Cache of devices capable of crashing cell network is found in NYC
nytimes.com
nytimes.com
The SIM cards come from cheap MVNOs that have dealer arrangements for cheap or free first month activations, then they just set up a handful of SIM boxes and a residential Internet connection back to the mothership (like they did at the captured house with the white Verizon 5G Home router just casually sitting on the floor next to the units).
Similarly, I’ve had some friends on US MVNOs themselves that have access to “free” international calling, yet every time they call (the same) international number the receiving party gets a wildly different caller ID from a wildly different country each time (Poland, Moldova, etc). Also dodgy SIM boxes!
Or grey-route bulk messaging and SMS OTP bypass so actors can register throwaway accounts on Signal/WhatsApp/Telegram, social platforms, fintech, crypto etc. then burn the numbers after use.
You need 100k SIMs to defeat per-SIM rate/behavior caps, receive OTPs for mass account creation and run thousands of campaigns/conversations in parallel while keeping each SIM's pattern below carrier detection thresholds.
It's not about the UN.
NYC is a prime market for "local presence" numbers (212/917/646 etc.), which boosts answer rates and trust for scams, impersonation, mass disinfo campaigns.
The real reason this shit is in NYC is because the number of tower cells is huge due to population density. It makes having a few hundred to thousand devices in one office a bit more viable.
Most are spoofed. Many, from local Long Island exchanges.
All the spoofed calls just reuse existing numbers. When I first started getting them, I called a couple, until I figured it out. I usually got some poor, confused schlub.
I’ve gotten some calls, myself, and have been said poor, confused schlub.
Yeah, the last time I asked for a 212 number from Verizon Wireless the guy literally laughed at me.
Skype was like that for a long time
There are schools everywhere, usually in places where there are lots of other amenities like shops, and doctors, and pubs.
So you mean... like, these are the exit points into the "legitimate" telephone network for, say, those random MedAlert scam calls I keep getting from numbers scattered all over North America? Or if not, what does "VoIP" mean here exactly?
Somehow I've missed this entire phenomenon...
Also, if the information would not exculpate the defendant, and the prosecution won't introduce it at trial as evidence of guilt, then the information can be withheld.
But I should mention the bad guys are trying to get grand jury assembled that would prosecute James Comey. Does that count as 'criminal trial process'? https://www.nytimes.com/2025/09/24/us/politics/james-comey-i...
I'm not a lawyer, but this corruption will be getting worse. That distinct is relevant still but for how long?
Now that Comey's been indicted, the trial process will begin, assuming he doesn't plea out (and I don't think he will). The uphill battle for the prosecution now begins.
Same year as the Phineas and Ferb reboot. Coincidence???
But the lyrics are still stuck in my mind, "The tri state area was the bi state area with an adjacent area, right over there".
I'm presuming this discovery was near the outer perimiter of that circle, because otherwise presumably they'd have quoted a smaller, scarier number.
> Investigators found the SIM cards and servers in August at several locations within a 35-mile radius of the United Nations headquarters. The discovery followed a monthslong investigation into what the agency described as anonymous “telephonic threats” made to three high-level U.S. government officials this spring — one official in the Secret Service and two who work at the White House, one of the officials said.
So 100k SIM cards scattered around the middle of New York City.
Probably an egress point for scammers and bot farms, and the speculation about local disruptions isn't grounded in anything other than scale?
I've used hardware a decent amount larger than what's pictured in the OP for work. But what I was using wasn't just for SMS. So I needed more sophisticated modems. What they're using looks like a bunch of 64 port modem banks exclusively for SMS.
(Oh wait if you mean the devices for what's in the article you linked, then yea, those I'm sure are much smaller and quite different.)
