Hacker News Reader

Or the could:

1. sample the HSS (HLR in old-money) every night to find which phones are camping in which location areas (LAC)s;

2. this given them a phone → area location for every phone in the country, where area is about 200 cells (a few km²);

3. then they could draw out the call detail_record (CDR) of very outgoing call, SMS, and even data session to get the cell identity;

4. this gets the phone → area mapping down to a few hundred m²;

5. then if they are motivated, they will use the location services in the Mobile Application Part (MAP) to silently move every unknown phone into dedicated mode and repeatedly determine its location to within 10m - 50m;

6. if the phone has control plane, GPS, they just ask it that. Many, many phones do;

7. this information is collected all the time and passed to in-house and 'external' GIS teams to cross-reference against all sorts of wonderful data;

8. they know who you are.

The good news is they don't care. They just want you to spend more. ARPU is everything.

Source: I built this stuff for a living.

All points well taken - and that I have a firm grasp on.

My threat model is "telco or ISP employee decides to see if John is a customer and, if so, just what John does with his phone". They will not find me in their customer database and they'd have to dig fairly deeply, and possibly involve banks and/or LEAs which are not my threat model.

Also, just as a coincidence, and not by design, my place of residence has zero bars of mobile service ... I lose it about two miles from where I live ...

When I was playing the game we cross licensed with banks, credit agencies, and etc. I couldn't evade my own nets because I have a drivers license, property, and bank accounts.

I'm sure that you've done better.

They generally know your location via tower triangulation. They know the sites you visiting via DNS or IP > reverse DNS. Combined with other data sources, they can get pretty close, probably exact. If you are not in a high rise apartment, they can guess your address and/or your work address based on normal 9-5 work patterns. They can map business to LinkedIn for employees of that company. I'm just trying to say that we leak a LOT of personal data to a LOT of people practically all the time. It is very very hard to stay anonymous today.

Also, I wouldn't be surprised if in the near future, KYC is required to buy any SIM that connects to the network. It isn't here yet but is coming.

"They generally know your location via tower triangulation."

Correct, but to clarify - they know your SIM cards location. In my case this correlates to a corp name and no actual personal name (mine or otherwise).

"Also, I wouldn't be surprised if in the near future, KYC is required to buy any SIM that connects to the network."

I suspect you are correct and I think this is already de facto practice for a consumer purchasing mobile phone service in the United States. I suspect, however, that an EIN and a corp name will continue to allow SIM provisioning without associated PII.

Something to consider: we are promised many, many more 5G SIM cards on the network than there are people on the planet. Most of those SIMs will be provisioned by corporate entities and, therefore, the ability to procure and deploy SIMs with no PII will persist ...

This is naive. Via triangulation they know your approximate location, and there are likely cameras with facial recognition and/or license plate readers in the area that can be used to correlate with arrival/departure to get your identity. Unless every single thing you use is in somebody else's name and you wear some kind of disguise everywhere it is already possible to bypass anonymity in most urban areas. If someone isn't doing it already someone will be soon, there's a lot of money at stake.

No it won't. Anonymous SIMs were already wiped out in large areas of the world. The way KYC works is you need to know the "beneficial owner" i.e. ultimate owner of an asset. The bazillions of 5G sims we're promised will all be tied to a strongly verified corporate identity and to get on a network will require you to present ID if an individual, or do corp KYC if a firm (which will in turn require the heads of the company to do personal KYC to establish beneficial ownership information).

Remember, this isn't even new for many countries.

> My mobile phone company has no idea who I am. It was trivially easy to purchase an iphone, at the Apple store, with cash and then purchase a Verizon MVNO SIM from US Mobile (which I prefer over StraightTalk because they allow tethering).

You may be able to do this in the US for the time being. However, in many countries already – a list that is steadily increasing – you cannot purchase a SIM card without showing ID, a copy of which is made and forwarded to state authorities. In other countries – I know of at least Chile – you may have to register the IMEI of the phone as well.

> then purchase a Verizon MVNO SIM from US Mobile

Are you paying with a pre-paid card? If not, your number is tied to your card which is tied to your identity.