Comment by lxgr | Hacker News Reader

Comment by lxgr | Hacker News Reader

Parent Full thread

> As far as I remember, the ICCID never actually appears in standard network messaging.

Yeah, that would be the IMSI (which a given SIM card can have multiple of, e.g. for switching to a more beneficial home network while roaming!)

The ICCID is useful for identifying a given physical SIM card (e.g. so that the phone can link a given user-selected profile name to it/the associated phone line for a "preferred line for contact" indicator in dual-SIM phones), and probably also as an identifier when dynamically assigning a new IMSI over the air.

> for the sake of emergency calling

The IMEI can indeed be an identifier of last resort for emergency calls. I wonder if some countries use it to block abuse/spam calls to emergency services, or more importantly, why some others aren't?

In Germany, for example, SIM-less emergency calls are no longer possible, supposedly due to many people calling the local emergency number to test whether a used phone is in working condition without inserting a SIM card... I don't know what they're doing with the IMSI in that case, and if it's locking these callers out, why they can't do the same for the IMEI.

At least in the US, the 911 infrastructure is dated.

In older systems, your caller ID is sent using in-band DTMF tones, which are decoded by the dispatch computer.

On newer E-911 systems they get some additional digital address data from the telephone network, but the record format wasn't designed with VoIP or cellular in mind. So in those cases, the telephone network sends a virtual number and the dispatch computer does a seperate out-of-band lookup with the VoIP/cellular company using that number as a key to get your location.

The whole emergency calling system is layers upon layers of hacks. While they can bolt additional functionality on if they're creative, it's more likely a given feature is _not_ implemented. There's a good chance that by the time the call gets to dispatchers, the IMEI/IMSI isn't displayed anywhere and they just see a random virtual number.

Gosh, yes it's a bit of a mess...

The PSAP (E911 end point) likely will receive an MDN/MSISDN (10 digit number you dial for NANP networks) - this is so they can call back if the call is dropped.

E911 is a special service, so in the case of deactivated/missing SIM cards, the carrier assigns a temporary MSISDN for duration of the call when the UE exits E911 mode - there are actually of regulatory and carrier requirements around E911 mode.

E911 Phase 2 required not only the DN, but also if possible the location of the device - whether thru Cell Base Station Triangulation (if possible) or GNSS with a LAT/LONG based on coarse/fine location info.

In any case, as @tjohns mentions, IMSI/IMEI are not typically used outside of the servicing network.

Good point, and implementing a "this IMEI calls 911 to ask for the time of day every hour" block on the side of the networks seems risky as well, so I get how it might not be that helpful.

But then I wonder why having an IMSI (as far as I understand, the SIM can be deactivated, foreign etc., i.e. it doesn't need to actually register to the network) improves this in Germany?

Maybe German authorities just hope that having to insert a SIM might deter people, since SIMs are perceived as being personally identifiable more than just phones without a SIM?

Huh. That's a think I've had vague notions of, but you've made pretty explicit.

Technology under pressure looks a lot like biology.

I've had this thought before while studying biology in college while working on legacy code as an intern. There's definitely a "designed by natural selection" feel to some old legacy systems.

I have heard of people calling emergency numbers to test if a phone is working, but never a country making that impossible. Here, I had always assumed that repeated nuisance callers would be investigated to see if there's an actual problem, and charged with a crime if they're doing it for no good reason.

Always thought it would make more sense to have a dedicated "test number" for this purpose. Probably with some rate limiting.

A lot of telcos used to have phone numbers you could call that would just say the number you're calling from (like with a computerized voice). I forget what this was called, but it was talked about in phreaking community or so on. Not sure if these "caller identifier" phone numbers are still around today though.

They're easier to make than ever, all you need is Twillio and a bit of Python code. There are quite a few in the US alone, both provided by carriers as well as enthusiasts and other companies in the industry.

800-444-4444 still works. Even starts with "thank you for calling MCI"

They're called ANACs - automatic number announcement circuits.

Ah yeah that's right, thanks!

BT in the UK has 17070 which tells you the number and lets you do tests like the "quiet line test". Handy when working out what was going on when I moved into a property with no live phone service (so no normal outgoing calls), lots of phone extension sockets, and (I discovered) two landlines coming in...

Reply on news.ycombinator.com