But we had enough volume that we could typically get improvements on routing by asking aggregators about difficult destinations (unless the difficulty was coming intentionally from the destination carrier). The aggregators do sometimes use grey routes from SIM farms. Squishyness around terms of use and accounting would have been an issue too, we would not have been able to fly under the radar on 'unlimited messaging'
Another potential use could be if you needed to send a lot of alerts to your employees/customers in a short period. Most aggregators have rate limits, and so do carriers... if you're a big customer, you can probably get limits raised; if you only have an occasional need, you might prefer to have a large number of low cost SIMs.
More likely an egress point for cheap VOIP routing.
Round-robining around some unlim SIM cards to stay below the radar will be cheaper.
This is a to take advantage of "free calls to North America" provided by MVNOs, and free < cheap. Twilio starts at $0.01/min; 1 cent/minute x 200 lines results in a delta of $2.8k per day. I'm assuming a 20% utilization rate[1] on a device that holds 1000 SIMs
Further, it's a way to bypass STIR/SHAKEN requirements for a less-than-legitimate VOIP termination operations, which can attract paying customers that want to evade detection, typically criminal endeavors.
1. 20% utilization is pretty generous, but even if its 2%, not using Twilio is profitable at scale.
The Bad Guys are neat with their cable ties, and number their gateway boxes.
The Bad Guys went with simple heavy-duty metal garage shelving rather than real racking, seemingly vastly overengineered for the weight of the equipment, as that sort of shelving can hold up to a Mg per shelf UDL. The "WallOfSimBoxes" kit does not sport any rack mounting brackets.
The Bad Guys don't use redundant power supplies, or battery backup.
* https://chinaskyline.net/sk-gsm-voip-gateway/esim-64-ports-s...
It also sounds like they did have multiple locations, but they didn't distribute the modems out enough to flew under the radar longer.
Logically one would switch sms-sending using some number of (fixed or mobile) sdr-based simboxes so that they would even appear to move around the city randomly.
Those guys did it on the cheap. But then they did not expect SS to drop on them.
I buy from Walmart. search their site for "Hyper Tough wire storage shelves"
> The agency did not provide details about the threats made to the three officials, but Mr. McCool described some as “fraudulent calls.”
> Investigators have been going through the data on SIM cards that were part of the network, including calls, texts and browser history. Mr. McCool said they expected to find that other senior government officials had also been targeted in the operation.
The article goes out of its way to imply a link between this farm and the threats, but doesn't actually explicitly make that link.
The CNN article covering the same story does the same thing: https://www.cnn.com/2025/09/23/us/swatting-investigation-ser...
The Secret Service statement, however, does make that claim explicitly in the first sentence: https://www.secretservice.gov/newsroom/releases/2025/09/us-s...
Provides evidence
"No, not that evidence"
No thank you.
The UK has criminalized possessing or using SIM farms or related gear in response to these popping up with some regularity. But the operators are pretty clever and know how to hide. I've been thinking about how easy it would be to detect these when you're a telco and I think the signature is unique enough that it should be possible to detect which SIMs are part of a farm, even if you don't know the exact location of the farm.
Whoever did this likely isn't all that happy that their carefully created infra was used to harass officials, which most likely is the single reason this operation got uncovered in the first place. If it would have just been used for low level crime who knows how long they could have continued to do this.
Note that these are not unique to NYC or even to the United States, they've been found in other countries as well, the UK has now criminalized possession or operation of these (but the fines are so low that I don't think it will make much difference).
Uh. No it isn’t. SNR between 5 or so masts gives you the exact location of any cell device. This is how $oldemployer used to track them
IIRC modern cell towers use cool tricks to send stuff for a particular phone to only where that phone is so they can send more total data. Can this not be turned into a precomputed map by taking a test phone everywhere and seeing what settings the tower picks to talk to it?
FYI: That was available back in 2022 as standard. Now it could be even better. :P
I'm not saying it can't be done, clearly it can be done otherwise this article wouldn't exist. But it is not quite as easy as pointing a magic wand (aka an antenna) at a highrise and saying '14th floor, apartment on the North-West corner', though that would obviously make for good cinema.
