Schneier on Security
A blog covering security and security technology.
« Food in Defense of a Crime |
| Voice Prints »
December 22, 2008
Registry of Cell Phone Owners
Also Tuesday, the Senate voted to create a registry of cell phone owners to combat kidnappings and extortions in which gangs often use untraceable mobile phones to make ransom demands.
Telecoms would be required to ask purchasers of cell phones or phone memory chips for their names, addresses and fingerprints, and to turn that information over to investigators if requested.
At present, unregulated vendors sell phones and chips for cash from streetside stands. It is unclear how such vendors would be made to comply with the new law.
How easy is it to steal a cell phone? I'm generally not impressed with security measures, especially expensive ones, that merely result in the bad guys changing their tactics.
Posted on December 22, 2008 at 12:01 PM
• 42 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
The same idiocy is planned for South Africa. Not sure at what stage it is. Will affect a lot of international visitors who will now have to register after arrival before they can legally use a cell phone. And cell phone theft is rife.
This would also have the side effect of hurting the market. I wouldn't buy any product that required me to give my fingerprints.
So now they've just created a new black market for stolen cell phones... and those bought from the US or on eBay.
If some technology is employed to keep "non-approved" cell phones from working in Mexico, hackers will just break it. New enterprising gangs will begin stealing and/or modifying devices to resell. And now the profitability of kidnapping spreads to an underground supply-chain.
To cut down on this, Mexico might push for eBay and other companies to comply with their new policy. They could, of course, at even more cost... opening up a new market for hacked cell phone websites. More resources are spent in trolling the internet for them. And the cycle continues.
I don't know, Bruce.
I'm pretty sure that a gang that would resort to kidnapping wouldn't also resort to stealing a cell phone.
I mean, kidnapping is a pretty serious crime. They wouldn't want to add any additional years for theft now, would they?
Okay, serious here now. Is there any reason that the kidnappers would NOT use the victim's cell phone? It's probably got the numbers of the people they want to inform on it. And if they pull the battery out then it is untraceable between calls.
Perhaps that is their plan: make selling such devices on the black market more profitable than kidnapping (on a risk/exposure vs return point of view) to reduce kidnappings.
It is absolutely to encounter such optimism during the holidays :)
I like to take advantage of O2, Orange and Virgin. I must have a couple of hundred sim cards now. lol.
err. absolutely wonderful even..
People have been making anonymous ransom demands since long before there were cell phones. Trying to combat kidnapping and extortion by making it harder to demand money is like trying to prevent rape with these ridiculous devices:
It causes significant inconvenience for everyone, all the time to prevent something that happens comparatively rarely to relatively few people. And it's too little, too late to be a good line of defense. "Anti-rape devices" inflict pain on the rapist when the crime is underway; tracing cell phones makes life difficult and dangerous for kidnappers after they've done the kidnapping. Both potentially harm the victim. And, of course, both are relatively easy to circumvent, so they're not very effective deterrents.
In my opinion, the best way to fight extortionists is to have a hard policy against giving in to any of their demands. If victims simply refuse to give in, then kidnappers have no good options: they can:
* wait and run a great risk of being tracked down
* release the hostages and lose some of the heat, but also their credibility
* kill the hostages; then they have no chance at making money (or getting their other demands met) and pay a high political and financial price. They become international fugitives, and any countries associated with them risk military action against them.
Potentially "letting hostages die" sounds harsh, but it makes everyone safer in the long run -- and may be the only way to do so.
Next up: Computer & MAC Address Registration, followed by life in prison for altering a MAC address.
It depends on what kidnapping you're talking about. There is (used to be) a lot in Mexico were a person was held for a few days of ATM withdrawls. The victim was usually let go after they got what they wanted.
Turkey requires registration of foreign cellphones (passport required) for use with local sims otherwise service is blocked after about 10 days. Again, this does not seem to stop the 'bad guys' doing the bad deeds within the 10 days or simply stealing a local's
So because it's easy to steal a car to commit a robbery (which of course, happens all the time), therefore, we should stop registering cars? The fact of registration makes it easier to trace -- the ransom call was made on a cell phone traced to someone gives police a vital clue to look for the thief of the phone. With no registration they have not clue.
Question: Don't cell phones continuously transmit to locate the nearest base station? It seems that if they were going to mandate a technological change, they could force the telecoms to make phones easier to track with Radio Frequency Fingerprinting.
The cell phone towers could log the fingerprints and some sort of hand held device could narrow down the search. I don't know how much this would cost, but at least it could not be faked.
