Geolocation methods in mobile networks (33c3)

music

Herald: so the NSA is spying, and was
spying, and we had Snowden, we have a lot

of documents to look at, and there is some
new research on how they used geolocation

methods in mobile networks. It is done by
the University of Hamburg and we have here

Erik who will present this research to you
and he has done this for the German

government and for the NSA
Untersuchungsausschuss which we call "NS

Aua", which means "NS Ouch", kind of. He
is a PhD student and holds a master's in

physics so give him a warm applause

applause

Herald: And for those coming later please

go to your seats and try to be quiet. Yep,
thank you.

Erik Sy: Hello. I'm really happy to have

you all here and I welcome you to my talk
about geolocation methods in mobile

networks. My name is Eric Sy and I'm a PhD
student at the University of Hamburg. So,

at the beginning I want to point out why
I'm giving this talk. So the German

parliamentary investigative committee
wanted to find out about the German

involvement in US drone strikes and then
the German government officials claimed

that they do not know anything or they do
not know any possibility how to use a

phone number for targeting drone strikes
and the investigative committee did not

really believe this statement and so they
asked our research group at the University

of Hamburg to prepare a report and we
handed in that report to the Bundestag and

it was very soon after what's also
published by netzpolitik.org

thank you for that

Applause

E: And it contains like technical
methods and approximates the accuracy to

localise mobile phones and it also points
out which technical identifiers are

required to conduct such geolocation. Now
I give you my agenda for today. First I

will speak about the purpose of
geolocation data and then we are looking

into a broad variety of different
approaches to conduct such a geolocation

in mobile networks, and then we specify on
drones and look into the technical methods

which can be conducted with drones, and
and then I'm going to point out which

technical identifiers we can use for such
a geolocation. And lastly I'm going to sum

up. So, the purpose of geolocation data:
it is a neutral technology, so we can use

it for rescue missions, for example if
somebody got lost in the forest or in the

mountains, we can use geolocation data to
find that person and rescue the person.

Or, if you ever used Google Traffic, there
you you can profit from monitoring traffic

conditions. But we can also use it to
invade the privacy of persons, for example

if we identify people on surveillance
footage, or if

we track the location of a certain
individual over a longer period, and

certainly we can use this data for
targeting drone strikes. However I want to

point out that this data, that they are
not suitable to prove the identity of a

person. So if somebody is conducting a
drone strike based on this data, then he

is actually not knowing who he is going to
kill. So, on the right side you see an

image of an explosion site from a Hellfire
missile. A Hellfire missile is usually

used by these drones and you can
approximate that the blast radius is

around 20 meters. So we would consider a
targeted drone strike if we have a

geolocation method which can determine the
position of a person more precise than 20

meters in radius. So, the first approach
which I want to present are time

measurements and the symbol which you will
see down there it's a base station, for

for the next couple of slides. And a base
station... this is the point in a mobile

network where your phone connects to. On
the slides you can certainly interchange

this base station with an IMSI-catcher.
IMSI-catcher is something like a fake base

station from a third party and you could
even build it yourself. So, the method

used to calculate the position of a phone
is for time measurements trilateration.

You have to know that that signal is
usually traveling with the speed of light,

so when you measure the time you can also
measure the distance. And here there are

three methods presented. There are "Time
of Arrival", where the signal moves from

the hand phone to the three base stations
and the accuracy is between 50 and 200

meters. This really depends on the cell
size and they can be more precise or less

precise. So, then we have "Time Difference
of Arrival," which is like a round-trip

measurement, and we have an "Enhanced
Observed Time Difference," where the

mobile phone actually computes the
location within the cell, and the accuracy

is between 50 to 125 meters.
So, and the next method which I want to

present are angular measurements. When you
conduct angular measurements, then you

determine the direction of arrival from
the signal and afterwards you do a

calculation which is called triangulation
and therefore you have to know the

position of the base station, but also the
alignment of your antenna and for this

method there's certainly two base stations
or IMSI-catchers sufficient to determine

the position of the mobile phone. The
accuracy is usually in field experiments

between 100 and 200 meters and the
challenge for this method but also for the

ones on the previous slides is that on the
normal mobile cells you don't have a line

of sight to each base station from your
mobile phone and so the signal gets

disturbed by buildings in the way and then
the accuracy becomes worse. So the next

method I want to show you, I think most of
you will know a little bit about GPS and

how it's calculated. So satellites, GPS
satellites, broadcast their time and their

position, and the mobile phone uses again
trilateration to calculate its position

and the accuracy is usually below 10
meters, but it depends a little bit on the

chipset within the mobile phone, and then
the base station can request the position

of the phone by issuing a radio... or by
issuing a request with the radio resource

location service protocol. So another
method which I want to present is the

mining of Internet traffic. Some
smartphones send GPS coordinates or the

names of nearby Wi-Fi networks, which are
also called SSIDs, to online services, and

usually these allow the determination of
the position around or below 10 meters,

and it is certainly possible to intercept
this traffic and evaluate the geolocation.