Subpoena the power, water & gas company, and look at apartments that have unusual power usage, coupled with almost zero water & gas usage. Especially look at apartments that don't have a spike in power usage in the morning & evening that corresponds to people having a regular commute.
I'm not sure how much power this equipment draws at idle - I'm assuming it's more idle at night, no need to send scammy SMS messages at 3am Eastern - but I'd wager you could track that.
Granted, it's not fast, but depending on how quickly the companies bend over backward for such a request & how good your interns are at using Excel, you might be able to get this done before sundown.
For those who have not seen it before, Waterwitch is on page 43 of the 2013 catalog here [1], and is described as "Hand held finishing tool used for geolocating targeted handsets in the field". It did seem to require, if I'm reading right, that the target be connected to a malicious GSM router called "Typhon" (page 42).
[1] https://www.cryptomuseum.com/covert/bugs/nsaant/files/NSA_AN...
Portable spectrum analyzers are regularly used to identify interference in urban environments. Even a damaged cable coax line on the street can interfere with cellular signals.
Even before doing that, a handheld Yagi in the parking lot will easily narrow it down to a couple of floors in a specific quadrant of the building.
But when people think of beam forming as “pointing a beam at a phone” that’s kinda thinking of the problem backwards. Modems beam form by looking at the various bits of signal delay coming down multiple antenna, and computing a transform function that will effectively result in the signal it sends mimicking those delays and thus forming a beam pointing in the opposite direction of the incoming signal.
But the modem has no idea what physical direction that beam is pointing in, and doesn’t care. It just know how to analyse an incoming signal to effectively mask the inputs from different antenna in order to extract a very weak signal, by taking advantage of constructive interference between a signal received on multiple antenna, and in turn invert that function to create an equivalently strong constructive interference pattern at the source of the signal when replying.
Most important the modem has no idea what the actual signal path was, it could have bounced of several buildings, been channeled by some random bit of metal acting as a wave guide, or any other manner of funky interference that literally any physical object creates. All it knows is that is a viable signal path must exist (because it received something), and it can compute a function to send a return signal back down the same path. But it’s very hard to turn that abstract signal path function the modem understands, into an actual physical direction. Not without doing a load of extra calibration and sampling work to understand exactly how all the antenna the modem uses interact with each other, which nobody does, because that information won’t improve the cell towers performance.
If you have MIMO, i.e., multiple signal streams, it will be more like an 4x4 matrix instead (how loud should radio X shout signal Y), and you'll not only optimize for “signal 1 should be the loudest possible at receiver 1” but _also_ “signal 1 should be at the _most quiet_ possible at receiver 2”.
The fact that cheap consumer devices are able to do this fairly reliably (one could even say it's pedestrian) at near-gigabit speeds says something about how insane our level of technology is.
It's also amusing to see lots of people state with great authority how simple it is to track down a transmitter, when in fact they've probably never so much as participated in a fox hunt, which can get quite interesting at higher frequencies and when not in open field.
Because - depending on cell tower coverage and the antennas installed on it - the degree of precision is far too low to be useful. In rural installations and the worst case, aka a tower with a dipole antenna on a mountaintop, at 900 MHz the coverage will be around 35 km. Segmented antennas just limit the section of the circle where the endpoints are. In suburban areas, coverage is usually 10-20 km, and urban areas it's 5km and less.
Now you know which cell and cell section the user is in... but to actually pinpoint the user? That takes some more work. First, you need a few more towers that the user can reach for triangulation - the more the better - but if the operator of such a setup is even remotely clever and the hardware/firmware supports it, they will have locked the devices to only connect to a single tower (you can see a map at [1] that shows the IDs). If the operator didn't do that but the site is too remote to achieve triangulation, you might need to drive around in a van and use an IMSI catcher, aka a phone tower emulator, and hope that eventually the site's devices register at it. That, however, is a lot of awful work, and is often not legal for police authorities, only for secret services.
