ICE is using fake cell towers to spy on people's phones | Hacker News Reader

ICE is using fake cell towers to spy on people's phones

forbes.com

669 pointscoloneltcb256 comments

Just wanted to advertise that the EFF recently released an open source tool for detecting cell-site simulators. The hardware is like $20 and it's pretty easy to setup yourself. Worth having around to stay aware of what's out there, especially if you live in one of the places recently targeted by the administration.

https://github.com/EFForg/rayhunter/

exactly what I'm looking for - much appreciated!!!

I wouldn't put it past the US to coerce Microsoft into injecting malicious payloads into these types of projects. EFF is putting complete trust in Microsoft's infrastructure: there's no out-of-band verification not served up by Microsoft itself (is there? It's just GitHub.com's TLS, and in-band SHA-1 hashes stored in the repo itself, which Microsoft controls; it can serve whatever bytes it wants, or different bytes on different requests...)

Microsoft has billions of dollars in US intelligence-cloud contracts and should leap at a chance to get an edge in on those. They've done things like this before; they provided incredible (and illegal!) cooperation with the NSA back at the time of the Snowden Leaks[0].

[0] https://www.theguardian.com/world/2013/jul/11/microsoft-nsa-... ("Microsoft handed the NSA access to encrypted messages" (2013))

> I wouldn't put it past the US to coerce Microsoft into injecting malicious payloads into these types of projects. EFF is putting complete trust in Microsoft's infrastructure: there's no out-of-band verification not served up by Microsoft itself

Isn't a git commit trail basically a Merkle tree of checksums? If any developer tried to do a pull or fetch they'd suddenly get a bunch of strange commit messages, wouldn't they?

Also: code signing is / can become a thing.

> Also: code signing is / can become a thing.

To that end, I started a project last month so that code signing can be done in multiple geographical locations at once: https://github.com/soatok/freeon

GP was probably referring to the binary releases on the GitHub repo.

Technically a Merkle DAG

Both are correct. The commit history is a Merkle DAG. The tree under each commit is a Merkle tree.

I don't know why you'd trust a checksum structure your adversary has complete control over.

That Merkle tree prevents the naive case where the adversary tries to serve a version of a repo, to a client who already has an older version, differing in a part the client already has. (The part the client has local checksums for). They shouldn't do that. The git client tells the server what commits it doesn't have, so this is simple to check.

Code signing could be a safeguard if people did it, but here they don't so it's moot. I found no mention of a signing key in this repo's docs.

The checksum tree could be a useful audit if there were a transparency log somewhere that git tools automatically checked against, but there isn't so it's moot. We put full trust in Microsoft's versions.

Lots of things could be helpful, but here and now in front of us is a source tree fully in Microsoft's control, with no visible safeguards against Microsoft doing something evil to it. Just like countless others. It's the default state of trust today.

Because the developers have just that on their local machine...?

Git is a distributed vcs after all. Every checkout is its own complete git "hub".

Because GitHub can serve different bytes to different people. You log in as one of the project's devs, you get your own consistent, correct view of your project; some other people get malware instead. How do you reconcile the full picture? No one distrusts GitHub. There's no public log which git tools generically check against to see if GitHub is attempting something evil, the way they do with certificate transparency. GitHub is the public log.

Git may be designed as a distributed VCS; and it'd be a different situation if it were used that way in practice. For many projects, GitHub has a full MITM. They could even—forget about the checksums—bifurcate the views in between devs—accept commits from one dev, send over those commits with translated Merkle trees to another dev who has a corrupted history, and they'd never figure it out.

Yes, but the moment you try to push your local git will complain that you are not aligned with the upstream repo.

Not so. GitHub would remember who you are; advertise to you and to you only a set of fake checksums consistent with your fake view of the repo. Your git client would see nothing amiss—your local fake checksums are consistent with the fake checksums the server sent you. Having accepted your push, the server would ignore the fake checksums, extract the content of your patch, apply it to the genuine repo, and compute a new set of checksums, extending the other checksum tree as if you had pushed directly to it. That's what an MITM is.

This falls apart instantly if you share a hash with anyone else, though. Which is exactly what happens when you send in a PR

Most projects on GitHub have you submit PR's via GitHub infrastructure so they have total control over who sees what there as well.

What happens when a dev tries to patch a bug in the malware and nobody can tell what the hell they're talking about?

> I don't know why you'd trust a checksum structure your adversary has complete control over.

I think the point is they don't have complete control over it. Sure, they have complete control over the version that is on GitHub. But git is distributed, and the developers will have their own local copies. If Microsoft screwed with the checksums, and git checks them. The next developer pull or push would blow up.

> "The next developer pull or push would blow up."

If they're pushing or pulling to/from GitHub, then GitHub has a total MITM and is able to dynamically translate checksum trees in between devs' incompatible views of the repo.

I don't understand. Can you explain how that would work? I thought the checksums are calculated on the contents, so how can they translate checksum trees that remain valid without changing the content (or vice versa)? This is my naive understanding, so I might be completely wrong, hence I ask.

That they'd change the content is the point—offer malware content for select targets, with corresponding malware checksums that are consistent with that malware and its entire history.

Those checksums would seem valid to the victims, as they're a self-consistent history of checksum trees they got directly from GitHub. The devs would be working with different checksum trees. GitHub would maintain both versions, serving different content and different checksums depending on who asks.

This seems to boil down to them keeping two repositories - presenting one to the logged in dev, and one to the public.

That might work for a while if dev isn't active. He would, for example have to not notice there was a new release, with an incremented version number that triggers updates. Even that doesn't work forever. Down stream dev's often look at the changes - for example a Debian maintainer usually runs his eye over the changes.

But if the dev is active this is going to be noticed pretty quickly. The branches will diverge, commit messages, feature announcements, bug reports, line numbers not matching up. It would require a skilled operator to keep them loosely in sync, and that's the best they could do.

Either way, sooner or later Microsoft's subterfuge would be discovered, and that is the death knell for this scenario. The outrage here and elsewhere would boil over. Open source would leave github en masse, Microsoft's reputation would be destroyed, they would lose top engineers. I don't have a high opinion of Microsoft's technical skills and leadership as they have been consistently demonstrated themselves to be inconsistent and unreliable. But the company too large and too successful to be psychotic. The shareholders, customers, and lawyers would have someones guts for garters if they pulled a stunt like that.

Lots of things could be helpful, but here and now in front of us is a source tree fully in Microsoft's control, with no visible safeguards against Microsoft doing something evil to it. Just like countless others

But it's written in rust.

> The git client tells the server what commits it doesn't have, so this is simple to check.

That won't work. The first thing the client does is ask the server for list of references with their oids (ls-refs). It only asks for oids and reports what oids it has after the server responds.

You'd need another way to identify that the client asking for references was the same one you vended the tampered source tree to, otherwise, you'd need to respond with the refs' real oids and the fetch would fail since there's no way to get from the oid the user has to the real one.

Or use signed commits?

I think GP is talking about a scenario where Microsoft would serve either malicious source tree or binaries to just one user, not all of them. that would be fairly hard to detect. but in such scenarios we'd also have to start asking questions about the state of the entire CA ecosystem.

Or detected easily with package builders like Arg Linux's makepkg that ship a hash along with the source URL. As soon as one user gets a different file, he has an alert and the compromised package for later analysis

like I said, if you assume your adversary is the US government then they might as well start issuing rogue TLS certs to target individuals.

It'd be a lot of trouble to interfere with the source, yes.

I think the release files is the place they could most easily tamper - generally they're stored on Github infra so the files could be changed, and the checksum on the download page also altered (or different files and different checksums provided to different people if targeted).

Unless the builds are totally reproducible it'd be tricky to catch.

Possible, yes, but pretty damming to Microsoft's reputation if proof that their infrastructure has been compromised and anyone realizes it's happening. This sort of thing killed Sourceforge when they started shipping adware bundled into installers of the programs they distributed.

