Schneier on Security
A blog covering security and security technology.
« Making Handcuff Keys with 3D Printers |
| Criminals Using Commercial Spamflooding Services »
July 26, 2012
Police Sting Operation Yields No Mobile Phone Thefts
Police in Hastings, in the UK, outfitted mobile phones with tracking devices and left them in bars and restaurants, hoping to catch mobile phone thieves in the act. But no one stole them:
Nine premises were visited in total and officers were delighted that not one of the bait phones was 'stolen'. In fact, on nearly every occasion good hearted members of the public handed them to bar or security staff.
I'm not sure about the headline: "Operation Mobli deters mobile phone thieves in Hastings."
There are two things going on here. One, people are generally nice and will return property to its rightful owner. Two, it's hard for the average person to profit from a stolen cell phone. He already has a cell phone that's assigned to his phone number. He doesn't really know if he can sell a random phone, especially one assigned to the number of someone who had her phone stolen. Yes, professional phone thieves know what to do, but what's the odds that one of those is dining out in Hastings on a particular night?
Posted on July 26, 2012 at 6:55 AM
• 44 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
The outcome would be likely better if they haven't planted the phones (or wallets for that matter) in plain sight, but placed them in a pocket of a coat left hanging on a peg in a crowded bar.
A seemingly abandoned valuable in plain sight will attract some honest soul very soon. But no honest soul would rummage through the pockets of someone else's coat or even take notice of the coat if it is not the only one left in an empty place.
On the other hand, thieves, while being rare, are on constant lookout and do not hesitate rummaging through someone else's property when they can easily do it surreptitiously (like pretending to hang or take back their own coat)
Note that phones in the UK take interchangeable SIM cards so typically aren't assigned a specific number and can be resold for someone else to use. That's fairly widely known by the general population (upgrading a phone and keeping your number usually just involves the sales guy transferring the SIM right in front of you). Carriers usually don't run blocks on the IMEI (handset number) so a stolen handset is usually good to go.
I think "generally nice" is appropriate.
I wonder how long this "deterrence" can be sustained, financially I would imagine it would be a few weeks at most before someone cries about the costs.
If legalities (like entrapment), are managed/mitigated then it could become sustainable via a good business model.... just a thought.
There's no mention of what the phones were. A high-end phone would be much more attractive than a run-of-the-mill phone....
Yes, professional phone thieves know what to do, but what's the odds that one of those is dining out in Hastings on a particular night
I'm guessing you've not been to Hastings?
It's a seaside town full of "Bed and Breakfast" places cheep hotels and just up the road a "Haven Holiday Camp".
The old town is where many people live who work in London but cann't aford to live closer and people who are retired or in the process of retiring. The old town thus has some nice bars and restaurants by they are more for the locals as is the Fish & Chip cafe in the Fish Market it's award winning and you often have to book a week or two in advance but don't sit out on the balcony unless you have no fear of very large seagulls landing on your table and taking the food of your plate (my solution to get a quiet lunch was to catch one of the bruts and make it squawk long and loud to warn of the other gulls, before letting it go).
The sea front has loads of quite nasty "greasy spoon" cafes and cheap burger and kabab joints. There are several "games arcades" and in the summer the sea front has the usual rip off fair ground type rides.
Thus the population and types of robber you will get is very seasonal and locational.
Yes they do have more than their fare share of pick-pockets and bag grabers etc during the summer and preying on those who are clearly day trippers / holiday makers.
But if they did their little test during winter or up in the old town I would expect the results they got.
I forgot to add that the UK has had it's worst summer in living memory and if I remember correctly the night they were doing this test there were floods taking place and just about the whole of southern England was on Amber flood alert. I suspect therefore it was "a quiet night" with most holiday makers and nearly all day trippers staying away.
To give you an idea of just how bad the weather was untill just a few days ago the temprature was down to between 10&20C during the day. Now however we have tempratures up in the low 30's just in time to roasst the arivals for the London Olympics (but the weather is due to turn back this weekend...)
