Cops want Apple, Google to kill stolen phones remotely – so why won't they?
- Reference: 1749036490
- News link: https://www.theregister.co.uk/2025/06/04/apple_google_stolen_phones/
- Source link:
Apple phones make up about 80 percent of those stolen
In a one-off evidence session in the House of Commons yesterday, angered Members of Parliament voiced concern that commercial incentives might be behind the tech giant's apparent lack of willingness to comply with calls from the Metropolitan Police, the UK's largest force.
In response, Apple said remotely locking stolen phones after they were stolen or blocking cloud services might create other attack vectors for fraud against legitimate smartphone users. Google said its relationship with customers was through its cloud accounts, not the device.
Speaking before a committee of MPs, Darren Scates, Met Police chief digital data and technology officer, said about 80,000 smartphones were reported as stolen in London alone in 2024, up from 64,000 in 2023. Apple phones make up about 80 percent of those stolen, while estimates suggest the replacement value of stolen phones is £50 million ($67 million) a year, he said.
After they were stolen, most of the devices are collected, distributed, and resold by criminal gangs. About 75 percent were moved abroad – the prime destinations being Algeria, China, and Hong Kong, Scates said. Data showing where stolen phones end up comes from the police working with phone providers and a sample of IMEI (International Mobile Equipment Identity) numbers – a unique 15-digit serial number assigned to every mobile device – known to belong to stolen devices provided by the police. Scates said the IMEI number could allow stolen phones to be blocked at a network level under an agreement by members of the GSMA industry association, representing only 10 percent of global phone networks.
[1]
"We're asking – and it's being considered by Apple and Google – [for] an international cloud-level [block]. They actually stop smartphone serial numbers [being allowed] to connect to their services if it's reported as lost or stolen," he told Parliament's Science, Innovation and Technology Committee.
[2]
[3]
Security experts suggest that an orchestration layer could use the IMEI to take stolen phones out of action globally after they have been unlocked and wiped by criminals, effectively slashing their resale value and the incentive for theft.
Trustonic provides such a layer for private companies, including smartphone supply chain distributors, financiers, and retailers. Dion Price, chief executive, told the committee that the company could control 11 different locking technologies from smartphone manufacturers. However, devices needed to be registered with the platform when they were first turned on and in a "ready-to-lock" state.
[4]
"You have to capture the devices at first turn-on," he said. "The devices that are on the street right now, because they've never been registered in any of those systems, they're subject to the locking technology in the market today. We receive a manifest of IMEIs, we ingest them into the system, and then throughout their entire life – it doesn't matter what happens to that device. If we get the signal from the legitimate owner of that device, then we can lock or unlock it within 30 seconds anywhere in the world."
Price suggested that a regulator or new government body could create such a system based on the IMEI numbers of all phones imported into the UK, since the data was already collected for trade and tax purposes.
He pointed out that when stolen phones are reconnected to cloud services, the provider gets a revenue stream. "If the new end consumer wants to leverage any content, any cloud services, any entertainment services, then obviously that's a revenue stream [for Apple]. Same goes from a Google Android perspective," he said.
[5]
Select committee chair Chi Onwurah, a Labour MP who has previously worked as an engineer in the telecoms industry, pointed out that phone providers also benefit from the value of replacement phones where "a significant portion of that is actually paid for by insurance companies."
Addressing phone providers, she said: "The Metropolitan Police desire to be able to switch off phones from contact with your cloud services given the specific IMEI. I don't understand, speaking as a telephone engineer myself, why you can't do that."
Gary Davis, global senior director for privacy and law enforcement requests at Apple, said MPs should look at the issue "in relation to all the protections we have in place," at which point the committee members laughed, perhaps in frustration.
[6]Apple has only 30 days to comply with EU DMA rules
[7]Google, high on AI, flogs Gemini for all things
[8]Google brings better bricking to Androids, to curtail crims
[9]Cops developing Ghostbusters-esque weapon to take out e-bike thugs
Davis continued, saying using the IMEI to lock the phone or block cloud services could create other fraud vectors.
