Blocking stolen phones from the cloud can be done, should be done, won't be done
- Reference: 1749465247
- News link: https://www.theregister.co.uk/2025/06/09/opinion_column_blocking/
- Source link:
The fear of our mobile devices not working when we need them most is [1]leaking into dreams , joining public nudity and disastrous lateness in our cinema of sleep's horror bill.
Now, the UK's powers-that-be want to make that nightmare a reality for criminals who perpetrate that other modern misery, phone theft. They need Apple and Google to help out, but that dream team doesn't want to.
Cops want Apple, Google to kill stolen phones remotely – so why won't they? [2]READ MORE
Before delving into the corporate psychology underlying this antisocial psychosis, we must get some facts in order. All mobile phones have an IMEI, a unique International Mobile Equipment Identity burned into them much as every vehicle has a Vehicle Identification Number (VIN) tattooed into its chassis – to prevent fraud. You can replace and respray a stolen motor, but if the VIN is on the list of hot motors, then it can be spotted during an inspection. Likewise, a snatched phone's IMEI can be blacklisted on cell networks, stopping the device from connecting. This means a stolen phone has little resale value and little attraction to thieves.
Which would work really well if two things were true: that there was a single universal IMEI blacklist and all carriers used it. Neither is the case. Lots of carriers do use a variety of blacklists, some with considerable reach, but enough exceptions exist to provide healthy export markets attractive to gangs around the world. A working device means operator revenue, no matter where it came from. Imagine trying to get gas stations to install pumps that have to validate a VIN before opening the taps, but not making it a legal requirement.
[3]
Yet the cell networks are only part of what makes a device useful. Cutting off access to Apple and Google from stolen devices makes them virtually useless anywhere. Extend IMEI blocking into the cloud, and the job's done. It would even cripple phones working as Wi-Fi devices; you can get around not having any Apple or Google services, but this isn't viable if you're after a cheap smartphone.
[4]
[5]
Apple and Google just don't wanna, for reasons so specious they'd make a toddler blush. Apple says it's fine with the idea in theory, but it knows all about online security and IMEI blocking would encourage blackmail. How? Apple knows these things, because it's Apple and spends so much money on security. Pick the logic out of that if you can. Google can't even be bothered to come up with a reason beyond "IMEIs are a special bond between carriers and subscribers, and that's the way it has to be." It doesn't go as far as saying "because it's written in the Bible," but only because it couldn't find a Biblical scholar to creatively interpret a verse or two.
The real reasons are easy to speculate about, akin to the non-blocking network operators, but with added cynicism. Every device connected to a cloud service means revenue, and the existence of an effective afterlife for stolen phones is the equivalent of an entire international aid effort seeding modern smartphones lacking modern services into places that couldn't afford them otherwise. Think Microsoft's studied ambivalence towards pirated copies of Windows in poorer markets: owning the ecosystem is far more important than revenue you won't see anyway.
[6]
There's also the danger that a flood of cheap phones that can't connect to your cloud services will encourage the development of others that they can use, especially in regions with good reason to distrust the American tech hegemony. Which, these days, is everywhere outside the 50 states. It doesn't particularly matter how likely this is to be a factor, the mere idea will be enough to dig those big tech heels in. So a few hundred thousand pedestrians will have their phones swiped by a hoodie on an e-bike, with all the subsequent personal and societal pain and cost.
[7]Are you a big AI business vendor making terrible AI business decisions? We can help
[8]AI's enormous energy appetite can be curbed, but only through lateral thinking
[9]Torvalds' typing taste test touches tactile tragedy
[10]Unending ransomware attacks are a symptom, not the sickness
It's unfair to pick on Apple and Google for an attitude so endemic across this and other industries we rarely notice its heft. Fraud, theft, and other crimes associated with digital identity are massively enabled by our daily digital systems whose universality and connectedness make them fertile for good and bad. But if criminals are dedicated to exploiting every weakness in cyberspace, the industry isn't dedicated to stopping them.
Every service provider that relies on digital identities is at risk from identity theft, with the damage to users being far more traumatic than to the organization. Systems against ID theft are piecemeal and heterogeneous, with the burden on the user having to manage multiple systems that can't even agree on the same name for the same thing.
