A device capable of intercepting phone signals was likely deployed at the 2024 Democratic National Convention (DNC) in Chicago, WIRED has learned, raising crucial questions about who authorized its use and for what purpose.
The device, known as a cell site simulator, was identified by the Electronic Frontier Foundation (EFF), a digital rights organization, after analyzing wireless signal data collected by WIRED during the August event.
Cell site simulators mimic cell towers to intercept communications, indiscriminately collecting sensitive data such as call metadata, location information, and application traffic from every phone within range. Their use has drawn widespread criticism from privacy advocates and activists, who argue the technology can be exploited to covertly surveil protesters and suppress dissent.
The DNC met amid widespread protests against Israel’s attack on Gaza. While accredited influencers attended exclusive yacht parties and VIP eventsthousands of demonstrators faced a strong presence of law enforcementincluding officers from the U.S. Capitol Police, Secret Service, Homeland Security Investigations, local sheriff’s offices and the Chicago Police Department.
Concerns about potential surveillance prompted WIRED to conduct a first-of-its-kind wireless survey to determine whether cell site simulators were being deployed. The journalists, equipped with two rooted Android phones and Wi-Fi hotspots running detection software, used Ray Hunter—a tool developed by the EFF to detect data anomalies associated with these devices. WIRED journalists monitored signals at protests and event locations in Chicago, collecting extensive data during the political convention.
Initial testing during the DNC revealed no conclusive evidence of cell site simulator activity. However, months later, EFF technologists reanalyzed the raw data using improved detection methods. According to Cooper Quintin, senior technologist at EFF, the Rayhunter tool stores all interactions between devices and cell towers, allowing for deeper analysis as detection techniques evolve.
A major breakthrough came when EFF technologists applied a new heuristic to examine situations in which cell towers requested IMSI (international mobile subscriber identity) numbers from devices. According to EFF analysis, on August 18, the day before the convention officially began, a device carried by WIRED journalists en route to a hotel housing Democratic delegates from states in the Midwestern United States abruptly moved towards a new tower. This tower requested the device’s IMSI and then immediately disconnected, a sequence consistent with the operation of a cell site simulator.
“This is extremely suspicious behavior that normal towers do not exhibit,” says Quintin. He notes that the EFF has generally observed similar patterns only in simulated and controlled attacks. “This is not 100% indisputable truth, but it is strong evidence to suggest that a cell site simulator was deployed. We don’t know who is responsible: it could be the U.S. government, foreign actors, or another entity.”
Under Illinois law, law enforcement must obtain a warrant to deploy cell site simulators. Similarly, federal agents, including those from the Department of Homeland Security, are required to obtain warrants unless an immediate threat to national security exists. However, a 2023 DHS inspector general report found that the Secret Service and Homeland Security Investigations did not always comply with these requirements.
