Mobile Phone Data

63ratattack

Hi everyone,
I'm starting this thread because I'm looking for some information on the retention and security of my data. Like everyone else in this country, I have a mobile phone and have had the same number for 4 years now.

But I often wonder about my mobile network (meteor)'s handling of my data. I'm sure it is very secure but its something I've just become interested in finding out more about. I've read their privacy policy but its very long and contains legal language I cant get my head around sometimes!

Does anyone know:
1. Exactly how long meteor holds your data for and for what purposes (in layman's terms!)?
2. What does it do with the data when finished with it?
3. Does it have access to the data it must hold for 3 years (due to legal reasons)?
4. Does anyone know how secure our data is - can just about anyone go and access the data that is only there for 3 years in case the gardai need to access it?

By the way, I e-mailed meteor about this but the person who deals with data protection wont be back until January so said I'd ask on here.

Cantab.

63ratattack wrote: »

Hi everyone,
I'm starting this thread because I'm looking for some information on the retention and security of my data. Like everyone else in this country, I have a mobile phone and have had the same number for 4 years now.

But I often wonder about my mobile network (meteor)'s handling of my data. I'm sure it is very secure but its something I've just become interested in finding out more about. I've read their privacy policy but its very long and contains legal language I cant get my head around sometimes!

Does anyone know:
1. Exactly how long meteor holds your data for and for what purposes (in layman's terms!)?
2. What does it do with the data when finished with it?
3. Does it have access to the data it must hold for 3 years (due to legal reasons)?
4. Does anyone know how secure our data is - can just about anyone go and access the data that is only there for 3 years in case the gardai need to access it?

By the way, I e-mailed meteor about this but the person who deals with data protection wont be back until January so said I'd ask on here.

In the US/Britain, if you have odd usage patterns or call dodgy people, you're guaranteed not only to have your time/dates/location recorded, but your voice is put through an automatic speech recognisor (ASR) and absolutely everything you say is stored. Your conversations can then be searched and mined through and your social network/interests/political affiliations/religious affiliations/likely movements/everything can be extracted.

I know, cos I've been in a server farm dedicated for this purpose.

I doubt this technology exists in Ireland (the Army/Garda comms guys wouldn't know how to write a line of C++, never mind analysing terabytes of data -- they're specialists in tendering for corrupt contracts for 1990s technology and getting over-paid people to advise them), but if we need to analyse people closely, MI5 are very obliging as they'd be just as interested as the Irish government would be. It's no hassle to pipe a channel over to England, in real-time or via a recording, for analysis.

The US government have legal power to analyse all international communications (outbound and inbound, emails, data and phone calls). I'd say it doesn't take very much for them to get a tap on the local benefit fraudster either.

Black Swan

Cantab. wrote: »

I doubt this technology exists in Ireland

Well, if it doesn't all they have to do is ask their "friends" for it? You know, the ones who are using Shannon as a staging point for their war?

Read in the most recent WIRED that anything mobile was insecure.

Cantab.

Blue_Lagoon wrote: »

Well, if it doesn't all they have to do is ask their "friends" for it? You know, the ones who are using Shannon as a staging point for their war?

Read in the most recent WIRED that anything mobile was insecure.

Yep. Pretty much.

If you were a bank robber and you organise the robbery on your phone (even take it to the robbery with you!), you're an idiot and you should be locked up forever to prevent you from contaminating the rest of the population!

Capt'n Midnight

http://en.wikipedia.org/wiki/ECHELON

http://www.snapshield.com/www_problems/United_Kingdom/The%20Capenhurst%20Phone-Tap%20Tower.htm

http://en.wikipedia.org/wiki/Enhanced_Full_Rate Working at 12.2 kbit/s the EFR provides wirelike quality
http://www.komplett.ie/k/ki.aspx?sku=363148 €102 for a terabyte drive which will hold something stupid like 20 years data or 10c per week and that price will be halving every year or two.

Cantab.

