Several police forces in England have bought equipment to create fake mobile phone masts—known as IMSI catchers or stingrays—that can be used to eavesdrop on telephone conversations without users being aware.

Documents obtained by the Bristol Cable, a media cooperative, reveal that—in addition to the Metropolitan Police, which is already suspected of using the covert listening gear—police forces in Avon and Somerset, Staffordshire, Warwickshire, West Mercia, West Midlands, and South Yorkshire have all acquired the devices.

IMSI catchers or stingrays (after a US company that makes such devices) work by sending out a signal that tricks a mobile phone into connecting with the equipment, rather than a legitimate base station. This allows information to be gathered about the device and its conversations by carrying out a man-in-the-middle attack.

The documents, obtained using freedom of information requests found by searching through publicly-available police expenditure data, provide important new details about IMSI catchers. For example, an acronym used by several police forces—CCDC—is revealed by unredacted minutes of a meeting held in May 2016 between West Mercia and Warwickshire police to stand for "Covert Communications Data Capture." Another document, this time from South Yorkshire cops, allowed the Cable to deduce that the CCDC was an IMSI catcher, something later confirmed by the police force concerned.

The documents also reveal how much IMSI catchers cost. South Yorkshire paid £144,000, while a document from Avon and Somerset showed that £169,575 had been spent on "CCDC equipment." Scotland Yard paid out no less than £1,037,223 in the final three months of last year—which suggests it bought around half-a-dozen IMSI catchers during its third quarter. Ars has asked the Met to confirm this number, but hadn't received a reply at time of publication.

Cellxion—the company supplying the IMSI catchers—is name-checked several times in the documents. However, on its website there is no mention of the device, only details of a "Quad Modem Telemetry System VPN Platform." Curiously, at the foot of the single Web page on the site, there is the following warning: "Under US Federal Law (18 U.S.C. 1030), United Kingdom Law (Computer Misuse Act 1990) and other international law it is a criminal offence to access or attempt to access this computer system without prior written authorisation from Cellxion ltd."

Information about the firm beyond Companies House is thin. Cellxion's turnover was £11.57 million last year, down from £13.41 million in 2014. Ars has sought further comment from Cellxion on its IMSI sales. It sells most of its goods—the balance sheet shows—to the rest of Europe and had 11 employees on its books at the end of October 2015. Cellxion is scheduled to appear at the home office's security and policing event next year.

The latest details obtained by the Cable confirm earlier suspicions that IMSI catchers are available in the UK, and thus presumably widely used, given their considerable cost.