Why it matters: As Android 16's new security features roll out with the next generation of smartphones, users will, for the first time, have a tool to detect invisible digital surveillance. Whether this prompts broader reforms in how such technology is used and regulated remains to be seen. Still, the feature reflects a growing awareness of the need to protect personal privacy in the mobile age.
An upcoming Android update will introduce a warning system to help users detect one of the most elusive forms of digital surveillance: the Stingray attack. Android Authority notes that as part of the Android 16 rollout, select new devices will alert users when their phone connects to a suspicious or insecure mobile network.
Android 16 will introduce a new "Mobile network security" setting that alerts users when their device connects to an unencrypted network or when a network requests device identifiers – both signs of a possible Stingray attack. Users can also disable 2G support entirely, further lowering their risk.
Stingray devices imitate legitimate cell towers, tricking nearby phones into connecting to them instead of real networks. Once connected, operators can capture unique device identifiers like the International Mobile Subscriber Identity (IMSI) or International Mobile Equipment Identity (IMEI), track a device's location, and even force phones onto older, less secure protocols like 2G.
The underlying technology exploits a fundamental principle of cellular communication: mobile devices automatically connect to the tower with the strongest signal. By broadcasting a powerful signal, Stingrays lure all nearby phones to connect, harvesting identifiers from every device within range – not just the intended target.
Often, operators don't initially know which device belongs to their target, so the Stingray collects data from all connected phones and then filters it to identify the intended one. More advanced models can intercept calls and messages or launch denial-of-service attacks by jamming legitimate signals.
Law enforcement agencies across the U.S. have used Stingrays for years, often under strict secrecy. Federal, state, and local police have deployed these devices in investigations ranging from violent crimes to minor thefts, with some departments using them thousands of times over the past decade. More recently, threat actors have begun using the devices as well.
Until now, most smartphone users had little ability to detect or defend against these attacks. Google has gradually added features to improve network security, such as disabling 2G connectivity and blocking unencrypted communication. However, hardware constraints limited these protections. Detecting Stingray activity requires a phone modem that supports advanced features – specifically, version 3.0 of Android's IRadio hardware abstraction layer. As a result, even the latest Pixel phones don't yet support the full range of protections. The new warning system in Android 16 will only arrive on upcoming devices – most notably, those launching with Android 16 later this year.