Now you might ask yourself, what about 911, how can they locate callers precisely? The thing is... it depends. Landlines and VoIP lines are usually mapped to a specific address (which is why VoIP providers give you an explicit warning that, if you do not keep that record up to date, 911 calls will be misrouted!), so that's trivial. Mobile phone callers however, until a few years ago the degree of precision was exactly what I just described - it completely depended on celltower coverage, with the only caveat that a phone will connect to another operator if it shows a stronger signal for 911 calls. Only then, Android introduced Emergency Location Service [2] and Apple introduced Hybridized Emergency Location [3] - these work with the sensors on the phone, most notably GPS/GLONASS/Beidou, but also SSIDs of nearby WiFi APs and specific Bluetooth beacons. Downside of that is, of course, the 911 dispatch needs an integration with Apple and Google's services, users can disable it for privacy reasons, and older phones won't have anything - so in these cases, 911 dispatchers are straight out of luck and again reduced to the above range of precision.
[2] https://www.android.com/safety/emergency-help/emergency-loca...
[3] https://www.apple.com/newsroom/2018/06/apple-ios-12-securely...
If the reporting around this is accurate, sounds like someone(s) was swatting through these, which brought the attention needed to find this group.
The last three places I've lived, I'd never seen the residents of fully half the apartments on my floor. They could have been jam packed with SIM farms, or abandoned tigers, or dead hookers in chest freezers for all I or anyone else in the building knew or cared about.
An apartment where nobody bothers their neighbors or the super, but keeps the rent checks coming, is the absolute best case scenario for everyone involved.
And again - if an unattended apartment is raided, there's nobody there to drop names. You lose the investment, but that's likely a lesser problem than worrying about what Kasim is going to tell the cops once the handcuffs go on.
Assuming you have carrier diversity on your sims, you could likely manage good enough backhaul over the sims for the control layer. At least for grey market SMS; grey market voip might need more consistent networking. Grey market VPN, eh... variable conditions might help customer traffic be considered mobile.
HP if memory serves me right. Around 20 years ago.
1. Sim box operators were running multiple locations for sending spam texts, cheap VoIP for scams, and potentially other phone-related crimes. 2. Operators were associated with other criminal gangs. Maybe directly, maybe indirectly. Someone may have been running a drug side-business from a location. 3. Someone uses this sim box operation to send threatening scam messages that happen to reach these government officials. For whatever reason, they take it seriously. 4. Now that the feds and NYPD have raided this sim box operation, they have to justify why they were doing this. It's probably not directly illegal to run a sim box farm so they are going to play up the threat a bit to get more coverage of the investigation.
I can assure you, a lot more dangerous criminal activity happened within a 35 mile radius of the UN than some zombie cell phones sending scam texts. While I applaud anyone shutting down scams, the window dressing is embarrassing. Someone has watched too much Blacklist or any of those fantastical police procedurals.
> 1. Sim box operators were running multiple locations for sending spam texts, cheap VoIP for scams, and potentially other phone-related crimes.
Agree, I would guess this was just a bottom-rate VOIP/text spam service, potentially affiliated/run by organized crime, that doesn't ask many questions, accepts payment exclusively in BTC, etc.
> 2. Operators were associated with other criminal gangs. Maybe directly, maybe indirectly. Someone may have been running a drug side-business from a location.
I think this is just another version of a grow-op. Run by a gang, mainly for profit. Perhaps the shelves were even from an old grow-op that became unprofitable when New York legalized marijuana.
> 3. Someone uses this sim box operation to send threatening scam messages that happen to reach these government officials. For whatever reason, they take it seriously.
I disagree here, from the description of the messages I think these were supposed to be actionable threats. At least two of the incidents mentioned were swatting attempts, which are still taken somewhat seriously and are treated as serious threats when directed at elected officials. US Police are highly armed and often very aggressive, swatting incidents have resulted in deaths before.
This, to me, reeks of the sort of foreign interference with domestic politics that has been mentioned in the past. Trying to escalate domestic tensions is straight out of that playbook.
