Monday, February 28, 2005

Nifty feature or stalking tool?

Can you imagine yourself going back to the lifestyle you had when you didn't own a mobile phone? For most of us I think not. Cell phones have been a necessary part of our daily lives that it's among the things you check you have with you when your leaving the house together with the house keys and your wallet. Coverage has also improved quite a lot since several years back with the addition of more and more cell sites. You don't hear about dead spots anymore even in basement parking lots in malls thanks to mini cell sites that they install in big buildings.

Interestingly, the 2 big mobile networks (GSM networks) here where I live just launched their new value added service wherein you can now "track" your loved ones wherever they are. The service isn't as accurate as a GPS device but it will do. It is more accurate in places where they have a lot of cell sites like in the big cities (the service can tell you in which particular building somebody is) and for the suburbs it can tell you the general location of the individual, or more accurately his or her mobile phone. It was initially marketed to parents so they could track their child. I don't know about the rest of you but I find all these a bit creepy. From what I understand (I have to admit I am not certain of these facts since I don't have a kid and I don't subscribe to this service, and their website isn't much help either) you purchase this special mobile phone + SIM pack and you register this unit with the mobile provider so that you and your spouse can track your kid (and vice versa). It's this registering that bothers me.

So what does the mobile provider know about you? Let's list them down. Your name for starters, your billing address, your proof of income (they require this prior to subscription), your birthday, your phone number (of course), and they know you have a kid, his or her name, age, phone number and location (well, actually they know your location too). Imagine these information stored in a database somewhere in the mobile provider's computer system. I wonder how much effort they spend in making sure this information is kept secured. From outside intruders (hacking) or even from their own personnel (insider). I could imagine somebody inside the company has the ability to query the location of any number in their network without having to register like a normal subscriber. I wonder if they have any internal checks in place to prevent abuse. Who else has access to this sort of information? The government? The police?

This reminds me of a news article a while back. Mediamen were in contact with some rebel groups who are holding some people in custody (sorry I really can't recall exactly what the situation was, it was the use of technology and its implications on privacy fascinated me). One of the TV crew mistakenly flashed his mobile phone in front of the camera to show an SMS from the group for all to see including the rebel leader's mobile number. The reaction was immediate. The rebel leader scolded the journalist as irresponsible over a radio interview later that day. I don't know if he is more concerned that the military will be able to track that number or that he will be flooded with unsolicited SMS messages. I think that they are technologically more savvy than most people think (at least a whole lot compared to the journalists mentioned).

Another more recent news story was about a jealous wife tracking her husband going to his [alleged] mistress. She caught up with them eating at a restaurant and she confronted them. The husband of course denied everything saying that she's merely a business associate and they were having a meeting. She should have waited for a more appropriate time when they were doing something more... err... inappropriate.

This "new feature" isn't actually new. It has been possible for mobile companies to track down the location of individual numbers in their network via the cell site the phone is using but they have just recently launched it as an added feature so now it is accessible to the general population.

So you want to track somebody huh? Well I have thought of a way to do it without the other person knowing it (works for my service provider I don't know about the other networks). It takes a bit of social engineering but it's not that difficult really, and it does have its disadvantages. The way my network does it, you need to send an SMS to a particular number that effectively gives your consent to another phone number to track you. So for this to work you need to get a hold of the other person's cell phone. This can be quite easy. Just say that your out of battery and that you just need to send a couple of important SMS to a person. You send *your* mobile number to this particular number in the prescribed format. You will get a confirmation SMS telling you that you can now be tracked. Delete the confirmation note plus all the SMS you sent in the sent items if the phone automatically saves it. And your done! The person doesn't get any additional confirmation messages when you track him/her. Scary huh? The people I told this to won't let me touch their mobile phones. I wonder why? hehehe.

There's a catch of course. Everybody has a way to know if there any active tracking permissions set up tied up to their number. You won't know it until you do that though. And when your caught, that person will know your number as well. :D And supposing that person knows somebody in the mobile phone company and tracks you down and hire somebody to beat you up or worse... well, you get the picture ;)

Right now I'm tracking one other phone (I like to track myself every now and then just to see what the service says - weird huh?) and it's one of my numbers mind you. I installed an old SIM to a much older phone and placed it in an inconspicuous place in my car. And presto! you have a cheap version of a car locator system. I don't actually expect my car to get stolen but you'll never know. Hmm... I just had an idea, so what if you place an extra phone to another persons car... hmmm... instant tracking device? But let's not go into that. Heh. :) Sometimes I scare even myself :p