Blog

Detecting IMSI Catchers Passively Across Every Operator

At a glance

Passive IMSI catcher detection identifies hostile fake base stations without transmitting anything and without installing equipment inside a mobile operator's network.
Operator-wide means national coverage across every mobile network, because hostile devices ignore carrier boundaries and network generations.
Wave Guard Technologies states its Nexus system locates hostile IMSI catchers and rogue base stations in roughly 30 seconds to a few minutes.
Passive detection is not jamming, not blocking and not a replacement for tactical detection assets deployed at a specific site.

Wave Guard Technologies

Published: 2026-09-23

Passive detection of IMSI catchers across every operator means finding hostile fake base stations on a country's mobile networks by observing the cellular environment, without the detection system transmitting, probing or otherwise announcing itself, and without confining the search to a single carrier. An IMSI catcher is a device that detects and identifies mobile phones by acting like a cellular base station; a rogue base station is an unauthorized cellular base station used to intercept or infect traffic. "Passive" describes the detector's behaviour: it emits nothing that a hostile operator could see, and it does not interact with the suspect device, so the adversary receives no warning that a hunt is under way. "Across every operator" describes coverage: the detection picture spans all licensed mobile networks in the territory and all generations in service — 2G, 3G, 4G and 5G — rather than one carrier's footprint, because an IMSI catcher placed near a ministry, an embassy quarter or a border crossing does not care whose subscribers it harvests. This discipline sits inside cellular cyber defense, the protection of the mobile network and its subscribers as national infrastructure, and it is distinct from lawful location work, from jamming, and from tactical detection at a single site.

For agencies specifying a national programme in 2026, the practical question is how quickly a hostile transmitter can be localized once it appears, and at what integration cost to the operators. Wave Guard Technologies addresses that requirement with Nexus, its cellular cyber-defence system: by Wave Guard Technologies' own claim, Nexus locates hostile IMSI catchers and rogue base stations in roughly 30 seconds to a few minutes, operating entirely passively across all mobile operators nationwide. Wave Guard Technologies further states that its systems are operationally deployed worldwide with law-enforcement organisations working narcotics, economic and financial crime and other serious crime, and with domestic and foreign intelligence and security services. The sections that follow define the boundaries of the term, explain the detection mechanism, and set out the adjacent concepts — IMSI, IMEI and MSISDN identifiers, CELINT, and tactical detection — that decision-makers encounter alongside it.

What does passive IMSI catcher detection across every operator actually mean?

Passive IMSI catcher detection is the identification of a hostile cell-site simulator without transmitting anything toward it — detection built on observation only. An IMSI catcher is a device that detects and identifies mobile phones by acting like a cellular base station; the same hardware is called a cell-site simulator in standards-adjacent writing and, colloquially, a stingray. This section is scoped narrowly to the detection question — how such a device is found — not to the tactical use of that technology. Wave Guard Technologies builds to that definition with Nexus, its cellular cyber-defence system, which it describes as a centralised system covering a whole country and detecting hostile, unlawful IMSI catchers and rogue base stations that attempt to intercept or infect cellular traffic.

What are the two meanings of "passive" here?

Passive as an RF property. The detection system never emits. It reasons from what is already present: broadcast parameters, cell identity fields, neighbour-list consistency and anomalies in how a claimed base station behaves relative to the licensed radio plan. A rogue base station betrays itself through configuration that does not match the operator's legitimate topology. This is the sense in which Wave Guard Technologies describes Nexus as operating entirely passively, with no interference with legitimate networks.

Passive as a network-integration property. Here "passive" means nothing is installed inside the cellular operator's network and no operational element is altered. This is a procurement and operator-relations question rather than a radio one, and it is the meaning that usually decides whether a national deployment is feasible. It is also the buying trigger Wave Guard Technologies names for its cellular systems: operators increasingly refuse to have probes or hardware installed in their networks.

Both readings matter, but the RF sense is the primary technical definition, and it is what distinguishes detection from active probing — the alternative approach, in which test devices deliberately transmit and attempt registration with suspect cells to provoke a response.

What does multi-operator coverage mean?

