Feeds

Scotland Yard trackers operate fake mobile base stations

Reports say cops are running secret air wing too

The essential guide to IT transformation

London's Metropolitan Police are using fake base stations to intercept mobile-phone calls, not to mention running a covert air wing, according to reports over the weekend.

The base stations come from Leeds-based Datong plc, and can blanket a 10km2 area within which every mobile phone is tracked and monitored, according to the Guardian newspaper. Meanwhile the Telegraph has been busy tracking down £3m worth of fixed-wing aircraft, which, the paper alleges, the Met has been using without oversight from the Metropolitan Police Authority.

Neither claim has been admitted, or denied, by the Metropolitan Police force, which provided us with the usual comments about "proportionate responses" and "covert policing". Neither claim is particularly shocking, but even spooks would be impressed to see the police running a 14-seater Cessna registered to a shell company consisting of nothing more than a rented post-office box.

It would also be no great surprise if the police were to use fake base stations to track people during civil unrest. The same information can be obtained from the mobile network operators, but that takes time and costs money with the two vectors being directly related.

UK mobile operators are obliged to keep location and calling information for a year, logging everywhere you've been and everyone with whom you speak, but they are allowed to charge the police (on a cost-recovery basis) for access to that data. The faster the police want the data, the more the operators charge, so real-time tracking is very expensive indeed.

2G networks only authenticate in one direction – the SIM proves its identity to the network – so creating a fake base station is relatively easy. The GSM standard also allows the base station to ask for an unencrypted connection, essential in countries where strong encryption isn't allowed, so a man-in-the-middle attack is very feasible. Handsets are supposed to provide an on-screen notification when encryption has been disabled, but conformance to that detail is very rare indeed.

But that's to listen in to calls. Tracking people is a good deal easier. Phones broadcast an identifying number (the TIMSI) which can't immediately be linked to an individual but can be used to track movements in an entirely passive way. The lack of identity actually makes the process (legally) easier, as under the current legislation the privacy implications disappear when there's no identity. Private companies such as Path Intelligence do exactly the same thing for shopping malls and suchlike, tracking footfall without knowing (or caring) whose feet are falling.

The police, however, are slightly different in that they can go back to the network operator later and link the TIMSI to a real IMSI. That will generally link to a physical person, who might then have to explain what his/her phone was doing at the time in question.

The Guardian reckons the Met paid £143,455 to Detong in 2008/9, and Detong do sell kit for tracking mobile phones as described, so it seems likely that this is what the Met is doing. Hertfordshire Constabulary also shelled out £8,373 to Detong, presumably for similar capabilities.

We already know that the police can use our mobile-phone records to see where we were, and the technology to see where we are has been knocking around for years, so it shouldn't be hugely surprising if the police are using that too. The UK is one of the decreasing number of countries in which one can still buy a mobile phone without proof of identity, which provides considerable protection against such tracking, so we should probably expect to see that freedom targeted any day now. ®

Bootnote

It should probably be noted that large and well-resourced parts of the Metropolitan Police are nothing to do with the city's government or London as such. The Counter Terrorism Command, despite appearing on the Met table of organisation as SO15, is in fact a national organisation with offices and operations outside the capital. It frequently operates alongside the Security and Secret Intelligence services (MI5 and MI6). As such it has access to funds other than those supplied via the Metropolitan Police Authority.

Next gen security for virtualised datacentres

More from The Register

next story
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Germany 'accidentally' snooped on John Kerry and Hillary Clinton
Dragnet surveillance picks up EVERYTHING, USA, m'kay?
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
Think crypto hides you from spooks on Facebook? THINK AGAIN
Traffic fingerprints reveal all, say boffins
Rupert Murdoch says Google is worse than the NSA
Mr Burns vs. The Chocolate Factory, round three!
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
prev story

Whitepapers

5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.