Wireless Carriers Can Now Catch Police Spying on their Networks

Researchers at SBA Research in Vienna have teamed up with T-Mobile Austria, a fully-owned subsidiary of Deutsche Telekom, to study whether the use of electronic surveillance devices known as IMSI catchers, commonly used by police and government agencies around the world to spy on cellular networks, can be detected. Turns out it’s actually possible to tell when police use this surveillance technology, CBC News reports.

Cell tower generic

For those who aren’t aware, IMSI catchers, which have been deployed in law enforcement vehicles and even airplanes, masquerade as legitimate cellphone towers so that cellphones in the device’s immediate geographic area are tricked into connecting to the fake cell tower instead.

According to the researchers, who presented their paper at a computer security conference in France in September, a wireless carrier’s network monitoring systems can look for tell-tale signs that an IMSI catcher has been used.

“We want to protect our frequency spectrum, which is quite expensive,” said Georg Petzl, T-Mobile Austria’s chief security officer, and one of the study’s co-authors. “To make sure that customers’ service quality is not lowered, you need to be able to say ‘this was an incident happening on our network’ and ‘this was a misuse of the frequency.'”

The researchers tested various makes and models of phones to see how each behaved after disconnecting from a makeshift IMSI catcher. They used the results to identify a common set of criteria, of varying degrees of reliability, that a network operator could use as evidence suggesting an IMSI catcher had been used. “Our results show that detection from the operator side is possible,” the researchers wrote.

However, due to limitations in T-Mobile Austria’s monitoring systems, the researchers were only able to monitor a single area of coverage, although they have suggested modifications that would make real-time detection possible across the whole network.

Christopher Parsons, a research associate at the Citizen Lab, part of the University of Toronto’s Munk School of Global Affairs, said “As far as I know, some Canadian carriers are investigating their ability to detect these devices,” but declined to provide specific names.

When CBC News reached out to carriers, only Bell responded with a statement to say “the use of IMSI catchers is illegal in Canada. We don’t publicly disclose the measures we take to ensure the security of our networks.” Rogers declined to comment, while Telus and Videotron did not respond.