Feeds

Scotland Yard trackers operate fake mobile base stations

Reports say cops are running secret air wing too

Providing a secure and efficient Helpdesk

London's Metropolitan Police are using fake base stations to intercept mobile-phone calls, not to mention running a covert air wing, according to reports over the weekend.

The base stations come from Leeds-based Datong plc, and can blanket a 10km2 area within which every mobile phone is tracked and monitored, according to the Guardian newspaper. Meanwhile the Telegraph has been busy tracking down £3m worth of fixed-wing aircraft, which, the paper alleges, the Met has been using without oversight from the Metropolitan Police Authority.

Neither claim has been admitted, or denied, by the Metropolitan Police force, which provided us with the usual comments about "proportionate responses" and "covert policing". Neither claim is particularly shocking, but even spooks would be impressed to see the police running a 14-seater Cessna registered to a shell company consisting of nothing more than a rented post-office box.

It would also be no great surprise if the police were to use fake base stations to track people during civil unrest. The same information can be obtained from the mobile network operators, but that takes time and costs money with the two vectors being directly related.

UK mobile operators are obliged to keep location and calling information for a year, logging everywhere you've been and everyone with whom you speak, but they are allowed to charge the police (on a cost-recovery basis) for access to that data. The faster the police want the data, the more the operators charge, so real-time tracking is very expensive indeed.

2G networks only authenticate in one direction – the SIM proves its identity to the network – so creating a fake base station is relatively easy. The GSM standard also allows the base station to ask for an unencrypted connection, essential in countries where strong encryption isn't allowed, so a man-in-the-middle attack is very feasible. Handsets are supposed to provide an on-screen notification when encryption has been disabled, but conformance to that detail is very rare indeed.

But that's to listen in to calls. Tracking people is a good deal easier. Phones broadcast an identifying number (the TIMSI) which can't immediately be linked to an individual but can be used to track movements in an entirely passive way. The lack of identity actually makes the process (legally) easier, as under the current legislation the privacy implications disappear when there's no identity. Private companies such as Path Intelligence do exactly the same thing for shopping malls and suchlike, tracking footfall without knowing (or caring) whose feet are falling.

The police, however, are slightly different in that they can go back to the network operator later and link the TIMSI to a real IMSI. That will generally link to a physical person, who might then have to explain what his/her phone was doing at the time in question.

The Guardian reckons the Met paid £143,455 to Detong in 2008/9, and Detong do sell kit for tracking mobile phones as described, so it seems likely that this is what the Met is doing. Hertfordshire Constabulary also shelled out £8,373 to Detong, presumably for similar capabilities.

We already know that the police can use our mobile-phone records to see where we were, and the technology to see where we are has been knocking around for years, so it shouldn't be hugely surprising if the police are using that too. The UK is one of the decreasing number of countries in which one can still buy a mobile phone without proof of identity, which provides considerable protection against such tracking, so we should probably expect to see that freedom targeted any day now. ®

Bootnote

It should probably be noted that large and well-resourced parts of the Metropolitan Police are nothing to do with the city's government or London as such. The Counter Terrorism Command, despite appearing on the Met table of organisation as SO15, is in fact a national organisation with offices and operations outside the capital. It frequently operates alongside the Security and Secret Intelligence services (MI5 and MI6). As such it has access to funds other than those supplied via the Metropolitan Police Authority.

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Hackers thrash Bash Shellshock bug: World races to cover hole
Update your gear now to avoid early attacks hitting the web
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.