What I think happened is - some foreign actor used organized crime connections, or some other way in to get time on this spam farm, and they used the numbers there to SWAT and threaten officials around the US in a way that's harder to trace than a regular VOIP provider.
> 4. Now that the feds and NYPD have raided this sim box operation, they have to justify why they were doing this. It's probably not directly illegal to run a sim box farm so they are going to play up the threat a bit to get more coverage of the investigation.
I think they see this as a wonderful coincidence. With the setup as described in the article, I could see this farm overloading the few cells that serve the particular area around whichever building(s?) these sites were found in, but city cellular networks are very dense. There's hundreds of mobile cells in New York City, and frankly I think if you wanted to seriously take down the cell network a few high power jammers distributed across the city would be more effective.
And yeah, I wouldn't be surprised if this isn't directly illegal, although I bet the operation as a whole has been dodging taxes and know-your-customer rules. But, here we have a golden opportunity to play this up as a major terrorist threat instead of just organized crime, and they're going to take that option every time.
> Telephonic threats to multiple senior U.S. officials this past spring – including multiple people protected by the Secret Service – first triggered the investigation, but officials say the network was seized within the last three weeks.
and guns/drugs
> Investigators also found 80 grams of cocaine, illegal firearms, plus computers and phones.
Maybe cartel tech stuff, but I'm not sure why cartels would mess with threatening politicians.
This sounds more like someone's personal property or a small party and not a commercial operation?
If you know of a better risk-free, tax-free ROI than 20%+ in a year
The word only is doing a lot of work here. There are also pictures of the equipment.
It seems unlikely you'd setup a scam setup like this and out yourself by making threats to government officials via your own infrastructure ...
So you mean they could have shut down these SMS and outbound call spam farms years ago
…but just didn’t have the motivation
Seems odd that the most important use they can highlight for cell service in NYC is accessing Google Maps. Not accessing 911, not some other vital use of cell service, but Google Maps.
NYC is full of free Wifi all over the place. So many McDs, Starbucks, and other restaurants and sites you can get Google Maps anywhere.
No mention of arrests or surveillance of any site to try and apprehend anyone related.
https://www.cnn.com/2025/09/23/us/swatting-investigation-ser...
EDIT:
While the headline on NYT highlights an attack on the towers for disruption, the CNN piece gives more weight to two other uses: (1) criminal communication network and (2) swatting.
I think those two make sense. The SIMs would probably hold US numbers and would appear authentic for accessing the US operators' networks.
And even if you wanted to deploy custom hardware to do it, it would be far easier to just use a high power jammer on the band anyway than mucking around with all those SIMs.
These are for making actual use of the telecom facilities at scale, with the anonymity you get from burner SIMs. It's fraud, not terrorism.
Edit: removed tracking id
"In addition to jamming the cellular network, he said, such a large amount of equipment near the United Nations could be used for eavesdropping."
How could a SIM farm be used for eavesdropping?
How are cell signals different from any other radio comms?
> “While forensic examination of these devices is ongoing, early analysis indicates cellular communications between nation-state threat actors and individuals that are known to federal law enforcement.”
https://www.secretservice.gov/newsroom/releases/2025/09/us-s...
The Secret Service is really trying to make hay out of these things being close to UN, but so are millions of other things in the New York City Metro Area. Either they have intelligence they aren't disclosing or someone's try to put a lot of spin on this crime bust.
I've used this before when I need to create an IG for a work project without wanting to link it to a personal number:
This was probably just a phone botnet for online botting purposes, where you want IP addresses in not-obviously-third-world bot countries.
Remember when Trump was running the second time? Those white Americans who were calling people all throughout America with those moronic threatening messages?
Until it happens to you or yours it is hard to comprehend.
May the Internet gods provide an audio link.
>One official, speaking on the condition of anonymity, said agents also found 80 grams of cocaine, illegal firearms, computers and cellphones when they discovered the network.
Sounds like literally a mobile botnet and it was probably just leased out access to a range of users.