Imagine a federated security system where the user allows different organizations to verify your identity with each other when necessary. You set who talks to whom, creating and controlling multiple verification pathways with no single point of failure. Getting it secure, effective, and usable by everybody would be a considerable challenge needing considerable buy-in but with potentially huge rewards to consumers and suppliers alike. But nobody's trying. A company may invest multiple billions in AI, but not a penny in systematic cooperation towards a proper consumer-focused identity environment. Which option would benefit the most people?
In a world where "don't wanna" is the default answer to a single measure that would cut crime across the world, there is no chance of actual industry-wide proactive cooperative problem solving on behalf of us all.
[11]
There is precious little chance of anyone even calling it out as true corporate sociopathy. The things we should dare to dream are instead the stuff of nightmares. ®
Get our [12]Tech Resources
[1] https://www.reddit.com/r/Dreams/comments/86emqv/cant_use_phones_in_my_dreams/
[2] https://www.theregister.com/2025/06/04/apple_google_stolen_phones/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aEcFFPzqMKv2VkZm9X1jpgAAAcc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aEcFFPzqMKv2VkZm9X1jpgAAAcc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aEcFFPzqMKv2VkZm9X1jpgAAAcc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aEcFFPzqMKv2VkZm9X1jpgAAAcc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2025/06/02/opinion_ai/
[8] https://www.theregister.com/2025/05/27/opinion_column_ai_energy/
[9] https://www.theregister.com/2025/05/20/torvalds_typing_taste_test_touches/
[10] https://www.theregister.com/2025/05/12/opinion_column_ransomware/
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aEcFFPzqMKv2VkZm9X1jpgAAAcc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[12] https://whitepapers.theregister.com/
Re: Nice idea
Sounds like a very expensive plan.
Re: Nice idea
The UK spends £18.6 billion a year on policing, not too much to expect some results, is it?
Re: Nice idea
Why not just make all stolen phones worthless, then the UK police could concentrate their resources elsewhere and people wouldn't get their phones stolen.
Re: Nice idea
"Why not just make all stolen phones worthless"
Call them Windows Phones, that'll make em worthless overnight.
Re: Nice idea
BA DUMP BA!
Re: Nice idea
perhaps if they could keep some of the proceeds of big difficult cases, they might try a bit harder, and there'd be more cash to spend on community policing. Same applies to HMRC too.
Re: Nice idea
Yes, catching criminals is so hard and expensive, let's just give up then.
Re: Nice idea
Yes, catching criminals is so hard and expensive, let's just "give up then"
AHH the either or bullshit arguement.
If you make the phones pretty much worthless, then that crime massively decreases. They then can shift focus to other issues, like stolen vehicles that are stripped and shipped.
There are finite resources.
If this country had half brain, they would actually look at research and massively alter multiple laws (personal possession of drugs, soliciting prostitution, TV licence prosecution, copyright laws)....but they won't because they listen to public opinion, driven by self serving media outlets.
Re: Nice idea
"they won't because they listen to public opinion"
As a public service, isn't this what they should do.
Re: Nice idea
but they won't because they listen to public opinion
The audacity of it, a government listening to public opinion instead of just giving people what's good for them. Can't have that.
Re: Nice idea
"As democracy is perfected, the office of president represents, more and more closely, the inner soul of the people. On some great and glorious day the plain folks of the land will reach their heart's desire at last and the White House will be adorned by a downright moron."
Henry Louis Mencken
Re: Nice idea
And that's what happens in some cases: When criminals make it very dangerous by going armed, the police start wondering if it's really worth risking their lives.
Sure, some police will still try, but they then face public outrage for when things go wrong. And if they have bad intel? They get the wrong person? Then they get a public lynching for their efforts. So they have to take extra care while the criminals don't. Makes it somewhat one-sided.
Add into the mix that the police have to show they're doing something: Meet targets, get arrest numbers... of course they'll focus on the easy cases, the low hanging, and more importantly, SAFE arrests. People who don't intend to break the law generally are sorry for doing so and won't fight too hard, and if they're innocent, well, just bully them into a plea deal so they admit their guilt and that's another success!
