Every day, you spend an unimaginable amount of hours staring at your smartphone screen: chatting, responding to messages, browsing the internet. But do you know how your mobile phone actually works?
Mobile communication, which enables the functioning of mobile phones, is wireless and is provided by cellular towers — base stations. To stay connected, mobile phones continuously send weak beacon signals to the nearest station or stations. Base stations transmit a response signal, the level of which is indicated by the number of “bars” on the mobile phone screen — no “bars” means no signal.
How phones keep tabs on us
- International Mobile Subscriber Identity (IMSI) is a sequence of numbers and letters assigned to a SIM card. It is a vestige of times when mobile operators tracked the nearest base stations to determine whether you were using your operator’s station or roaming (using another operator’s station). The first part of the IMSI code contains information about your mobile operator, while the rest is a unique identifier for your mobile phone in that cellular network. Law enforcement can determine a mobile phone’s IMSI, captured in less than a second without any notifications. IMSI catchers are typically deployed at large gatherings, allowing law enforcement to later identify attendees, especially those actively encouraging others to join.
Special applications generate traffic reports by monitoring the speed at which your mobile phone transitions between base stations, from one geographic zone to another. The phone number or IMSI itself is irrelevant; what matters is how quickly your cellphone moves between stations. Depending on the time spent at each base station, the corresponding road segment is marked with red, yellow, or green.
- Temporary Mobile Subscriber Identity (TMSI) is a temporary identifier for each subscriber’s mobile station, regardless of whether they made a call or not. Every mobile device transmits a unique code received and recorded by a specific number of base stations. Law enforcement can request (and do request) all this data, including identity information for each subscriber, from the mobile operator. Examining data files from a single base station may only reveal that someone passed by, and their mobile phone signaled that station while in standby mode. If a call was made or data transmitted, the files will also contain records of the call and its duration.
Most mobile devices send signals to three or more base stations simultaneously. By analyzing data files from these stations and comparing the signal levels received, it is possible to accurately determine the phone’s location through triangulation. Thus, your phone, your daily companion, is essentially a tracking device.
Ways to protect data on your phone
Disposable phone
To connect to a mobile operator, you must enter into an agreement and provide your name, address, and passport number. Additionally, if you buy a phone in installments, the bank will check your credit history to ensure your creditworthiness. It’s inevitable.
A sensible alternative is a disposable phone with a prepaid payment system. Frequently changing prepaid phones, for example, weekly or monthly, allows you to remain incognito. Your Temporary Mobile Subscriber Identity (TMSI) will appear in the base station data files and then disappear again. If you maintained secrecy when purchasing the phone, it would be impossible to trace the owner’s identity through it. Prepaid mobile phones are still associated with the user’s account, so the IMSI will be linked to that account. Therefore, the anonymity of the subscriber depends on how the person acquired this disposable phone.
For illustration, let’s imagine that when purchasing a disposable phone, you managed not to leave any traces that could lead back to you. You followed all the recommendations from the previous chapter and asked someone not associated with you to buy the phone for you with cash. Can such a phone really remain untraceable? In short, no.
Contrary to what most people think, disposable phones are not entirely anonymous. According to the U.S. Communications Assistance for Law Enforcement Act (CALEA), information about IMSI identifiers associated with disposable phones is transmitted to law enforcement agencies just like the IMSI of regular subscribers. In other words, a law enforcement officer can identify a disposable phone as easily as a regular mobile phone. Of course, the owner’s identity cannot be determined solely based on the IMSI, but the owner can voluntarily reveal themselves.
Certainly, you can use only a disposable phone. In this case, you will have to anonymously purchase additional time from time to time using prepaid cards or bitcoins. This can be done by connecting to a public Wi-Fi network, changing the MAC address of the network card, and avoiding surveillance cameras. Alternatively, you can pay a stranger to buy you additional time in some remote store for cash. It will be more expensive, and there may be certain inconveniences, but you will have an anonymous phone.
Despite its apparent novelty, mobile communication has been around for over forty years and, like landline telephony, relies on outdated technologies, making it vulnerable from a privacy standpoint.