Wouldn't that be entrapment?
Also, how would they prove that I didn't intend to bring the thing to the lost&found office the other day (or next week)?
(No idea what the appropriate laws for finding lost property are in UK, but here you would have a certain allowance of reporting your finding to the authorities. E.g. when finding something on Friday evening in a bar, you'd be rather safe at least until next Monday.)
Perhaps, but when I lost a phone in 2009, 6 months later my grandmother received one of those Western-Union scam calls (person calls up, claims to be a friend or loved one, claims to be in some unusual location and needs money). Best we can figure out is that someone took my lost phone, sucked my address book out of it, then picked the entry labeled "Grandma" as a target to scam (and a frequently-called number to build up a plausible scenario).
xprsg and Paeniteo. How is it entrapment, whatever that is?
This sort of tactic is fairly standard, leave a car parked with a number of goodies in plain view while keeping it under surveillance and wait for some oiks to come along and help themselves. In rush the Rozzers and said oiks are off the streets for a couple of hours.
Hah! Have them try this in Paris and I am sure they will all be taken... even if they are still in your pocket (as from my experience there a few weeks ago).
@Paeniteo "Wouldn't that be entrapment?"
Not unless it was placed under a notice that said "free phone". Any person who saw a phone on a table would instantly recognize it is someone else's property. Honest people would hand it in over the bar or attempt to ring a number on the phone to return it. Taking the phone without consent would be theft.
As to how they prove it was stolen, I assume they stick some software on the phone to track its movement and activities. If someone makes calls on it, downloads stuff, travels everywhere except the nearest police station then the reasonable assumption that it's been stolen and the police could act accordingly.
@Ian: "[what is] entrapment"
"In criminal law, entrapment is conduct by a law enforcement agent inducing a person to commit an offense that the person would otherwise have been unlikely to commit."
Following the Wikipedia article, however, I now feel that it's unlikely to have been entrapment - although you can never be sure.
back in the 90's the Stpaul PD did a sting in cooperation with the Sprint telephone company, supposedly selling "stolen" phones, and eventually arrested a number of their customers, I suppose some must have pleaded guilty, but the phones were offered by the legitimate phone company for sale with the stpaul cops selling them with a "JOE ISUZU sales pitch, and no stolen phones were involved. Anyone who bought one and later got a lawyer should have gotten off easily since no crime was commited except by a company and government agents who all have impunity.
Leave a smartphone unguarded at my daughter's high school (in a largely upper-middle class area), and it is gone. The described sting would be far more successful, there.
Most folk are honest, but a few specialize.
The NYPD did something similar where they left a wallet on the ground and arrested anyone who tried to pick it up. The problem was that A.) very few people touched it, and B.) the people who did were well-meaning folks who wanted to take it to the police station so they could get it back to its rightful owner.
@Ian: leaving goodies locked up in a car is definitely not entrapment - a honest person would NOT break in. Goodies in the open (like a wallet on a sidewalk) is quite possibly entrapment, depending on the actions taken by the police and their timing.
according to schneier's security process, 'be vigilant'.
re: JW at July 26, 2012 7:29 AM
Wrong. The wikipedia article on IMEI explains how it works.
1) Not entrapment. If the police officers had planted a phone on the bar, then walked around to people and said "Hey, look at that phone over there. It's unattended and those are expensive. You should steal it." That's entrapment. Merely providing the opportunity to commit a crime isn't.
2) I'm not surprised really. Most people "know" that a stolen cell phone becomes useless fairly quickly (despite not being true as often as you think).
First of all, I wonder if they'd done some relevant research on local crime statistics before setting up the sting operation. In addition, I'm not too sure that people in general are nice and will return property to its rightful owner, either direct or indirect.
My gut feeling is telling me it has more to do with a number of demographic factors, disposition and trust. I frequently hang out at a couple of bars down where I live, one where theft is a scourge and another one where you can pass out without a problem, leave all your stuff unattended and lose exactly nothing but your dignity.