BTW: Never accept a plea deal if you're innocent unless it includes a guarantee it won't go on your criminal record and you're okay with the terms. Just because you're told it'll be best for you, or the best outcome, or it'll save you hassle: It could also cost you more than you expect, and wreck your life. So be very, very weary about plea deals and the police going easy on you if you just confess...
"how about the police and justice system work to stop the criminals?"
While I'm right behind the idea of the police actually working for a change, an ounce of prevention is better than a pound of cure. Apple and Google have it in their power to make it no longer worth stealing phones in the first place. Even if the cops had a 100% success rate in finding and returning stolen phones, it would still be a worse experience for the victims than not being victimised at all. And that's before you consider the likelihood that the phone thief might assault their victim as well as grab the device.
Re: "how about the police and justice system work to stop the criminals?"
I think it was the BBC covered this, too, and they noted the reasons why Apple and Google don't want to is: IMEI fraud and spoofing, plus a lot of the stolen phones wind up in places like China that won't honour the block, so it's pretty pointless.
There was also the suggestion they simply brick the phone (send a signal that'd stop the phone from working) except any such attempt can be circumvented, and it would also open up extortion rackets where criminals could threaten to block your phone unless you pay up. Considering what we have on our phones these days... that could be real inconvenient.
So it's not simply Apple and Google being lazy: They might even have a point as to why blocking phones outside of the current approach would be bad.
Re: Nice idea
"actually have some coppers on the street"
Proven not to work, but keep going with this Daily Mail nonsense...
What the police actually do about theft is try to find the people who buy the phones and ship them out of the country, because it's basically impossible to catch every little scrote committing minor property crimes.
Re: Nice idea
Complex problems need to be addressed by multi-tiered solutions, where the problem needs to encounter the cheapest tiers first, and the most expensive tiers last.
Police is really expensive. We need police, and we need it to work properly, of course, but it can't be the first solution for every problem. Wherever there is a cheap and effective fix for 99% of a problem, you need to deploy that , and use police to deal with the remaining 1%. Otherwise, the economics just don't work.
Neglecting a simple technical fix while calling for a law enforcement solution, is like suggesting that we could all just dump trash in the streets, if the street cleaning crews just were more efficient. It just doesn't work. The street cleaning crews can only do their job if they are dealing with a tiny fraction of all trash. Police is the same. They can't deal with a society with strong incentives to being a criminal. Fix the incentives, then they can deal with the rest.
"there is no chance of actual industry-wide proactive cooperative problem solving"
Unless it's mandate by law. That's why in 1700 the actual form of democracy was devised - to have a state that protects the less strong ones from the 800 puond gorillas. Just, it canìt work if most voters just try to find an 800 pound gorilla to hide behind and crush others.
The IMEI is the ID the phone uses to identify itself to the mobile network.
We have the chain phone > mobile network provider > internet > somebody else's computer.
How and why should somebody else's computer be able to reach through the comms network to grab the IMEI which should be none of its business.
OK, probably Apple can because Apple. If Google can't so much the better. Or to put it another way, if Google can see the IMEI what about Meta, X, random site the user visits? It's a security issue if that's possible.
This is something the mobile networks can and should be dealing with. Talk to the right people.
What are you talking about? Every phone OS can see the phone's IMEI, it's a decision by the OS maker (and lawmakers, maybe) if it makes that information available in any form. But the OS could always check against a stolen phones list.
Who would be in charge of those list is the tricky bit - some governments would probably use that in nefarious ways
What I am talking about is that back when GSM was introduced, and with it the IMEI, we were briefed that the network operators could at least block if not disable (it was a long time ago) a stolen phone.
This, it may be difficult to believe for some, is before Android and iPhone OSes existed. Before the phone would connect to the internet. Before there were cloud services to connect to.
The system was designed for the network operators do this.
It's how it was supposed to work.
Talk to the right people.
Yep: The first thing in the article was about a global, centrally managed block list so the operators can all use the same list.