Leasing access to botnets and other resources is 1000% normal in the "crime web" and is a business in of itself rather than being directly part of the crimes.
On top of that, a "nation state" attacker isn't going to be giving their employees cocaine, unless its Hamas lolololol.
I've never heard of this, do you have a source?
Anyone can only catch “one or two” at a time.
The White House just buried its report on white terror in America.
Let me guess, you’ve never heard of it?
Sarcasm aside, the problem is far worse than one could imagine or anecdotally discuss on HN.
What do you mean by that?
Isn't it costly to acquire that many SIM cards? Or maybe they were inactive until they were associated with an account? So it was just to keep allowing for a rotating set of SIM accounts?
Are we going to find out that all these cellphones were used to run bots on X or similar?
Seems like a nation-state level attack from somebody that has millions to spend to keep this up their sleeve
It sounds sophisticated, but nation state or cartel or something else big?
What I'm really curious about is the money trail. These cards weren't bought in one off cash purchases or via some penny ante crypto reseller. Someone bought in bulk using real money. They probably had to talk with the salesguy at the MVNO to make an order that large. This kind of thing must leave a footprint.
They're ordering and activating maybe 20-50 at a time, and ordering that number of SIM activation kits from dealer supply houses is extremely normal. Activation typically also is at little to no cost as well to dealers in this market.
FWIW: at sixteen, I somehow managed to get dealer access to a CDMA MVNO. I was able to activate accounts on the fly with $2 of "free" credit to start the user off, with zero cost to me. I still get emails to this day over a decade and a half later from various cellular resellers offering me bulk cellphones...
https://readsludge.com/2025/09/15/democratic-pr-firm-to-run-...
It’s a cell tower jammer and terrorism multiplier. Can’t call or text. It will probably disturb internet service as well. Include a few radio jammers for local police and a few satellite antennas you could create an opportunity then a panic to cover your tracks getting out.
When you think about the sheer scale of monitoring every cell phone in the country it probably doesn't stand out nearly as much as you would expect.
Two possibilities:
1. Most if not all of these virtual cell phones are connecting from the same location.
2. Some of these virtual cell phones are connecting from the same location, with the remainder in reserve.
In the case of (1), you have both a fixed location and a high saturation that is unlikely.
In the case of (2), you could imagine using certain numbers at certain times to simulate the work day or hours during which people are more likely to be at home. Randomization or round robin could produce unlikely patterns, but without them, these virtual phones would be underutilized, save for some kind of cyberattack that would compromise their location.
Or the truth simply may be that they aren't doing anything, because no one is watching.
Could it perhaps be espionage related to a downgrade attack? ie force a target's phone to switch to 3G by temporarily overloading/confusing the 4G/5G network.
[1] https://www.secretservice.gov/sites/default/files/2025-09/Si...
>>These devices were concentrated within 35 miles of the global meeting of the United Nations General Assembly now underway in New York City. Given the timing, location and potential for significant disruption to New York telecommunications posed by these devices, the agency moved quickly to disrupt this network.
What nation-state actor might want to disrupt a major US city during a meeting of the UN General Assembly?
So YES, there is a specific claim, and it came directly from the USSS, in the exact article heading this topic. The USSS does not merely toss in observations without a basis in their working threat model (unless they've changed since I worked adjacent to them). It may indeed turn out to be unrelated, but the USSS is publicly stating they are treating it as more than a coincidence.
https://cnetross.en.made-in-china.com/product/OSomfpPGJWUH/C...
...and their purpose is mostly to provide an IP-to-cell-phone-number gateway for SMS spam and phone scams. A real cell phone number is greatly preferable to VoIP phone numbers, which are blocked / flagged at a much higher rate.
> These devices were concentrated within 35 miles of the global meeting of the United Nations General Assembly now underway in New York City. Given the timing, location and potential for significant disruption to New York telecommunications posed by these devices, the agency moved quickly to disrupt this network.
