Confirmed: UK police forces own IMSI grabbers, but keeping schtum on use

CCDC is for 'Covert Communications Data Capture'


Despite a nationally observed policy where they neither confirm nor denying using them, British police forces' widespread ownership of IMSI grabbers was confirmed today.

An investigation by indie journalism outfit the Bristol Cable has has revealed that five forces, including Avon and Somerset Constabulary, have been purchasing the eavesdropping equipment, often billing their purchases under the acronym CCDC.

While these purchases have been on public record for a while, it was not known what the acronym stood for until now. Unredacted minutes [PDF] of a meeting this May between West Mercia and Warwickshire police, which the Cable obtained and published, let slip the meaning of the acronym with a subheading titled “Covert Communications Data Capture (CCDC)”.

The minutes continued to state that “West Midlands and Staffordshire Police have recently purchased and operated 4G-compatible CCDC equipment”. The Cable reported that police and crime commissioners from the forces subsequently approved a decision to replace their existing equipment and purchase new CCDC technology.

Further evidence of the purchases was revealed in a South Yorkshire Police report, in which a budget item titled IMSI Covert Communications was given the identical spend on another item for CCDC: £144,000. South Yorkshire police confirmed that the CCDC and IMSI Covert Communications items were in fact the same budget item.

Privacy International's Matthew Rice told the Cable that “the findings – by revealing the codename – show that many police forces in the UK have invested in covert communications surveillance technology, yet the secrecy around them does not inspire confidence that the police are willing to be subjected to the level of scrutiny these powerful capabilities ought to attract.”

According to research by Privacy International, cops are purchasing the eavesdropping devices from British business Cellxion. According to the Cable: "Cellxion focuses on mobile networks in two capacities. One is the facilitation of communications through mobile networks for law enforcement. The company’s other main product is IMSI-catchers."

According to public purchase data, Avon and Somerset Police paid Cellxion £169,575.00 for “CCDC equipment" as well as other “communications and computing equipment”, while London's Metropolitan Police Service also awarded Cellxion a contract worth over £1,000,000 for CCDC in 2015.

It is not known which manufacturer produced the equipment that South Yorkshire, Warwickshire and West Mercia police forces were seeking to replace, although the documents obtained by the Cable confirm that such equipment had been purchased.

The Register contacted the police forces; however, neither would confirm nor deny whether they held any information regarding our requests.

Warwickshire Police and West Mercia Police Temporary Assistant Chief Constable Stephen Cullen eventually told us: "Our main priority is to protect the public from harm and we achieve this by utilising a number of techniques, some of them covert in nature. To retain their effectiveness we are not able to openly discuss these methods."

What's the fuss?

While the use of IMSI grabbers has never been confirmed by a British police force, an investigation conducted by Privacy International and Vice, broadcast in a documentary titled Phone Hackers: Britain's Secret Surveillance, spoke of their "widespread deployment" around London.

How do they work?

The devices exploit a long-known security shortcoming in the Global System for Mobile Communications (GSM) standards.

While GSM was developed by the European Telecommunications Standards Institute (ETSI) as a secure means of wireless communication, the specifications require the mobile device to authenticate itself to the network using its IMSI (International Mobile Subscriber Identity) – but do not require the network to authenticate itself to the mobile device.

This vulnerability makes it very difficult for mobile device users to defend against malicious actors who seek to spoof the network itself. because of this, many critics say that if the State is seeking to exploit this vulnerability rather than attempting to see it patched, it is a failure in its duty of care.

While earlier this year the Interception of Communication Commissioner's Office (IOCCO) was informally told it was going to be asked to look into the use of IMSI grabbers in prisons, the use of the devices by the police would remain outside of the remit of the most transparent of the oversight bodies.

Police use of the devices is permitted under Part II of the Regulation of Investigatory Powers Act 2000, which covers covert surveillance, and as such is overseen by the Office for Surveillance Commissioners, which provides oversight of covert operations conducted under Part II of RIPA and the Police Act 1997 (in a similarly covert manner). ®

Broader topics


Other stories you might like

  • NASA installs a new and improved algorithm to better track near-Earth asteroids

    Nearly 20 year-old software used to protect humanity gets an upgrade

    NASA has upgraded its near-Earth asteroid monitoring algorithm to model hazardous space rocks more accurately after nearly two decades, it announced on Tuesday.

    The new system, dubbed Sentry-II, is more powerful than its predecessor, Sentry. Astronomers working at the space agency's Center for Near Earth Object Studies can now automatically calculate thermal influences that nudge an asteroid’s orbit, potentially sending it hurtling towards our home planet.

    The so-called Yarkovsky effect describes the subtle and gradual change of motion when asteroids are heated by the Sun’s light. When asteroids spin, one side of its surface exposed to the star gets heated. As it continues to rotate, the hot region enters shade and cools down. Infrared energy is radiated outwards; the photons carry momentum and impart a tiny thrust on the asteroid. Over long periods of time, these small kicks can change their paths and knock them out of their original orbit.

    Continue reading
  • Facebook slapped with an eyepopping $150B lawsuit for spreading hate speech against Rohingya refugees

    Lawsuit claims social media giant's algos helped Myanmar military crackdown on the Rohingya

    Meta was sued on Tuesday for a whopping $150 billion in a class-action lawsuit for allegedly amplifying hate speech and aiding the Myanmar military in the genocide of the Rohingya people.

    The case, led by an anonymous Rohingya refugee living in the US, accuses the entity formerly known as Facebook of inciting hatred and inflicting real harm on the predominantly Muslim group for years. Not only did the social media platform ignore hate speech posts, it's alleged that the service's algorithms actively promoted anti-Rohingya propaganda as hundreds of thousands of people fled from Myanmar to escape persecution.

    Facebook has already acknowledged its role in the campaign, which saw an estimated 25,000 people perish and 700,000 forced from the country. The lawsuit also comes after ex-employee and whistleblower Frances Haugen leaked internal documents demonstrating how its algorithms prioritized engagement over safety.

    Continue reading
  • Power management IC shortage holding cars, laptops, hostage

    Couple of cents-worth of kit causing big problems for the year to come

    The shortage of power management chips is worsening and holding back companies from building cars, PCs and items with batteries or an on-off switch, Trendforce said in a study this week.

    Power management ICs cost just a few cents, and are among cheap chips that include display driver and USB-C components that are in short supply. These chips are as important to PCs and other electronics as CPUs or memory.

    The demand for PMICs has gone through the roof with the emergence of electric cars and growing demand for PCs and consumer electronics during the past 20 plus months. Trendforce expects the prices will go up by 10 per cent to a six-year high of $0.23.

    Continue reading

Biting the hand that feeds IT © 1998–2021