Registry of Cell Phone Owners

In Mexico:

Also Tuesday, the Senate voted to create a registry of cell phone owners to combat kidnappings and extortions in which gangs often use untraceable mobile phones to make ransom demands.

Telecoms would be required to ask purchasers of cell phones or phone memory chips for their names, addresses and fingerprints, and to turn that information over to investigators if requested.

At present, unregulated vendors sell phones and chips for cash from streetside stands. It is unclear how such vendors would be made to comply with the new law.

How easy is it to steal a cell phone? I’m generally not impressed with security measures, especially expensive ones, that merely result in the bad guys changing their tactics.

Tags: , , , , ,

Posted on December 22, 2008 at 12:01 PM • 42 Comments

Comments

Marius Loots • December 22, 2008 12:19 PM

The same idiocy is planned for South Africa. Not sure at what stage it is. Will affect a lot of international visitors who will now have to register after arrival before they can legally use a cell phone. And cell phone theft is rife.

HJohn • December 22, 2008 12:26 PM

This would also have the side effect of hurting the market. I wouldn’t buy any product that required me to give my fingerprints.

Ceej • December 22, 2008 12:31 PM

So now they’ve just created a new black market for stolen cell phones… and those bought from the US or on eBay.

If some technology is employed to keep “non-approved” cell phones from working in Mexico, hackers will just break it. New enterprising gangs will begin stealing and/or modifying devices to resell. And now the profitability of kidnapping spreads to an underground supply-chain.

To cut down on this, Mexico might push for eBay and other companies to comply with their new policy. They could, of course, at even more cost… opening up a new market for hacked cell phone websites. More resources are spent in trolling the internet for them. And the cycle continues.

Brandioch Conner • December 22, 2008 12:45 PM

I don’t know, Bruce.

I’m pretty sure that a gang that would resort to kidnapping wouldn’t also resort to stealing a cell phone.

I mean, kidnapping is a pretty serious crime. They wouldn’t want to add any additional years for theft now, would they?

🙂

Okay, serious here now. Is there any reason that the kidnappers would NOT use the victim’s cell phone? It’s probably got the numbers of the people they want to inform on it. And if they pull the battery out then it is untraceable between calls.

Matthew • December 22, 2008 12:46 PM

Perhaps that is their plan: make selling such devices on the black market more profitable than kidnapping (on a risk/exposure vs return point of view) to reduce kidnappings.

Chris Finch • December 22, 2008 1:05 PM

I like to take advantage of O2, Orange and Virgin. I must have a couple of hundred sim cards now. lol.

dcposch • December 22, 2008 1:11 PM

People have been making anonymous ransom demands since long before there were cell phones. Trying to combat kidnapping and extortion by making it harder to demand money is like trying to prevent rape with these ridiculous devices:
http://en.wikipedia.org/wiki/Anti-rape_female_condom

It causes significant inconvenience for everyone, all the time to prevent something that happens comparatively rarely to relatively few people. And it’s too little, too late to be a good line of defense. “Anti-rape devices” inflict pain on the rapist when the crime is underway; tracing cell phones makes life difficult and dangerous for kidnappers after they’ve done the kidnapping. Both potentially harm the victim. And, of course, both are relatively easy to circumvent, so they’re not very effective deterrents.

In my opinion, the best way to fight extortionists is to have a hard policy against giving in to any of their demands. If victims simply refuse to give in, then kidnappers have no good options: they can:
* wait and run a great risk of being tracked down
* release the hostages and lose some of the heat, but also their credibility
* kill the hostages; then they have no chance at making money (or getting their other demands met) and pay a high political and financial price. They become international fugitives, and any countries associated with them risk military action against them.

Potentially “letting hostages die” sounds harsh, but it makes everyone safer in the long run — and may be the only way to do so.

PJ • December 22, 2008 1:17 PM

Next up: Computer & MAC Address Registration, followed by life in prison for altering a MAC address.

anonymous canuck • December 22, 2008 1:27 PM

It depends on what kidnapping you’re talking about. There is (used to be) a lot in Mexico were a person was held for a few days of ATM withdrawls. The victim was usually let go after they got what they wanted.

Dave • December 22, 2008 1:49 PM

Turkey requires registration of foreign cellphones (passport required) for use with local sims otherwise service is blocked after about 10 days. Again, this does not seem to stop the ‘bad guys’ doing the bad deeds within the 10 days or simply stealing a local’s

Richard Head • December 22, 2008 1:49 PM

So because it’s easy to steal a car to commit a robbery (which of course, happens all the time), therefore, we should stop registering cars? The fact of registration makes it easier to trace — the ransom call was made on a cell phone traced to someone gives police a vital clue to look for the thief of the phone. With no registration they have not clue.

schneitj • December 22, 2008 1:53 PM

Question: Don’t cell phones continuously transmit to locate the nearest base station? It seems that if they were going to mandate a technological change, they could force the telecoms to make phones easier to track with Radio Frequency Fingerprinting.

The cell phone towers could log the fingerprints and some sort of hand held device could narrow down the search. I don’t know how much this would cost, but at least it could not be faked.