You can't compare it sourceforge, MS is too big to fail

You’re welcome to read the code yourself once you check it out, it’s not very big. Supply chain attacks are a thing but I don’t think this is one.

I don't think there are many options to host sourcecode and binaries in a way that is safe against an adversary like the US, and especially in such a way that technically illiterate users are protected. Because you'd have to assume that CAs are not off-limits either then.

So does the EFF detector discriminate between Stingrays that are operating legally and those that are operating illegally?

I wonder what their lawyers think of this.

https://bja.ojp.gov/program/it/privacy-civil-liberties/autho...

There is nothing wrong with running a receive-only hotspot. Not sure what you’re implying here.

If you have any precedent or ruling indicating that it is illegal for Americans to check for the presence of surveillance, please present it. Otherwise, I'm not aware of any duty of private citizens to remain willfully blind to their government's actions.

Should it?

lol spot the fed

Discussion about Rayhunter from 6 mos. ago: https://news.ycombinator.com/item?id=43283917

I watched the presentation on Rayhunter at Defcon. Amazing stuff. Major kudos to the team.

Would be a shame if someone used this to track down the ICE towers and vandalize them.

This "shame" is/would be a badge of honor, my friend.

This shame feels like something that would get one extraordinarily renditioned to some black site where nobody would ever know about the shame

True, but at least we know who was right.

PSA: If you have to worry about your government taking people away to some black site, things have gotten pretty bad.

PSA: Things have indeed gotten pretty bad, which is also why were are discussing tech to detect (and some are discussing the possibility of countering) elements of the forces doing the disappearances.

ThatsThePoint.jpg

For $20, it's cheap enough to add to a drone for a targeting purpose

Is running a fake cell tower technically against FCC regulations? Any possibility of just reporting them to the FCC and causing them to incur fines or take them down?

The people at FCC are just government officials. They'd be foolish to antagonize the leadership of the executive branch based on just principles (I know how unscrupulous this sounds. But such are times). Besides, they are up against one of the most heavily funded rogue forces in the world that is also known to go after people outside their jurisdiction (citizens) with impunity.

Maybe best not to joke about that.

An enthusiastic and muddle-headed person might get inspired by disposable Internet chatter, and then go and get themselves sent to federal prison (or worse).

Also, I suspect that an attack like that would only justify (or be used as a pretext for) additional actions that are undesirable to the perpetrator.

Maybe best not to even reply to such jokes. An enthusiastic and muddle-headed person might be a contrarian and might get challenged by disposable Internet chatter to not do something and still do that and get themselves in trouble. Staying silent is the timeless strategy of having no effect on the world

If there was someone for whom this strategy worked, they wouldn't speak up to tell us.

You won't find a "tower", you'll find an SUV or a hotel room with Pelican cases and armed officers inside.

IMSI catchers have been popular by police all over the world. Here are some other tools [0] [1].

Edit: Interesting also the collection of network security via gsmmap [2]

[0] https://gitweb.stoutner.com/?p=PrivacyCell.git;a=summary

[1] https://github.com/srlabs/snoopsnitch [2] https://gsmmap.org/

Rayhunter – Rust tool to detect cell site simulators on an orbic mobile hotspot - https://news.ycombinator.com/item?id=43283917 - March 2025 (23 comments)

I don’t know why your cellphone can’t do this. For example, It “knows” which towers are around your home. If all the sudden there’s a new one, pop up an alert.

I use Network Cell Info Lite[0] for this purpose.

Sadly, it's only available in the Google/Apple stores (if anyone knows of a similar tool that's available elsewhere, I'd love to hear about it!)

It allows me to locate the "cell towers" I'm connecting to and that are nearby, as well as the devices around me, and will map them for me.

In fact, several years ago, I noted a brand spanking new "cell tower a block or so away (this is in NYC) that appeared to be in the street(!). It stayed there for a couple weeks and then was gone. It sure seemed like it was an IMSI catcher[1].

It's not directly the feature set you suggest, but can certainly be used to identify the towers near you -- and any new ones that might "pop up."

[0] https://play.google.com/store/apps/details?id=com.wilysis.ce...

[1] https://en.wikipedia.org/wiki/IMSI-catcher

Edit: Another comment (https://news.ycombinator.com/item?id=45189302 ) mentioned snoopsnitch (https://github.com/srlabs/snoopsnitch ) and other tools which, apparently can do similar (and more apropos to the topic at hand) things as Network Cell Info Lite.

Additional context: https://san.com/cc/exclusive-evidence-of-cell-phone-surveill...

>At 8:58 a.m., just before the protest began, SAN began monitoring eight LTE bands present in the area and found no anomalous behavior. At 9:06 a.m., however, a burst of 57 IMSI-exposing commands was detected.

>Other bursts, present on four of the LTE frequency bands, appeared roughly every 10 minutes over the next hour, causing Marlin to issue numerous real-time alerts. A post-scan analysis confirmed the detection of 574 IMSI-exposing messages.

>It also flagged two “attach reject” messages, a type of cellular rejection sent when a cell phone tries to connect to a network. Attach rejects can occur for valid reasons, such as when a phone with an expired SIM card tries to connect to a network but such messages are rare on properly configured networks. IMSI catchers may use attach reject messages to block or downgrade connections and obtain an IMSI before it is encrypted. SAN observed the two suspicious messages at 9:55 a.m. and 10:04 a.m. at the height of the protest but did not encounter others before or after the demonstration ended.

>SAN conducted a follow-up scan during the same time period, the following day, when no protesters were present. Unlike the day prior, Marlin did not issue real-time alerts.

I.e. the inference is that ICE is unconstitutionally tracking and assembling lists of protestors exercising their First Amendment rights.

> "A post-scan analysis confirmed the detection of 574 IMSI-exposing messages."

That's roughly 574 unique protestors, give or take.

Full-on autocratic tyranny—this is also what Putin's oligarchs did to Ukranians at the Maidan Protests, in Kyiv in 2014. Used IMSI-catchers to assemble lists of everyone present, and intimidate them.

https://slate.com/technology/2014/01/ukraine-texting-euromai... ("How Did Ukraine’s Government Text Threats to Kiev’s EuroMaidan Protesters?" (2014)).

How do you know there wasn’t a warrant?

It'd be flatly unconstitutional to approve a dragnet warrant targeting a protest.

In a recently-unsealed search warrant reviewed by Forbes, ICE used such a cell-site simulator in an attempt to track down an individual in Orem, Utah.

Maybe you missed it when you read the article?

The article[0] I'm replying to is about a political protest in Tukwila, Washington.

[0] https://san.com/cc/exclusive-evidence-of-cell-phone-surveill...

(It establishes that it is possible to obtain a warrant to use this device. One could have been obtained in Tukwila.)

They wouldn't necessarily be targeting the whole protest, the IMSI catcher would work broadly and from that the warrant would require them to narrow down to one and ignore rest. Unless I misunderstood the technical details the parent comment posted.

This broad dragnet nature of Stingray collection has always been why it's been a major privacy issue. Like doing a wiretap by tapping the whole neighbourhood and filtering phone calls for a certain address.

After reading Kavanaugh's latest concurrence I am not so sure.

Whoever thought it was a good idea to let a president appoint the supreme court was a naive fool.

Given that the Supreme Court has managed to appoint[1] two presidents in the past thirty years, I'd say that the Gordian knot has tightened.

[1] Bush 2000, and less directly but far more dangerously, by making Trump unprosecutable in the run-up to 2024.

Appoint, yet still needing Senate approval is probably what made this palatable to the founding fathers. I'm guessing the old white dudes in wigs never thought that the Senate would abdicate its role by become subservient to one old dude if not in a powdered wig at least in powdered face

But the Senate Judiciary Ctte and then the full Senate get to vote.

