IN APRIL 2014, three men were shot when a drug deal turned sour on a tree-lined residential street in Baltimore. The city’s police department quickly linked the crime to Kerron Andrews, a dreadlocked 22-year-old, but could not find him at his registered address. Agents used phone records to determine roughly where he was, but instead of going door-to-door until they found him, they opted for something far more efficient: a Hailstorm. Using this, they tracked Mr Andrews directly to an acquaintance’s sofa, between the cushions of which he had stuffed the gun used in the shooting.

The Hailstorm is a more advanced version of the StingRay, a surveillance device that operates by mimicking a cellular tower, forcing all nearby mobile phones to reveal their unique identifying codes, known as IMSI numbers. By crosschecking the IMSI numbers of suspects’ phones with those collected by “cell-site simulators” such as Hailstorm and StingRay, police officers can pinpoint people with astonishing precision. The tools have been used to trail suspects to specific rooms in apartment blocks and to find them on moving buses on busy city streets. Developed at first for military and intelligence services, cell-site simulators are now furtively used by federal agencies such as the Federal Bureau of Investigation (FBI) and the Drug Enforcement Administration (DEA) as well as by local police forces across the land.

Law-enforcement agencies rarely seek explicit court approval to employ cell-site simulators, and rarely admit to using them after the fact. As a condition for purchasing them, state and local police forces must sign strict non-disclosure agreements with the FBI, since the more information is made public about cell-site simulators, the more “adversaries” will adapt to them. The agreements prohibit police from disclosing any information about the technology, even to judges in the form of warrant requests; prosecutors must drop cases if they are pressured to reveal details about them. In one case in Baltimore, a judge threatened to hold a detective in contempt after he refused to testify about the use of StingRay in locating an armed-robbery suspect. Instead of instructing the detective to answer, the prosecution dropped the evidence. In another armed-robbery trial in Tallahassee, prosecutors offered the defendants a generous plea deal rather than demonstrate how the device worked in open court.

Given this secrecy, it is impossible to identify all the agencies using cell-site simulators. The American Civil Liberties Union (ACLU) has counted 58 agencies that possess the devices, across 23 states and the District of Columbia, but thinks the true number may be much higher. The technology has been used not only to trace murderers and armed robbers, but also to nab car thieves, phone pilferers and, in one case, a woman who made a series of abusive phone calls. The city of Baltimore alone has admitted to using the technology 4,300 times between 2007 and 2015. “I have never seen a tool that is on one hand treated in such a cloak-and-dagger fashion, but on the other used as a bread and butter tool,” says Stephanie Pell of West Point’s Army Cyber Institute.

The ray and the net

Civil-liberties advocates claim the secrecy around cell-site simulators is unjustified. According to Christopher Soghoian, a technologist at the ACLU, the wiliest criminals already know to use disposable “burner” phones and, short of forgoing cellular communication altogether, there is no foolproof way for them to evade StingRays and Hailstorms. But their covert use raises worries about privacy, he says. Cell-site simulators often trace phones to pockets, purses, homes and other places protected by the Fourth Amendment’s prohibition on “unreasonable searches”. Moreover, they do not just gather information from the target’s phone, but also from other phones nearby. Brian Owsley, a law professor at Texas Tech University School of Law who, as a judge, rejected several federal requests to use cell-site simulators without a warrant, says there should be laws requiring data inadvertently gathered in this way to be deleted.

Lawmakers are starting to address such grievances. Washington state, California, Virginia, Minnesota and Utah have passed laws requiring their police forces to seek warrants before using cell-site simulators. Congressman Jason Chaffetz of Utah hopes to pass a bill that would do the same on a federal level, though he is unlikely to prevail in such a politically charged year.

Movement in the courts may come more quickly, however. After the Baltimore police department grudgingly confessed in a court hearing last summer that it had used a Hailstorm to locate Mr Andrews, the presiding judge suppressed all evidence related to the surveillance operation—including Mr Andrews’s gun. Without a warrant, she held, the police had breached his Fourth-Amendment rights. Civil-libertarians are optimistic about the precedent the case may set. The state of Maryland will appeal against the ruling on February 9th.