The first place is a rock 'n roll type of bar with a high concentration of Thai boxing, Krav Maga and other martial arts afficionados with a high degree of situational awareness. Although everybody is welcome, folks without tattoos, piercings or ordering non-alcoholic beverages are not trusted unless they are regular patrons in good standing. No credit is given and there is a strict zero tolerance policy about hastling girls, substance abuse or the selling thereof. The majority of the in-crowd are locals who in spite of regular internal brawls will stick up for each other when confronted by third parties. They also act as an umbrella for a bunch of geek students who get pestered or picked upon in other more trendier places. Any severe transgression against acceptable policy is guaranteed to get you beaten senseless, either by the barkeep or one of the guys trying to impress the ladies in the house. If necessary, the entire bar will testify against the victim if police is called in.
The second bar is a gathering place for mostly artists, intellectuals, fashionistas and folks passing by after a visit to the nearby museum at the riverside. It is also close to the red light district and an area with a high percentage of disenfranchised immigrants, asylum seekers and drug addicts. Most of the staff are girls. There is a high degree of tolerance for all sorts of weirdos, habits and behaviour. Though any form of agression or political incorrectness will get you scolded and ostracised, it is not a reason to be removed from the premises. Patrons in general are trusting kind of folks, rather careless, tend to look the other way for any event not impacting their micro peer group and will refuse to get involved in anything they consider none of their business.
Guess where most thefts take place ?
They don't mention the model mobile phone they were parading. Not to pick unnecessarily on the police, but isn't there a certain chance they were using something, ehm, slightly short of an iPhone 4? There's very little point in stealing a phone you can buy off the shelf for £25.
Oh, in the same vein, this is a story from Matt DeLito who allegedly is a London cop and whos stories allegedly are fictional adaptions of real events. Anyway, it deals with a London-based sting, using an iPad.
Careful selection of initial conditions make for poor statistics.
Oh, and Prunehart (?) - try getting most UK operators to block on IMEI and you will be in hell - they don't care, they want to sell tariffs. Not to mention that most phones can have their IMEIs hacked so that they will work at least while they are unloaded to their new owners.
Hasting's finest, Detective Chief Superintendent Christopher Foyle (Foyle's War), knows how to intimidate potential crooks.
Possibilities to consider:
a] the phones weren't left anywhere near Whitehall district
b] News of the World is out of business
I don't remember if Bruce posted the Symantec cell phone study.
It looks instead at cell phone data privacy as opposed to device theft and the results are quite a bit darker than the Brit's results.
On cell phone theft
It seems like it depends on the area. Most "hustlers" (not pro's, just shady) know how to turn a phone into cash, esp. a smartphone. I've witnessed plenty in action. In the major city near me, there's plenty of shady people who will steal any good phone that's left out so long as there's enough people there to give them deniability or there's no cameras. In nearby rural areas, buying, selling, trading, and stealing phones is a good way for young people to make spending money. They also get "upgrades" earlier than most people. ;)
So, I think opportunistic crime has more to do with the presence of opportunists than opportunities.
Hastings is a small town. Small town people are different.
I'd like to see how many phones would be stolen in Barcelona or NYC or London or Hong Kong. I know at least 2 were stolen in 2 days a few months ago in Barcelona. One disappeared on a subway from inside a friend's backpack and the other was brazenly stolen from a table in the back of a restaurant the following day after some commotion by gypsies. Neither were ever seen again. The wasn't much the Barcelona police could do, but they didn't do much at all besides send us to the police station to leave statements. I think they hoped we wouldn't bother filing a report since they weren't doing anything. The report was needed for insurance.
Both devices IEMI numbers have been reported, so hopefully those phones are completely useless world-wide. I suspect they are in Africa being used happily.
That same trip on a train from Milan to Florence, an Italian businessman left his iPhone at our shared table and walked off. I stopped him so he wouldn't forget his phone. My two travel buddies asked what I was thinking. I knew how much hassle the lost phone would bring to that man ... plus I hate Apple.
BTW, I'm from lots of small towns, but both my travel buddies are from NYC. That explains much.
