Washington - A recent Washington Post story on surveillance technology that can track cellphone users anywhere in the world left some readers with a question: What can they do, short of tossing their phones into the sea, to keep their locations private?
The answer is, individually, not much if you are an ordinary cellphone user. As long as your phone connects to a carrier's cellular network, the carrier must keep records of your location. But security experts say that carriers could do a better job of protecting these records from surveillance. If customers, as a group, push these companies to do so, change might come.
“The carriers have all the power,” said Christopher Soghoian, principal technologist for the ACLU who has long warned about the vulnerability of cellular networks to surveillance.
The surveillance systems described in the story work by gaining access to carrier databases that track which tower cellphones are using at any given time. This allows a person's location to be mapped on a computer screen — to within a few blocks in an urban area or a few miles in a rural one. These systems are marketed to governments around the world and, many experts fear, may also have fallen into the hands of sophisticated criminal gangs and rogue states.
There is debate in the security community about whether blocking these systems would be time-consuming and expensive — one expert estimated the cost in the billions of dollars — or relatively easy and quick. Either way, it's clear that carriers could do more to protect their users' privacy. Some already do.
Makers of the surveillance systems boast that their success rates in tracking people exceeds 70 percent. That means that they fail a substantial portion of the time — something approaching 30 percent. Some of those failures likely result from technical shortcomings in the complex world of telecommunications systems. But in at least some cases, carriers are actively seeking to block locations queries about their customers.
Karsten Nohl, a German telecommunications researcher, said he has advised several carriers that have changed the configurations in their systems to limit the information that surveillance systems can collect. He said the changes were relatively straightforward, though they must be done carefully.
“It's easy but not trivial,” said Nohl, chief scientist for Security Research Labs, based in Berlin.
The key is the SS7 network, which carriers and other telecommunications companies use to communicate with each other. The network is necessary to get calls, texts and Internet services to users, but it's also dated and not secure, experts say. That puts the responsibility on carriers to aggressively screen data requests and to send location information over SS7 only when absolutely necessary — and only to trusted partners.
But Tobias Engel, another German telecommunications security researcher, said cellular networks can be difficult to change without causing unintended consequences that affect how they function. He urged carriers to screen data requests over SS7 more aggressively, but he said it would be difficult for some, and the changes are likely to take time to implement.
“That's always the problem with changing stuff in SS7. That's why carriers are so reluctant to do it,” Engel said. “If you change something, you don't know what will break.”
Sophisticated users can opt for personal solutions: encrypted e-mail or apps that use the Internet, rather than cellphone networks, to carry calls. Some security-minded people sometimes use Web-based calling services to obscure their actual phone numbers, making it harder for tracking technology to work.
But for most of the world's billions of cellphone users, only carriers can turn off the tap of surveillance data flowing over SS7 networks. Security experts say few will bother to make that investment — regardless of whether it is large or small — if there's no cost to their bottom line for failing to do so.
“Why would you protect your customers if your customers don't complain about not being protected?” Nohl said. - Washington Post