Remember Kavanaugh's confirmation vote in 2018 was 50-48, Lisa Murkowski (R-AK) voted against, Susan Collins for, Joe Manchin (D-WV) also for [0]. Susan Collins' reluctant-voice-of-moderation act has run out of steam, finally, probably decades overdue

[0]: https://en.wikipedia.org/wiki/Brett_Kavanaugh_Supreme_Court_...

Unfortunately American politics has completely deteriorated to a civil war between red and blue.

Which I suppose is another thing that was predicted but not acted upon: the establishment of political parties.

When you treat with someone you know to be a compulsive liar, the onus of proof is on them.

If this government has not proven that they had one, you'd be mad to trust that they did.

There are no consequences to it for lying, or for not following the law, or not acting in good faith. It has a well-documented history of doing all three, and is headed by a convicted criminal.

Can we stop sanewashing these people?

They clearly don't care for legality, constitutionality, anything positive or good.

Whether an action has gotten a legal thumbs-up or not is of little relevance here.

I'd like to leave the question of why that's true as an exercise for the reader, but your comment makes it sound as if you have trouble with this concept, so let's be explicit - a state operating autocratically can, and often will, rubberstamp whatever it decides it wants to do.

Had a quick look for the numbers from FISA to give you an example of this. https://www.motherjones.com/criminal-justice/2013/06/fisa-co... says that they denied 11 requests for surveillance warrants out of 33,900 requests over 33 years of operation.

That's a pass rate of 99.07%!

So allow me to say - a warrant wouldn't have changed anything, they give them out like nothing.

In the article though, it does say: "ICE did not respond to requests for comment from SAN. It is not clear whether ICE or any other law enforcement agency obtained a warrant to use an IMSI catcher — commonly referred to as a “Stingray” — to conduct surveillance."

>Whether an action has gotten a legal thumbs-up or not is of little relevance here.

On the contrary, I don't think there's anything more relevant.

That such action can be legal speaks volumes about the state of what is legal and tolerated within the US. This, like pretty much everything about the current administration, is not explicitly about Trump, but something that has been cooking for at the very least the past two decades.

It's relevant in the sense of "is this an indicator of increasing autocracy" but not relevant in the sense of "does the presence of the warrant indicate this is ok".

I think the parent poster is saying that the present of a warrant does not make the action not autocratic. And you are disagreeing with a different idea (that the presence of a warrant doesn't matter at all), by saying it does matter, but in the opposite way -- if a warrant is present that indicates the state is losing checks and balances.

It seems like it would be hard to make pronouncements about the error rate without knowing the actual rate of unsupportable requests? Moreover, you’re referencing FISA warrants which are so unlike typical warrants that constructing arguments based on FISA practice is risky.

Point me to an article if I’m wrong, but I haven’t heard even a single credible rumor that these Stingrays aren’t being used for exactly what authorities say they are - trying to find particular individuals is a general area. Have you heard of whistleblower accounts or accidentally leaked details about large scale storage ordata mining of location data from Stingrays?

If your argument is simply that law enforcement agencies don’t have the right to conduct a dragnet when pursuing a fugitive murderer, as is the case here, you’re going to need something more persuasive than a rant against authoritarianism.

I mean... I get paranoia, but this is arguing that an audit trail is not useful?

That is, a high pass rate could also indicate that it is a well functioning system with few spurious requests and none that are lacking required information.

Does requiring a warrant guarantee best behavior? No. But it does provide a solid path for accountability and a path to codify better rules, when abused.

99.967%

A warrant for several thousand people at a spontaneous event ?

Those Attach Rejects should have a cause value, possibly telling a bit more on the reject reason.

I see those quite frequently, the bulk of them are phones trying to roam in a network they're not allowed to though, and some cause the cell is a bit overloaded, some cause the phone sends a wrong tracking area - not sure that's a phone bug or a common scenario where the phone retains an old tracking area, then it tries to connect to the same tracking area - then the phone discovers it's is now in a different tracking area, and after being rejected, it connects with the correct one.

True but they happen because of individual phones. If you have bursts of those across dozens of devices, that indicates it is on the network side. Also, cell tower handoffs usually don't require Attach Rejects and are generally normal routine operations.

SAN doesn't say where the unusual tower traffic originated. Does the Marlin system attempt to geolocate and identify the suspicious transmitters?

Could the regular mobile tower operators collect subscriber identities at will via their regular gear, with no stingray vans or warrants required, and save the information for later? That seems to be how it's done with the other subscriber location and communication contents that they collect.

It would be amazing if an authoritarian government like that in Venezuela could just "facilitate" (such a funny word these days) getting a single convicted murderer into the US and then turn the US into the same kind of authoritarian government.

Whoops, I hope no other country in conflict with the US gets this idea, that pool has expanded significantly lately!

I recall reading about the people who slammed planes into the World Trade Center towers. They were not hell bent on destroying buildings, they were hell bent on destroying society of the US, destroying buildings was just a stepping stone. And, sure seems like they succeeded.

That's why the orange man is protecting the border

I just can't wrap my head around why spending $500M to paint the wall is protecting me from a Venezuelan murderer. Do Venezuelan murderers see them like colorful poisonous dart frogs and avoid them somehow?

https://factually.co/fact-checks/politics/border-wall-paint-...

They don't, which is why racial profiling is back on the menu.

Citizens on the streets don't need to show their papers to ICE, but that's been worked around by yesterday's SCOTUS. Being brown at Home Depot is now sufficient cause to get arrested by ICE.

It's funny to me how Build That Wall was such a key part of Trump 45 but is a giant nothing burger for Trump 47. How could it be that it is so much less important just 4 years later, oh, right, never mind

Begs the question.

Castro did that. Google Mariel Boatlift of 1980.

But the US is not in decline because of whatever anyone from outside does. It's following the same cycle all Hegemons go through over 100-200 years. Whether its Greece, Babylon, Eygpt, Rome, Islamic Caliphates or all the later European powers. They all went through a similar a cycle - rise - dominate - decline. See Oswald Spengler - Rise and Fall of the West written 100 years ago.

You're referring to history, which nobody gives a care about it seems. Here in the US, it's as if we're living in a bad sci-fi/horror movie the last ten years. People argue about politics, forgetting to hold politicians accountable to any laws. Most of SCOTUS is a party stooge and the POTUS is a mafia type thug, basically blackmailing corporations and law firms. Trouble is, this "cycle" will most likely have world wide repercussions and in a lot of cases already has.

>I recall reading about the people who slammed planes into the World Trade Center towers. They were not hell bent on destroying buildings, they were hell bent on destroying society of the US, destroying buildings was just a stepping stone. And, sure seems like they succeeded.

nah someone made all that up after the fact

Al Zawahiri's Knights Under the Prophet’s Banner argued that spectacular attacks should provoke U.S. overreach, bleed it economically, and expose its weakness. That was published in 2001. After 9/11, but only by two months.

It would be extremely easy:

https://www.nbcnews.com/news/amp/rcna206917

> Mexico’s security chief confirmed Tuesday that 17 family members of cartel leaders crossed into the U.S. last week as part of a deal between a son of the former head of the Sinaloa Cartel and the Trump administration.

I don't know how Republicans continue to support this administration. Maybe they just don't know he's aiding criminals?

> He believed that was the case because the former cartel boss, whose lawyer said in January he had entered negotiations with U.S. authorities, had been pointing fingers at members of other criminal organizations likely as part of a cooperation agreement.

> “It is evident that his family is going to the U.S. because of a negotiation or an offer that the Department of Justice is giving him,” Garcia Harfuch said.

Looks like they're getting protection in exchange for testimony against other cartels.

> . Maybe they just don't know he's aiding criminals?