Admittedly, this would probably just force them to use ransom notes, but I could see it having general applications. Privacy people probably wouldn't like it, but you can't change the technical possibility that exists today.
This is really interesting, at least they are trying to improve security measures in Mexico. I agree, now bad guys will just find another way to go around this; will this registry really work?
Here in germany phone companies are required to take your data when you buy a cell phone card as well. But they are not required to verify if they are correct and in fact many companies don't.
What makes matters even worse is that it is perfectly legal to trade cell phone cards and a group of people even set up a card wapping service: you get a new card if you send yours in.
So in order to make this work you need to a) enforce correctnes of the given data, which is practically impossible and b) ban trading/swapping of phones which in itself is not possible. Just imagine complice A buys a phone, "looses" it, and bad boy B "finds" it.
All in all the whole idea is ludicrous, burns money and lulls people in a false sense of security not to speak of the possibility of abuse of the gathered data, and all that for no good reason.
In germany we call this "Datenkrake", a data squid, because it has many arms and grabs all the data it can get.
I suspect the excuse for the measure is "Kidnaping" the reason is something else...
We see enough of these "for the children" excuses handed out by Governments to spot them a good country mile away.
The question is what is the real reason (tax/fine gathering is most likley, then some friend of a politico with a new pork scheme).
"The fact of registration makes it easier to trace --"
What value is tracing it if it is stolen? Just how vital a clue is it to learn that a car or a cellphone was stolen from such-and-such area between such-and-such times?
Besides, the corollary to your car analogy is that unless people are now required to report each time their cellphone is stolen or just gets misplaced, said "vital clues" are probably of negative value because now the cops have to determine if the phone really was stolen or if the owner really is involved in the crime and making up a story. At least when a car is stolen, its obviously gone. A stolen cellphone might not even be noticed for a day or two depending on whose phone it is.
That's a lot of overhead for questionable value, when, as someone else pointed out, they could just use the victim's cell phone anyway.
New business model: Buy a stolen phone from a fence, in the factory clone a thousand copies of the original, sell the lot to an entrepreneur at the wholesale price. Repeat.
Another new business model: Buy a cell phone legal. Report it stolen. Sell to model above. Repeat.
I enjoy free sim cards from O2, Orange and Virgin, here in the UK. Require no registration either.
What is a criminals desire, is a terrorists dream.
its funny to see that so called "Less developed" countries like Sri Lanka has already implemented this and is issuing mobile certificates on demand. So the enforcement officers can simply run a command on the phone and get the user's National ID no and his/her age on demand. Recently all mobile users were forced to re-register their SIM card with the nearest mobile management centre with their national identity card. They were given period around 2 months to do the registration.. the numbers which were re-registered were disconnected after the period..
I think the bad guys will just do a two-fer. Kidnap someone, then use his or her cell phone to place the ransom call.
Writing from India. Working for the largest Mobile telco here.
This madness is in full swing in my country too. There are cries for 'more' after the Taj thingy.
I kept telling my colleagues- 'refuse to be terrorized' - but people love to be scared.
Northern India had major 'witch hunts' conducted by the govt across telcos, the aim being to smoke out people with stolen-id phones. Turned out that a Delhi Rickshaw-puller had 16000 phones registered in his id. The phone dealers are running the racket.
Strangely- i have friends in the ministry. When I confronted them with 'how easy its to steal a phone' - their eyes glazed over.
Its impossible to make someone understand something when their pay-cheq depends on their not understanding it.
China has started this sort of practice a few years ago. Mobile carriers are required to ask the customer provide their ID to purchase the cell phone and SIM card.
Who do you suppose advises such measures? Who qualifies as expert and says "yes, this should work"?
Here in saudi you are supposed to give a name for prepaid mobile service. This is not followed through in practice, however. I have a prepaid SIM that I use for 3G net access, I have only ever paid cash for it and my name is not in any way associated with the account. In most areas with sizable populations of illegal or partially legal workers, you can usually find a shop that will hook you up with "anonymous" service. Here in the gulf you just need to speak a little tagalog, urdu, or tamil and you are set.
In Italy we have been required to provide ID when buying a SIM Card for years now. Also, traffic generated by mobile phones and landlines are kept for 24 months and are usable by investigators as long as they have a grant signed by a judge.
It's also already done in Taiwan, but not for kidnapping of course. In Taiwan, it's very easy to buy pre-paid cellphone cards, and it used to require no ID or any documents (you'll need to provide ID for buying a contract, because they need to know whom they should send their bills). However, many scammers and criminals take advantage of this and use these pre-paid cards as "non-traceable" cellphones. Of course, it does not really stop any scammers to scam more money.