So here I have two quotes for you, and the
first one it effectively means that anyone

using Google Maps on a smartphone is
working in support of a GCHQ system. This

quote comes from the Snowden archive and
was issued in the year 2008. So we

certainly see that there's
some proof that at least at those days,

that they enter, some third parties
intercepted those traffic and use it for

determining the geolocation, and if you
want to work with, or determine the

location with the SSIDs, it is necessary
that you have a map where a certain Wi-Fi

access points are located. And therefore
we have also something like... like a

proof that this has been done by the NSA
and this is the mission victory dance,

where they are mapping the Wi-Fi
fingerprint in every major town in Yemen,

and in Yemen also a lot of drone strikes
are conducted. So, let's go to next

method. Signalling System No. 7 is a
protocol which is used for communication

between network providers, and network
providers need to know where, in which

cell, a mobile phone is located to... to
enable the communication, and these

informations are saved in location
registers, and a third party can easily

request these location informations. I
want to refer to the talk by Tobias Engel,

which... he gave a talk two years ago
which really goes into the details of this

method, and maybe if you like to, there
are also commercial services available to

access this data. So, let's talk about
drones. We do not have very solid proofs

that geolocation methods are conducted by
drones, but we have certainly hints. A

hint is this GILGAMESH system, which is
based on the PREDATOR drones, and is a

method for active geolocation, which
describes an IMSI-catcher so... but if

anybody of you has access to more
documents... yeah it would be nice to have

a look. So...
applause

E: So, the easiest method would be
certainly to request for GPS coordinates,

and there you just replace the base
station with a drone. But the method which

is better, or which I think is the
preferred one: Angular measurements.

Angular measurements, if you have a look
in our report, there we approximated that

the accuracy of these methods are between
five and thirty five meters in radius from

an altitude of two kilometers, and if you
get closer to the mobile phone it becomes

more accurate. So, it would be, to some
extent, sufficient to conduct a targeted

drone strike on this data, and in the
meantime, since this report was handed

over to the Bundestag, I also found other
work which described that they are able to

achieve an accuracy of one meter from
three kilometers altitude for small

airplanes. You have to know that those
sensors to measure the angle of arrival,

that they are usually located within the
wings and within the front of the plane,

and when the plane becomes larger it's
also easier to have a more accurate

measurement. Then I want to point out that
a single measurement can be sufficient to

determine the location of a mobile phone.
If we can assume that the target is on the

ground. So if you assume that the target
is maybe in a building in Yemen, so a

single measurement would be sufficient on
a low building in Yemen. And a sky scraper

would be more difficult. So, and the big
advantage of these methods is that

environmental parameters have a very low
influence, since we can have a almost line

of sight, which allows a better accuracy.
So now I'm going to talk about the

identifiers which can be used for
geolocation. Certainly the phone number

and each IMSI-catcher or base station can
request, can issue an identity request to

a mobile phone, and then receive the IMSI
or EMI. The IMSI is something like a

unique description for a certain customer
in the the mobile network and the EMI is

like a unique serial number for an device.
So, when we include those methods of

mining Internet traffic, then we can also
add a lot of more identifiers, for example

an Apple ID or Android ID, MAC address,
even cookies or user names. If you are

interested in this, you can have a look at
the link I provided there. That there's a

very interesting paper about this. So I
come to my last slide, my summary. I

showed you multiple, or a lot of different
methods to localize a mobile phone, and I

pointed out that a single drone can
localize a mobile phone with accuracy

which is sufficient to conduct a targeted
drone strike. Since this document was

handed over to the Bundestag, they also
never denied that these methods can be

used for... or that the accuracy of these
methods... is true. So then I pointed out

that as an identifier the phone number,
the IMSI, and the EMI each can be used for

the geolocation of a mobile phone, and the
last information which I want to give you

is that geolocation methods cannot prove
the identity of a person, and this is

really important to know, that we are
not... yeah. That when we conduct, or when

somebody is conducting these drone
strikes, that they are not aware who is

actually using the phone, and so and I can
happen that they are killing the wrong

person. So I thank you very much, I thank
my colleagues and my family and everybody.