I mean, our president is a criminal himself. Repeatedly violating the law and the constitution while in office. At this point those supporting the regime must doing it out of either cowardice or malice

> I mean, our president is a criminal himself. Repeatedly violating the law and the constitution while in office

Allegedly. No convictions have come from any of the accusations as POTUS.

> No convictions have come from any of the accusations as POTUS.

I'm not sure we'll ever see one since the supreme court is in his pocket and has already ruled that that the president is allowed to commit crimes as long as it was an "official act" as determined on a case by case basis by the court

That's through the courts. There is still the concept of impeachment+conviction which is what Trump was arguing was the only way to deal with presedential misbehavior. Of course he was leaning on the knowledge that his party's control of congress would make that a non-starter as well

He is a convicted criminal. He committed fraud and was found guilty in New York.

The Venezuelan murderer doesn't actually have to exist for that to happen.

Good point, you could, for example, accuse someone of being equivalently dangerous, say in the MS-13 gang, illegally deport him without due process, and then hold up a doctored photo with those initials tattooed on his hands and insist he had those tattoos on his hands.

Then, just do whatever the hell you want all the name of protecting people from crime and protecting jobs.

What am I saying, that's completely ridiculous and could never happen in a "law and order" country like the US.

Man I'm old enough to remember how right wing America was angry about the FBI raid in Waco.

Nobody really gives a shit about the constitution it is all about ideology. ICE is going after immigrants so nobody cares about the razzias.

Am I wrong for suspecting that the policy that colors the current Administration’s tyranny has its roots in those prior (Bush II, Obama)? Were we not warned of the possible consequences when less sensational or consenting news broke back then?

Absolutely, we were warned. No one heeded and then came the destruction of the Republican party by the likes of Rush, Newt and Rove who convinced the voting public everyone is evil who doesn't agree with them. Centrist and left leaning voters hoped it would just run it's course and go away, then evangelicals signed up with the Republicans and here we are.

Right, I’ve heard this story before. But what are we attributing to whom we’d otherwise label incompetent or malicious from among the center and left, from among the electorate and the elected?

Or, what absolves them from not being held accountable for not taking heed to these warnings, being passive?

They aren't absolved, but it's pretty normal to put more blame and attention on willful criminals as opposed to neglectful bystanders.

The left was a Cassandra the whole time -- it's been nothing but warnings from the left. The Democrats (note: the Dems are not a left party) refused to listen, assuring everyone it was fine, that we just needed to return to norms and decorum. If we just elected the most proper guy, if we just went a little more rightwards in our policies, all this would be fine.

Meanwhile, the left out there pointing at Obama's extrajudicial killings, Bush's whole post 9/11 fiasco, Clinton's "Superpredators" nonsense, etc. etc. and making tons of noise about how this was all going to end.

Turns out, the left was right, the Dems were wrong. But the Dems are still fighting to try and shut down the left. Look at how hard the Dem establishment hates Mamdani.

My line of questioning could be interpreted as a conflation of the left ("the electorate") with Democrats ("the elected"). Thanks for pointing out that distinction. I think it offers some directive as far as accountability can be considered.

I’m curious to see where the Mamdani Experiment takes you all. His constituents are one group who are for certain no stranger to the armed presence reported elsewhere today. Under pretenses all too familiar.

>I’m curious to see where the Mamdani Experiment takes you all. His constituents are one group who are for certain no stranger to the armed presence reported elsewhere today. Under pretenses all too familiar.

What are you going on about? Mamdani may or may not be a good mayor for NYC. Ask me in two years.

But he's not some sort of jihadi, Commie pinko. He's a New Yorker who is actually talking about issues that New Yorkers care about.

It certainly helps that his competition are a disgraced serial sexual harasser (Cuomo), a corrupt sitting mayor whose administration (as well as himself) is riddled with corruption and a lack of accountability (Adams) and a clownish jerk whose claim to fame is that he used to ride the subways at night with his gang and beat up whoever they felt like (Sliwa).

Given the competition. is it any wonder that Mamdani is a cinch to win the mayoralty?

And all that has absolutely zero to do with the mud being slung at him. He will be the next mayor of NYC and I look forward to his tenure -- especially since it means the other folks will go away, at least for a few years.

Mamdani may suck at being mayor. I don't know. But it would be difficult for him to be worse than his field of opponents.

And none of that stuff has anything to do with national politics or the DNC.

I say all this as an old white guy of Jewish extraction.

I don't know where you're from or where you live, but you're talking out of your ass and it smells that way too. Yuck!

Edit: I may have, as anecdata (thanks for calling me out, anecdata!) suggested (https://news.ycombinator.com/item?id=45193191 ), misunderstood your post. Upon reflection, I probably should have been more charitable in my reading of it. That said, you're flat wrong about Mamdani's "constituents." He, for the reasons I mentioned above, is supported not just by the minorities being targeted by the Trump administration, but by huge numbers of regular New Yorkers (of all ethnicities and melanin content levels), because he's the best candidate.

I'd add that Mamdani didn't just fly in from an Iranian terrorist training camp to run for mayor. He grew up in NYC, went to NYC public schools and has been an elected member of the New York State Assembly for the past four years.

If I misunderstood your comment as to Mamdani, his constituents (the residents of State Assembly District 36 in Queens), and/or his validity/viability as a mayoral candidate, my apologies.

I think the person you are responding to was suggesting Mamdani voters were likely the sort of people who are being targeted by the current administration. I think you might be misunderstanding their (admittedly obtuse) post.

Thanks for pointing that out.

I should have been more charitable in my reading of GP's comment.

I've edited my comment to reflect that.

They weren't attacking Mamdani, they were saying that it would be interesting how things play out, considering that, being a brown person, he's in the group of people that the RNC would love to toss into a camp before making them disappear.

Yeah. I get that now.

It's an interesting, if horrifying thought -- stripping someone of their citizenship because folks don't like his religion and/or level of melanin.

It's disgusting.

I said it already, but I'll say it again -- I have no idea whether or not Mamdani will make a good mayor -- but he's far and away the best candidate in the race.

> Meanwhile, the left out there pointing at Obama's extrajudicial killings, Bush's whole post 9/11 fiasco, Clinton's "Superpredators" nonsense, etc. etc. and making tons of noise about how this was all going to end.

I had a whole comment written up but, meh. The noisy people are made out to be conspiracy theorists, even when someone like Chomsky brings all the receipts. People want to believe the person they voted for is the "good guy" in a superhero sort of way.

Trump is partly able to do what he does because of these extreme expansion of powers from previous presidents. This is why "but my guy good!!" is among the worst forms of reasoning for justify $bad_thing.

> The noisy people are made out to be conspiracy theorists, even when someone like Chomsky brings all the receipts.

Yes. This is what I was saying: https://en.wikipedia.org/wiki/Cassandra

My bad! Learned a new expression today.

they've lost all sense of nuance. Everyone is evil if they don't have an R beside their name. It's all about shutting off the brain and trusting the process (of indoctrination)

since reagan, actually: https://en.wikipedia.org/wiki/Unitary_executive_theory

John Yoo is probably the most influential lawyer of the 21st century.

I was certainly talking about exactly this.

Trust me, people thought you were some wild crazy freak.

See here's how it works, watch:

There's going to be concentration camps. The volume of deportation required demands it. There always needs to be two sides agreeing in a deportation, the sending and the receiving. If there's a bottleneck at the receiving or an incompetence in the sending then you warehouse. It's inherent to any logistics.

No that feeling you have that I'm crazy, that's what I'm talking about.

Anyways... See you in a year or so and I'll link back to this.

I normally try to avoid commenting on politics because this account is tied to my identity and therefore my profession and it's generally not advisable to tie those things together.

So it is with no degree of lightness that I say that I agree and this concerns me gravely.

The time to be concerned was 10-15yr ago when these tactics were being normalized (if you take issue with the means) and the policies that teed up the current immigration showdown were being figured out (if you take issue with the end).

