Slashdot Mirror
Ask Slashdot: How To Stay Ahead of Phone Tracking ?
An anonymous reader writes "In the last few years there has been a significant upsurge in subverting the cellular network for law enforcement purposes. Besides old school tapping, phones are have become the ideal informant: they can report a fairly accurate location and can be remotely turned into covert listening devices. This is often done without a warrant. How can I default the RF transmitter to off, be notified when the network is paging my IMSI and manually re-enable it (or not) if I opt to acknowledge the incoming call or SMS? How do I prevent GPS data from ever being gathered or sent ?"
As you know, they can track you even when the device is off, unless you've taken the battery out.
Turn your phone off when you aren't using it. Do you really have to be contactable 24/7? I suspect not for most people and if your phone is off then you cannot be tracked.
If you want to receive calls or SMSes, you need to leave the phone on and transmitting:
When a call for your number comes in, the incoming call is NOT transmitted nationally. Only in the GSM-cell that you are actually in is the signal transmitted. So, the system has to know in which cell you are to be able to "call" your phone. If you properly turn it off, the phone will tell the GSM network it is going off. So when a call comes in, it will go to voicemail immediately. If you yank the battery, the system will assume you are still in that cell where you last had the phone on, but it will probably time you out if it doesn't hear from your phone for a while. (which happens naturally if for example you drive out of range).
You can't.
Those are functions performed by the baseband software stack, which cannot be modified by the end user. Also you can't be simultaneously connected and not connected to the network anyway. If you don't want to be tracked by the network, don't use a cellphone.
Great idea! Then not only are you giving away your location but you're transmitting your message in the clear, for anyone to eavesdrop on!
I can't help but think you've missed the point a little...
I would say a good start is to just use the airplane mode of your phone. That should disable your RF transmitter. But of course you wont be notified when the network is paging your IMSI. The save option is to use a phone with OsmocomBB, a free software implementation of the GSM stack: http://bb.osmocom.org/trac/ It has limited functionality (no GPRS working at the moment) but at least you know exactly would your phone is doing. With that, you can even run CatcherCatcher, which is able to detect IMSI catchers: http://opensource.srlabs.de/projects/catcher The supported phones are a bit outdated, mostly old Motorola phones. But there is one supported smartphone: the Openmoko Freerunner. It is pretty usable these days and is fully supported by Debian. I love it, but you will need to tinker - a lot.
Thanks Apple, please tell your users how to remove the batteries!
The issue is that the government does not wait until they think you *are* a criminal to do this stuff, they start doing it when they think you *might* be a criminal, or worse yet, when someone *wants* you to be a criminal. It's not the stuff that would actually manage to fetch a warrant that a lot of people are worried about, it's the fishing expeditions that lazy crime fighting agencies and power abusing bureaucrats engage in if they don't like some of your associations. Just look to what happened during the McCarthy era to see what can happen when persons in power don't like the idea of you exercising your right to free association with people they don't like, regardless of if any rules are being broken.
- Buy it using a fake id. - Ask a homeless or drug addict to buy you a prepaid phone/sim and use it. - Buy it in another country.
The correct answer is live in a third world country Smart phones are about the only thing that will work reliably. After the electricity supply, security forces and tracking technology are the things least likely to work reliably
Sent from my ASR33 using ASCII
Phone tracking was a result of the troubles in Ireland and the NATO/US need for Red trouble makers in 1980's Europe. ... your phone is sucking up details about your life as you walk around with/use it. :)
Think of an early Cyber Intelligence Sharing and Protection Act (CISPA) hardwired into every generation of phone by default.
Then came GPS, web 2.0, maps and cloud
Stop using your phone other than for family to say hi and ask for help/shopping.
Meet your people/tribe/business associates without a phone and talk face to face or in some other hi tech/no tech way.
Soon a working phone with CCTV (camera pod), facial recognition, 24/7 city wide look down drones, covert LEO in-car cameras will be filling in even more details.
Dont forget the private sector is also doing its part to link all their cameras in too
No warrants are needed. Deep extended boarder search, gang area 'random' searches, drink driving tests will all have rows of plate reading cameras, passenger face capture, driver logging, train station federal task forces, anti war mil protest watching... all add up to very deep efforts if you make a list.
