Hacker News Reader

Comment by ajsnigrutin | Hacker News Reader

IMSI catchers should be made illegal in general.

If they want data from mobile users, ask the telcos, they have all the data in their logs. Except for some minor edge cases, using an imsi catcher is only beneficial to the three letter agencies, if they're doing shady stuff and don't want the telcos to find out.

Also, with any matter of surveillance, where a mass of personal info is gathered, everyone involved should be notified about the data collection in some reasonable amount of time (eg. max 30 days, unless the courts prolong it for 30 days more and have to keep manually prolonging that), so everyone gets a letter "on date X. y. 20ZQ, a police investigation done by XYZ gathered your data from X hour to Y hour in location of cell towers QWE and WER, where the following lines from the log have been forwarded to the agency: ..."

View on HN

The problem is much deeper unfortunately.

If they banned IMSI catchers it just makes the job marginally harder. When I mean marginally I truly mean MARGINALLY. Right now a police officer can fire up some software, draw a selector box around a region, and pull everyone who was in that region inside some timeframe. They don't need an IMSI catcher for that. Cell phone data from advertisers is often enough. It's real minority report pre-crime level shit. This of course all ignoring the fact that IMSI leaking happens with EM emissions which can be argued are incidentally picked up anyway and therefore information that doesnt require a warrant. Like a license plate for your car.

We need much, much stronger privacy laws. But first we need to get people into congress that actually care.

I care. And I consider running, but it feels like a race to the bottom...

This comment is gold. Another way to attack the problem is to educate end users.

How do we convince Bob down the road that giving private information to corporations is a cause of some of our own problems? Usually I get retorts of condescending looks with a “I’ve got nothing to hide” -type response.

We need to draw the whole problem space out for regular people somehow but it’s big and complex.

Well yeah, but the police will ignore the laws, do a parallell reconstruction, and do whatever they want.

We must take away the tools that make their illegal works possible. One of them are imsi catchers, the other is location access to apps on phones, especially when the app is closed, then better authentication schemes must be implemented (some of it is done with 5g, but eg 2g is completely broken), etc.

IMSI catchers are not passive listeners, but actively transmit and act as if they are a legit tower and let phones connect to them, identifying them only because phones send identifiers to them. Passively listening to signals doesn't do much on newer networks and even with older (eg. 2g) only works if you capture the first connect to the network (when IMSI is transmitter, after that a temporary TMSI is used).

Reply on news.ycombinator.com