The key problem is that the cops are half a generation behind. The main cost of a cellphone these days is operating it, not buying it.
As someone suggested, high end might have been more likely to be pinched, but high end is much more likely to have remote tracking and/or disabling apps as well and any thief worth their salt will have a clue about that.
Before leaving baits phones they would have done better to find out what the market is. I doubt it is booming, any more than cheap VCRs or CRT TVs.
Correct me if I'm wrong, but it seems to me that in Britain, just as in the US, finding and keeping property that someone has accidentally abandoned in a public place is perfectly legal and is not theft at all. If you were to find my wallet in a bar, trying to return it would be the courteous thing to do but is not required -- and even if you intended to return it, you might very well start by taking it home and placing an ad somewhere. (Of course, there are things you might do with it afterward that would be illegal and wrong -- using my ID to try to impersonate me or making purchases on my credit cards, for instance. (But it's certainly OK if you spend whatever cash is in it.) I'm not at all sure that using somebody's lost cell phone would automatically be illegal, though, especially if what you're using it for is to try to identify its owner!)
Therefore, if a "sting" of this type ever catches anybody, that person is almost certainly completely innocent. Forget "entrapment" -- any officer who performs this sting and arrests such a person should be stripped of his badge and thrown in his own jail.
I'm forwarding this to the Hastings police in the hope they'll rethink their scheme and change it so that anybody they catch will have committed a crime first. For example, they might have somebody behave like a drunk, with the phone sticking noticeably out of his back pocket. Then if somebody nicks it, he or she has done something wrong.
Some people are quick to conclude that this is not entrapment.
The Wikipedia entry on entrapment in England and Wales says that entrapment may include: "A police officer encourag[ing] a person to commit a crime so that the officer can have him prosecuted for that crime." Also, judges may consider "whether the police had good reason to suspect the accused of criminal activities."
Leaving a phone out for random members of the public to pick up is both (i) encouraging a person to commit a crime in order to generate a prosecution , and (ii) not directed at a specific person and therefore cannot entail good reason to suspect the accused. (I know it's just Wikipedia, but that seems to have been the standard reference for declaring that this is NOT entrapment.)
I'm sure there are much more productive, and prosecutable, ways to stop theft.
JW and Ethel: IMEI codes can be blocked by the carrier, but usually they aren't. The carrier has an interest to not block stolen IMEI because doing so would discourage theft and therefore decrease cell phone sales.
John David Galt: So, if you were to get up to use the restroom at a bar, and I were to find your jacket abandoned on the back of your chair, it could be mine? Found your car in the lot, too, you haven't been there for hours! No, this doesn't sound right.
Actually finders keepers is typically NOT the case when it comes to the law, at least the little I've read (ianal etc). You've got to be able to prove deliberate abandonment on the part of the owner, and finding a wallet/phone on a table/sidewalk won't cut it. There's a pretty clear trail of case law in this regard involving bank errors, cash stuffed in the lining of granny's old suitcase that you pawned, etc.
Obviously this might differ depending on jurisdiction.
IMEI codes can be blocked by the carrier, but usually they aren't. The carrier has an interest to not block stolen IMEI because doing so would discourage theft and therefore decrease cell phone sales.
It doesn't work that way, Eyal. The carrier has no interest whatsoever to encourage MD (Mobile Device) theft. First of all, carriers make money on services -- not on MD sales. In fact it's quite the contrary, carriers often subsidize ME (Mobile Equipment) and lose money on the sale. And for those trying to fake MEIDs or IMEIs, it can get you in trouble, especially if you don't know what you are doing. It's not worth the risk. Second, carriers often have services to wipe and sometimes disable lost phones, and they can be tracked.
@Chris Lawson, re: "Leaving a phone out... is... encouraging a person to commit a crime"
Not that I necessarily disbelieve you, but I'm skeptical. Do you know of any case law backing that claim up? If that were the case, that providing opportunity is equivalent to encouraging, then how can the police in England or the UK perform any sting operations at all? Do they just eschew them entirely?
