Feeds

Scotland Yard trackers operate fake mobile base stations

Reports say cops are running secret air wing too

Protecting users from Firesheep and other Sidejacking attacks with SSL

London's Metropolitan Police are using fake base stations to intercept mobile-phone calls, not to mention running a covert air wing, according to reports over the weekend.

The base stations come from Leeds-based Datong plc, and can blanket a 10km2 area within which every mobile phone is tracked and monitored, according to the Guardian newspaper. Meanwhile the Telegraph has been busy tracking down £3m worth of fixed-wing aircraft, which, the paper alleges, the Met has been using without oversight from the Metropolitan Police Authority.

Neither claim has been admitted, or denied, by the Metropolitan Police force, which provided us with the usual comments about "proportionate responses" and "covert policing". Neither claim is particularly shocking, but even spooks would be impressed to see the police running a 14-seater Cessna registered to a shell company consisting of nothing more than a rented post-office box.

It would also be no great surprise if the police were to use fake base stations to track people during civil unrest. The same information can be obtained from the mobile network operators, but that takes time and costs money with the two vectors being directly related.

UK mobile operators are obliged to keep location and calling information for a year, logging everywhere you've been and everyone with whom you speak, but they are allowed to charge the police (on a cost-recovery basis) for access to that data. The faster the police want the data, the more the operators charge, so real-time tracking is very expensive indeed.

2G networks only authenticate in one direction – the SIM proves its identity to the network – so creating a fake base station is relatively easy. The GSM standard also allows the base station to ask for an unencrypted connection, essential in countries where strong encryption isn't allowed, so a man-in-the-middle attack is very feasible. Handsets are supposed to provide an on-screen notification when encryption has been disabled, but conformance to that detail is very rare indeed.

But that's to listen in to calls. Tracking people is a good deal easier. Phones broadcast an identifying number (the TIMSI) which can't immediately be linked to an individual but can be used to track movements in an entirely passive way. The lack of identity actually makes the process (legally) easier, as under the current legislation the privacy implications disappear when there's no identity. Private companies such as Path Intelligence do exactly the same thing for shopping malls and suchlike, tracking footfall without knowing (or caring) whose feet are falling.

The police, however, are slightly different in that they can go back to the network operator later and link the TIMSI to a real IMSI. That will generally link to a physical person, who might then have to explain what his/her phone was doing at the time in question.

The Guardian reckons the Met paid £143,455 to Detong in 2008/9, and Detong do sell kit for tracking mobile phones as described, so it seems likely that this is what the Met is doing. Hertfordshire Constabulary also shelled out £8,373 to Detong, presumably for similar capabilities.

We already know that the police can use our mobile-phone records to see where we were, and the technology to see where we are has been knocking around for years, so it shouldn't be hugely surprising if the police are using that too. The UK is one of the decreasing number of countries in which one can still buy a mobile phone without proof of identity, which provides considerable protection against such tracking, so we should probably expect to see that freedom targeted any day now. ®

Bootnote

It should probably be noted that large and well-resourced parts of the Metropolitan Police are nothing to do with the city's government or London as such. The Counter Terrorism Command, despite appearing on the Met table of organisation as SO15, is in fact a national organisation with offices and operations outside the capital. It frequently operates alongside the Security and Secret Intelligence services (MI5 and MI6). As such it has access to funds other than those supplied via the Metropolitan Police Authority.

The next step in data security

More from The Register

next story
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
'Speargun' program is fantasy, says cable operator
We just might notice if you cut our cables
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.