpenter, 2018) |
| Real-time location ("ping") | Current location from the carrier | Varies by state; warrant common; emergency requests allowed |
| Tower dump | Every phone on chosen towers in a window | Unsettled; Carpenter did not decide |
| Geofence request | Devices in a drawn area from an app company | Search requiring a warrant (Chatrie, 2026); validity of warrant designs still being litigated |
| Message content | Emails, messages stored by a provider | Warrant |
Worked example: how many bystanders?
Detectives in an invented city investigate an overnight break-in at a pharmacy. They request a tower dump covering three towers from 1 a.m. to 3 a.m. Suppose each tower serves about 1,500 active phones in that window (an invented figure; urban towers can serve more).
- Total records: 3 x 1,500 = 4,500 phones.
- Suspects sought: maybe 2.
- Bystander share: 4,498 / 4,500 = 99.96 percent.
Compare Carpenter: one person, 12,898 location points over 127 days. A tower dump flips that shape: very short time, thousands of people. That difference is why courts have struggled to fit tower dumps into Carpenter's reasoning, and why the Court left them open.
Geofence requests to app companies reached the Supreme Court in Chatrie v. United States, decided June 29, 2026. The Court held that getting a person's Google Location History was a search, even for two hours of data, and sent the case back on whether the multi-step warrant was valid. Google said in late 2023 that it would move Location History storage onto users' devices, which reduces what it can hand over, but other apps and data brokers still hold location data. Lesson 7 covers the broker route.
Extraction tools
Once police have a phone in hand, mobile device forensic tools copy its contents. The best-known makers are Cellebrite (its UFED line) and Grayshift (GrayKey), with Magnet Forensics, MSAB, Oxygen and others in the market. Depending on the phone model and software version, an extraction can pull messages, photos, location history, app data, deleted files and passwords.
The nonprofit Upturn's October 2020 report, "Mass Extraction," built on more than 110 public records requests, found:
- more than 2,000 agencies in all 50 states and D.C. had bought these tools
- 44 agencies logged at least 50,000 extractions from 2015 to 2019, which Upturn called an undercount
- 40 of 81 responding agencies had no policy on using them
- a GrayKey unit cost $15,000 to $30,000; a Cellebrite UFED about $10,000 plus $3,000 to $4,000 a year in licensing
Upturn also documented how many extractions happen by consent rather than warrant. In Harris County, Texas, 53 percent of 1,583 extractions were consent searches or searches of "abandoned/deceased" phones. Anoka County, Minnesota reported 38 percent of 497. A lab study Upturn cited found more than 97 percent of participants handed over their phone, passcode already entered, when asked, while only about 14 percent of observers thought a reasonable person would.
Riley v. California requires a warrant to search a phone taken at arrest. It does not stop a person from consenting. Upturn recommended banning consent searches of phones. Police agencies and prosecutors generally defend consent as voluntary and say phone evidence clears innocent people as well as convicting guilty ones, for instance by confirming an alibi through location data or messages. Victims of crimes also hand over phones by consent so police can document threats.
Common mix-ups
- Claim: Encrypted phones cannot be opened. What the evidence shows: It depends on model and software version. Vendors regularly sell new methods, and many phones can be at least partly extracted.
- Claim: A warrant for a phone lets police take everything forever. What the evidence shows: Warrants are supposed to describe what can be searched. Courts disagree on how specific phone warrants must be, and retention of extracted data varies by agency.
- Claim: Cell-site simulators listen to calls. What the evidence shows: The DOJ policy says its devices must not be used to collect communication content. They identify and locate phones. Older or foreign equipment may differ, so ask about the exact model.
Reporting angle
Request purchase records and licenses for any extraction tool, the agency's policy on phone searches, a sample consent form, and annual counts of extractions split by warrant, consent and other. Ask whether the agency owns or borrows a cell-site simulator, whose policy governs its use, how many times it was used last year, and whether courts were told what the device was when warrants were sought. Ask prosecutors how many tower dump and geofence requests their office approved and whether the practice changed after June 2026.
Research angle
- DOJ announcement of its cell-site simulator policy.
- Upturn, Mass Extraction: how it requested records on phone extraction tools from agencies.
- Carpenter v. United States, the full opinion.
- Riley v. California, on searching phones.
- Chatrie v. United States opinion, June 29, 2026.
- Google post on changes to Location History and where the data is stored.
Check yourself
1. What does a cell-site simulator do?
Phones connect to the strongest tower signal. A simulator poses as one, which lets operators find a target phone and also touches bystanders' phones.
2. What did the Justice Department's September 2015 policy require for federal use of cell-site simulators?
The policy set a warrant default with exigent and exceptional exceptions, and required data deletion and auditing.
3. A detective asks a carrier for every phone that connected to three towers near a burglary between 1 and 2 a.m. What is that called?
A tower dump collects all devices that used specific towers in a time window. Carpenter expressly did not decide whether tower dumps require a warrant.
4. Upturn's 2020 report found more than how many U.S. agencies had bought mobile device forensic tools?
Upturn documented more than 2,000 agencies in all 50 states and D.C. that had bought these tools.
5. Why do consent searches of phones concern Upturn and other critics?
At one Texas county, 53 percent of 1,583 extractions were consent or abandoned or deceased phone searches. A lab study found over 97 percent of people handed over their phones, passcode already entered, when asked.
6. After Chatrie (2026), which statement about geofence requests is accurate?
The Supreme Court held the data request was a search and remanded on whether the specific warrant was valid.
Terms in this lesson
- Cell-site simulator
- A device that imitates a cell tower so phones connect to it, used to locate or identify phones. Brand names have included StingRay.
- Tower dump
- A request for records of every device that connected to particular cell towers during a time window.
- Geofence warrant
- A warrant asking a company for devices recorded inside a drawn area during a time window.
- Mobile device forensic tool (MDFT)
- Hardware and software, such as Cellebrite or GrayKey, that copies and analyzes data from a phone.
- Extraction
- Copying data from a phone, from a logical copy of user files to a full physical image of the storage.
- Exigent circumstances
- An emergency exception that lets police act without a warrant when there is no time to get one.
Sources
- U.S. DOJ: Justice Department announces enhanced policy for use of cell-site simulators (Sept. 3, 2015) checked 2026-10
- Upturn: Mass Extraction (Oct. 20, 2020) checked 2026-10
- Carpenter v. United States, No. 16-402 (2018), opinion checked 2026-10
- Riley v. California, 573 U.S. 373 (2014) checked 2026-10
- Chatrie v. United States, No. 25-112 (June 29, 2026), opinion checked 2026-10
- Google: Updates to Location History and new controls coming to Maps (Timeline saved on device) checked 2026-10