"People will try and pretend a phone is something else on occasion. So we will then make a decision as to whether to activate the device or not. In conjunction with the carriers, we worry, and we have had these discussions with the Met, that there is a vector for fraud.
"We see extensive fraud attempts. Every month, over 1,000 people try to imitate you, me, other people here to seek data from us and to delete your accounts. They do it for malicious purposes. They do it in order to then maybe blackmail you. We see these attack vectors on an ongoing basis, and I would like to think, in an area such as this, that our expertise built up over time in relation to attack vectors would mean something. I'm not saying we're opposed to [IMEI blocking] at all [but] I would wish to see that assessed in the context of all the other protections we have in place."
Committee member Kit Malthouse, a former policing minister, said: "The concern is that it feels to a lot of people like you're dragging your feet … and that sitting behind this is a very strong commercial incentive, right?"
Davis responded: "I think it's a little unfair. It is necessary for me to refute the suggestion that we somehow benefit from our users suffering the traumatic event of having their phones stolen and being disconnected from their lives. We have invested many hundreds of millions [of dollars] in designing in protections."
Simon Wingrove, software engineering manager at Google, said Android devices can be blocked from accessing the cloud services after they are stolen. "The mechanism is slightly different, but that facility already exists. If you go into the Find My Device app and you lock or wipe the device, at that point, you're blocking and doing that. The victim of the theft would do that."
He said the action would stop criminals from accessing a victim's Google account and cloud services like Google Photos, Google Drive, or Gmail, but it was unclear if the stolen phone could be used to access other Google accounts created by the new "owner" after it was stolen, unlocked, and reset.
Onwurah asked: "Why can't you do what the Met Police is asking for, which is to block it on the basis of the IMEI?"
Wingrove explained that the IMEI is connected to the cellular modem of the device and is a construct from the telecom industry. "The IMEI is actually the identifier for the business relationship that the carrier has with the victim of theft. The IMEI represents that relationship. Our relationship with the user is through the Google account," he said. ®
Get our [10]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aEBtiWF8XQteZ4_g4EUwyQAAAtY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aEBtiWF8XQteZ4_g4EUwyQAAAtY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aEBtiWF8XQteZ4_g4EUwyQAAAtY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aEBtiWF8XQteZ4_g4EUwyQAAAtY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aEBtiWF8XQteZ4_g4EUwyQAAAtY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2025/05/29/apple_has_only_about_30/
[7] https://www.theregister.com/2025/05/20/google_high_on_ai_flogs/
[8] https://www.theregister.com/2024/10/08/google_android_security/
[9] https://www.theregister.com/2024/05/14/ghostbuster_ebike_weapon/
[10] https://whitepapers.theregister.com/
> My iphone gets nicked, so I buy a new iphone. The stolen iphone gets sold on and the new iphone owner buys apps and accessories from Apple.
But what about those phones that get stripped for spares? Think of the money Apple *loses* when repairs are done cheaply by 3rd parties.
(Warning: post may contain irony.)
So the IMEI is now be supposed to be somehow transmitted into "the cloud"?
A) Is this supposed to become a Lex Apple or will "the cloud" be defined for every vendor differently?
B) What a gift for privacy-invading PII-resellers ...
Re: So the IMEI is now be supposed to be somehow transmitted into "the cloud"?
I had the same thought.
What the hell is he talking about?
Re: So the IMEI is now be supposed to be somehow transmitted into "the cloud"?
no, it's still written in a ROM at the factory and can't be modified easilly.
Chagig the IMEI means that you eed to locate the right chip, unsolder it, transfer all it's content, except the IMEI, on a new chip, put in that new chip the IMEI you want, solder the new chip...
So not something that can be done in a hurry.
IIRC 30+ years ago, when GSM (2G) was brand new IMEI blocking was sold as the way to make sure your phone couldn't be used by a thief... and all the operators told you to keep that number around and give it to the police so that they could send it to the operators for blocking.
Do the opposite
Whatever the cops want, don't do it. Never is the span of history have cops been on the right side of it.
Re: Do the opposite
In this case, they are extremely strongly on the right side. If a device is stolen, with a police report to indicate this, brick it. But the manufacturers (who make money off of people buying replacements) don't want to do this.