applause

Herald: Thank you.
applause

H: That's great. Thank you very much. It's
the first talk we have here today where we

can have a lot of questions. So come on.
You have the microphones, number 1, number

2, number 3, number 4, and ask your
questions. It's the only chance to have

this man answering them. No questions?
Here's someone. No. Yeah. Sorry!

Microphone: No problem.
H: Number 4.

Microphone 4: Hello. Do you know why we
are located in London right now when we

use Google Maps here?
H: "Do you know", can you ask me again,

"do you know why we are located in
London?"

M4: Yes.
H: Here?

M4: When we use Google Maps, we are
located in London.

H: Do you know that? The Congress is
located in London. Do you know why?

E: I'm not aware.
M4: Okay, I thought this was on plan.

H: Okay.
M4: Thank you

H: Number 1.
Microphone 1: Okay, so on slide 12 you

showed this angle of arrival-
H: Can you please be quiet, we can't

understand the questions unless you're
quiet. Sorry.

M1: Okay, so, on slide 12 you showed the
angle of arrival method executed by a

drone. Is this a passive method or does it
require some cooperation by either the

phone company or by the targeted mobile
phone?

E: It can be conducted passively. Like, if
you call the phone or page the phone

multiple times and you see which phone is
answering this paging... okay, it needs to

be active in a way that you contact the
phone, but you don't need an active IMSI-

catcher for it. You just phone or call the
phone, and then you see which phone is

answering, and then you know where the
phone is situated.

M1: Thanks.
E: Yeah.

H: I see that we have a question over
there so can you just ask your question

please?
M8: Here?

H: Yes, number 8, please.
M8: Thank you for the talk. I'd like to

ask a question about tracking unpowered
mobile phones: I mean you mentioned lots

of methods for phones which are both...
with both have their batteries inserted

and are actively operating. Could you
elaborate a bit about the methods of

tracking phones, which seem to be off
turned off from the users point of view,

and maybe also something about those who
have their batteries removed?

E: Actually, if you really turn off your
phone over a long period, let's say a

couple of months, I think you are safe,
but... laughter Buf if you...

M8: That's good to know.
E: But, actually, like if you have a base

station and somebody is switching off his
phone and maybe he is meeting somebody

else at that point and somebody else is
also switching off his phone, then it can

be suspicious, but it really depends
whether somebody is looking into this data

or not.
H: Thank you. Number 8 again.

M8: I had a short question: As you
described, we are somehow dependent on the

good winning of the NSA, for instance, and
I wanted to ask if there's some way to

avoid geolocation or use Google Maps
without sending identity to location

services.
E: That is fairly difficult. I would

assume that GPS phones are a little bit
better to avoid geo-locationing,

especially if you add additional GPS
spoofing, because they are... The network

cells are really large and so it's more
difficult to track you within the network

cell, but if you have a drone right above
you and you emit a physical signal, then

the drone will always be able to localize
where the signal came from. So it's

difficult, because it's physically
difficult.

M8: Okay.
H: Thanks. Number 1, please.

M1: So, I have a question about the
physicalities of receiving a... or

localizing or making angular measurement
of a phone within a densely populated

area, where there's possibly tens of
thousands of phones within the receptional

area of a 3-kilometer-high drone. That
would obviously require you to be more

sensitive on one hand than this cell tower
and on the other hand also receive at the

same time and sort out all kinds of
interference.

E: You usually a cell can be between,
let's say 200 meters, and 3 or 30

kilometers in size, so 3 kilometers in
altitude it's not very high.

M1: So you assume that the drone does a
pre-selection. We are digital beamforming

on the ground path and only looks at a
cell of interest, because it knows from

the network, the suspect is in that cell.
E: It depends on the area: In an urban

area you have to reduce the size of the
cell, otherwise you would receive too many

signals, but in a countryside you can have
larger cells or you can cover a larger

area.
M1: Regarding covering larger areas: Did

you take, considering that these drones
aren't really like our quadcopter size,

they're more airplane-sized, proper
airplanes, did you take the classical

synthetic aperture radar techniques of
observing something for a long time while

flying straight over it and then
integrating over it into account? Because

that's usually where we get our high-
resolution radar imagery of the earth.