To paraphrase planting trees for shade, the second best time to be concerned is right now.

The solution to the warehouse cost problem is pretty easy, you just need to burn them because ashes are more compact, ergo less transportation costs.

You just don't want to realize that this has nothing to do with ethics anymore. It's about control and money.

The general consensus in response to this suggests a non-trivial shift in the Overton window in the last 20 years.

How about we rain check...see you in 5–10?

Maybe the people who have enabled massive illegal immigration should have thought of the consequences.

The use of Stingrays to conduct mass surveillance dates back decades, yes.

>Were we not warned of the possible consequences when less sensational or consenting news broke back then?

People were screeching about this stuff then but they were brushed off by as "conspiracy weirdos" or "yeah they're probably doing it but who cares because it'd be unconstitutional" or "they won't use it on petty criminals" depending upon the exact year and political context you brought it up in.

the president's power has expanded far too much over the past 30 years. The supreme court and congress are really failing at their jobs.

Closer to 100 years iirc. Didn't presidential power start expanding in the 30s?

That's true, FDR kind of had a step function there on Presidential power

> ICE used such a cell-site simulator in an attempt to track down an individual in Orem, Utah. The suspect had been ordered to leave the U.S. in 2023, but is believed to still be in the country. Investigators learned last month that before going to Utah, he’d escaped prison in Venezuela where he was serving a sentence for murder, according to the warrant. He’s also suspected of being linked to gang activity in the country, investigators said.

Sounds like a real cool guy.

Wiretaps have always been a tool in law enforcement's hands, and if it's subject to a warrant, which the article goes on to say it was, I am completely fine with this. If the ability to tap phone conversations 75 years ago didn't cause us to descend into fascism, I don't automatically think this is scary.

I'm tired of people protecting these murderous criminals who don't give two sh*s about any laws. This lack of empathy (for the victims of these criminals) is appalling.

The thing that annoys me most about such thoughts is not the callousness - it’s the extremely short sighted opinion that the same tactics won’t eventually be used on them, or people they care about. It never even occurs to them that can happen until it does.

Erosion of anyone’s rights is an erosion of everyone’s rights.

Absolutely, we older types used to argue with the term, "slippery slope". ICE is a classic slippery slope that will most likely be used, eventually, against all of us if the current administration isn't stopped breaking the law.

This 100%. It's like a private army is being built, especially with the masks/secrecy aspects of it. Terrifying.

ICE and the use of the National Guard is very terrifying. The current administration could use them both to try to hold onto power when it terms out. The lunacy of SCOTUS and congress is beyond the pale. If, and I do mean if, the Epstein situation blows up on the big orange dummy, no one should doubt he will try to declare some type of marshall law to stay above the law. Then we will find out if the National Guard members really pledged allegiance to the Constitution.

> I'm tired of people protecting these murderous criminals who don't give two sh*s about any laws. This lack of empathy (for the victims of these criminals) is appalling.

wait, are you talking about this guy and the people they killed in Venezuela or ICE?

Isn't it obvious? How many people has ICE killed extra judicially?

Do deaths in detention count? [0] 12 so far since the administration began through August (data only being published after 90 days.) Of course, nothing's stopping the administration from using "probable cause" to detain anyone suspicious - like citizens (or at least brown citizens.) [1]

[0] https://www.ice.gov/detain/detainee-death-reporting

[1] https://www.nbcnews.com/news/us-news/us-citizen-detained-ice...

No, ICE did not kill those people. I looked through the latest six this year. Two were suicides (one suicide was of a man who had state charges against him for several crimes including child molestation), one was someone who had diabetes and refused to take insulin, and the others seem to have had other health issues. They got medical care many different times.

I think it is misleading to conflate murder with people dying of health issues in detention after medical care.

I think it's also misleading to call it people dying of health issues. But after years of knowing, under multiple administrations, that even the pre-Trump ICE detention regime killed detainees due to medical assessment delayed and care denied [0], the weight of the evidence points currently points to ICE being malicious, not ignorant: ICE currently knowingly detaining medically frail individuals, without care corresponding to their needs, knowing that a random subset would die due to circumstances that ICE could have chosen to change, but didn't.

Therefore, I think that what is happening does rise to extrajudicial killing - killing that ICE chose not to prevent but to maintain; and inevitable killing without any corresponding sentence.

Forgive me for not taking ICE at face value. I looked through the next four accounts – assuming that, at that point there would be sufficient independent reporting that would either complement or contradict ICE's accounts.

The next four individuals died preventable deaths due to care ignored (e.g. in the case of Nhon Nguyen, who was detained with dementia), or denied (e.g. in the case of Maksym Chernyak, who was unconscious after fainting for hours until detention guards provided medical attention too late.)

- Marie Ange Blaise's death (#7) was blamed by ICE on blood pressure medication noncompliance. The narrative stitched together from Broward County medical examiner reporting, along with detainee testimony, instead argues that she fainted after taking blood pressure medications, and it took at least 8 minutes for medical attention to arrive (after a guard walked away) [1].

- Nhon Nguyen (#8) was, according to his family, detained while living with advanced dementia, and according his death report, bounced backwards and forwards between hospitals and his detention processing center before dying of avoidable pneumonia [2].

- Brayan Garzón-Rayo (#9) died by suicide after repeatedly being denied a mental health evaluation - once due to short-staffing, next due to contracting COVID-19. [3]

- Maksym Chernyak (#10) fainted - possibly due to overdose - but was denied care for hours despite attempts by others detained with him to draw attention; his death was attributed to a stroke. [4]

[0] https://phr.org/our-work/resources/deadly-failures-preventab... [1] https://www.wlrn.org/immigration/2025-08-01/haitian-ice-deat... [2] https://www.abqjournal.com/news/article_7519bc08-a416-4275-a... [3] https://www.kcur.org/news/2025-05-13/missouri-man-who-died-b... [4] https://www.pressdemocrat.com/2025/04/24/as-immigrant-arrest...

Most likely in the hundreds if you count the deaths in detention, the deaths due to deportation to unsafe or unsanitary locations, and the suicides attributable to their actions.

This is based on a historical accounting of ~1 death a month in their direct care over the past 5 years, plus assuming at least as many due to other root causes. I expect that number to increase as they continue to expand operations and worsen protections for detainees.

“It is better, so the Fourth Amendment teaches us, that the guilty sometimes go free than the citizens be subject to easy arrest.” - Former Supreme Court Justice William O. Douglas

I'm totally against running Stingrays willy-nilly at protests, but this story seems like a non-issue. They had a warrant to track someone down, narrowed it to 30 blocks, then used the Stingray for final location tracking. Doesn't sound like they were logging IMEI's or interested in traffic.

How would one go about detecting the IMSI commands? Would an advanced radio receiver be able to see these? I know pretty much nothing about SIGINT but been contemplating spending some time learning about it.

https://github.com/EFForg/rayhunter/

" So far Rayhunter has not turned up any evidence of cell-site simulators being used to spy on protests in the US — though we have found them in use elsewhere. ... But we’ve received reports from a lot of protests, including pro-Palestine protests, protests in Washington DC and Los Angeles, as well as the ‘No Kings’ and ‘50501’ protests all over the country. So far, we haven’t seen evidence of CSS use at any of them. "

Sounds like that's now stale information:

https://news.ycombinator.com/item?id=45184758

The article describes a search conducted with a warrant. Given the brazen criminality ICE agents are acting with, I’d like to see evidence of malpractice before risking diluting the message.

Edited to redact; response was referencing a different article.

not sure if they just edited it very quickly or what, but that sentence no longer appears in the article.

Are you quoting from the Forbes article listed above?