All the tech used in 1950's Soviet watching, Vietnam, Iraq is now so cheap, tiny and sold to even the smallest, struggling police forces as federal 'gifts' to help with 'drugs', 'terror' or just as free 'surplus' with never ending private maintenance contracts.
The next big thing will be state level voice print records- no longer the play thing of GCHQ, NSA - expect a fake cell towers in a region of interest to do more than just log calls, numbers and record flagged people - your voice will soon be all that local law enforcement needs on any network.
Swap the phone sim all you want, better stay off the voice too.
Domestic spying is now "Benign Information Gathering"
So don't use your cell phone as a cell phone. Buy a pre-paid with no ID (if you can), use the data connection to open a VPN link, use whatever voice and IM protocols you want over the VPN link.
09F91102 no, 455FE104 nope, F190A1E8 uh-uh, 7A5F8A09 that's not it, C87294CE no. Ah! 452F6E403CDF10714E41DFAA257D313F.
Even with GPS disabled or if your phone doesn't have GPS, cell triangulation allows for a reasonably accurate position of the phone. In urban areas this works well, in rural areas less so but still enough to provide someone with potentially useful information. This is a function of the cell phone network and not the GPS of your phone.
Discharge what?
The capacitors in the power supply circuitry.
Curiously enough I saw an idea to solve this problem this morning. It's a small bag lined with material opaque to radio waves (possibly lead foil or barium, I don't know). Whether this particular implementation works or is a tin-foil beanie, again I don't know. But the concept seems to me good. With modern phones like iPhones or my HTC One, the battery is non-removable, so it isn't easy for the user to verify that all radio transmission is in fact shut down - there could still be things like, for example, passive RFID. But if you had a radio-opaque bag in which you kept your phone, you could have a phone with you in case of emergencies, without the possibility of being tracked except when you were actively using it.
I'm old enough to remember when discussions on Slashdot were well informed.
I had a ham radio, but we ate it at Easter lunch. I don't know why my grandma insisted in carving the ham to look like a radio; but it was her house.
Memory is deceptive because it is colored by today's events. - Albert Einstein
I am in a position to offer a perfect solution. Just move to rural Australia and move your phone contract to Telstra. They are so fucking incompetent, nobody will ever succeed in tracking you.
:-/
The only downside is that you won't be able to make phone calls either.
That's what that battery is for - the mind control circuit. It's the only way they're keeping the people in line.
What most people don't know is that *that* is why there's a battery in your computer too! It has nothing to do with the stupid clock. The clock doesn't need the battery! You've seen the ones that work with a potato - that's proof enough that a clock doesn't need a battery. No, they have the computers programmed to reset your clock and bios after a short timeout to make you THINK you need that for the clock. And all you weak-minded losers fell for it, and the mind control circuit just keeps you believing that you need that battery.
Is it just my observation, or are there way too many stupid people in the world?
Before cell phones were cheap and everywhere, we had a large community of HAM operators who used our local 2m repeater to make short personal phone calls. It wasn't that hard to implement, just a DTMF decoder and a POTS interface board. We had improved capabilities once we replaced the repeater controller with a newer one that had this functionality built in. We were able to not only use DTMF tones to make phone calls, but to also patch into a network of linked 2m repeaters to converse with other HAMs throughout the state using VHF.
These comments are my own and do not necessarily reflect the views or opinions of my employer or colleagues...
Seriously, if you're that paranoid about being traced, why even carry a cellphone?
Essentially, if you're going to turn off all the functions that allow connectivity, and disable the phone enough that you're *pretty sure* that you can't be traced, why are you even carrying it? It's going to be a non-functional pile of circuitry in your pocket, basically. If you're that concerned, then any time you turn it on you might be being traced, even if the radio function is allegedly "off".
I guess if you want to be able to call out in case of emergency, just buy a one-time phone and DON'T USE IT UNTIL YOU NEED TO. Then throw it away.
-Styopa
I have heard about mesh networks, for instance, B.A.T.M.A.N. or Netsukuku. You just need a mesh network to GSM gate that impersonates your phone and sends the calls via the mesh to the endpoint router with VoIP gate. It's quite difficult to trace the mesh but all this project needs at least tens of paranoiacs around the city that keep the mesh routers up and running.
I believe that if your phone is on and in a frequency blocking bag, the battery will drain faster than normal, since the phone is now emiiting a more powerful signal trying to locate a tower.