Also, how would 100,000 phones in a single cell affect the network. Isn't this pretty normal for any major concert or sporting event?
But I'm very surprised there wasn't a copy of Sims 3 visible.
If these were found in a foreign country then maybe, but these would be far more likely to be some foreign intel service than the NSA.
If the NSA needs outbound phone numbers, they're more likely to set up a shell company and pretend to be an MVNO or a VOIP telco provider, a couple computers on a cheap cloud host masquerading as a phone provider is a lot easier to manage and hide than a setup like this. This is a pretty common kind of business so it's easy enough to blend in, and it isn't restricted to a single apartment or city.
If the NSA wants to eavesdrop on phone calls, they just set up a room inside the relevant phone provider [0].
I think this is more likely a gang operation or a foreign influence operation. Details are thin but it feels like a shady organized crime operation (think quasi-legal, probably advertising as bottom-rate VOIP numbers or text gateways) that got used at one point by a foreign influence operation to make threats and try to interfere in domestic politics.
(The country currently committing genocide with us tax payer bought weapons).
The pictures of the confiscated equipment is every phone phreaks orgiastic wet dreams.
It is interesting that these sorts of things are going on in the first world, and until discovered anyone vocalizing suspicions of such a thing would be regarded as a paranoid delusional crackpot.
> "several locations within a 35-mile radius of the United Nations headquarters"
That's the entirety of New York City!
edit to add: This very weird part was actually lifted from the USSS press release,
> "These devices were concentrated within 35 miles of the global meeting of the United Nations General Assembly now underway in New York City."
https://www.secretservice.gov/newsroom/releases/2025/09/us-s... ("U.S. Secret Service dismantles imminent telecommunications threat in New York tristate area")
Looking at a map, a 35 mile as-the-crow-flies (and as the cell network signal flies) radius of the U.N. Secretariat building almost gets one to Lake Hopatcong, New Jersey, in one direction and past Stamford, Connecticut, in another.
The article:
https://www.cnn.com/2025/09/23/us/swatting-investigation-ser...
The article mentions a "circle around NYC's cellular network infrastructure".
"Kind of"?
Lots of interesting discussions about cell phone networks lately.
Fake cell phone towers ICE is using to track people:
https://www.forbes.com/sites/the-wiretap/2025/09/09/how-ice-...
GrapheneOS (de-googled android) and FLX1s (pure Linux phone):
https://news.ycombinator.com/item?id=45312326
My question is: are any of these alternatives helpful against these novel attacks? If you are on a phone using a network vanilla provider like tmobile or otherwise, is there any way to prevent your phone from trying to connect to a fake network?
If I controlled the entire cell phone stack, like I would with FLX1s, then could I have something like the ssh initial connection signature:
The authenticity of host '100.64.0.46 (100.64.0.46)' can't be established.
ED25519 key fingerprint is SHA256:yE4jh7gROroduLqbIFcInlUXrpDy8JIpJPc+XvtIpWs.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])?
It would be a bit of a pain to accept a new cell tower when I'm in a new city, but I could imagine syncing a whitelisted trusted set of cell phone towers (ha, when I think of that the whole idea of "trusted" is laughable). But, at least I would have more insight into when I am getting surveilled. And, I could say "not today ICE!" or "tmobile, idk, please give me my HN fix, I don't even care if you know I'm aware my government is tracking me as I pay the service fee!" I bet a whitelist hosted on github would be faster to update than tmobile installing new cell phone towers so privacy enthusiasts could enable their own safety.
Prevent what exactly?
> If you are on a phone using a network vanilla provider like tmobile or otherwise, is there any way to prevent your phone from trying to connect to a fake network?
LTE and beyond have mutual authentication. Your phone will attach to any network for an emergency call, but attachment to LTE requires the network trusts your sim and your sim trusts the network. [1] No trust on first use necessary, because the SIM includes its private keys and public keys for the network.
[1] https://www.sharetechnote.com/html/Handbook_LTE_Authenticati...