"In a recently-unsealed search warrant reviewed by Forbes, ICE used such a cell-site simulator in an attempt to track down an individual in Orem, Utah. The suspect had been ordered to leave the U.S. in 2023, but is believed to still be in the country. Investigators learned last month that before going to Utah, he’d escaped prison in Venezuela where he was serving a sentence for murder, according to the warrant. He’s also suspected of being linked to gang activity in the country, investigators said.

When the government got the target’s number, they first got a warrant to get its location. However, the trace wasn’t precise–it only told law enforcement that the target was somewhere in an area covering about 30 blocks. That led them to asking a court for a Stingray-type device to get an accurate location.

The warrant was issued at the end of last month and it’s not yet known if the fugitive was found."

My mistake - wrong article !

https://san.com/cc/exclusive-evidence-of-cell-phone-surveill...

A warrant against a criminal. This is the case that most people support.

I do not support having my cell phone location data sucked up by the government in general while exercising my First Amendment right to protest. That this particular government is doing it is frankly, terrifying.

I agree with you about cell phone data being sucked up when exercising your rights. I love the EFF: https://ssd.eff.org/module/attending-protest

This particular article was about using Stringray with a warrant. I'm sure that the government is abusing Stingray but it'd be nice to have evidence first.

Even if that tool queries everyone in the neighborhood?

The argument with Stringrays is that even with a warrant to target an individual the police end up sucking up a large amount of random people's location and cell phone data.

Like license plate readers and facial recognition, you're out in the world without the expectation of privacy but I think for most people that feels different when a giant automated system is sucking everything up without recourse.

WHile I don't expect privacy, I want it, and I want other people to really think about it and not want public surveillance as well. We should have some expectation of privacy out in public and not allow a loophole of "oh, but we were looking for someone else but also saw you", it's a huge loophole with essentially no limits. A warrant should cover one "thing" a person, group, etc. Anything else grabbed in the process should not be admissible in court or even be used by the police.

"Earlier this year, new media publication Straight Arrow News said it had analysed “mobile network anomalies” around a Washington state protest against ICE raids that were consistent with Stingray use."

Warrants can also be malpractice when the law is in the hands of authoritative types.

Unlike when its people you agree with doing the same things?

I hardly think the courts are above malpractice. They seemed fine with the patriot act, for instance. Citizens United is the definition of malpractice in my book, essentially legalizing corruption.

The Patriot Act was an eye opener to me. Fear has to be, by far, an authoritarian's best tool against the masses. I was shocked "we the people" let the Patriot Act happen, i was also shocked when people locked themselves up for a year voluntarily during covid. All you need is a way to produce fear in the population and they'll do and believe anything you say. Anything.

"THere are criminals though!" and "think of the children" are what will bring in full authoritarianism. People are afraid of their own shadows these and want to live a 100% secure life at ANY cost.

...even if that cost is electing a pedophile.

Really wish Apple would allow us to lock our phones to 5g standalone so we can choose to make fake cell towers a thing of the past.

Update: I quickly searched this to see if it was available on the latest version of iOS and you can mostly use it on T-mobile USA with ios 17+. As they have enable support for 5g SA nationwide. if your SIM card has enabled 5G SA provisioning and if you set the iPhone to 5G On, it will not fall back in any area that has good T-mobile reception meaning they would have to turn off T-mobiles towers or you to be in a deadspot for the IMSI catcher to work. If you enter field test mode you can confirm that you are provisioned for NR SA in area that T-mobile has it’s own good towers with good reception. If it shows up you are provisioned. If not you can call t-mobile and ask that they provision it but many newer sims are provisioned with 5g SA by default and you can use 5G On setting instead of auto to only be vulnerable to downgrade attacks in weak signal areas and deadzones. I’m not an expert on this so if I’m wrong please comment.

Every bus stop and billboard with a CBS logo on it is doing the same thing and has been for a long time. They map your movements by presenting as a cell tower and record the IMEIs of passers by. Forbes won't write a story about that though.

Any citation for that? You seem to have created your account specifically to comment here so I have to assume you're well informed on the topic.

That's not how cellular networks work.

Your IMEI will never be send in clear over the network. Not even back in old 2G networks.

If the gov needs your data they can use standardized lawful interception interfaces. This interface offers all juicy data - not only voice, SMS and your phone number.

You're confusing IMEI and IMSI.

Lots of retail does this with Bluetooth™ beacons (whether just at entry/exits, or at high-trafficked areas).

Which is another reason I simply just stopped carrying a cell phone a few years ago. Absolute freedom.

----

I paid my vehicle off early just so I could disable the infotainment's cell-link. My city has OCR cameras on every 4-lane highway (so I'm still tracked) but it sure is wild how important locations are these days.

slippery slope, I know...

isn’t this essentially a warrantless search of any bystander who happens to connect to the tower? basically random, digital stop-and-frisk?

Could folks share more accessible methods for developing counter-Stingray type activities described in this paper, or rather, which ones they themselves have used with varying degrees of success?

https://www.cise.ufl.edu/~butler/pubs/ndss25-tucker-marlin.p...

Ideally, this is something I could hack together in the next few days since ICE is prepping to invade my city.

I can't help you, I'm just here to thank you for your service.

burner phones and sunglasses are probably easier

My understanding of the linked paper is that it details methods of detecting stingrays. Not jamming them...

I could've been more clear :) don't think I could engage in prevention without violating some FCC laws. But in general, yes - prevention > detection > awareness > ignorance.

'no phone' is the only safe option

No phone actually stands out a lot in real life surveillance systems and will very quickly get you a bunch of additional attention because it’s so unusual.

Not usually that I’m aware of as a single data point in any system but if there are other reasons to thing you’re trying to act surreptitiously you are going to be very close to the top of the list of people of interest.

There’s a lot to be said in 2025 for appearing uninteresting to anyone who might be watching.

Dreh dich nicht um, schau, schau… Der Kommissar geht um, oh oh!

Alles klar, Herr Kommissar?

There’s no information or evidence about any system capable of detecting someone without a phone being in use today. You’d have to combine multiple technologies to do it, and while it might be technically possible the details go beyond any known current systems.

What on earth are you talking about… that is not even a little bit true. I think you’re over complicating this in your head quite a bit.

Here’s something [1] that’s was public almost 20 years ago at this point. Things have advanced a lot since then. I don’t think you quite understand just how much of a pipeline there was for this kind of technology that went almost directly from quite classified SIGINT stuff in the GWOT to casual LEO / domestic stuff.

I know the whole no phone thing sounds like a real high speed operator move but it’s very literally a signal they go looking for when trying to sift through large amounts of data.

[1] https://www.pnnl.gov/main/publications/external/technical_re...

They can detect the presence of phones, yes. But that doesn’t automatically mean being able to detect people that aren’t carrying phones. To do that, you’d need to integrate the phone detection data with some other source of data on people present in the area in question. I’m saying there’s no evidence of such a system actually being used in practice. The paper you linked doesn’t address that at all.

Btw, to help understand the technical challenges involved with this, the whole reason Tesla focused on vision-only for its self-driving was the difficulty of integrating sensor data from multiple sources, e.g. lidar + vision would be significantly more difficult to achieve. It’s not that this isn’t possible in theory - it’s just that there’s no evidence of anyone having done it for “lack of phone” detection, and that’s probably because it’s not really a requirement that’s in high demand.

I’m not looking to argue with you here. You can take the advice or leave it but I will leave you with one quick tale to say that around the late 90s / early 2000s employees at GCHQ used to have a rule that when they were on their way to work they had to turn off their phones when they were I forget exactly how far but something like 30km of arriving to work.

They realised that technology had changed for them even that long ago that all it was doing was just making a really clear signal for the opposition as to who they were and that they were someone interesting.

I think the advice you have is very literally decades out of date.

If you have an hour or two to kill I’d recommend taking a look at this for a real no bullshit modern way of thinking about this problem space: https://youtu.be/0_04-lTu2wg?feature=shared

In a tightly targeted situation like entering the GCHQ building, sure. Because it’s essentially a target-poor environment with a known point of interest that possible targets are visiting. Those constraints make the problem much simpler.

