Slashdot Mirror
FBI Taps Cell Phone Microphones in Mafia Case
cnet-declan writes "We already knew the FBI can secretly listen in to car conversations by activating microphones of systems like OnStar. A new Mafia court case suggests that the FBI can do the same thing to cell phones. The judge's opinion and some background information [pdf] are available for reading online. The most disturbing thing? According to the judge, the bug worked even if the phone appeared to be 'powered off.' Anyone up for an open-source handset already?" From the article: "This week, Judge Kaplan in the southern district of New York concluded that the 'roving bugs' were legally permitted to capture hundreds of hours of conversations because the FBI had obtained a court order and alternatives probably wouldn't work. The FBI's 'applications made a sufficient case for electronic surveillance,' Kaplan wrote. 'They indicated that alternative methods of investigation either had failed or were unlikely to produce results, in part because the subjects deliberately avoided government surveillance.'"
The poster of the story seems to be under the false impression that the FBI activated the mobile phone's integrated microphone. This would have been quite alarming. However, if he (or the original author) had read the affidavit correctly (as you probably did), he'd notice that they just bugged him. (Point 3: "[...] through a listening device placed in the cellular phone [...]").
"Between strong and weak, between rich and poor [...], it is freedom which oppresses and the law which sets free"
Due to the design of cell phones, it's actually very easy to modify a phone so that it gives a clear visual indication of whether it is transmitting or not.
If, for whatever reason, your phone starts transmitting (be it on a call, or because the FBI have remotely activated it), then some LEDs can be configured to light or flash - providing clear visual feedback. This could be a bit more convenient than removing the battery except when needed.
In fact, you can get the modification kits ready for use, for less than $5 - and installation, can take less than 30 seconds.
These kits are more usually sold as novelties for 'ricing' phones, but they can also be used for serious purposes:
Example kit
there are actuially a few secret goodies available to the feds in many modern cell phones.
First... Sat based GPS is NOT required in most cells phones to silently get perecise location, as per FCC device regulations and as per millions of dollars in levied and honored fines to lagging noncompliant cell providers.
also part of underwraps subsections of ETSI LI spec framework for LI (Lawful Interception) hint at leveraging the E911 feature that makes a cell not be able to disconenct if a 911 operator toggles a cell phone into "stay online no matter what" mode. Heck, ive played with that mode once... had to rip out the battery! (no way to hang up). Technology was added to prevent poor signal drops during a 911 call, but then used to keep line open while victim is delirious or expiring. For docs, Just look for havesting all spec docs starting with S3LI03 prefix on the net. Or hang around Cryptome or usual places.
Regarding the gocv tracking your movements in real time (if battery not removed from your non-GPS cell : 1996 the FCC defined a fancier "E911 Phase 2" for more precise ALI information to PSAPs using latitude and longitude information, and to identify a mobile caller's location within 125 meters (410 feet) 67% of the time to the PSAP. A PSAP is one of over 6,000 Public Safety Answering
Points (PSAP), some route , some deal directly with initial public calls. FCC 97-402 CC Docket No. 94-102 rules (i.e., by October 1, 1996). besides the 34-bit Mobile Identification Number (MIN), being sent in Phase I of E911, the 34 bit MIN accepted a "call back' even without a valid phone number, as the 1996 regulation also stipulates that CELL PHONES WITH NO CONTRACT OR DORMANT DEVICES MUST HAVE FREE ACCESS TO 911 service, no matter what. The tracking protocol is indepentdant of billing accept/reject.
To allow the cell to be detected within 410 feet WITHOUT GPS, cell phone towers use triangulation methods automated with cellular geolocation systems involving time difference of arrival (TDOA) and angle of arrival (AOA)
As for REMOB mode of cell phone (remote observation) the details seem to be partially vender unique, but it is supected that the table is trivially assined via Mobile Identification Number (MIN) table lookup in REMOB snitch mode.
PLEASE NOTE that the court documents allowing the voice tapping of the MAFIA suspect stated "OR OTHER MEANS". the "OR OTHER MEANS" is the non modified NON_ALTERRED original cell phone being merely set in a VOX mode for packet burst with simple threshold to sleep unless steady VOX activation, controlled partly by other terminal point. Otherwise battery of a modern cell will last only a few hours.
I cannot believe all the fools in this thread that actually believe the FBI has ability to add devices INSIDE a modified cell phone. Yeah... like theres lots of empty space!!! The judges papers said OR OTHER MEANS and this other means is the REMOB mode. Similar to onstar silent snithc mode in cadillacs.
If you really want to panic... the FBI buys the RFID scans of all the points on NY turnpike taht record car tire RFID that the TREAD act mandates to allow gov to uniquely track movements of all cars by untamperable chips in the tires... even at 90 miles and hour adn 12 feet away (though instaed of overpasses for RFID car tires as in parts of I-75, reading coils UNDER the pavement are used, as with the RFID tire impressions collected at canadian border customs booths.
sorry for all the lazy typos. I am very tired. an i know that factual anon posts stay +0 until the FBI shills squelch them to -1 rapidly with there grooming accounts they use here to stifle agitatant insider posts like this one.
In fact, it did.
As far as I remember, just after the collapse of the USSR, there were published some information about how KGB was able to activate the mics of "normal" old phones by activating the line from substation; so that the phone didn't ring, but the mic was getting enough current flowing through it to work.
I don't really see how that's possible. When the handset is on-hook, the microphone is disconnected. This is a requirement for BABT compliance. You are correct. The analog POTS system fully disconnects the microphone and speaker when on hook, as per design standards going back to the 1870's. It's not possible to listen in on-hook without modifying the phone. OP is either engaging in "urban legendry", or the incident took place before 1982, when BT still owned the entire phone system (including the sets themselves) and could believably send a technician 'round to "fix the phone".
If a job's not worth doing, it's not worth doing right.