With each successive generation, mobile communication has gained new capabilities, primarily related to more efficient and faster data transmission. The first-generation mobile phones, or 1G, became available in the 1980s. These initial 1G networks and phone devices used analog communication and relied on several different standards. In 1991, second-generation mobile communication (2G) emerged. 2G communication combined two standards: Global System for Mobile (GSM) and Code Division Multiple Access (CDMA). It also included the Short Message Service (SMS), Unstructured Supplementary Service Data (USSD) service, and several other fast data exchange protocols that still exist today. Currently, we use 4G/LTE communication, and 5G is coming soon.
Regardless of the generation of communication (2G, 3G, 4G, or 4G/LTE) supported by a specific mobile operator, it invariably relies on an international set of signaling protocols known as the Signaling System, or SS7 (Common Channel Signaling). The Signaling System (currently in its 7th version) ensures the continuity of mobile communication as you travel on the highway and move from one base station to another. It can also be one of the tools for tracking. SS7–7 handles all call routing tasks excellently, including:
- Establishing a new connection for a call.
- Interrupting this connection when the call is completed.
- Billing the party making the call.
- Managing additional features such as call forwarding, displaying the name and phone number of the calling party, three-way calling, and other intelligent network services.
- Free calls to 800 and 888 numbers and paid calls to 900 numbers.
- Wireless communication services, including user identification, data transmission, and mobile roaming
Exploiting the vulnerability of SS7 allows not only the determination of a mobile network subscriber’s location anywhere in the world but also eavesdropping on phone conversations. If real-time connection interception is unsuccessful, conversations and transmitted text messages can be recorded in encrypted form and decrypted later.
The entire system is only as secure as its weakest link. Despite advanced European and North American countries investing billions of dollars in creating relatively secure 3G and 4G networks, they still rely on SS7 as the primary protocol.
SS7 is responsible for establishing connections, billing, call routing, and information exchange. This means that if you gain access to SS7, you can control the call. SS7 allows a hacker through an obscure mobile operator somewhere in Nigeria to connect to calls in Europe and the USA. Additionally, SS7 has features that enable remote monitoring of users.
You might think that encrypting cellular phone conversations is sufficient for privacy. Starting from the 2G generation, connections in GSM phones are encrypted. However, the initial encryption technologies in 2G networks were unreliable and did not live up to expectations. Unfortunately, the cost of transitioning from 2G to 3G communication was disproportionately high for many operators, so outdated 2G standards were widely used until 2010.
In the summer of 2010, a group of researchers broke down all possible encryption keys used in 2G GSM networks and reworked the obtained figures into a so-called rainbow table — a list of precomputed keys and passwords. They published this table for mobile operators worldwide to see how vulnerable the encryption in 2G GSM networks was. Every packet (or data block transmitted from sender to receiver) of voice, text, or other data sent over 2G GSM networks could now be decrypted within a few minutes using the rainbow table. It was a harsh lesson, but scientists deemed it necessary and pushed operators toward change.
It’s important to note that 2G communication is still supported, and operators are considering selling access to their old 2G networks for “Internet of Things” (IoT) devices — so-called smart devices (devices connected to the internet, excluding computers — e.g., TVs or refrigerators) that transmit data only occasionally.
Landline phones
Of course, wiretapping existed even before the proliferation of mobile devices. While an increasing number of people are transitioning to mobile phones, many still haven’t abandoned landline phones out of habit. Others use so-called IP telephony (VoIP), i.e., telephone communication over the Internet, which can be conducted through wired or wireless internet connections from home or the office. Whether it’s a physical telephone company switch or a virtual one, law enforcement has the ability to wiretap phone calls.
The 1994 Communications Assistance for Law Enforcement Act (CALEA) requires telecommunication equipment manufacturers and service providers to modify equipment so that law enforcement can wiretap the line. In other words, under CALEA, theoretically, any call made on a landline phone in the U.S. can be wiretapped. According to new amendments to CALEA, law enforcement authorities do not always need a court order for wiretapping. However, legislation still prohibits ordinary individuals from wiretapping others’ phone calls.
How can one talk about invisibility when using a landline phone, which seems to be designed for surveillance? Not at all, unless you buy special equipment. For true paranoids, there are specialized landline phones that encrypt all voice communication over wired connections. These devices effectively address the issue of intercepting private phone conversations, but only if used by both parties; otherwise, the phone connection can be wiretapped without any issues. Others can avoid wiretapping using specific techniques.