But the OP article is about a Stingray operation covering 30 blocks, and other discussion in this thread is about protests such as the anti-ICE protest which gathered cellphone info from the protestors. In those kinds of environments, if you don’t want to show up on surveillance, you’re much better off not carrying a phone.

Being more specific, this comment of yours is not supported by evidence:

> No phone actually stands out a lot in real life surveillance systems and will very quickly get you a bunch of additional attention because it’s so unusual.

But, if you’re getting your information from videos like the one you linked, I can see why you have these beliefs.

It’s very clear that you just started thinking about this topic in the last hour but for some reason you’ve got a real unearned confidence in what you’re saying.

I have very good reasons to know what I’m talking about here but again, I’m not here to argue with you.

The trust me bro argument is always a convincing one.

Perhaps if I read you my last comment in a voice lowered a few octaves like in that video, you’d believe me.

>I have very good reasons to know what I’m talking about here but again, I’m not here to argue with you.

You are exactly right!

Because the gub'mint can track the nasal implant inserted when I was anally probed by the aliens!

You're making a ridiculous claim that makes exactly zero sense.

If folks are tracking cell phones, they can track yours just as well as everyone else's. Which means they can identify you.

If you don't have a pocket surveillance device on you, unless you're broadcasting RF waves with your (tiny) penis, you cannot be tracked via radio/cell. Full stop.

> track the nasal implant inserted when I was anally probed

That's a reach. Literally.

Those were separate insertions done in parallel.

The aliens are very efficient!

You not having a phone is absolutely not a meaningful barrier towards identifying you in a crowd when things like ClearView exist. It will only make you stand out as someone who’s trying not to be known and get you towards the top of the list of people they are now interested in.

Your chance of even being able to move from your home to a protest and back completely anonymously is close to zero without you standing out very quickly. Honestly, do what you want but I’m telling you with a great deal of certainty that the only thing you’re are doing in reality is inviting a greater deal of scrutiny and your security situation is actually worse as a result of it.

I've been following your responses in this thread. I do agree with you but you make it seem that it's almost impossible to blend in now. Based on this, wouldn't it be almost impossible for intelligence agencies to develop human sources in modern countries? They could just trace the case officer back to their home base or just classify them as a spy based on other patterns? Doesn't this mean that human intelligence is practically dead in 1st world countries?

No not at all, it is done completely differently though.

Before when I was talking about the needle in a haystack problem which is the biggest weakness of the modern big data era.

So to give a really concrete example imagine you need to meet a source clandestinely in the past it’s lots of sneaking around doing surveillance detection routes and meeting in hotel rooms and things like that. Those days are completely dead. You stand out immediately.

Instead you’re looking to have very normal and plausible reasons to be in the same space together while remaining in a large crowd and not having contact usually outside of that.

So imagine you and I both get season tickets to the local sports team and we go there to watch a game just as regular fans and we find a way to communicate in that crowd.

Even the best data analysis / ML algorithms are only ever going to see two people going to a sports match every few weeks. There’s nothing interesting about either one of them that stands out.

It’s just a very different way of doing business basically but hopefully that’s an illustrative example to show you what I mean.

fwiw, that video does describe a threat model for more casual individuals, but does describe some overall good protections mentioned elsewhere (e.g. lockdown mode). the guest also does tacitly admit that the government is much more like the eye of Sauron, and is a wholly different beast.

So where is the burner phone kept? It can't be kept at your home - you have to assume its location is being logged. So you have to purchase and store it somewhere besides your house. You can't use your car to purchase it or store it, so you need a bike. On the day of the protest you need to charge the burner phone away from your car or home and then bike to the protest.

Is this too extreme? How expansive are the queries theyre running on these identifiers? Are they running algos to detect burner phones based on the highly anomalous activity patterms described above?

It's becoming common practice for protesters to store their phones in faraday bags. I don't think "no phone" would stand out as much as you think it would.

If you rotate burner sims you are probably mostly fine but yeah with enough effort they can do a larger geo analysis with the IMSIs. Only IMSI (the sim id) is in the clear on LTE afaik so you might be okay if you are not otherwise of interest.

Just turning the phone off and wrapping it tight in aluminum foil is almost certainly better.

They can and do have the ability to MITM traffic though. There is not anything to stop someone with the hardware from doing it and everyday that passes it seems the rules matter less and less.

Sim swapping seems easy to detect based on anomalous patterns. And it's not a question of effort. If the data is there to allow links to be made, an algorithm can be designed to make those links. Then it's zero effort.

Sounds like "no phone" is the winner

This is dumb advice that doesn’t match any kind of realistic threat model. It’s like something you saw in a movie I think.

The entire modern game is very literally, don’t be interesting and don’t do weird shit that normal people wouldn’t do. It’s a needle in a haystack problem so don’t go and start creating a really weird signature of whatever it might be: behaviour, communication, RF emissions etc. The anomaly is the signature and has been for about 20 years now.

So are you in the “no phone at protests” camp? Because it’s impossible to attend a protest and “act normal” because by definition you’re engaging in abnormal behavior and that’s exactly why they’re logging all the phones there

I think you can still go to a protest with a phone just fine honestly.

The fact that there are a lot of people there is actually the strength of it.

I’d probably think carefully about what you want to use it for and what I had on there though. I wouldn’t recommend bringing a device with a a bunch of incriminating evidence to an event like that.

I think a good threat model is just operate on the assumption that maybe someone stops you and asked to look at your phone. Go ahead and also assume that they will ask at the most inconvenient point in the day also. Act accordingly and I wouldn’t anticipate much in the way of trouble from having one.

Also, look at it through the eyes of the opposition, what are their goals here…

1. Fix the signal to noise ratio in a crowd

2. Identify people

3. Map out networks

And your goal is to not to be “invisible” (you can’t anyways) but to be uninteresting. They aren’t the same thing and the difference is important.

For the overwhelming majority of people I don’t think there is much yet to worry about in simply attending a protest (Assuming you’re a citizen and you act sensibly because otherwise that’s an entirely different threat model and you probably shouldn’t be there at the moment).

But I would leave you with this bit of advice also… they very much want you to think they are the all knowing, all seeing and ever present 50ft tall enemy. That isn’t true. There is also no shortage of people who really seem to get off on pretending things are more dangerous than they really are but that shit turns into paranoia real quickly and then people become terrified to do anything or you start making bad decisions. Fight both of those things when you run into them.

You can and should feel good about getting out in the streets at the moment, it’s not going to get easier the longer it goes on just be sensible.

Thanks, that was a very thoughtful comment and you basically read my mind, in that I have become so paranoid that I’m afraid to go to a protest. And I can definitely see how that plays right into their hand. I think there is definitely a lot of room for messaging like yours because it seems like now many are becoming aware of the surveillance situation which is good but at the same time can result in a form of learned helplessness.

It’s a weird new world for sure out there and honestly everyone is going through this.

Even the CIA had to stand up a whole new department years ago when the realised they even with all of their tradecraft and gadgets they couldn’t even move around London without the Brits knowing about it and had to totally change how they did business as a result. It’s not just an average protestor on the street problem at all.

I think a big part of the problem comes from this idea that you’re trying to be invisible and you keep running into all these new layers of problems all the damned time.

Maybe I’m using E2EE apps but the people I’m talking with take screenshots and run them through co-pilot or put them into their iCloud backups or a million other scenarios. It just feels like such an unwinnable game sometimes that you can very easily and convincingly get yourself to a place where you feel overwhelmed and you just freeze which is such a trap in and of itself.

I’d recommend keeping the illegal activity side of things extremely fucking low to non-existent personally and everything else will become much simpler as a result. It’s much easier to just not have evidence than trying to hide it. That doesn’t mean you shouldn’t do things with a sense of purpose though. There are many ways to frustrate the opposition, to tie up their resources, to send them on wild goose chases, to wear down their morale that are all firmly in the legal category.

