Detecting Fake 4G Base Stations in Real Time (Q&A)

Cooper Quintin, Senior Staff Technologist at the Electronic Frontier Foundation (EFF), answers questions regarding Crocodile Hunter, an open-source tool designed to detect fake 4G LTE base stations, cell-site simulators, and IMSI-catchers (such as Stingrays and Hailstorms) in real time [00:00]. Quintin explains how cell-site simulators are deployed by law enforcement and intelligence agencies to conduct mass surveillance, intercept communications, and track mobile subscribers during public gatherings and protests.

Quintin clarifies the technical architecture and legal operating model of Crocodile Hunter. The system operates strictly as a passive receiver using software-defined radio (SDR) hardware (e.g., BladeRF or USRP) combined with the open-source srsLTE (srsRAN) library to parse cellular broadcast signals [15:08]. By remaining completely passive, the tool avoids transmitting RF signals, ensuring compliance with FCC and international radio licensing regulations [11:12]. Quintin details the detection heuristics used to uncover rogue towers, including abnormal changes in Tracking Area Codes (TAC), anomalous neighbor cell lists, unexpected ciphering downgrades, and rapid power shifts characteristic of mobile simulator equipment [07:28].

The Q&A also explores practical privacy countermeasures for individuals in the field. Quintin analyzes the protective efficacy of airplane mode, Faraday sleeves, and burner phones, noting that while airplane mode prevents standard beaconing, determined adversaries with IMSI-catchers can exploit device behaviors unless devices are physically powered down or left behind [03:49]. He concludes by discussing EFF's ongoing legal FOIA efforts to expose surveillance capabilities and invites the security community to contribute to open-source cellular monitoring networks [22:35, 28:19].

(AI summary — Gemini Flash)