The transition to digital telephony made intercepting phone calls easier, not the other way around. Now, if it’s necessary to wiretap a digital communication line, it can be done remotely. The switching computer simply creates a second, parallel stream of data without the need for additional equipment. Moreover, it’s much harder to determine whether a specific line is being wiretapped. In most cases, such wiretapping is only discovered by chance.
In practice, law enforcement intercepts all voice and text messages transmitted through any cellular network using the Remote Control System (RES), the digital equivalent of analog channel wiretapping. When the subject under surveillance makes a call on a mobile phone, RES creates a second data stream through which information is directly conveyed to law enforcement personnel.
But even when using a digital phone, you can still become invisible.
IP Telephony (VoIP)
In addition to mobile and outdated landline phones, there is a third option for telecommunication — IP Telephony (Voice over Internet Protocol or VoIP). This is a great option for wireless devices that do not come equipped with the ability for phone calls, such as the Apple iPod Touch, for example. VoIP has more similarities with internet browsing than making a traditional phone call. While landline phones require a copper cable, mobile phones operate through cellular network base stations. VoIP simply transmits your voice over the internet — either through a cable or a wireless internet connection. VoIP is also available on mobile devices like laptops or tablets, regardless of whether the device supports cellular networks.
For cost-saving reasons, many people at home and in the workplace have subscribed to VoIP systems provided by internet service providers or telephone companies. To transmit voice signals, a “twisted pair” or “optical fiber” cable is required — the same type used for streaming video and high-speed internet.
The good news is that encryption is applied in VoIP systems, particularly something called SDES (Session Description Protocol Security Descriptions). The bad news is that the SDES method itself is not very secure.
Part of the issue with SDES is that the encryption key is not transmitted via the cryptographic SSL/TLS protocol, which ensures secure data transmission. If the other party does not support SSL/TLS, the key is sent openly. Instead of asymmetric encryption, symmetric encryption is used, meaning the sender must somehow communicate the generated key to the recipient for them to decrypt the phone connection.
What happens when using Skype or Google Voice? New keys are generated for each new connection, but these keys are transmitted to Microsoft and Google, respectively. This doesn’t inspire much trust if privacy during the conversation is crucial.
Fortunately, there is an option for end-to-end encryption when using VoIP on a mobile phone.
Open Whisper Systems developed the Signal app, a free and open-source IP telephony system for mobile phones. It allows Android and iOS users to effectively secure phone conversations using end-to-end encryption.
The main advantage of the Signal app is that the keys are held only by the caller and the receiver, without the involvement of any intermediaries. In other words, similar to the SDES situation, new keys are generated for each call, but the keys exist in a single instance and are stored only on users’ devices. The Communications Assistance for Law Enforcement Act (CALEA) grants law enforcement access to information about each specific connection, but in this case, they would only see encrypted traffic, which is entirely uninformative. The developer of the Signal app, the non-profit organization Open Whisper Systems, does not have these keys, so seeking them with a court order would be futile. The keys are only stored on the subscribers’ devices and are destroyed at the end of the connection.
Cryptography from “Open Whisper Systems” in the form of end-to-end encryption using the “Signal Protocol” is implemented in the following applications:
- Since 2015 in the WhatsApp messenger, and as of April 5, 2016, the entire traffic of a billion messenger users has been protected by its end-to-end encryption algorithm “Signal Protocol” ².
- Since 2016 in the Google Allo messenger, if you enable the “incognito mode” ³.
- Since October 2016 in the Facebook Messenger application ³.
- Since January 2018 in Microsoft’s Skype applications on iOS and Android, in test mode as the “Private Conversation” option ⁴.
Currently, the Communications Assistance for Law Enforcement Act (CALEA) does not apply to end-users or their devices.
You might think that encryption will cause your mobile phone to discharge faster. It will, but not significantly. The Signal app sends push notifications to users, similar to WhatsApp or Telegram. Therefore, you will only be notified of incoming calls, minimizing battery consumption. Additionally, Android and iOS apps use audio codecs and buffer management algorithms specific to cellular networks, so again, encryption will not significantly drain the battery during a call.