Admittedly, this would probably just force them to use ransom notes, but I could see it having general applications. Privacy people probably wouldn’t like it, but you can’t change the technical possibility that exists today.

Steven • December 22, 2008 2:04 PM

This is really interesting, at least they are trying to improve security measures in Mexico. I agree, now bad guys will just find another way to go around this; will this registry really work?

Anonymous • December 22, 2008 2:11 PM

Here in germany phone companies are required to take your data when you buy a cell phone card as well. But they are not required to verify if they are correct and in fact many companies don’t.
What makes matters even worse is that it is perfectly legal to trade cell phone cards and a group of people even set up a card wapping service: you get a new card if you send yours in.
So in order to make this work you need to a) enforce correctnes of the given data, which is practically impossible and b) ban trading/swapping of phones which in itself is not possible. Just imagine complice A buys a phone, “looses” it, and bad boy B “finds” it.
All in all the whole idea is ludicrous, burns money and lulls people in a false sense of security not to speak of the possibility of abuse of the gathered data, and all that for no good reason.
In germany we call this “Datenkrake”, a data squid, because it has many arms and grabs all the data it can get.

Clive Robinson • December 22, 2008 2:26 PM

I suspect the excuse for the measure is “Kidnaping” the reason is something else…

We see enough of these “for the children” excuses handed out by Governments to spot them a good country mile away.

The question is what is the real reason (tax/fine gathering is most likley, then some friend of a politico with a new pork scheme).

Annie Mouse • December 22, 2008 4:05 PM

@Richard Head
“The fact of registration makes it easier to trace –”

What value is tracing it if it is stolen? Just how vital a clue is it to learn that a car or a cellphone was stolen from such-and-such area between such-and-such times?

Besides, the corollary to your car analogy is that unless people are now required to report each time their cellphone is stolen or just gets misplaced, said “vital clues” are probably of negative value because now the cops have to determine if the phone really was stolen or if the owner really is involved in the crime and making up a story. At least when a car is stolen, its obviously gone. A stolen cellphone might not even be noticed for a day or two depending on whose phone it is.

That’s a lot of overhead for questionable value, when, as someone else pointed out, they could just use the victim’s cell phone anyway.

Roy • December 22, 2008 6:39 PM

New business model: Buy a stolen phone from a fence, in the factory clone a thousand copies of the original, sell the lot to an entrepreneur at the wholesale price. Repeat.

Another new business model: Buy a cell phone legal. Report it stolen. Sell to model above. Repeat.

Chris Finch • December 22, 2008 6:48 PM

I enjoy free sim cards from O2, Orange and Virgin, here in the UK. Require no registration either.

What is a criminals desire, is a terrorists dream.

jay • December 22, 2008 7:37 PM

its funny to see that so called “Less developed” countries like Sri Lanka has already implemented this and is issuing mobile certificates on demand. So the enforcement officers can simply run a command on the phone and get the user’s National ID no and his/her age on demand. Recently all mobile users were forced to re-register their SIM card with the nearest mobile management centre with their national identity card. They were given period around 2 months to do the registration.. the numbers which were re-registered were disconnected after the period..

anon_coward • December 22, 2008 9:56 PM

Writing from India. Working for the largest Mobile telco here.
This madness is in full swing in my country too. There are cries for ‘more’ after the Taj thingy.
I kept telling my colleagues- ‘refuse to be terrorized’ – but people love to be scared.

Northern India had major ‘witch hunts’ conducted by the govt across telcos, the aim being to smoke out people with stolen-id phones. Turned out that a Delhi Rickshaw-puller had 16000 phones registered in his id. The phone dealers are running the racket.

Strangely- i have friends in the ministry. When I confronted them with ‘how easy its to steal a phone’ – their eyes glazed over.
Its impossible to make someone understand something when their pay-cheq depends on their not understanding it.

Richard • December 22, 2008 10:30 PM

China has started this sort of practice a few years ago. Mobile carriers are required to ask the customer provide their ID to purchase the cell phone and SIM card.

Razvan • December 23, 2008 1:41 AM

Who do you suppose advises such measures? Who qualifies as expert and says “yes, this should work”?

John Waters • December 23, 2008 2:52 AM

Here in saudi you are supposed to give a name for prepaid mobile service. This is not followed through in practice, however. I have a prepaid SIM that I use for 3G net access, I have only ever paid cash for it and my name is not in any way associated with the account. In most areas with sizable populations of illegal or partially legal workers, you can usually find a shop that will hook you up with “anonymous” service. Here in the gulf you just need to speak a little tagalog, urdu, or tamil and you are set.

Anonymous • December 23, 2008 2:59 AM

In Italy we have been required to provide ID when buying a SIM Card for years now. Also, traffic generated by mobile phones and landlines are kept for 24 months and are usable by investigators as long as they have a grant signed by a judge.

