UK Police Buy Covert Cellphone Surveillance System

digitig writes "UK Metropolitan Police have purchased a 'covert surveillance technology that can masquerade as a mobile phone network, transmitting a signal that allows authorities to shut off phones remotely, intercept communications and gather data about thousands of users in a targeted area.' Other customers apparently include 'the U.S. Secret Service, the Ministry of Defence and regimes in the Middle East.'"

Comments

Question:

[muckracer]

Will a phone in flight mode release its IMSI and IMEI identity codes?

Re:Question:

[Anonymous Coward]

There are always to ends of a stick. That scheme relies on devices' intelligent behavior. Phones could be hacked to ignore "the best signal cell-tower" or to emit false IMSI and IMEI at first, to test network sanity. If it accepts BS or takes too long to authenticate (it's a giveaway of Man in the Middle attack), ignore it!

Re:Question:

[Anonymous Coward]

But as a communication device it's worthless. No phone network, no wifi.

No. "Flight Mode" is just a shortcut which can be used instead of manually disabling cell communication, cell data, GPS, and wifi. You can shut down everything except wifi capability, for example.
From what I read in the article this system generates a signal which spoofs the cell tower networks, and asks the devices to respond with unique phone info, etc. So as long as you have just the cellular portion of your phone shut down, it won't release anything but still remain useful via wifi.

Assuming Android here, I'm not sure if iPhone or Windows phones have the same capability or not.

Re:Question:

[nahdude812]

There's an app for Android phones, called Antennas. It shows you the location and status of nearby towers, and can be configured to run and collect the status of nearby towers in the background.

If a modified version of this app was used to crowd-source information about towers, false towers such as this could be identified. These mobile false towers will be physically located close to the interception victim, and will be a lot less powerful and have a lot less range than a typical tower. They'll also have less capacity than a normal tower, and maybe be physically located in an unusual spot (eg, on the street). These details should be able to be aggregated and the information used to warn about a new tower or a tower which has moved, or a tower whose signal strength is not on par with typical towers. Anyone curious about the status of a suspicious tower can drive out to its location and have a look to see if there's a real tower there, or instead it's a "news van" at that spot.

It seems like on a rooted phone, you ought to be able to blacklist certain towers, maybe give the device a whitelist of verified towers to use in a certain area. Maybe even make that black/whitelisting selective - only disable suspicious towers when making / receiving a call (since it seems likely the purpose is not location awareness, but call interception).

1984 is a guidebook, not a warning

[captainpanic]

Pity really that some idiots actually feel safer when they are constantly monitored.

Re:1984 is a guidebook, not a warning

[AmiMoJo]

I wrote to my last MP (free to do online via The Work For You) to complain about the ever increasing internet surveillance. In the letter I pointed out that saving a single life, or even many lives, is not justification for the loss of privacy and rights. If saving a life came before all other considerations we would ban cars and shut down the road network. Given that I asked why she voted for the new laws.

Her response was along the lines of "it saved the life of a woman who was said she was going to commit suicide on Facebook because the police were able to backtrace her IP address".

She lost her seat at the last election (I won't say which because it would reveal where I live and I value my privacy). Good riddance.

The big question: oversight

[tucuxi]

This seems like a law-enforcement version of the WASP drone featured at last summer's Black Hat / Defcon

The big question is, since the technology has been available for a while, and is obviously useful for its stated purpose, that of oversight. Privacy-invading technologies will always exist, will always be useful for law-enforcement, and are due to increase the more we mesh our lives with technology. How will authorities deal with data filtering, retention, probable cause, and the opportunity for discovering wrongdoers vs. the invasion of people's privacy? That is the big question.

A somewhat-rosy scenario is detailed in Charlie Stross' Halting State series. The ugly scenario looks like 1984. Which one we choose depends on an educated public steering their politicians, instead of letting their politicians be steered by ??? and profit.

Re:The big question: oversight

[Rich0]

Yup, listen in on conversation illegally and find out that the suspect will have incriminating evidence in their car on Tuesday at 10AM. Then at 10AM on Tuesday a cop happens to notice that they didn't signal 300 yards before changing lanes and pulls them over. Then they notice something unusual and search the car, and boom, you have a legal search finding evidence that can be used. The phone tap that led to it all would simply not be mentioned in court.

Everybody violates the law 50 times a day, so if the cops need a reason to search you at any time chances are that you'll give them a legally valid one.

Why?

[Sqr(twg)]

Why would the police need to "masquerade" as a phone network. They can just get it from the *real* phone network. All phone companies comply with police requests, as long as they are legal. Oh, I see...

Re:Why?

[Rich0]

Doing stuff like this allows you to put EVERYBODY in a huge dragnet and see who is worth looking into more closely. You don't have to actually use any of the data you collect as evidence. You simply need to figure out who to target with legal methods.

Suppose I sniff thousands of phone calls and find out that you are doing something I don't like - such as making drugs, or copying movies, or saying bad things about your school on Facebook, or whatever. I can't use that as evidence, but I know who you are now. Then I just walk down your street and notice that your grass is taller than the local ordinance allows, or claim that I heard a shout for help that seemed to be coming from your house and knock on the door. You open up the door and I happen to see something inside that is suspicious, or whatever. Now I have probable cause and can get a warrant, and I can carve another notch in my baton or whatever.

Legally searching houses is expensive, and it ticks people off when you search the wrong ones. On the other hand, mass interception of phone/internet/etc is cheap and tells you who to target with legal techniques.

Re:Just Wrong

[Anonymous Coward]

This technology is not about "one guy". These are large-scale devices designed to track and suppress communication among protesters. Governments know that shit will hit the fan on a large scale eventually. They're just too corrupt and rotten to continue as they are doing right know without resistance. So they prepare.

For example, in Germany, police already occasionally logs and tracks protesters (yes, peaceful ones). Sure, it was illegal, but who cares? There are no consequences for violating laws if the government does it.