US Patent 7751826 - Motorola submitted the patent in 2002, it was issued in 2010:
US Patent 7,751,826
The Federal Communications Commission (FCC) has mandated that, by December 2002, all cellular telephone carriers must market handsets capable of providing an emergency locator service. This emergency locator service, known as E911, will enable personnel at the public safety answering point (PSAP) to pinpoint the location of a cellular telephone user dialing 911. This FCC mandate further requires that the user not be able to override the emergency locator service in the case of a 911 emergency call.
This technology has raised public concern that, in addition to being used for emergency location, the locator service may be used by cellular carriers or by others to track the movements of cell phone users without their consent. There is therefore a need for a system that complies with the FCC mandate for location service while providing maximum privacy protection for cell phone users.
The invention overcoming these and other problems in the art relates in one regard to a system and method for selectively activating or deactivating E911 tracking service, in an embodiment by disabling power to GPS locator circuitry in a cellular telephone until the key sequence "9-1-1-Send" is detected. In one embodiment, the power to the GPS circuitry in a cellular handset may be activated by detection of a keypad sequence and the rotation of a physical switch to permit power delivery. When the handset detects the key sequence "9-1-1" it may output a signal that loads the switch into a "ready" position. When the user presses the "Send" button, the switch closes, enabling power to be delivered to the GPS circuitry. In other embodiments, the selective delivery of power may be controlled by software.
Motorola has been building phones for more than a decade in which the GPS circuitry is physically separated from electrical power until the user does something that causes it to be connected. This obviously doesn't help you if your phone has been hacked or modified and it doesn't help you avoid network triangulation, but it makes you wonder how all these supposed experts know all about the "dangers" of cell phones without having done much research or talking to the people who actually made the phones (you know, the inventors of patents are listed on the patents).
Instead of modifying your phone, turning it off, taking the battery out etc. you could build a mini Faraday cage. put the phone in there whenever it's not in use. :) When people ask about it tell them you've had issues with your phone running away.
Common Sense (+1)
Multiple tower triangulation, which seems so obvious, is quite difficult to implement, and is rarely done. Here's why:
- if you're fairly close to a tower, then other towers are unlikely to hear you. (This is by design: cell phone towers are designed to minimize overlap in coverage, so as to maximize frequency re-use over a geographic region)
- Those times when you are in range of multiple antennas (LTE people call these e-nodeBs), it's your cellphone that keeps track of the strengths of the neighboring e-nodeBs. This list of signal strengths and interference levels is not sent out from your cellphone unless a handover between enb's is about to happen.
- communications between a cellphone and a tower is not by a single carrier, but rather using a large number of discrete frequencies (for LTE, it's orthogonal frequency division multiplex). This type of modulation is designed to resist fading and interference, but is extremely difficult to triangulate, because the databits are spread over many symbols)
Most common localization of a cellphone uses a single tower. Simply knowing the antenna that you're connected through localizes you to a sector (of about 60 to 120 degrees in angle by about 1Km to 10Km in radius). The cellphone operator's Mobility Management Entity keeps track of this in real time, so as to route your calls, forward messages, and page your cellphone. Of course, this is several square kilometers, but it's possible to do much better:
Better single-tower geolocation takes advantage of every cellphone's being kept in tight time-synchronization with the clock in the tower's enb, using "Timing Advance". The Timing Advance method, in theory, can determine the distance of your cellphone to the tower within about 150 meters, but typically an operator gets 300 to 400 meters rms. This is a radial distance from the tower to your cellphone. The azimuthal location is coarsely determined by the sectorization of the tower: most cellphone towers have 3 to 6 enodeb antennas, and so can localize within 120 to 60 degrees in azimuth. And so, in general, you can be geolocated within an annulus: it's about 300 meters in radial distance from the tower, and about 60 to 120 degrees in azimuth. A fairly big territory: probably a football field or three. These systems are very useful for locating network problems, but cannot determine your location to better than a couple hundred meters.
A few systems can improve on this. For example, Newfield Wireless has developed a high resolution method of single-tower localization, apparently using enodeB timing data combined with local geographic information. But I'd be surprised if this results in better than 50 meter resolution.
Short version: Cellphone triangulation will not track you. Single tower tracking systems can yield coarse tracking.