Re: Do the opposite
Try reporting a stolen car or bike to UK police.
They jot down the details and then ignore it.
So we are expected to believe that the police are wanting to put resources into deterring phone theft?
What the UK gov wants (ok, what MI5 and the Met want) is a mechanism in place to remotely disable people's phones. Going to a Greenpeace demo? The ISMI catchers will capture all the IMEIs within a radius and those phones will be suddenly disabled as the kettle is being put in place. End of text-based demo management, end of camera functionality.
I don't think Apple or Google (except in relation to the Pixel) should be responsible for this. At least some mobile handset manufacturers already implement remote locking technology like Samsung's Knox. I imagine Apple have something similar and Google Pixel has something similar too. Cheapo brands might not but they could do and if the government wanted to make it mandatory they could.
I imagine Apple have something similar
They offer "Lost Mode", which means that (if Find My Phone is turned on), when the phone contacts Apple, it is put into Lost Mode.
IME blocking is something done by network providers, and would require Apple to work with network providers. They don't do that. Apart from people who want to have Apple phone tracking turned off, I don't know if it would have any advantage.
Telecos from many countries already use an international stolen IMEI blocklist. If there were a problem with this as Apple and Google maintain, we'd have seen it by now.
There are several problems with it, but none of them are the ones mentioned by Apple and Google.
The main one is that - outside of Europe and North America - not many operators are signed up to use it. This is slowly being addressed.
A secondary issue is that most of the operators who are signed up only use blocklists for device stolen in their own country - so if you export the stolen device, it works again.
A third is that while the IMEI is usually stored in write-once memory on the device, it has to pass through layers of rather less secure software before it reaches the network. Intercepting and changing the IMEI is illegal in the UK. But so is stealing the phone.
And so on....
That said, it is a relatively simple way of making life more complicated for purveyors of stolen phones. It's far from watertight though.
you can't really change the IMEI, even with software... Since it has to be part (in one form or another, nowadays in 5G only something encrypted derived from IMEI and the IMSI is sent [I won't go in more details, you can read the 3GPP specs] ) of the first messages exchanged by the phone to connect to a PLMN.
Maybe...
.. governments should actually do their job and have rigorous enough policing to prevent theft and catch those that do it, and adequate punishment and rehabilitation for those caught.
It'll never happen.
Re: Maybe...
> .. governments should actually do their job and have rigorous enough policing to prevent theft and catch those that do it, and adequate punishment and rehabilitation for those caught.
In other news, I'm looking forward to receiving a refund for the costs of locks on my doors and windows...
Nice non sequitur there...
Onwurah asked: "Why can't you do what the Met Police is asking for, which is to block it on the basis of the IMEI?"
Wingrove explained that the IMEI is connected to the cellular modem of the device and is a construct from the telecom industry. "The IMEI is actually the identifier for the business relationship that the carrier has with the victim of theft. The IMEI represents that relationship. Our relationship with the user is through the Google account," he said
Yeah, Google accounts in no way have any relationship to the device on which they're used. My device's operating system has no relationship to Google, and Google clearly have no way of knowing the IMEI number of the device I'm using the account on. How could they possibly lock it out of their cloud services at a platform level when reported stolen?
MPs pass dumb laws like the Online Safety Act that try to turn behavioural problems into technology ones, and yet here we have a clear-cut case where the technology exists and could be applied with relatively little effort - just legislate for it!
Re: Nice non sequitur there...
All phones' OSes have access to the phone's IMEI - having the OS check online if the IMEI is on a block list is not rocket surgery
Re: Nice non sequitur there...
The network itself checks that when you try to connect to a telecom network. It's part of the built in stuff that's been there sinnce 2G.
To be allowed on a mobile network the terminal equipment ( parse that as phone ) has to send the IMEI and the IMSI in one form or another depending if it's 2G/3G/4G or 5G.
That's how $TELCOs SIM-Locked phones when SIM-Locking was a thing. They were checking the IMEI and the IMSI and if the phone IMSI was not matching with the Phone IMEI in the database they didn't authorize the phone on the network.
Re: Nice non sequitur there...
