How To Predict If Your IoT Device Will Steal From You

Sometimes making your wide area IoT device truly “wide area” isn’t as easy or as safe as it looks. One blind spot for many IoT technologies: roaming. Here’s a story about a non-profit group that tracks the migratory patterns of birds and found itself victim of a costly mobile IoT device theft:

According to official broadcaster Radio Poland, the environmental EcoLogic Group placed a tracker on the back of a white stork last year to track the bird’s migratory habits.

It travelled some 3,700 miles (6,000kms), and was traced to the Blue Nile Valley in eastern Sudan before the charity lost contact.

EcoLogic told the Super Express newspaper that somebody found the tracker in Sudan, removed the sim card and put it in their own phone, where they then racked up 20 hours’ worth of phone calls.

Radio Poland says that the organisation has received a phone bill of over 10,000 Polish zloty ($2,700; £2,064), which it will have to pay.

As mobile IoT use cases go, animal tracking in most cases is compelling both in terms of its financial return as well as its environmental benefits. From altrustic examples like tracking storks in order to better understand the spread of West Nile virus to tracking the location of billions of farm animals around the world to improve productivity, the business opportunity is attractive to IoT hardware developers and the data that can be collected is coveted by ranchers, buyers, regulators, investors, law enforcement, and others.

Until recently, animal tracking over wide area wireless area networks has remained effectively unsolved due to the high cost of cellular service, large device form factors, and poor battery life. Some short range RFID solutions provide a type of chokepoint visibility, but longer range/lower power/lower cost wireless networking technologies, as I’ve discussed here and here, are in the early stages of breathing new life into wide area animal tracking.

But as those things being tracked/monitored begin moving over wider and wider areas, the issue of network coverage becomes more serious: if my device strays outside of its “home” network — whether private network or public network — what is the best way to borrow connectivity from other networks?

Lessons From Cellular

In the mobile handset business as well as other mobile data businesses, this borrowing of connectivity is known as “roaming”. Carriers make roaming agreements with your carrier and charge your carrier for the right to connect on their network. When roaming, your phone’s right to roam in another’s territory is authenticated using a private key embedded in a SIM card inserted into your phone. Billing matters are pre-arranged between your home network and the partner network. Basically, SIM’s are/were a necessary evil for mobile phones for a range of reasons including but not limited to roaming, but the constant with mobile phones is they are tied to human users who will (usually) detect a missing handset within minutes or hours, report it lost/stolen, and generally mitigate the kind of fraud charges we see in the Hijacked Stork incident above.

But wide area mobile IoT devices are different. By definition, they (frequently) operate remotely and away from the beneficial owner or user. Detecting a stolen mobile IoT device may not be obvious and using the Hijacked Stork as an example, the GPS location of the fraudster making phone calls might appear on a map the same as it would for the stork.

For owners or operators with multiple (even thousands) of devices, the risk of a stolen SIM is compounded by orders of magnitude.

But as the Lesson of the Hijacked Stork illustrates, this is risky business for LPWAN vendors. If your mobile LPWAN device supports fully bi-directional communications and public key cryptography, the risks of the theft of a SIM card can be mitigated or eliminated via SIM-less roaming. But for those of you out there experimenting with SIM-based mobile LPWAN devices like this one, it’s probably worth asking your engineering team if they are really going to deploy a SIM card with it and if so, if they are fully aware of the risks.

Maybe The SIM Is Not Such A Great Idea for the Mobile IoT

Adding a SIM to a mobile IoT device is a bad idea for many reasons, but here’s a really basic one: adding a SIM to an IoT device increases deployment costs:

“Today almost every M2M device includes a SIM card. The cost of procuring the SIM card for an M2M application, getting someone to physically put it in the SIM card slot and then verify the network connection usually costs upwards of $25. As the same engineer is probably also physically installing the device, which takes 30 minutes or more, that’s lost in the overall installation costs, so no-one really appreciates it. But the prospect of tens of millions of SIMs being fitted into devices every day to get to our tens of billions is a non-starter. The IoT needs products which are taken out of a box, turned on and just connect and work. For LTE-M that means eSIMs, which are still only supported by a few networks. Both cellular and LPWAN networks need ways to register devices automatically, so manufacturers can buy services for multiple units which they pre-provision.”

So before we even get to the security risks of a SIM in a LPWAN device, the simple addition to total cost of ownership should be enough to shake your head.

SIM cards are de rigeur for wireless carriers, so you shouldn’t be surprised to hear that NB-IoT and LTE CAT-M devices are using them. Here is AT&T’s LTE-M “starter kit” and here’s Vodafone’s NB-IoT version of the same. The state of carrier IT and billing systems leads me to predict that carriers will not be quick to abandon SIM cards for IoT devices, mobile or fixed.

If you want to predict whether your IoT device will “steal” from you, you can raise the probability by a huge margin if the device includes a SIM card. The theft could be overt, a la the Hijacked Stork, or more subtle, as in the hit to TCO. The SIM has its uses in mobile telephony but its use in IoT devices, particularly mobile IoT devices, is a stopgap whose time has passed. Bring on the SIM-less IoT devices.

Next post: Options for SIM-less wide area IoT systems.