This is because operators can pick which block lists to implement. That means they can ignore the block list from the EU or US, for example, so phones stolen from those countries will still work. A global block list would address this pick and mix approach and hopefully plug that hole. However, the operators would just choose to ignore the global list and use their own, so that approach is highly unlikely to achieve anything.
The reason for Apple and Google to be dragged into this is for them to install Kill switches in their OS's - something that could be horribly abused, both by governments and criminals. Hence their stated reluctance. Plus IMEI spoofing and the likely response from criminals of cloning the OS without the kill switch and installing that on a 'bricked' handset. So basically it'd be a colossal waste of time, money and resources.
>>How and why should somebody else's computer be able to reach through the comms network to grab the IMEI which should be none of its business.
They don't have to reach anywhere. IMEI is available to Android/iOS (whatever the Apple equivalent is) all Google/Apple have to do is to ask what the IMEI is and the OS will send it right back.
Note that, since Android 10, third party apps on the Google Play store can't ask for the IMEI. The system calls are still there if your app has the right privs and any app that asks for those privs on the store is denied store presence (I presume... who knows if what they say should happen actually does in real life). I presume its pretty similar in Apple land.
all Google/Apple have to do is to ask what the IMEI is and the OS will send it right back.
What about rooted phones running some other Android variant, can they lie about the IMEI? If so, there's the solution for the crooks.
Of course Google, Meta, and X can see the user's IMEI. In Android it's called the Read Phone State permission.
iOS doesn't allow apps to read it any more, but the OS still knows what it is.
I would hope for more nuanced reporting on this
We know the UK government (of whatever colour) does not like citizen privacy & autonomy.
The UK police currently essentially ignore phone theft (even if your phone tracking software can show them the exact location a stolen phone is currently located at & so they could get a nice easy arrest if they could be bothered!)
This is more about having a nice way to block "people of interest" from the cloud / screw up with their phone usage at will
If you think I am being melodramatic, read up about how terrorist legislation is subverted into big prison sentences for protesters, look at the long disreputable history of the "spycops" saga etc.
Re: I would hope for more nuanced reporting on this
The UK police currently essentially ignore phone theft selectively enforces law
FTFY
Phone thief probably can swear, looks mean and intimidating. Whereas auntie having a brain fart on Facebook after getting a bit tipsy will be crying and compliant.
For the poor wages they get, they wouldn't be risking having to watch their back going home after finishing a shift.
Re: I would hope for more nuanced reporting on this
"auntie having a brain fart on Facebook after getting a bit tipsy"
Ah yes, it's fine to call for burning asylum seekers if you 'get a bit tipsy'.
Gotta lie to flerf has become gotta lie to far-right propagandise...
Re: I would hope for more nuanced reporting on this
>” This is more about having a nice way to block "people of interest" from the cloud / screw up with their phone usage at will”
I would agree, as I know my phone/device and if it gets lost or stolen, I can log into my account from another device (assuming I have correctly set up account recovery in the event of my primary phone and/or device being lost or stolen) and deny access to my Apple/Google account from it. Okay this isn’t as simple as calling up a mobile operator, passing a simple security check and they then barring the device, but it is doable.
This seems to be more about the authorities saying to Apple and Google - we have this phone, please block logins to your cloud service, sorry we don’t know the account name.
Which suggests Apple and Google need to include IMEI validation as part of the cloud service sign in and connection maintenance.
Re: I would hope for more nuanced reporting on this
It's more that they don't care about the low hanging fruit of the thief: They want to track where the phone goes so they can find the whole network involved in the theft.
It's the same for cars: They ignore car theft so they can follow the cars through the chop-shops and smugglers to see where the car or it's components, wind up.
Problem is the criminals keep changing their approach, routes and networks and ship to countries where your local police can't follow, so it's really hard to catch those behind it all.
