Comment by danso | Hacker News Reader

Comment by danso | Hacker News Reader

Parent Full thread

Dumb question, but what is the meaning of AT&T "toll records" used to link the user to an iPhone 6?

> "AT&T responded and a review of the subscriber information showed the telephone number was associated with a Tracfone prepaid account with no subscriber information. However, a review of the AT&T toll records showed an associated Apple iPhone 6A Model 1586"

That is, if you are a Tracfone user and Tracfone uses AT&T to provide service, AT&T effectively sees the Tracfone user information?

Also, Twitter tracks the type of client used to send a tweet and reveals it in the metadata accessible to the public API -- the `source` attribute [0], e.g. "Twitter for iPhone", "Twitter Web Client", "TweetDeck". And Twitter probably captures more about the device/client that isn't publicly revealed, such as the browser agent for when a tweet is sent via the web client.

If the suspect had tweeted using the iPhone client, or via the iPhone Safari browser, would the police have enough info to subpoena Apple for Apple Account tied to that specific phone number? In other words, skipping the process of subpoenaing AT&T/Tracfone because the suspect was dumb enough to register the Twitter account using that phone number?

[0] https://dev.twitter.com/rest/reference/post/statuses/update

My understanding is that "toll records" simply means the metadata that AT&T keeps to charge Tracfone the usage of their customers.

At minimum they need to keep track of the ICCID for your sim card and the IMEI for your phone [1]. Once you have the IMEI and know that this is an iPhone, it is trivial to ask Apple for the records of who bought that device, or which iTunes account is associated with that SN.

edit: corrected per comment below.

[1] https://www.cnet.com/news/on-call-how-does-my-carrier-know-w...

Not that it matters much, but a SIM card has an ICCID, and a (GSM) phone has an IMEI. ESN is a phone identifier, for CDMA phones.

Of course, makes totally sense. IMEI is associated with the (GSM) phone, not SIM card. Thanks.

I think AT&T just logged the IMEI of the phone that used their towers, which I believe is sent as a standard part of the authentication packets the phone sends to the towers.

So the lesson is if you are trying to murder people over the internet, don't plug your anonymous sim card into your iphone which is tied to your identity?

Is that the lesson? I would've guessed the lesson is to not try to murder people over the Internet.

Makes sense why AT&T was asked for data. I'm interested in why Tracfone wasn't. But I guess if it's enough to have a phone number and suspicion that it belongs to an iPhone, that's enough to send a search warrant to Apple. Given the popularity of the iPhone, I wonder if law enforcement has the option of querying Apple to see if an Apple account is tied to a number and save them the work of sending a search warrant to the phone service provider.

edit: replaced "subpoenaed" with "asked for data"/"search warrant". Doesn't look like a warrant was mentioned in the AT&T case.

Was trying to be witty, but really the lesson would apply to anyone trying to be anonymous on the Internet, including those who have more noble motives.

If you want to be anonymous on the internet and you are doing this for immediate and spontaneous reasons my advice to you would be to forget about whatever you were planning, likely you will not manage to maintain your anonymity.

If you have a lot of knowledge in this field and a fair amount of time to prepare you may be able to pull it off but chances are you will still get a detail wrong somewhere and find yourself lifted out of bed at 3 am.

In that case I hope you have a very good lawyer.

I always figured if you had to do something illegal go to a public library you've never been to before and only use a computer once and never use it again. Also disguise yourself when you go. That being said you wouldn't be able to login to anything like twitter and you can't continue your actions very easily.

Fingerprints?

Surveillance camera(s) in the street tracking you to you parking your car?

Forgot not to take your cell phone?

Did it ring while you were in the library? Did you answer if it did?

Is it the city/town that you live in?

Did you talk to anybody while you were there?

Do you speak the language natively?

Do you have any accent that might stand out?

Did you go during office hours?

Male or female?

How big a city/town was this in anyway?

Another 100 items or so?

See, it is so easy to forget something, and that's before getting into any fancy CSI stuff.

You need a library card to use those machines, and though it's been a while, I recall having had to show ID last time I got one of those.

Risk of death from seizure is not high. Though intentionally triggering people is disgusting and he should never do it again and pay some damages. Intention to cause harm seems clear.

At the very least it seems like assault.

I assume device IMEI and/or SIM ICCID of call carried on their network was recorded since Tracfone operates as an MVNO afaik.

Toll records would be the CDR, I'd imagine. [0]

[0]: https://en.wikipedia.org/wiki/Call_detail_record

Reply on news.ycombinator.com