Original URL: http://www.theregister.co.uk/2009/04/10/mobile_phone_tracking/

The mobile phone as self-inflicted surveillance

And if you don't have one, what have you got to hide?

By David Mery

Posted in Law, 10th April 2009 09:02 GMT

Like the breadcrumbs in Hansel and Gretel, mobile phones leave a trail wherever they go. Practically everybody can be tracked via this trail, and the beauty of it all is, we're effectively tracking ourselves.

By design, phones pass their location on to local base stations. You can gauge how effectively the networks can track you by requesting your personal information from your network provider using a data subject access under the Data Protection Act, or by just running Google Mobile Maps on your phone. The smaller 3G cells in central London give an even better location than on GSM.

Mobile phone penetration in Europe reached an average of 111.26 per cent in 2007 according to ITU estimates, while in the UK it was 118.47 per cent. We love them so much that we are more likely to leave our wallet at home than our mobile.

The location breadcrumbs from these, along with other communication traffic data, are kept as part of a mass surveillance operation affecting everyone. They are collected by the networks, retained for a year, and handed over to the police and other bodies on request.

Professor Steve Peers, of the University of Essex and Statewatch, points out that although the system is incredibly sweeping, it doesn't stigmatise anyone because every phone call is going to be subject to this.

It's no longer just the individuals who are suspect of, or connected to, or convicted of a crime who are subject to some sort of additional surveillance beyond which they would traditionally have been subjected to. As regards to data retention, as regards to fingerprints, as regards to passenger records, it's everyone or a very large percentage of the population subject to the hoovering of that information.

This is cogent analysis. Mobile phones and email are used by everyone, including terrorists and other criminals. The data can be instrumental in tracking down criminals, with the caveat that having a bigger haystack does not make it easier to find a needle. But it misses one perverse effect - those who will be stigmatised in the future are those who don't have traffic data retained.

Lack of traffic data is what becomes suspicious. There are already two documented cases in Europe where not carrying a mobile phone was considered one of the grounds for arrest.

On 31st July 2007, in Brandenburg and Berlin, Germany, the flats and workplaces of Dr. Andrej Holm and Dr. Matthias B., as well as of two other persons, were searched by the police. All four were charged with "membership of a terrorist association" and are alleged to be members of a so-called 'militante gruppe' (mg):

According to the arrest warrant against Andrej Holm, the charge against the four individuals was justified on the following grounds:

• Dr. Matthias B. is alleged to have used, in his academic publications, "phrases and key words" which are also used by the 'militante gruppe';

[...]

• The fact that he - allegedly intentionally - did not take his mobile phone with him to a meeting is considered as "conspiratorial behavior".

On 11th November 2008, 150 French anti-terrorist police officers swooped on the 330-inhabitant village of Tarnac to arrest four men and five women aged 22 to 34, since nicknamed the 'Tarnac Nine'. These 'brilliant students' were living in a farm and ran a grocery store. All but one have been released. They were accused of "criminal association connected to a terrorist enterprise". French Interior Minister Michèle Alliot-Marie (MAM) was in the news soon after:

The Interior Minister is convinced of having saved France by nipping a revolution in the bud. For MAM, the defendants are the seed of Action Directe.

"They have adopted the method of clandestinity. They never use a mobile phone. They managed to have, in the village of Tarnac, friendly relations with people who could warn them of the presence of strangers," said the minister.

In the village, people laugh at this statement. One of the defendants rented an apartment above the town hall. "Is it a clandestine method?", asks Jean-Michel, who goes on: "Can one be labelled terrorist because he does not have a mobile phone?". Here, mobile reception is poor.

Mass surveillance of the rest of us is becoming even more pervasive. The UK started transposing the European directive on retaining data generated through electronic communications or public communications networks (European Directive 2006/24/EC) with the Data Retention (EC Directive) Regulations 2007. These came into force on 1st October 2007 and require service providers to retain fixed and mobile telephony traffic data of everyone's calls and SMS and MMS for one year and hand it over on request.

More than 650 public authorities can lawfully obtain communications data, including intelligence and law enforcement agencies, emergency services and other public authorities, such as the Financial Services Authority, local councils and the Home Office's UK Border Agency.

These regulations were superseded this week (on 6th April 2009), by the 2009 Regulations eventually completing the implementation of the European directive by adding the requirement to retain Internet access, email and Internet telephony traffic data as well.

What has to be retained in all cases is data necessary to trace and identify the source and destination of a communication and to identify the date, time and duration, and the communication's type. For mobile telephony and for Internet access, email and telephony, there's also a requirement to retain data necessary to identify users' communication equipment (or what purports to be their equipment) and the location of mobile communication equipment. The detail of exactly what needs to be retained has been regrouped in an easy to read list in a schedule to the Statutory Instrument (S.I.).

Earlier this year, Sir David Omand, a former Cabinet Office security and intelligence coordinator, gave a clear indication of what some in Whitehall have on their wish-list:

[A]pplication of modern data mining and processing techniques does involve examination of the innocent as well as the suspect to identify patterns of interest for further investigation.[...] Finding out other people's secrets is going to involve breaking everyday moral rules. So public trust in the essential reasonableness of UK police, security and intelligence agency activity will continue to be essential.

One extension to the traffic data retention guidelines that fits within this agenda is the building of a massive central silo for all UK communications data. Another is the e-Borders database (in pilot schemes, 0.0035 per cent of people screened were arrested); the location of your mobile phone had better match the country you declared you would be in.

Professor Steve Peers offers a glimmer of hope:

What is the relevance of [the European Court of Human Rights DNA database ruling] Marper to that? To what extent can it regulate or stop what is clearly an ongoing development?

Marper is very relevant if it rules out the sweeping collection of personal data regardless of the stigmatisation factor and regardless of the UK factor (the distinction between the UK and the rest of the Council of Europe countries). If we ignore these factors and say what is wrong here is purely sweeping collection of personal data, then this is a very significant judgement. Then it's profoundly important. It really stands in the way of what we're already doing across Europe, not just in the UK.

Of course the ruling may be interpreted to have no relevance outside its application to the retention of DNA and fingerprints. Then Sir David Omand's national security strategy may be further implemented and carrying a mobile phone - an electronic tag - could become a necessity, if you don't want people to think you have something to hide.

David Mery is a scribbler and technologist based in London. Two years ago he was one of 64 who asked the Metropolitan Police to have their DNA samples destroyed, and DNA profiles and associated records purged. His request was one of 18 that were deemed exceptional enough to be granted. His website is gizmonaut.net.