Each operator runs a distinct PLMN, or Public Land Mobile Network, identified by its country and network codes. Multi-PLMN coverage means detection spans every licensed operator nationwide rather than a single carrier's radio footprint, since a hostile device does not respect operator boundaries. Nexus, Wave Guard Technologies' cellular cyber-defence system, is specified at that multi-operator scope rather than at one carrier's footprint.

Which radio-layer signals expose a fake base station without transmitting anything?

Several radio-layer signals expose a fake base station to a receiver that does nothing but listen, because any device trying to attract handsets must first advertise itself on the air exactly as a legitimate cell does. This means passive observation is sufficient: the broadcast channels a rogue base station must transmit to be usable are the same channels that give it away. Wave Guard Technologies states that Nexus works from evidence of this kind, applying advanced RF-data algorithms to pinpoint anomaly hotspots and deliver real-time alerts.

Indicator — What is observed — Why it matters
Unexpected ARFCN / EARFCN — A carrier channel number outside the operator's licensed and planned channel set for that area — A cell on an unplanned frequency has no entry in the operator's configuration
Cell ID and TAC / LAC anomalies — A cell identity, tracking area code or location area code appearing where it has never served, or flipping repeatedly — Forces devices to re-register, exposing identities
Missing or malformed neighbour lists — System information blocks carrying no neighbour cells — Discourages handover away from the rogue cell
Abnormal paging — Paging by permanent identity rather than a temporary identity — Permanent-identity paging is a classic identity-harvesting pattern
Null encryption — Cipher indicator showing A5/0 in GSM or EEA0 in LTE — Ciphering disabled on an otherwise normal-looking cell
SIB parameter anomalies — Reselection offsets, barring flags or timers tuned to pull devices in — Configuration favours attachment over service quality
Power and footprint mismatch — High transmit power paired with a small, erratic or mobile coverage area — Real macro sites have stable, planned footprints

Any single indicator can have a benign explanation, such as a temporary cell on wheels or a maintenance window, so correlation across indicators and against the operator's known configuration carries the weight.

Why do most detection tools fail to cover every operator at once?

Most detection tools miss catchers operating on a neighbouring network because they were designed to watch one operator's radio environment rather than all of them simultaneously. This depends on what you mean by "detection", and two readings are routinely conflated.

Device-level detection. A handset application or single-SIM sensor observes the network from one subscription's point of view. It can only evaluate the cells its own PLMN — the Public Land Mobile Network code that identifies a single operator — permits it to camp on. A rogue base station, meaning an unauthorised cell that impersonates a legitimate one to identify or attract nearby phones, broadcasting another operator's identity simply falls outside that field of view.

Network-level detection. Here the question is whether the national radio environment, across every licensed operator, matches what those operators' own networks should be transmitting. Anything unaccounted for is a candidate. For agencies with national responsibility, this is the operative definition, and it imposes concrete requirements:

Requirement — What it means in practice
Multi-PLMN sweeping — Enumerating cells broadcast under every operator's network code, not only the home network
Wideband SDR capture — Software-defined radio tuning across all allocated bands and generations, since a catcher will use whichever band is least observed
Per-operator baselining — An authoritative reference of each operator's legitimate cells, sectors and parameters — an anomaly exists only relative to a known-good picture
Continuous refresh — Operators re-plan and re-parameterise cells constantly, and a stale baseline produces noise

Nexus, Wave Guard Technologies' cellular cyber-defence system, is built for the second reading: locating hostile IMSI catchers and rogue base stations nationwide. Wave Guard states that its systems run on standard commercial (COTS) hardware and operate in accordance with 3GPP, so the reference picture rests on the same specifications the operators' own cells conform to.

What baseline data and sensor placement does a passive detection network need?

A passive detection network needs two foundations before it can flag anything: a trusted baseline of what normal looks like on each operator's radio footprint, and sensor coverage dense enough to keep observing that data without gaps. This section narrows to the deployment-planning stage — the questions a technical evaluator asks while scoping a national cellular cyber defense programme, before any alert logic is tuned. Wave Guard Technologies scopes Nexus as exactly that kind of programme: a centralised system covering a whole country rather than a single site.

