Cell site simulators such as Stingray were challenged in court and rather than explain how they work the evidence was withdrawn. Perhaps they aren't reliable. Gunshot triangulation systems like ShotSpotter aren't reliable either. This tool may be in the same boat.
My interpretation was that LEOs who use Stingrays were required to sign NDAs and the company as well as one of the three-letter-agencies that facilitated them didn’t want the information in public court records.
It’s possible that there is something unconstitutional going on. It’s possible that having the technical specs in court would allow foreign terrorists (for example) to understand how they are being caught.
Whatever it is, it seems incompatible with a democratic republic government. But the democratically elected representatives don’t seem interested in reigning it in.
Stingrays won't be able to give exact location but can determine who's cellphone is in the surrounding area and the signal strength of that phone. If you know who that IMSI belongs to, you could setup the Stingray to alert when the IMSI is near. Then you can drive around checking signal strength and send out an officer with a portable unit to literally go door to door checking for where the signal is strongest. Is it legal? Who knows. Cops can drive around with license plate readers automatically looking for certain plates or just cataloging them. Is a nearby phone being tricked into broadcasting it's IMSI similar to recording a publicly visible license plate? That's for the courts to decide. Cops can do parallel reconstruction where they set aside illegally obtained evidence and build up a new chain of legal investigation that arrives at the same conclusion. I suspect that cops aren't willing to gamble on their Stingray-obtained evidence being constitutional so the easiest route is just to use it as a guiding hand for their official, legal investigation and just never make it part of the evidence so it can't really be challenged.
There's also the issue that since Stingrays don't authenticate the subscriber into the network, you could probably feed it bogus IMSIs. If I had more free time and money I'd make a PoC.