It is also a false statement. The IMSI identifies the subscriber, the International Mobile Equipment Identifier or IMEI identifies the specific device independently of SIM card, IMSI or anything else tying the subscriber to the carrier.
I thought it was a crime to lie to Parliament.
Fat-Fingered DoS
The same potential issue exists with CompuTrace and other BIOS/IP-style remote laptop erase/disable services: Freddy/Fanny Fatfingers at CompuTrace (or whomever) can wipe or brick the wrong device when they're typing the reported-as-stolen device's MAC address into their control computer.
People and businesses have to weigh whether that risk is less or more than risk of data on their stolen laptops being potentially accessed/copied/sold, and that's why it is an option , not a requirement.
Same reason as everthing
"I don't understand, speaking as a telephone engineer myself, why you can't do that."
Greed, they profit from the crimes. They can do it, but it will hurt their income.
BUT - I can guarantee you if a goog or apple executive's phone gets stolen, it will be blocked and tracked down using the IMEI. But you and me,, nooooo, we are the cattle, not the farmers.
Milk us, butcher us, that's all we are to them, something to squeeze for profit.
Re: Same reason as everthing
We are less than cattle. We are livestock feed.
The livestock are small companies and start-ups that are bought after reaching harvest size, er, a certain market status. We are the suckers, er, punters, that feed their growth until slaughter, er, damn, I mean market buy-out or IPO size.
Restrictions but 999
They could disable the phone except to 999 and then if it was a mistake or hacking it would be easily straightened out.
Re: Restrictions but 999
I don't think 999 would want to be dealing with admin mistakes. But you could allocate another number.
Of course, then you have to staff it (across all languages and timezones, as these phones are shipped abroad), and then deal with all the crims calling and claiming they've accidentally disabled their own phone.
apple does this already?
Had to look it up as I specifically remember reading articles saying police said drops in apple theft following them making some change like the one requested in the article.
Apparently that change was activation lock. Can't tell when it was put in the news article I just saw was dated 2021 but references 2013 which sounds more reasonable.
Perhaps it assumes the user has to do something special to enable it. I did read an article on how to disable it seems in some cases you can use specific DNS to bypass it (seems simple for apple to block that workaround if they want). Then you can file a claim with apple to justify that you are the proper owner. They can deny the request(they could just flat out not allow appeals if they want). I'm sure it causes headaches for some legitimate sales of incorrectly prepared devices that are sold.
Doing something more extreme seems likely to cause more headaches. Maybe the police or someone can explain why activation lock isn't good enough. At the time it was expected that the feature would render such devices as useful as spare components only.
Re: apple does this already?
Activation lock, and you don't have to do anything special. As long as you have signed into iCloud, it's on by default and will prevent anyone else from activating that iOS/macOS device, even if they wipe it. if you to the DNS bypass thing, you can activate it can't ever sign into iCloud with your own account or it will lock down again.
This does not prevent stolen devices from being chop shopped, nor does IEMI lock.
It occurs to me that a phone that was verifiably inside the UK, when reported stolen, and which is now located outside the UK - is almost certainly stolen. That's a "tell".
Another characteristic sign is that the phone will be factory reset and a new account installed.
Combine both of these, and it should be safe to shut down. Once a phone with a mark against it is moved outside the UK and has had a factory reset, then any attempt to associate it with any cloud account, except the one it was previously associated with, should be made to fail.
Talking to the wrong people
Surely it's the network that has access to the IMEI. I don't use any Google services on my Android and don't see why they should have the IMEI even if I did.
Numpties.
Gary Davis, global senior director for privacy and law enforcement requests at Apple,....said.... 'It is necessary for me to refute the suggestion that we somehow benefit....'"
My iphone gets nicked, so I buy a new iphone. The stolen iphone gets sold on and the new iphone owner buys apps and accessories from Apple. In many cases the owner of the new iPhone will end up lockedi in the Apple ecosystem and buy more Apple stuff. Apple makes extra money three ways from my phone getting nicked, so it's clearly not neccesary for Davis to refute the fact that Apple benefits from thefts. The committee should have done more than laugh at him, they should have called him out for the liar that he is.