NSA warns that mobile device location services constantly compromise snoops and soldiers
- Reference: 1596612546
- News link: https://www.theregister.co.uk/2020/08/05/nsa_location_data_guide/
- Source link:
The new [1]guide [PDF], titled “Limiting Location Data Exposure”, notes that smartphones, tablets and fitness trackers “store and share device geolocation data by design.”
“Location data can be extremely valuable and must be protected,” the document adds. “It can reveal details about the number of users in a location, user and supply movements, daily routines (user and organizational), and can expose otherwise unknown associations between users and locations.”
Which is not good at all for spies and defence force personnel.
The guide also suggests that it is impossible to stop mobile devices recording and revealing location data, partly because network operators can’t help but collect such data in their normal course of business.
The document also warns: “Location data from a mobile device can be obtained even without provider cooperation. These devices transmit identifying information when connecting to cellular networks. Commercially available rogue base stations allow anyone in the local area to inexpensively and easily obtain real-time location data and track targets.”
While acknowledging that most devices offer settings to reduce location-tracking, the guide says “Mitigations reduce, but do not eliminate, location tracking risks in mobile devices. Most users rely on features disabled by such mitigations, making such safeguards impractical.”
The guide nonetheless suggests many mitigations, including turning off radios when not in use, using a VPN, and disabling features like “Find my Phone”.
Users are also told to “Disable advertising permissions to the greatest extent possible” by limiting ad tracking and resetting the advertising ID for the device at least weekly.
“While it may not always be possible to completely prevent the exposure of location information, it is possible—through careful configuration and use—to reduce the amount of location data shared,” the document concludes. “Awareness of the ways in which such information is available is the first step.”
Clearly the NSA has given some thought to how the information is available. It may therefore be best not to ask how it knows its advice is sound. ®
Get our [2]Tech Resources
[1] https://media.defense.gov/2020/Aug/04/2002469874/-1/-1/0/CSI_LIMITING_LOCATION_DATA_EXPOSURE_FINAL.PDF
[2] https://whitepapers.theregister.com/
phones in secured areas
In such a case you'd have a congestion of "going offline" events at the main entrance of your security area.
Does not help when personell go for their daily run in a non-secure location or even just travel to & from secured areas.
You may note that the article didn't mentioned secured areas at all. This has nothing to do with discovering the location of your super-secret headquarters, it's about being able to gather valuable information just by tracking people going about their daily lives. Things like Strava heatmaps giving away the precise perimeter of military bases are examples that have come up before. But the point of this article is that even if you try to deal with those more glaring examples, it's virtually impossible to prevnt any tracking from happening at all. You can tell people not to upload their runs to Strava, but you can't prevent the local telecoms company from noticing that 1000 new America-registered SIMs are suddenly connecting to their base stations. And you can't prevent spies from setting up their own fake base station to get the same information.
Secured areas aren't relevant, because people don't spend their whole lives in secured areas. You can gain a lot of useful information just by seeing where people are and what they're doing the rest of the time. Block phones from your operating base or agency building all you like, you can't stop people being able to figure out where the living barracks are, changes in staffing levels, troop movements, and so on. It's similar to being able to figure out activity levels by looking at satellite photos of car parks. No matter what steps you take to try to hide things, at some point people need to get to work and that activity in the public space can be tracked. All you can do, as the NSA effectively say here, is try to at least make your opponents work a bit harder to get that information.
> it's virtually impossible to prevnt any tracking from happening at all.
Remove the word "virtually" and you'd be right. The network operator collects measurement reports from every mobile and analyses them to generate locations. These can then be used to help diagnose network quality issues. Equally, black-hats could, with access to the data, do all sorts of other shenanigans as you outline.
The only way to not be tracked is to take the battery out (rumour has it there is special firmware that can be pushed to individuals that make it look like the phone is off when it is instead doing some tracking, but I've never seen concrete evidence of it)
Re "using a VPN"
It is very difficult to use a VPN properly and to your advantage, most people just end up inadvertently owning up to using one and in case of poorly designed VPN solutions even blowing the VPN for other users.
Most people altogether, including most people NSA wrote their guidance for, need to interact personally with other people to be able to do their job. You can't realistically rely on everyone you are meeting with or inviting to your office/safe house to follow this guidance reliably. Hence you are happily VPN'd to, say, Norway, until your first informant comes to give you the parcel in a cafe in Beirut with their Android phone in their pocket. Your smart slabs get near each other, registering similar pattern in available wifi APs, and voila, you and possibly others on same VPN profile are no longer in Norway, you are in Beirut and on Santa's naughty list.