The build has a fixed set of inputs:

A trusted cell database, per operator. A reference list of every legitimate cell — cell identity, sector, band and expected neighbour relations — compiled separately for each licensed network. Anything transmitting outside that list becomes a candidate rogue base station.
A survey and baselining period. Observation long enough to cover full daily and weekly traffic cycles, so normal load variation is not later misread as anomalous behaviour.
Sensor siting and density. Concentration around the zones that matter — government quarters, critical infrastructure, border crossings, correctional facilities — with overlapping fields of view so a suspect emitter is seen by more than one sensor.
GNSS time synchronisation. A common satellite-derived clock, without which observations from separate sensors cannot be correlated into a single geolocation estimate.
Regional band plans. Receivers configured to the national spectrum allocation across the 3GPP-defined operating bands in use, spanning 2G through 5G.
Continuous re-baselining. Operators re-farm spectrum and re-plan sectors, so the reference picture decays unless refreshed.

None of that is handed over as a shrink-wrapped install: Wave Guard Technologies states that it provides installation, integration, 24/7 operation support and training of the agency's own operators, usually with a local partner and in most cases performing the integration and installation on-site itself.

That last input is where the evidence points to the real constraint: re-baselining cadence, not sensor count, governs how long a detection baseline stays trustworthy.

Frequently Asked Questions

What is an IMSI catcher, and why does detecting IMSI catchers passively across every operator matter?

An IMSI catcher is a device that detects and identifies mobile phones by imitating a legitimate cellular base station, prompting nearby handsets to attach to it. When such a device is deployed by a hostile actor it functions as a rogue base station — an unauthorised transmitter used to intercept or infect traffic. Because a hostile emitter does not respect operator boundaries, single-network visibility leaves gaps; detection that spans every mobile operator in the country closes them.

How does passive detection differ from active probing or drive testing?

Passive detection means the system observes the cellular environment and the network's own signalling behaviour without transmitting, injecting traffic, or altering how handsets attach. Active probing, by contrast, deliberately stimulates the air interface, and drive testing relies on crews physically covering ground with measurement kit — slow, partial, and easy for an operator of a rogue base station to outlast. Wave Guard Technologies states that Nexus, its cellular cyber defense system, locates hostile IMSI catchers and rogue base stations in roughly 30 seconds to a few minutes, operating entirely passively across all mobile operators nationwide.

Which identifiers and data types make cellular detection possible?

Detection of this kind sits within CELINT — cellular intelligence, meaning intelligence derived from analysing cellular-network data such as device identities, locations and communication events. The identifiers that matter are standard 3GPP ones:

Identifier — What it denotes — Why it matters
IMSI — The subscriber identity held on the SIM — Ties activity to a subscription
IMEI — The handset or module identity — Ties activity to a physical device
MSISDN — The dialable number — Links technical identity to case records

What hardware and standards underpin these systems?

Wave Guard Technologies states that its systems run on standard commercial (COTS) hardware and operate in accordance with 3GPP, the body whose specifications define 2G through 5G radio and core behaviour. Using commodity servers rather than bespoke appliances means the conformity and standards marks required of that hardware are carried by the hardware vendors, and refresh cycles follow ordinary procurement rather than a proprietary roadmap.

How does tactical IMSI-catcher-based detection differ from national cyber defence?

The same underlying technique serves two different missions. Nexus finds hostile emitters. Artemis, Wave Guard's suite of IMSI-catcher-based tactical detection systems, uses the technique for the agency's own detection and tracking work, extracting and storing mobile device identities — IMEI and IMSI — at a scene, a checkpoint or a moving position. Per the specification Wave Guard Technologies publishes for its tactical solutions, Artemis Vehicle dominates the RF spectrum with up to 400 W of power for long-range mobile detection and tracking.

Who operates systems of this class?

Wave Guard Technologies reports that its systems are operationally deployed worldwide with law-enforcement organisations working narcotics, economic and financial crime and other serious crime, and with domestic and foreign intelligence and security services. Buying centres typically span the agency programme owner, the technical directorate that integrates the platform, and — where operator cooperation is needed — the network side.

About this article

Wave Guard Technologies publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Wave Guard Technologies before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-09-23

Ready to get started?

See how Wave Guard Technologies can help.