I'm surprised that Stingray has such an obvious signature (break everything on nearby phones), seems like that makes it trivial to detect and defeat for any capable criminal.
https://opensource.srlabs.de/projects/snoopsnitch/wiki/IMSI_...
Where is the disconnect here?
[1] https://www.wired.com/2015/10/stingray-government-spy-tools-...
Stingrays (and presumably other IMSI catchers) don't actually act as a bridge to a legitimate network; they're a terminal connection, and effectively deny service to any devices connected to them. This is the default behavior, and it's how the FBI has claimed they're deployed domestically. The reason they don't cause major outages appears to be that they only accept connections from targeted phones; they could equally easily be used as mobile DoS beacons. And the reason they don't cause targets to abandon their 'broken' phone is that they don't have to run full-time for effective triangulation.
For Stingrays to collect calls, as outlined in your link, is effectively a whole new service on top of the basic behavior. The Stingray continues to be an endpoint for the targeted phone, but also extracts the GSM encryption key on the device. It then opens a new connection to a cell tower, and uses the IMSI and stolen encryption to impersonate the real device. From that point on, its a mitm attack.
So the only way a Stingray transfers calls is for targeted users, while configured in a mode that's supposedly not employed in the US. Harris is claiming they use a variant of this system to pass 911 calls, Wyden is pointing out that it's completely untested and doesn't even claim to support text-to-speech dialing.
(Source: Wikipedia is surprisingly comprehensive, primary source at: https://www.documentcloud.org/documents/1282642-07-08-29-200...)
Criminals are always looking for the next tech that gives them an edge and know immediately when the police can exploit it. Nextel direct connect (which was not interceptable for a long time) and BBM were the big ones of recent memory.
Importantly, you're going to need Apple to support this in the baseband hardware of iPhones to perform tower discrimination (some vendors exist that have proprietary software and/or baseband firmware to perform this functionality on Android).
EDIT: Maybe this could be done with bunnie and snowden's introspection engine? https://www.tjoe.org/pub/direct-radio-introspection
Some, but the vast majority of criminals do not put that much effort into their crimes, and among those that do, most wind up botching things. When criminals gravitate toward a system law enforcement agencies have trouble with it is more survival of the fittest than active planning.
Law enforcement fought to keep stingrays a secret for two reasons: pressure from the manufacturer, and a desire to avoid public scrutiny (which is likely the reason the manufacturer pressured them to keep it secret). The police would greatly prefer that the general public not spend too much time thinking about stingrays to avoid the risk of a stricter warrant process being required. It is also helpful if judges and defense lawyers are not familiar with the device and do not know what questions to ask.
Or OS vendors. crickets