E: You can conduct multiple measurements
or you just conduct one, if you know that

the target is on the ground.
M1: So, did that account for your

estimated accuracy?
E: It's not necessary to integrate.

M1: Okay, thanks.
H: Thank you. We have a question from the

internet.
Signalangel: Yes, the internet wants to

know if there are attributes, which you
can change of the phone, to stop

surveillance. Attributes like the email,
for example.

E: Can you please repeat the question?
S: Are there attributes of the phone,

which you can change, to stop
surveillance?

E: Yes, certainly you can fake the IMEI
or the IMSI. That is also another reason why

it's not sufficient to prove the identity,
because any phone can just take these

data.
S: And we have a second question, which

is: Does the GSM network have a feature
which allows anyone to get the GPS data

from the phone?
E: Yeah..., it would be..., that.., and

the radio resource location service
protocol.

S: So, thank you.
laughter

E: Yeah.
H: Okay, number five.

Microphone 5: Hello, you delivered you
work to the NSA Untersuchungsausschuss and

they, the Bundestag did not say anything
about it, but is there a statement from

the NSA Untersuchungssausschuss?
E: And the government said something about

it. They said that, that they washed their
hands and said we did everything nicely

because we added also a disclaimer to the
data we provided and that the disclaimer

says that the NSA is forced to, to stick
to the German law and that they are not

allowed to do whatever they want with this
data.

M5: Thank you.
H: Very nice, number 6, please.

M6: Hello, on slide 12, you got, you
specify the accuracy of about five meters

for two drones. So how does it scale if
you would use more than two drones? For

example 10 or whatever.
E: I think that there was a small

misunderstanding. Actually, one drone is
sufficient.

M6: Okay, so could you use more than one
drone?

E: Yeah, you can use as many as you want
but one is sufficient.

laughter
M6: Yeah, but that, of course. But does

the accuracy increase by using more than
one?

E: Yeah if you go closer to the target and
then their accuracy increases.

M6: Okay, but with the same distance but
more than one drone?

E: Actually not.
M6: Okay, thank you.

H: Number four, please.
M4: Also referring to the accuracies, you

were talking about field experiments and
so on. Did you conduct those yourself or

where did you get all the information
from?

E: These are some references, there you
can find the field experiments.

M4: Thank you very much.
H: Number two, please.

M2: Thank you very much for the
interesting talk. My question is regarding

the fingerprint which you can use on many
phones to unlock the phone. Is there

currently and if not will there, do you
think there will be a possibility that for

example an app which requires the
fingerprint identification on the phone

that this is also passively read and by
that you increase the identification of

persons? Did you understand the question?
E: Yeah, but I think this is like based on

the GSM network and the other I think that
that's based on the operating system.

M2: So currently using this technology,
there they couldn't be, there, it's not

possible to link this?
E: No.

M2: Ok, thank you.
H: Ok, number one, please.

M1: My question is actually about the
civil use of geolocation service not so

much about phones. So, you mentioned that
every time you use an online service that

use geolocation you send the SSids of
nearby Wi-Fi networks and with every

request you actually enrich a Wi-Fi map,
Wi-Fi database of either Google, if it's

on Android, or Apple if it's on iOS. Now,
there was a talk at CCC here in 2009 when

this technology was still nascent and that
back then was called Skyhook but then the

speaker had this provocative question:
Shouldn't this Wi-Fi map be public domain

instead of just a belonging proprietary
and belonging either to Apple or Google

nowadays? So, haven't we lost that
struggle? I mean we can't keep our SSids

private, so shouldn't it be public domain?
E: Yeah it would be a good idea to make it

public domain I said since also a lot of
positive things can be created with this

technology, like helping people in
emergency situations.

H: Okay ...
M1: I wanted to take the chance to say

thanks for this talk. I'm one of the
people who actually commissioned the

analysis because I work in the inquiry,
and it was extremely helpful for us to

have the analysis done because we, like
you said, keep being confronted with

Secret Service people who tell us that no
way can mobile phone numbers help in the

secret war. So yeah I just wanted to say
thanks.

applause
H: Yeah, thank you very much.

H: Great, so thank you also very, very
much for your work and keep on going with

that.

music

subtitles created by c3subtitles.de
in the year 2018. Join, and help us!