Ping-Che Chen • December 23, 2008 3:06 AM

It’s also already done in Taiwan, but not for kidnapping of course. In Taiwan, it’s very easy to buy pre-paid cellphone cards, and it used to require no ID or any documents (you’ll need to provide ID for buying a contract, because they need to know whom they should send their bills). However, many scammers and criminals take advantage of this and use these pre-paid cards as “non-traceable” cellphones. Of course, it does not really stop any scammers to scam more money.

Anyway, I don’t think it’s wise for kidnappers to use cellphones. It’s just too easy to track. It’s easier to just ask a collaborator far from your position to use a public phone to do so. This reduces the chance of exposing your position.

Anonymous • December 23, 2008 5:11 AM

Just give the wino that lives in the park a few dollars for a bottle of night train and he will get and register that sim phone for you.

Same approach I understand works well for purchases from the bottle shop if underage.

bob • December 23, 2008 7:04 AM

I understand that in Canada, they made everybody register their firearms. Same basic idea. Now they have a really big list of the 99% of guns that are unrelated to crimes. They should do that with their cellphones too, in case there’s any tax money still in the hands of the taxpayers.

What they should do is instead of registering non-criminals, they should pass laws requiring people who break laws to register!

HJohn • December 23, 2008 9:23 AM

@bob: “What they should do is instead of registering non-criminals, they should pass laws requiring people who break laws to register!”

I heard on news radio yesterday that they issued $500 gift cards to people who had warrants out for their arrest, I think in Chicago. When they went to cash in, they nabbed them. I don’t know details because it was just on the radio when i was driving. But it gave me a chuckle.

SumDumGuy • December 23, 2008 12:34 PM

@Hjohn – re “gift cards”

The police have been pulling variations on that theme for years. Another version has been to tell them they won a free boat and to come down to the “collection center” to get it. The “collection center” was to collect wanted criminals, not boats.

Of course anyone with half a brain would realize that a truly valuable “prize” does not just appear in the mail out of the blue and would probably think of a way to resell it without exposing himself. Ebay would be a great place to sell those gift cards at a discount from face value.

The fact that such schemes work as well as they do is probably why so many people in law enforcement believe the mantra that “criminals are stupid” – if that’s the only kind they ever catch, they never actually run into the smart ones.

Tritium • December 23, 2008 3:20 PM

The original, and still primary, purpose of vehicle registration (in the United States) is proof that you have paid your ‘road tax,’ not identification of criminals.

Back in the day, the state would issue you a license plate with a unique identification number (originally leather, then steel, now I think it’s aluminum), and somewhere in a government office was a piece of paper noting the physical characteristics of the vehicle (“red truck” “blue four-door” etc) so that you couldn’t pay your tax, then let all your neighbors borrow your plate and drive their cars without paying for the roads.

Long, long ago my state issued a new plate in a different color scheme each year, but nowadays to save money we can use the same plate indefinitely and just get a new sticker to put on the corner every year.

The plates don’t prevent criminals from committing crime anonymously – just steal some from a car parked outdoors. If you’re going to rob a bank, stealing license plates is nothing. But it does keep people from driving on roads they didn’t pay for.

szigi • December 25, 2008 6:24 AM

Get a homeless guy, give him nice clothes, maybe a couple of dollars cash, and get him buy you an untraceable phone. This is how various car and other loan frauds work since a long time.

The Raven • December 25, 2008 8:12 AM

They’re expecting one of the most corrupt police forces on earth to keep an accurate registry of fingerprints? Or anything? Oh, wow. This is so not going to work.

And a lot more innocent people are going to get caught in the gears, which isn’t funny at all.

Krawk!

averros • December 26, 2008 6:33 PM

Russia has that requirement – can’t get a cell phone without your ID registered. Can’t do that legally, that’s it.

The last time I was there I lost my cell phone, so I went to the nearby kiosk at a Metro station to buy a replacement – and forgot to take passport with me. So the vendor simply wrote in somebody else’s data in the book, and I got the phone without any traces leading back to me, just for asking. I still have it, heh.

Anonymous • December 27, 2008 11:55 PM

@szigi

Why spend so much?

Just give the wino 5$ for a bottle of cheap wine if he goes to the bottleshop for you.

Memories from my underage age tell me I have emperical evidence that it costs <5$ to circumvent any identity/age check at any commercial outlets. For any product.

Anonymous • December 28, 2008 12:14 AM

Lets rephrase that

-Just give the wino 5$ for a bottle of cheap wine if he goes to the bottleshop for you.

+Just give the wino 5$ for a bottle of cheap wine and he will authenticate for you.

Anonymous • January 1, 2009 5:34 AM

Once upon a time, regular posters to this blog were mostly security savvy guys. They seem to have largely been replaced by people whose sole imperative is to ridicule officialdom at any cost, regardless of making sense.

For the record: doing ransom negotiation via the kidnapping victim’s own cellphone would be really, really dumb. We can only hope that a lot of kidnappers try to do that, so we can thin them out a bit.

Leave a comment

Login

Allowed HTML <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre> Markdown Extra syntax via https://michelf.ca/projects/php-markdown/extra/

Sidebar photo of Bruce Schneier by Joe MacInnis.