An example of this (the car side) happened to a friend: Car stolen but could be tracked. Police weren't interested. Except the thief abandoned their car to steal a more expensive car... so their car was eventually recovered, got moved around various police pounds, things removed, lost, found, lost again, the whole car then was lost as it was redirected to another pound, found, lost yet again, then eventually, nearly a year later, handed back because the insurance company was seriously pissed at that point and threatening serious action against the police. Coincidentally, my friend had worked for Caterpillar, and had helped check a long list of serial numbers of machine parts recovered by police in a variety of countries. All were stolen from the UK years ago, the machines stripped down and parts sent abroad to be swapped into compatible machines - and a years long investigation/sting operation had just concluded with the local police in those countries making arrests, recovering parts and sending the serial numbers back to the UK to confirm the parts were, indeed, stolen. One thing she noted: They didn't recover ALL of the parts of the original machines... and where they were recovered, the parts were found in across a number of countries.
Minimal Impact
Apple Activation Lock already does the equivalent of this. If someone nicks my phone I use the Find My app to lock the phone and if someone tries to use it then they can't. They can't reset it or restore it and Apple won't do so without an original receipt and proof of original ownership. Great so far, but over the Apple boards and you'll see about a post a day from someone asking how to deactivate Activation Lock. Most of them are probably small-time thieves trying to get into their ill-gotten gains but some of them will be people who have bought a stolen phone probably without knowing it was stolen. My point is that even though Apple can and does disable stolen phones and has been doing so for some years now, it hasn't stopped them getting nicked. Why does anyone think that a different method based on IMEI would make a difference?
Re: Minimal Impact
I wonder how many know about this feature?
More critically, how many can access their Apple account without the just-stolen device that probably has the long-forgotten ID/password, etc, to do so?
Re: Minimal Impact
The premise is flawed - a fully bricked phone is still valuable. Even with Activation Lock or IMEI blacklisting, stolen phones can be stripped for parts or exported to markets where these protections don’t apply. The goal isn’t to make theft impossible, just less profitable - but when the scale is industrial, even bricked phones have value. And if the police aren’t seriously disrupting these networks, then all these technical measures are just noise.
Re: Minimal Impact
What markets won't it apply to if the only two OSes cover everywhere on earth?
Except maybe Android phones in China but even so it seems a very expensive way of getting a phone to a country where they spend all day making them on production lines.
Re: Minimal Impact
> The goal isn’t to make theft impossible, just less profitable [...] all these technical measures are just noise.
Those two bits are in direct contradiction. The technical measures make the phone less valuable by preventing you from selling it as-is into the most expensive markets. That makes the theft less profitable.
You don't have to bring the profit to zero , you just have to push it as far down as you can. Every little bit will make the police work that much more effective.
Re: Minimal Impact
yes, but do you remember how much car theft was reduced when decent loocks and immobilisers became standard? Making it harder cools the whole ecosystem, even if it isn't a magic bullet that stops it entirely.
According to perplexity, "The standardisation of electronic immobilisers and improved locking systems has led to a dramatic reduction in car theft—by about 40–50% in the years following their widespread adoption, and by over 80% in the UK over two decades."
Re: Minimal Impact
I'm sorry, disabling the OTA capability of my phone being locked is the first thing I do (if I can) with every new phone. I don't want it to be bricked accidentally on purpose by the carrier/$big_corp.
If my phone gets nicked... tough luck. On the other hand, it's a phone, I don't keep my whole life on it.
Meanwhile Nintendo proudly says they will brick your Switch 2 if they think you broke the terms and conditions.
I've worked for big phone
I've worked for big phone, one of the biggest and oldest on the planet, and let me tell you, it really is quite simple to disable a phone once it is reported stolen. There is not one damn complicated thing about it. I did it every day.
The phone companies absolutely DO NOT want to put any effort into it. ------------------------------>>>>>>>>>
Easy fix.
The government owns the IMEI* and you can only use it if you abide by their rules.
Same as a vehicle registration number.
*Within their jurisdiction.
Nice idea
But how about the police and justice system work to stop the criminals? You know, actually have some coppers on the street, arrest, convict and meaningfully sentence the first line thieves (and confiscate and destroy the bikes they use), find and prosecute the gangs who bring together the stolen phones and ship them out of the country?
By all means, Google and Apple SHOULD stop supporting the theft of phones, but that should be a backstop.