Spy Blog - SpyBlog.org.uk

However, even mobile phone companies seem to have a hard enough time keeping their own Cell ID location maps up to date, let alone having access to those of other mobile phone networks in foreign countries. A lot of (but not necessarily all, depending on roaming agreements sometimes between subsidiaries of the same multinational telecomms company) this location data gets filtered out of the Call Detail Records for international roaming calls. The commercial priority is to grab a chunk of the hugely inflated prices that are usually charged for such calls, at the country/roaming agreement partner level. The picture gets even more complicated where there are several local telecomms companies with roaming agreements with a foreign one, and where the customer's handset switches not just between different cells, but different companies as they move around, sometimes every few metres.

The Sri Lankan telecom authorities did, apparently, send SMS messages to foreign "roaming" phones belonging to tourists, asking them to phone or SMS the authorities. This is a legitimate and useful use of SMS, after a disaster, although it does somewhat imply preferential treatment for foreign tourists over the local population.

There have been plenty of reports of the further victimisation of the tsunami survivors and their property by the human predators who emerge wherever the rule of law has broken down in the disaster zone.

There are even reports of the homes of foreign tourists presumed lost being burgled back in their home countries once their personal details have been published.

Ther have been email hoaxes sent to tsunami victims' families, and no doubt there are several "419", "phishing" and premium rate phone numbers scams involving bogus disaster relief "charities".

Look at the statistics for hoax 999 emergency service calls in the United Kingdom alone, there are tens of thousands of deliberately malicious calls every year, let alone the accidental or misinformed ones.

SMS has a potential for use in the disaster recovery phase, where individuals alert the emergency and relief agencies with location reports about groups of survivors, the need for particular supplies or medicines etc.

A question that needs to be asked of the people proposing SMS as a pre-disaster warning and alert system is, would you believe an email spam claiming that a Disaster (natural or terrorist etc.) is likely to happen in your location in, say the next hour ? Would you believe it ? Even if the "From" address was apparently from a Disaster Warning Service to which you had voluntarily or commercially subscribed ? Would you believe the warning and act upon it i.e. evacuate your children and yourself, shut down your business etc ?

You would be foolish to do this on the basis of an unauthenticated email.

What is different with SMS messages ? Nothing !

These too can be easily forged, the only major difference is the cost of doing so. Email spam can be sent by the million essentially free of charge. SMS spam costs a spammer money to the GSM Mobile phone networks, unless they are prepared to skip on the next monthly invoice and to shut down their business operations. This is unlikely for commercial spam, but not a problem for lunatics, fanatics and terrorists.

Neither is it a problem for organised criminals who want to cause a panic which ties up the local "first responder" emergency services especially the local police forces, whilst they conduct, say a bank raid or a major smuggling operation in an area now denuded of police resources.

For relatively slow moving disasters, like hurricanes (the winds may circulate and gust at up to 200mph, but the storm as a whole might be moving at only a few tens of miles an hour) or forest fires, then SMS and landline phone trees are a valuable resource in giving a final evacuation warning to householders who are almost certainly already prepared by news media reports to evacuate at a moments notice, depending on the direction of the wind.

This is not the same as an out of the blue volcano, earthquake, tsunami or threatened terrorist or military attack.

Why would an SMS Emergency Alert system not be subjected to malicious attacks and attempts to subvert or spoof it, into causeing panic for various reasons ?

Even if an SMS emergency disaster alert system were to be restricted to self selected or government nominated local people,unless the central systems are secure to the highest possible standards, any such system will come under prolonged and frequent attack and attempts to hoax and subvert it.

Which power mad lunatic or terrorist intent on causing panic, or organised criminal wanting to divert the police etc. away from his activities, would not be willing to devote considerable resources for the chance of controlling an army of "zombies" ready to clog the roads , airports, telecomms bandwidth etc. at a moment's notice, once he has managed to subvert the SMS Panic Button ?

Given that there are over a billion GSM phones out there at the moment, and that the 3GPP replacements just coming on stream are no better in this respect, it could easily take 20 years or more before enough mobile phones and devices are fitted with the requisite strong authentication mechanisms, to appear on the market. Even then, if the usual "backwards compatability" commercial pressures apply, even the new devices will still be able to be hoaxed using the old insecure SMS protocols.

Even the suggestions to limit an Emergency Disaster Warning to the physical locations where it is expected to strike is fraught with difficulties. In the USA the E911 system of compulsory Location Based tracking of Emergency Phone Calls to the nearest 200 metres or so is slowly rolling out throughout the country. However this is designed to help tracing someone who calls the Emergency Services in a remote area or at night etc where they themselves are unsure of their location. It does not seem to include a strong authentication mechanism for alerts from the Emergency Services. US E911 equipped mobile phone handsets were of no use in the Indian Ocean, where the requisite network infrastructure is not installed, and is likely to be technically incompatible even if one were to be.

Inevitably there are also huge privacy problems associated with being tracked and monitored by your mobile phone: a technology currently being tested for the electronic tagging of criminals, which is a further barrier of a lack of trust of central governments, which would need to be overcome if such a system were to become more widespread.

Can you trust your Government if it issues an Emergency Alert or even if it issues an "Official Denial" in order to prevent panic being spread by informal SMS message trees ? This was a major issue during the inept handling of the SARS epidemic in China

A self selected SMS flash mob "warning" system is no substitute for a proper Civil Defence and Emergency Services system, and tempting though it is to some people to create one, you should be kicking your government for proper resources for the latter and not be wasting time and lives on the former.

Unless and until, the next generation of mobile phones standards, (not 3GPP, and it may even be too late to include in the 4th Generation standards) include a mandatory strong authentication mechanism for SMS messages, then SMS disaster/emergency warning systems will be worse than useless - don't do it !