Very good advice. I make a big effort to stay on the good side of the law as like you I have a healthy respect for their abilities. I’m also interested in your last couple sentences there about sending them on wild goose chases. It reminds me of a YouTube video I watched recently about a way to send AI data scrapers into an infinite hall of mirrors filled with randomly generated text. Not something I have the time to cook up at the moment but I found it amusing. At the same time it’s not hard for me to imagine how easy it would be to pass laws that make such efforts to poison AI a felony.

>For the overwhelming majority of people I don’t think there is much yet to worry about in simply attending a protest (Assuming you’re a citizen and you act sensibly because otherwise that’s an entirely different threat model and you probably shouldn’t be there at the moment).

That seems a tad naive. I think being recorded by local/Federal agencies at a protest, especially one critical of current government actions, is a legitimate concern. Especially since those tools are being brought out specifically for the protest, not because they are looking for some murderer that happens to be a block away from you.

Also, the word "yet" is doing a lot of work there. Considering that data can be stored indefinitely with little oversight, there is little to stop police from searching through the database and looking for "targets of interest" like phones that showed up to multiple protests.

Being at a protest is already known to make you interesting, which is why those tools are being brought out in the first place, why police are "friending" protest organization FB pages to gather membership data, etc. Keeping yourself out of databases that could be used later to jam you up is reasonable. There is also no way for police to tell who has a phone and who doesn't at a protest, so you aren’t highlighting yourself anymore by not bringing your phone (or turning it off), unlike say wearing a mask and sunglasses to reduce facial recognition visually highlights you.

> So where is the burner phone kept? It can't be kept at your home - you have to assume its location is being logged. So you have to purchase and store it somewhere besides your house

You can remove the battery, put it in a Faraday cage and charge it turned off (or in another device/out of one). It can be on only when you need it.

i’m not sure about this approach - what about in the event of apprehension or some other means of physical access to the device? biometrics can (sometimes) be used even if the authenticator is unconscious.

I’m explicitly making the argument that you should act as though your phone (and any other devices) can and will be searched by someone at the most inconvenient point possible and assume that that search isn’t necessarily tied in any meaningful way to you having your phone on your person and go from there.

Because that 1000% is a real capability you will have to deal with and like sure, do what you can to make the costs associated with that as hard as possible but don’t get confused into thinking it’s a technical solution that is going to fix this problem.

Fully patched iOS in lockdown mode isn’t going to save you from someone physically making you open it in front of them.

Think something a lot closer to this xkcd comic: https://xkcd.com/538/

My phone has hardware kill switches, so I can be sure the modem is off when I need it.

What phone is that? I've been wanting a phone with mic/camera especially hardware kill switches

https://en.wikipedia.org/wiki/Librem_5

that's what i would do, just leave the phone at home. Bring a camcorder and post your social media engagement dopamine hit when you get back home. No need for constant connectivity, people protested pretty effectively in the 60s before cell service even existed.

I leave mine at home, but you're right; I should also get some counter-facial recognition paint.

However, my endeavor here is more focused on awareness and transparency for the masses than subterfuge for the individual.

"Israel targeted top Iranian leaders by hacking, tracing their bodyguards’ phones — report"

<https://www.timesofisrael.com/israel-targeted-top-iranian-le...>

I'm listing the Times of Israel first as it's an Israeli publication, though it cites the following NY Times article which researched the story:

"Targeting Iran’s Leaders, Israel Found a Weak Link: Their Bodyguards"

Despite all the precautions, Israeli jets dropped six bombs on top of the bunker soon after the meeting began, targeting the two entrance and exit doors. Remarkably, nobody in the bunker was killed. When the leaders later made their way out of the bunker, they found the bodies of a few guards, killed by the blasts.

The attack threw Iran’s intelligence apparatus into a tailspin, and soon enough Iranian officials discovered a devastating security lapse: The Israelis had been led to the meeting by hacking the phones of bodyguards who had accompanied the Iranian leaders to the site and waited outside...

<https://www.nytimes.com/2025/08/30/us/politics/israel-iran-a...>

(Archive / paywall: <https://archive.is/XdZet>)

It's not just your phone, it's the phones of those around you. Whether or not you have a security detail.

This is one factor which makes pervasive surveillance so absolutely insidious.

What is the baseline spying by ALL agencies? For non experts this would be useful to know. Just heard something suggesting most comms are fully infiltrated anyway for certain foreign actors but have no idea how to validate those claims myself.

The Forbes article says ICE acquired mobile cellular surveillance equipment and services under the Biden administration, and there have been IMSI catchers detected at demonstrations for a long time, for example at the Dakota Access Pipeline demonstrations in November, 2016[1]. It's not a new thing.

[1] https://www.justsecurity.org/34449/investigating-surveillanc...

Wasn't this thought impossible with LTE, I thought older bands were only susceptible to this attack.

5G standalone is not transmitting IMEI in plain text ever to my knowledge.

isn't this then ripe for a downgrade attack?

To LTE? Doesn't work there either.

There are IMSI catchers - but they all require GSM. At least on Google Pixels you can turn off 2G with a switch. The phone even shows a message about its insecurity.

In Germany I'm running 100% on LTE/5GNR-only for many months now without having a single coverage gap.

thank you for the explainer; I do need to research for a more complete understanding of this space.

looks like iPhones will need to enable Lockdown Mode to disable 2G, at least for iOS 17+ per https://ssd.eff.org/module/attending-protest

Classic 2G stingrays are a lot less complicated, but attempts to secure the IMSI haven't properly been implemented until 5G came around. Even then, the IMSI has been replaced with encryption and temporary identifiers your carrier knows belongs to you, and if law enforcement comes in with a warrant they can get those replacement identifiers from your carrier regardless.

You can't get the IMSIs passively anymore, but LTE doesn't make these attacks impossible, just less practical, especially for criminals that don't have warrants on their side.

They can use standardized lawful interception interfaces to get all this data.

No big need to dig down deep into the radio and protocol layer.

You can collect IMSI passively over LTE: https://github.com/SysSec-KAIST/LTESniffer

You can just jam everyone in the area and see who reconnects.

Couldn’t I just grab a Baicells eNB off eBay and point it at my own Open5GS installation and passively sniff IMSIs of users scanning around anyways that try to attach and reject? It feels like I could build some kind of “sniffer” fairly easily these days as well.

>In order to maintain an uninterrupted connection to a target’s phone, the Harris software also offers the option of intentionally degrading (or “redirecting”) someone’s phone onto an inferior network, for example, knocking a connection from LTE to 2G. [1]

>In its most basic functionality, the [LTE] IMSI catcher receives connection/attach request messages from all mobiledevices in its vicinity. These attach messages are forced to disclose the SIM’s IMSI, thus allowing the IMSI catcher to retreive the IMSI for all devices in its vicinity... a fully LTE-based IMSI catcher is possible, very simple and very cheap to implement without requiring to jam the LTE and 3G bands to downgrade the service to GSM. [2]

Exploits on 5G to retrieve the IMSI. [3]

[1] https://theintercept.com/2016/09/12/long-secret-stingray-man...

[2] https://arxiv.org/abs/1607.05171

[3] https://arxiv.org/abs/1809.06925

If your cell phone is connected to cell towers, almost anyone can buy your location.

Only option is stay in airplane mode and use wifi.

Hello WiFi Geolocation technologies. https://en.wikipedia.org/wiki/Wi-Fi_positioning_system

"small government"

This seems like it would be more useful as an Android app you can side load rather than a rust app.

If I am understanding correctly, I would need a mobile device?

Would this work using the phone as a hotspot? If so, then I guess my previous comment is moot.

Reply on news.ycombinator.com