Anyway, I don't think it's wise for kidnappers to use cellphones. It's just too easy to track. It's easier to just ask a collaborator far from your position to use a public phone to do so. This reduces the chance of exposing your position.
Razvan: That is exactly how it works.
Just give the wino that lives in the park a few dollars for a bottle of night train and he will get and register that sim phone for you.
Same approach I understand works well for purchases from the bottle shop if underage.
I understand that in Canada, they made everybody register their firearms. Same basic idea. Now they have a really big list of the 99% of guns that are unrelated to crimes. They should do that with their cellphones too, in case there's any tax money still in the hands of the taxpayers.
What they should do is instead of registering non-criminals, they should pass laws requiring people who break laws to register!
@bob: "What they should do is instead of registering non-criminals, they should pass laws requiring people who break laws to register!"
I heard on news radio yesterday that they issued $500 gift cards to people who had warrants out for their arrest, I think in Chicago. When they went to cash in, they nabbed them. I don't know details because it was just on the radio when i was driving. But it gave me a chuckle.
@Hjohn - re "gift cards"
The police have been pulling variations on that theme for years. Another version has been to tell them they won a free boat and to come down to the "collection center" to get it. The "collection center" was to collect wanted criminals, not boats.
Of course anyone with half a brain would realize that a truly valuable "prize" does not just appear in the mail out of the blue and would probably think of a way to resell it without exposing himself. Ebay would be a great place to sell those gift cards at a discount from face value.
The fact that such schemes work as well as they do is probably why so many people in law enforcement believe the mantra that "criminals are stupid" - if that's the only kind they ever catch, they never actually run into the smart ones.
The original, and still primary, purpose of vehicle registration (in the United States) is proof that you have paid your 'road tax,' not identification of criminals.
Back in the day, the state would issue you a license plate with a unique identification number (originally leather, then steel, now I think it's aluminum), and somewhere in a government office was a piece of paper noting the physical characteristics of the vehicle ("red truck" "blue four-door" etc) so that you couldn't pay your tax, then let all your neighbors borrow your plate and drive their cars without paying for the roads.
Long, long ago my state issued a new plate in a different color scheme each year, but nowadays to save money we can use the same plate indefinitely and just get a new sticker to put on the corner every year.
The plates don't prevent criminals from committing crime anonymously - just steal some from a car parked outdoors. If you're going to rob a bank, stealing license plates is nothing. But it does keep people from driving on roads they didn't pay for.
Get a homeless guy, give him nice clothes, maybe a couple of dollars cash, and get him buy you an untraceable phone. This is how various car and other loan frauds work since a long time.
They're expecting one of the most corrupt police forces on earth to keep an accurate registry of fingerprints? Or anything? Oh, wow. This is so not going to work.
And a lot more innocent people are going to get caught in the gears, which isn't funny at all.
There already is the National Registry of Cellular Phone Numbers where you can lookup someones cell phone number or reverse lookup.
Russia has that requirement - can't get a cell phone without your ID registered. Can't do that legally, that's it.
The last time I was there I lost my cell phone, so I went to the nearby kiosk at a Metro station to buy a replacement - and forgot to take passport with me. So the vendor simply wrote in somebody else's data in the book, and I got the phone without any traces leading back to me, just for asking. I still have it, heh.
Why spend so much?
Just give the wino 5$ for a bottle of cheap wine if he goes to the bottleshop for you.
Memories from my underage age tell me I have emperical evidence that it costs
Lets rephrase that
-Just give the wino 5$ for a bottle of cheap wine if he goes to the bottleshop for you.
+Just give the wino 5$ for a bottle of cheap wine and he will authenticate for you.
Once upon a time, regular posters to this blog were mostly security savvy guys. They seem to have largely been replaced by people whose sole imperative is to ridicule officialdom at any cost, regardless of making sense.
For the record: doing ransom negotiation via the kidnapping victim's own cellphone would be really, really dumb. We can only hope that a lot of kidnappers try to do that, so we can thin them out a bit.
This has just gone into effect in South Africa: http://www.mg.co.za/article/...
Beyond it being a major inconvenience, with little benefit, we now have yet another set of databases of personal information that can be badly managed and leaky.
There doesn't appear to be any requirement for auditing the system yet, although that may be gazetted later.
Schneier.com is a personal website. Opinions expressed are not necessarily those of BT.