1. 25

  2. 4

    I have a couple of technical nitpicks that don’t really detract from the overall point of the article.

    But I think it’s worth being accurate about the technical details, as there’s enough to be worried about without adding additional worries:

    It is unclear whether enabling airplane mode stops this tracking.

    The article linked from here seems to confuse intelligence agency capability with standard mobile phone functions. If you turn a normal phone to airplane mode, the cellular radio will stop transmitting and it will stop trying to associate with any mobile phone towers - so carrier-side cellular location tracking can’t work.

    This doesn’t prevent a “state level actor” from messing with your phone so that it does whatever they want regardless of whether it’s in airplane mode, but most people’s phones won’t do this unless they’re very faulty or compromised. This is relatively quick to verify with a cheap SDR receiver[*] or even an old AM radio.

    The only way to make sure is to remove the SIM card and battery from the phone.

    Battery, of course. SIM card, may make no difference. Phones have unique IMEI numbers and a phone without a SIM card will still associate to any tower for emergency calls.

    I guess it depends on exactly which data the carrier is tracking (subscriber number, IMEI number, or both).

    P.S. Of course, this is a breach of GDPR, but nobody cares.

    This is the part that surprised me the most. Have any lawyers weighed in on this? (Either that there’s some exemption in GDPR being leveraged here, or to explain the ways that this could be challenged under GDPR.)

    [*] Much like with the AM radio, even if the SDR is a cheap dongle that can’t receive the actual cell band, any up-close transmitted signal is strong enough that it’ll swamp the receiver as noise.

    1. 2

      I’d like to add that, out of the three carriers that will grant the Spanish Institute of Statistics aggregated location data, (Vodafone, Movistar and Orange), Vodafone and Orange let you opt-out via email or their app.

      Movistar hasn’t enabled any opt-out mechanisms yet.