Burner Phone 101

It basically comes from routing requirements (especially to receive incoming phone calls) combined with billing requirements (to make people pay for their connectivity) combined with the empirical requirement to see which base station a device is connected to, and which other base stations can see it at a given moment.

If you aggregate all of that data, then you know a (geographically moderate-resolution) complete history of where almost all people have been at almost all times, and patterns of their habits and whom they probably recurrently spent time with.

Not all of this data has to be collectable, because these things could be disaggregated by introducing different protocol layers. For example, you could pay the mobile company for data connectivity, but use cryptographic blinding mechanisms so that it doesn't know which specific subscriber obtained connectivity at a particular place and time. (Those blinding mechanisms could be implemented inside of SIM cards, so the SIM card's task is to cryptographically prove "I am a SIM card of a current paying subscriber of carrier X" rather than "I am SIM card number 42d1b5c0".) You could have device hardware IDs be ephemeral rather than permanent. Actual messaging and call services could all be "over the top" (as phone industry jargon puts it), provided by people who are not the phone company itself.

This disaggregation is a straightforward improvement from a privacy point of view because it prevents companies from knowing things about you that they didn't need to know in order to provide services.

Meanwhile, in the world we live in, we see governments trying to make it harder to make phones less trackable, by putting legal restrictions on changing hardware addresses, or requiring legal ID in order to establish service. I imagine that an additional cryptographic indirection layer in SIMs to prevent carriers from linking a permanent identifier to a network registration (or specific data use) would also be banned in some places if it were invented.

This shouldn't be inevitable. One thing that made me think about this was when there was a little scandal (which I was a small part of) about companies tracking device wifi MAC addresses for commercial purposes. There was a little industry that would try to recognize people and build commercial profiles based on recognizing that the same device was present (in fact, at the time, even if it didn't actually connect to the wifi -- because a typical wifi-enabled mobile device was sending broadcast wifi probe packets that included its MAC address). So Apple was like "this is a bad use of MAC addresses, which only exist to distinguish devices that happen to be on the LAN at the same time, and perhaps to allow network administrators to assign permanent IP addresses to specific devices", and they made iPhones randomize wifi MAC addresses for some purposes, mostly fixing that particular issue.

We could think just the same way about GSM networks: "these identifiers exist for specific protocol reasons; using them for device or user tracking is an abuse that should be mitigated technically".

Easy enough to say "Gee...these 2 phones are always together or nearby when activated" or "this phone shuts off right before this one powers up".

Although, I suspect there are a few other ways to determine identity easier. Such as tracking the device identifier and then looking up nearby public facing cameras.

Unless you bought a pixel, graphene’d it and then paid a homeless person to activate a pre-paid data only sim which you would top up with vouchers paid in cash and used a von and international voip service…

A lot of effort though

1. starting with threat modeling (though they don't call it that);

2. mentioning that your OPSEC affects not only you but also people connected to you; and

3. mentioning that maybe you should just leave the device at home (because it's basically a surveillance machine that you pay for).

(A more common article format would be to unload a pile of supposed security&privacy measures without putting them into context, and wouldn't properly set expectations for what that gives you. Neither of which is very helpful, and can be very counterproductive.)

Step one is already difficult here in Australia: to do so you must hand over your personal details and ID. At least that was true for anything with a SIM card for sale back in the 2010s

So the “step 0” was “find a retailer who didn’t follow the rules”, and they’d usually be a corner store selling handsets or SIM cards by the bucket load to all sorts of interesting characters

And also be aware of "shoulder surfing", which is different today in 2 ways it wasn't in the past.

In the past, the risk was something like someone looking at you type in your PIN on a bank ATM, or maybe your password on an computer keyboard.

Today, shoulder surfing is mainly different in 2 ways: (1) near-ubiquitous high-resolution surveillance camera networks, which can be places/scale and capture images that humans practically didn't; and (2) with machine learning, they don't even need to see what buttons you press, only see movements of your arm.

(Randomizing button positions on a touchscreen can help, and also help fight forensics like traces your fingers leave for where they touch. But randomization means you need to be able to see your screen, which reduces the ways you have to hide your screen from the view of others.)

Firstly, What's the current opinion on using third party LLMs by the infosec community? Secondly it's more philosophical: do activists on the ground embrace this new tech or fight against it? Or is it an amoral tool, like what a phone is considered to be? Is there a distinction between the big third party APIs and local on device use?

(If it helps, the feeling is a bit like a seeing a Linux developer use an Apple mac for development)

GPS is a passive technology, no?

Downloading GPS assist data obviously isn't, and plenty of phones use wifi scanning as a way to augment GPS position fixes, but this seemed a strange callout. Am I missing something?

Most OPSEC failures are due to leakages which is a failure of compartmentalisation.

That's not to say technical approaches don't remain important, but even most encryption is still based on the idea that someone can't just cut off your fingers until you reveal something that satisfies them.

> Keep device & OS as updated as possible

I don't think so! Cloud rot also affects tracking servers, ad-serving servers and pre-installed apps. A phone that is never updated will, in a few years, be affected by the cloud rot and most of it's tracking will stop working.

The best burner phone is the oldest second-hand phone from a flea market that can still connect to the phone network.

> SIM rotation: Rotating SIMs manually or using PGPP eSIMs changes your IMSI, though your IMEI stays constant.

So then, why rotate them? If one phone is known to be yours, then each SIM inserted into it is known to be yours, and any other (burner) phone that SIM gets inserted into will also be known to be yours.

Pair each SIM with only one burner phone and there will be no record of a connection between them, unless they're connected to the same tower and moving at the same time.

> Do not share your email, phone number, or ID with carriers or clerks when activating service

Not possible in Europe. Buying a SIM card requires an ID.

Also if you want one-way “location less” communication, the old alphanumeric pager network is still available.

I think those messages are simply broadcast across the network (which at least in the US is national). There’s evidence of a message being sent, none about whether it was received or where it was received.

https://blogs.dsu.edu/digforce/2023/08/23/bfu-and-afu-lock-s...

Movies make it seem anyone can walk into any store in a trenchcoat and walk out with a burner phone ready to go. I get the service part (you can buy prepaid SIMs in cash). What about the phone?

Cash is likely tracked too these days, if you get it from an ATM for sure, or maybe it is for some modern tills. So learn to busk before you think about buying a burner phone.

For example, can you just walk into Best Buy with cash?

It’s either got too much stuff on it or not enough stuff on it.

Are there actually smartphones without an IMEI and with a Wi-Fi card only, preferrably not a Broadcom one?

Buying a phone anonymously is much harder than "just cash". Most places demand name & address for sign-up, and if you're unlucky want to see an ID.

You really should think through where and how you buy, how to find the "off the back of a truck" places, where to get SIMs, how to pay for renewal in untraceable money and without a CC, etc.