Capt'n Midnight wrote: »

http://www.komplett.ie/k/ki.aspx?sku=363148 €102 for a terabyte drive which will hold something stupid like 20 years data or 10c per week and that price will be halving every year or two.

Yeah, a back-of-an-envelope calculation would indicate that:
IP address/date/time/userID/url: 500 bytes (generous)
Say 100 sites per day (generous) per person = 100 * 365 * 500 = 18 MB
Add compression = 4 MB
4 million people in Ireland = 16 TB

So, €1,500 a year will buy you a raid array of iSCSI hard drives capable of logging the internet activity of every single person in the country.

Speech recognition will add to the storage costs but not by very much.
A typical 100 second call:
- 200 words per minute or 333 words per call.
- 10 calls a day = 3333 words, or 33k bytes
- compress = 10 k bytes
- 365 days a year = 3.65 MB
- times 4 million (crazy! 25,000 under ASR surveillence more realistic)

Storage is not a problem for ASR -- processing time is. As is training the system to detect and understand funny Northern/Dublin/Traveller accents and slang.

ironclaw

This technology doesn't exist in Ireland. Sure, the Telecom's hailed 3G as a great new tech back in the day after having existed in England for 3 years previous. Plus our Broadband network is famously miles behind everyone else in Europe.

I would be surpirsed if any of Irelands data was logged or anaylised. I would say that type of surveilance only comes into play if the party invovled is placed under surveilance.

Mr. CooL ICE

Mildly OT, but the current GSM system as a bit of a security hole. Basically, the phone needs to authenticate itself to the network, but the network doesn't need to authenticate itself to the phone. Someone using something known as an IMSI-catcher can pretend to be a phone base station/mast and intercept calls.

The UMTS system (3G and 4G) provides mutual authentication, so this won't be as easy to exploit

ironclaw

That is possible but nigh impossible without a huge bank roll. From some reseach I did a while back your looking at 250k just for the equipment (Which would be illegal in any case as you would be monitoring licensed frequencys) It is a valid point however. Its a man in the middle attack but the target would have to be in close enough proximity.

My question is, the links between towers and eventually back to the "control centre", how are they encrypted? That would be my first point of entry if I wanted to launch an attack.

Cantab.

Surely all data is encrypted as it goes over the air? And don't 3G SIM cards use much stronger encryption than the old GSM ones?

But how do you protect yourself from the prying eyes of private companies and the government?

I guess the answer is: don't use a mobile phone! Or if someone could come up with a front-end app that encrypts the voice channel. Obviously the person on the other end would need the same app running and the appropriate keys, but I'm sure it's not beyond the realms of possibility.

The zfone project looks really cool. It's opensource and made by that PGP guy Philip Zimmerman. There's even a plug-in for qutephone. This is the kind of stuff that will become more and more mainstream over the coming years allowing free and private communication for the masses.

knackerwacker

Cantab. wrote: »

Surely all data is encrypted as it goes over the air? And don't 3G SIM cards use much stronger encryption than the old GSM ones?

But how do you protect yourself from the prying eyes of private companies and the government?

I guess the answer is: don't use a mobile phone! Or if someone could come up with a front-end app that encrypts the voice channel. Obviously the person on the other end would need the same app running and the appropriate keys, but I'm sure it's not beyond the realms of possibility.

The zfone project looks really cool. It's opensource and made by that PGP guy Philip Zimmerman. There's even a plug-in for qutephone. This is the kind of stuff that will become more and more mainstream over the coming years allowing free and private communication for the masses.

I think the CIA and the Freemasons are closing in on Eamon Hynes!

ironclaw

Cantab. wrote: »

The zfone project looks really cool. It's opensource and made by that PGP guy Philip Zimmerman. There's even a plug-in for qutephone. This is the kind of stuff that will become more and more mainstream over the coming years allowing free and private communication for the masses.

I'd still be cautious. We're going on what we know about computers and processing power. Think about Echelon (and obviously the others out there that we don't know about it) We're talking huge processing power. My opinion is if the CIA or who ever want it, they will get it.

Security don't work through Wireless.. :pac: