Getting the Message? Police Track Phones with Silent SMS

[Mirrorshades]

Getting the Message? Police Track Phones with Silent SMS

In Europe security services have been sending thousands of Silent SMS messages, allowing them to locate and track phones without the recipient's knowledge.
A legal vacuum exists around the technique.
by Fabien Soyez On January 27, 2012

In June 2011, Colette Giudicelli, a senator representing the Maritime Alps region of France, wrote to Claude Gueant, the French Interior Minister:

Many foreign police and intelligence services use clandestine “Silent” SMS to locate suspects or missing persons. This method involves sending an SMS text message to the mobile phone of a suspect, an SMS that goes unnoticed and sends back a signal to the sender of the message. Colette Giudicelli would like to know whether this procedure has been used in France.

Seven months later, and there has still been no response from the French government. The subject might well have faded from memory, had it not been for the 28th Chaos Communication Congress, held in Berlin at the end of December. At the international hackers conference, the researcher and mobile security expert Karsten Nohl announced: “In Germany in 2010, police sent thousands of Silent SMS in order to locate suspects.”

Also known as Flash-SMS, the Silent SMS uses an invisible return signal, or “ping”. Developers from the Silent Services company, who created some of the first software for sending this type of SMS, explain:

The Silent SMS allows the user to send a message to another mobile without the knowledge of the recipient mobile’s owner. The message is rejected by the recipient mobile, and leaves no trace. In return, the sender gets a message from a mobile operator confirming that the Silent SMS has been received.

Silent SMS were originally intended to allow operators to ascertain whether a mobile phone is switched on and to “test” the network, without alerting the users. But now, intelligence services and police have found some other uses for the system. Neil Croft, a graduate of the Department of Computer Science at the University of Pretoria in South Africa, explains:

Sending a Silent SMS is like sending a normal SMS, except that the mobile does not see the message it has received. The SMS’s information is modified, within the data coding scheme, so that the user who receives the message doesn’t notice anything. A Silent SMS can help police to detect a mobile without the person concerned being aware of the request.

Technical bit: in order to tamper with the SMS’s information and make it silent, the security services go through a network for sending and receiving SMS known as an SMS gateway, such as the Jataayu SMS gateway. This allows them to interconnect the processing and GSM systems. Neil Croft, now president of an SMS marketing company, explains:

These Silent SMS are also used by some hackers to organise attacks known as “distributed denial of service” (DDOS) attacks. These run down the battery on a mobile abnormally fast, rendering it unable to receive calls. Such a procedure is not expensive: to send one Silent SMS per second for one hour costs about €36 euros.

This method of mass sending appears to be widely used by these security services. In November 2011, Anna Conrad of the Die Linke (The Left) party in Germany, posed a written question (pdf) to her local state assembly concerning the use of Silent SMS by the German police. Her local assembly responded: in 2010, her state conducted 778 investigations and sent 256,000 Silent SMS.

Mathias Monroy, a journalist with Heise Online, argues this surveillance technology is flourishing largely as a result of a legal vacuum:

This is very problematic for privacy, because legally it is unclear whether or not a Silent SMS counts as a communication (…) The state found that it was not one, since there is no content. This is useful, because if it is not a communication, it does not fall under the framework of the inviolability of telecommunications described in Article 10 of the German Constitution.

On December 6, the German Interior Minister Hans-Peter Friedrich announced that German police and intelligence had been sending an average of 440,000 Silent SMS a year since they began using the system.

After each SMS was sent, investigators went to the four German mobile operators – Vodafone, E-Plus, O2 and T-Mobile – in order to access the recipient’s information. To aggregate this raw data provided by operators, the police use Koyote and rsCase, software supplied by Rola Security Solutions, a company that develops “software solutions for the police”.

Smile, you’re being tracked

Silent SMS allow the user to precisely locate a mobile phone by using the GSM network, as Karsten Nohl explains:

We can locate a user by identifying the three antennas closest to his mobile, then triangulating the distance according to the speed it takes for a signal to make a return trip. A mobile phone updates its presence on the network regularly, but when the person moves, the information is not updated immediately. By sending a Silent SMS, the location of the mobile is instantly updated. This is very useful because it allows you to locate someone at a given time, depending on the airwaves.

This technique is much more effective than a simple cellular location (Cell ID), as François-Bernard Huyghe, a researcher at IRIS, sets out:

This is the only instantaneous and practical method to track a mobile constantly when it’s not in use. We’re talking then about geopositioning rather than geolocation. After that, either the police track the information via the operators, or private companies process the data and, for example, refer the investigator to a map where the movements of the monitored phone appear in real time.

The benefits of Silent SMS don’t stop there: by sending a large number of these SMS, security services can also disrupt the mobile or remotely reactivate its signal and wear out the battery. A spokesman for the German Interior Ministry tells OWNI:

German police and intelligence services use Silent SMS to reactivate inactive mobile phones and refine the geolocation of a suspect, for example when they move during an interview. The Silent SMS is a valuable investigative tool, which is used only as part of a telecommunications surveillance operation sanctioned by a judge, in a specific case, without violating the fundamental right to protection of privacy.

Remote reactivation

In France, police and intelligence services work with Deveryware, a “geolocation operator”. Deveryware also market a “geolocation employee punchcard”, the Geohub, to businesses.

Deveryware combine cellular localization, GPS, and other “real-time location” techniques. Questioned by OWNI whether Silent SMS were one of these techniques, the company’s response was evasive:

Regretfully we are unable to provide an answer, given the confidentiality imposed on us by legal requisitions.

Deveryware’s applications enable investigators to map and compile a history of a suspect’s movements. Laurent Ysern, head of investigations for SGP Police, states:

All investigative services have access to the Deveryware platform. With this system, one can follow a person without having to be behind them. There’s no need for shadowing, so less staff and equipment needs to be mobilized.

While in Germany the Ministry of the Interior responded within 48 hours, the French government remains strangely silent. There has been one single response, from the Press Department of the National Police:

Unfortunately, no one at the PJ (Police Judiciare) or the public safety office is willing to comment on the subject, these are investigative techniques …

Silence too from the French telecoms operators SFR and Bouygues Telecom. Sebastien Crozier, a union delegate at France Telecom-Orange, says:

Operators always collaborate with the police, it’s a public service obligation: they act in accordance with judicial requests…There is no definitive method, sending SMS is one of the methods used to geolocate a user. We mainly use this technique to “reactivate” the phone.

By 2013, the use of these surveillance methods is expected to reach an industrial scale. The Department of Justice will set up, with the help of the arms company Thales, a new national platform of judicial interception (PNIJ), which is expected to centralize all legal interception, i.e, phone-tapping, but also summons such as requests for cell location. Sebastien Crozier remarks:

This interface between police officers and operators will streamline court costs and reduce processing costs by half, because until now summons have been handled station by station…There will be more applications, but it will be less expensive for operators like the police.

Image Credits: Flickr CC Nicolas Nova ; Arlo Bates ; Keoshi ; Luciano Belviso ; Meanest Indian ; Spo0nman

Follow @FabienSoyez on Twitter

Read more about Surveillance on Owni.eu

Source: http://owni.eu/2012/01/27/silent-sms...ce-deveryware/

[tilltheend]

I don't even own a phone. I always figured police could try to tap your phone illegally anyways. I have nothing to worry about though.

[Mirrorshades]

I don't even own a phone. I always figured police could try to tap your phone illegally anyways. I have nothing to worry about though.

Not even a landline?

Mirrorshades

[tilltheend]

I don't even own a landline, I don't really like talking on the phone at all, and I have noone to talk to on the phone anyways.

[Chicken_Hawk]

Ok, so maybe getting a cell plan with out texting? Man, I have become so used to it, but I may want to consider it.

Hawk

[killswitch604]

Ok, so maybe getting a cell plan with out texting? Man, I have become so used to it, but I may want to consider it.

Hawk

I could be wrong, but I don't think it's worth it to get a phone without texting. Phones now are able to let the government listen to you, even when the phone is off, and even if the battery is removed. In most smart phones there is a small, hidden battery that serves as a way for the government to still trace you even if you remove the regular battery. It's best not to have a cell phone at all if one wants to get away from things like that. I see major shit coming to this country soon, anyway, so I don't care at the moment. I just watch what I say and text for now.

[Chicken_Hawk]

I could be wrong, but I don't think it's worth it to get a phone without texting. Phones now are able to let the government listen to you, even when the phone is off, and even if the battery is removed. In most smart phones there is a small, hidden battery that serves as a way for the government to still trace you even if you remove the regular battery. It's best not to have a cell phone at all if one wants to get away from things like that. I see major shit coming to this country soon, anyway, so I don't care at the moment. I just watch what I say and text for now.

I am pretty sure MS would concur and the only real thing we can do is to avoid saying anything risky altogether. I am doing more face to face conversations these days as you can't hide behind technology.

Hawk

[Mirrorshades]

I could be wrong, but I don't think it's worth it to get a phone without texting. Phones now are able to let the government listen to you, even when the phone is off, and even if the battery is removed. In most smart phones there is a small, hidden battery that serves as a way for the government to still trace you even if you remove the regular battery. It's best not to have a cell phone at all if one wants to get away from things like that. I see major shit coming to this country soon, anyway, so I don't care at the moment. I just watch what I say and text for now.

I've heard much the same things. There is a video on Youtube showing how to remove the second battery. It looks very much like hearing aid battery.

On the bright side, your Supreme Court has ruled that the cops must get a warrant before using GPS tracking against someone. In this country, they plant to legalize pretty-much the same behaviour, under our glorious Fuhrer's "lawful access" legislation. Whether or not this will require a warrant is unclear at this point (at least to me).

If you watch Chris Soghoian's presentations at the 28th Annual Chaos Communications conference, he shows a hair-raising slide produced by a company in England that is selling surveillance gear to governments. This slide shows the location of cell phones in Indonesia, where each cell phone is shown as a little red dot, superimposed on a map from Google Earth. If you zoom in, it is possible to show on a street level, just where the owner of a particular phone has been to. You can narrow it down to particular shop, cafe, etc. The impression I had from Chris's presentation was that it is possible to follow a particular phone in real-time

Another reason not to carry one of the damned infernal things.

Mirrorshades

[killswitch604]

I am pretty sure MS would concur and the only real thing we can do is to avoid saying anything risky altogether. I am doing more face to face conversations these days as you can't hide behind technology.

Hawk

Same here. I get very upset when somebody texts me sensitive information or mentions it during a phone call, but yet some people don't seem to get it. They accuse me of being paranoid because of how I think.

[Chicken_Hawk]

Same here. I get very upset when somebody texts me sensitive information or mentions it during a phone call, but yet some people don't seem to get it. They accuse me of being paranoid because of how I think.

Me too, I give them my email and then they send me a text...WTF. I don't reply to the text, but send an anon email. I know I am a small fish, but I do not like exposing myself anymore than I have too!

Hawk