How Law Enforcement Tracks Cellular Phones

http://www.crypto.com/blog/celltapping/

by maxerickson • 13 years ago

81 37 13 years ago

andr• 13 years ago

So is the concept of someone remotely turning your cellphone into a microphone fact or fiction? Is their any proof in either direction?

eatitraw• 13 years ago

It may be rooted in reality. Not that they can turn on microphone on any phone, but that they were able to hack someone's phone to download firmware, for example.

BTW, there are recent news about FBI secretly activating webcams: https://twitter.com/tinyrevolution/status/409311691088723968...

LoganCale• 13 years ago

Every webcam should have a hardware light that indicates when it is on, as the ones built into Apple laptops do. The light cannot be disabled through software, it's just wired into the power connection to the camera and always comes on when the camera is turned on.

sillysaurus23• 13 years ago

is the concept of someone remotely turning your cellphone into a microphone fact or fiction? Is their any proof in either direction?

It is fact. http://news.cnet.com/2100-1029-6140191.html

Law enforcement absolutely has that capability, as well as turning your phone into a tracking beacon even when it's powered off.

See here for more info and discussion: https://news.ycombinator.com/item?id=6722519

tptacek3• 13 years ago

https://twitter.com/mattblaze/status/411539368990363648

tedunangst4• 13 years ago

Here's a thought. Remember that whole parallel construction thing everybody was freaking out about?

The NSA passes the FBI a tip. The FBI needs to get this tip admitted into evidence, so they claim they overheard it on the phone. One snag: the target's cell phone was turned off when the conversation took place. Solution: a magic bug that can listen even when it's turned off.

0xdeadbeefbabe• 13 years ago

It seems to be a fact, but have a little imagination. Your phone is leaking lots of data, data that is so useful to investigators that they'd prefer not to listen to you because they'd have to assign someone to interpret what was meant minute by minute.

rayiner• 13 years ago

This is a really excellent article.

Here's an article that goes into a lot of the law that is relevant to the investigative techniques mentioned: http://www.michiganlawreview.org/assets/pdfs/107/4/kerr.pdf. Note: the article makes a case in support of the third party doctrine, which justifies many of those investigative techniques, but is very well-researched and presents a pretty balanced view of what the law is in addition to defending that status quo.

tptacek3• 13 years ago

Matt Blaze is a really excellent person, and this is a research focus area for him.

For more in the same vein, try "The Eavesdropper's Dilemma" (http://www.crypto.com/papers/internet-tap.pdf). This paper is dear to me for reasons obvious to those who worked with me in the 1990s.

nchuhoai• 13 years ago

Just to put it to rest: This whole theatre in movies where you have to stay on the line sufficiently long enough to be able to trace their location is bull?

runjake• 13 years ago

Correct, and it has been bull since at least the late 70s, when digital trunking of calls was virtually omnipresent.

http://en.wikipedia.org/wiki/T-carrier

DanBC• 13 years ago

Yes.

Ann makes a call to Bob and hangs up within a second.

That call is not free; it will be listed on Ann's bill.

toomuchtodo2• 13 years ago

And if it was made from/to a cellphone, what towers saw that phone is going to be logged. Hello triangulation!

BrownBuffalo• 13 years ago

Hence why dump phones are so important to drug dealers. Change, recycle.

socillion• 13 years ago

Here's one case where that didn't work out: http://jolt.law.harvard.edu/digest/telecommunications/united...

Using a phone without your name attached to it is not equal to anonymity: https://www.schneier.com/blog/archives/2009/05/on_the_anonym...

Imagine if you had data on all cell phones, including location at time of call - wouldn't it be remarkably easy to match a disposable phone with it's predecessors based on when and where it was used, and who it was used to contact? For how, see this article: http://justsecurity.org/2013/10/11/nsa-call-records-database...

The [Hemisphere project] slides emphasize the program’s value in tracing suspects who use replacement phones, sometimes called “burner” phones, who switch phone numbers or who are otherwise difficult to locate or identify.

http://www.nytimes.com/2013/09/02/us/drug-agents-use-vast-ph...

lief79• 13 years ago

Am I missing something, or where is the http://www.trueposition.com tech included in this link? At least for the gsm networks, they can generally locate you with cross tower triangulation within 60 meters or so, far more accurate than just the nearest tower. Useful for e911 without GPS working. I'm not sure if they have any non gsm customers.

nitrogen2• 13 years ago

Before GPS hardware was commonly available in phones, some CDMA carriers offered phone-based navigation services that relied on tower triangulation. Thus, it's highly likely that triangulated location data was available to emergency services and law enforcement from CDMA networks as well.

coin• 13 years ago

'Cellular phones work by periodically scanning for and "registering" with the nearest base station (generally the one with the strongest radio signal).'

This is not true. A handset registers when it enters a new zone. A city is typically broken down into several zones. The handset does not register itself with every new cellsite ("tower") it encounters. If one's phone stays in the same area, it will never transmit while idle. This is the basis for its long battery life.

http://denbeste.nu/cdmafaq/voicemail.shtml

downer89• 13 years ago

I'm not sure that's true for dense urban zones like NYC. I'm pretty sure my phone registers with many different towers frequently.

There's a tower on almost every other building in New York, and sometimes even within buildings and underground.

Considering that smart phones are particularly promiscuous, especially in the presence of poorly conceived and opportunistic apps (downloaded by my rotten teenage kids), my phone is probably a shining beacon of electromagnetic activity, constantly transmitting high-score updates, and my entire contact list and GPS coordinates to web servers hosting silly JSON APIs.

toki5• 13 years ago

There was a DEFCON talk two years ago in which the presenter assembled large antennas and ran open-source software that allowed him to mimic a base station. Everyone who was using phones on a specific network (I don't remember which -- I want to say AT&T) connected to his base station within a few minutes, and he proved the concept by hijacking outgoing calls.

If one's phone stays in the same area, it will never transmit while idle.

Maybe phones used to do this, but nowadays I'm not so sure.

yuubi• 13 years ago

CDMA also has optional timer-based registration, with intervals between ~12 sec and ~55 hours (depending on what the base station wants; search 3gpp2 C.S0005 for REG_PRD for the gory details), or the base station can send a Registration Request Order message (which does what you might expect) to the phone of interest.

How Law Enforcement Tracks Cellular Phones

Related Stories