In addition to end-to-end encryption, the Signal app also implements Perfect Forward Secrecy (PFS). What is PFS? It is a feature that ensures the encryption key for each subsequent call will differ slightly from the previous one. If someone gains access to your specific encrypted phone connection and encryption key, they won’t be able to eavesdrop on all your future connections. The foundation of all keys remains the original key, but if someone acquires one key, it does not mean that a potential intruder can listen to all your future conversations.
NYM
NYM is a project developing a decentralized network to protect metadata and communication patterns on the internet.
- Metadata refers to data about data, such as who, when, where, and how one communicates with others.
- Communication patterns include recurring or typical ways of communication, such as the frequency, duration, or subject of calls.
These data points can be exploited for tracking, censorship, manipulation, or discrimination against users.
VoIP is a technology that enables voice and video calls over the internet using IP protocols. VoIP applications like Skype, WhatsApp, Telegram, and others are popular among users looking to save on phone calls or communicate internationally.
However, VoIP applications don’t always ensure an adequate level of user privacy and security. Some may collect and analyze metadata and communication patterns to create user profiles for sale to advertisers or governments. Others may use weak or outdated encryption methods vulnerable to hacking. Some may face censorship or blocking by internet service providers or regulators.
Hence, there is a need to integrate NYM with VoIP to encrypt calls through a Mixnet. A Mixnet is a network consisting of multiple layers of nodes that mix and delay data packets to hide their source, destination, and content from observers. NYM uses a Mixnet to provide anonymity and protect metadata and communication patterns for any applications connecting to its network.
The integration of NYM with VoIP for call encryption through Mixnet can be implemented as follows:
- Install one of the Nym clients, such as Nym Connect or NymVPN, allowing connection to the Nym network and sending/receiving encrypted data packets through the Mixnet.
- Choose a VoIP application supporting integration with Nym, such as Signal, Wire, Telegram, or Jitsi, which employ modern and reliable encryption methods to protect call content.
- Configure the VoIP application to use the Nym client as a proxy server, redirecting the application’s traffic through the Nym network and encrypting/mixing data packets at each layer of the Mixnet.
- Make and receive calls through the VoIP application, enjoying a high level of privacy and security provided by the integration with Nym.
Connecting NYM to Telegram on Windows:
- Step 1. Download NymConnect from the official website https://nymtech.net/download/nymconnect, install, and launch it.
- Step 2. In Telegram, go to Settings → Advanced → Connection type → Use custom proxy. Add a new proxy server of “SOCKS5” type and enter the address and port of the proxy server from NymConnect. Save the settings.
This integration option can offer several advantages for users, such as:
- Reducing the risk of tracking, censorship, manipulation, or discrimination by third parties interested in obtaining or blocking metadata and communication patterns.
- Increasing freedom and self-expression, allowing users to communicate with anyone, anywhere, and anyhow without the fear of being eavesdropped, interrupted, or identified.
- Improving service quality and support provided by the reputation and incentive mechanism rewarding Nym nodes for their work and penalizing them for improper behavior.
However, this integration option may also have some drawbacks or limitations, such as:
- Increased traffic and battery consumption associated with the use of an additional encryption and mixing layer, requiring more resources and time to process data packets.
- Reduced connection speed and reliability susceptible to delays, losses, or damage to data packets passing through different nodes and layers of the mixnet.
- The need for trust and compatibility between the Nym client and VoIP application, which may have different protocols, standards, or policies influencing the integration’s functionality.
In conclusion, integrating NYM with VoIP for call encryption through Mixnet is one of the possible options that can provide a high level of privacy and security for users but may also have some drawbacks or limitations to consider when choosing and using this option.
Conclusion
- In this article, we explored various methods to ensure the privacy of phone calls, such as disposable phones, IP telephony, and the integration of NYM with VoIP.
- We outlined the advantages and disadvantages of each method, as well as the risks associated with intercepting metadata and communication patterns.
- We provided recommendations on choosing and using technologies that can enhance the level of protection and anonymity for phone calls.
We hope that this article will help you make an informed decision and secure your phone conversations from unwanted interference.
¹ CALEA
² Facebook. WhatsApp Encryption Overview — 4.04.2016
³ Wired. With Allo and Duo, Google Finally Encrypts Conversations End-to-End — 18.05.2916
⁴ Signal. Signal partners with Microsoft to bring end-to-end encryption to Skype — 11.01.2018