This, coming from the people who want all of that location and tracking data on the rest of us because, they are apparently the good guys and the rest of us are not.
It might have been more honest for the NSA to say these things compromise everyone's security and even spooks and soldiers can't protect themselves...
So how do you protect yourself when you NEED the always-on availability that's essential in today's fast-paced society? And no, the answer to, "What did we do before cell phones?" will be, "Whatever it was, it didn't happen very quickly, and seconds count today."
Plus, because of the way wireless communications work, whatever the technique you use, you WILL leave radio traces that alone can be useful tracking information. It's a problem similar to post/mail or any other two-way form of communications: both ends must be known for it to work, yet that alone is compromising information. Efficiency becomes its own drawback.
We've essentially run into a nigh-intractable problem. How do you maintain two-way communication without the communication itself being tracked by a determined adversary?
Easy... 2 girls and 1 cu... no wait, 2 cups and a piece of string.
On a serious note, this has been known for years, the ad-tracking is new advice, I also wonder how the tin-foil hat brigade will react now its "official"
Pagers can help although they're nowhere near a complete solution. It's transmitting that's the problem, including transmitting "ACK"s.
"even spooks and soldiers can't protect themselves" - spooks have always had hard time protecting themselves on radio. Britain's famous Peter Wright wrote in his memoir about detection and location pinpointing many decades ago. Only today we beep all around the place like R2D2 on stimulants and it costs virtually nothing to gather these signals and get large amount of useful information from them.
Traffic analysis has been popular...
...since olden days, c.f. Gordon Welchman's The Hut Six Story: Breaking the Enigma Codes
Coat: off out with my personal locator beacon to get some exercise
The way it was done doesn't specifically alert politicians.
Open shared infrastructures are ...
Open. This is inevitable, so open shared infrastructures should not be used where their openness can lead to hazard. I would have thought this was blindingly obvious. Not for nothing was frequency hopping point to point radio invented and widely used for secure communications before the "smart phone" took over the planet.
Trump tells Putin where you are
Turning off your phones won't help. Trump shares battlefield intel with Putin and Putin is the one paying to get you shot. He knows where you were deployed. When he has enough coffins for a photo-op, Trump will withdraw troops from Afghanistan and hand over those bases to Putin.
It's a repeat of Syria.
NSA needs to get all back doors closed now. They should never have left kit vulnerable.
It's wishful thinking to believe this treason will end in January.
We'll file this one
under "no shit sherlock"
Then fire the people who forget to turn their phones off at "super secret volcanic lairs"... and that will hopefully solve the "just opened an e.mail attatchment from an unknown source" problem too
Talyrand: they forgot nothing and learned nothing!
Oh dear......the NSA spends gazzillions of dollars tracking the citizens who stump up the gazzillions of dollars......and then start to worry that the tracking THEY ARE DOING might be a problem for their own people!!!!
*
So how about a SIMPLE avoidance scheme for the NSA (at no charge!):
1. Buy a dozen pre-owned phones for cash in the local High Street.
2. Buy two dozen SIMs for cash, with vouchers for minutes also paid for in cash in the local High Street.
3. Make sure that there is no CCTV covering items #1 and #2.
4. Distribute burner phones and burner minutes to spooks.
5. Train said spooks ONLY EVER TO USE SAID BURNER PHONES IN PUBLIC SPACES WITH NO CCTV.
5A. Train said spooks to install SIMS when in a location NOT TRACEABLE TO THE INDIVIDUAL SPOOK (e.g. a coffee shop, an internet cafe)
6. Train said spooks to use said burner phones ONLY EVER TO CALL OTHER SAID BURNER PHONES.
7. Train said spooks to stay off their personal page(s) e.g. Facebook!
8. Repeat from #1 as required.
*
The real problem (in an age of rampant narcissism) will be items #5, #5A, #6, and #7.
Can I bill someone for consulting advice? ...but then free advice is worth what you pay for it!
How terrifying
" Commercially available rogue base stations allow anyone in the local area to inexpensively and easily obtain real-time location data and track targets. ”
Just a minute there : am I supposed to understand that there are rogue base stations implemented everywhere ? Controlled by who ?
Because if that is not the case, then they are being implemented to track someone who is already known, and that is state-level spycraft, so doesn't concern me.
Or just... don't allow phones in secured areas.