Sorry for the double post, but I decided to look it up myself.
"Lord Nicholls identified that a useful guide when considering whether the conduct of the police amounted to inciting or instigating crime was to ascertain whether the police did more than present the defendant with an unexceptional opportunity to commit a crime."
I think the key wording here is "more than present... an unexceptional opportunity." I'm pretty sure leaving out a phone is most definitely an unexceptional opportunity since phones get left out all the time.
(Quotation from The Law Gazette, IANAL)
Wow, the UK must be nearly crime free for the cops to have this much time on their hands. Were they by any chance drinking "to blend in" while on duty staking out the bait phone?
The people I hang around with, all our phones look pretty similar (androids with a black housing) and no real way to tell them apart until you try to login and your pin doesnt work. If you've had a couple of drinks I can easily understand you absent-mindedly putting a phone in your pocket in a dimly lit bar without realizing its not yours [until you get home and realize you have two]. It would be like accidentally drinking from someone else's glass.
This "sting" would be similar to putting a black wheeled suitcase in the pile of them on the lazy susan at an airport after a plane lands and nicking anyone who grabbed it - if they could even keep track of which one was the "sting" one in the first place. Be funny if they arrested somoeone for taking his own suitcase [or celllphone in the original story] because they got mixed up too. At least until they convicted him anyway, that wouldnt be funny.
Yeah, there are a lot of problems with assuming that this indicates that random people will usually be altruistic with a found cell phone. There are really a lot of factors here, from the fact that the people in the bar are obviously by definition not too desperate for cash or they wouldn't be spending it on booze... to the fact, as mentioned above, that we are not talking about random people that first pick up the cell phone. It will be some do-gooder that is most prone to picking it up first probably.
Also, to add to the pile (I sure there are more) a bar is a social environment people may return to. If someone steals the phone that may become known, costing them far more than the phone is worth in social disapproval.
I've lost my phone twice on the bus now, and each time it was stolen by whoever found it. Even when I texted them with my name address and phone number to call me to return it, and a reward, the people refused to return it. They just used some of the cell phone time and probably tried to either sell it, or threw it away.
Frankly the whole thing sounds like it was deliberately arranged as a publicity stunt for the cops. If you actually wanted to catch thieves or measure the altruism of people, this is never how you would do it.
"One, people are generally nice and will return property to its rightful owner."
Try to do that in Cambodia or another developing country. The thieves will take the phone, throw away the SIM Card and be using your phone in one hour or selling it (or unlocking it).
The statement above would apply only in countries where there is a high degree of wealth, trust and an effective police force to act as a deterrent to the 'defectors'.
There was a quote on History Channel's documentary about a worst case pandemic which sums it up:
"We like to think that moral progress has made us nice people. We've heard that our distant ancestors were mean and cruel and ruthless, and we can't imagine that we would be such people - but we're nice mainly because we're rich and comfortable. And when we're no longer rich and comfortable, we won't be as nice." Economist Robin Hansen
To be fair as well most Cambodians (and other people in developing countries) are honest people. But they live on a much more desperate level than most Western people can comprehend.
@ Paul Harper
I understand what you say, but I disagree a little. Most people are honest. The correlation between wealth and honesty is weak; some dishonest people happen to be wealthy. Honesty is strongly corelated to values and principles the person holds, which is independent of wealth, police, and laws.
"But they live on a much more desperate level than most Western people can comprehend."
I can tell you unbelievable stories of honesty, generosity, and hospitality in some of the poorest nations of all.
More to the point, there's little point nicking phones in the UK, we have a comprehensive blocking database for stolen phones.
Hacking around that? HIGHLY illegal.
Phones are ubiquitous. At a point, enough is enough.
Reminds me of a Weird Al joke: An accordionist hurriedly parks his car, leaving his accordion in plain view and forgetting to lock the door. When he returns, his car contains *two* accordions.
Schneier.com is a personal website. Opinions expressed are not necessarily those of BT.