From: Greg Broiles <gbroiles@netbox.com>
Date: Tue, 21 Apr 1998 17:39:25 -0700 (PDT)
To: Phil Karn <karn@Qualcomm.com>
Subject: Re: Position escrow
In-Reply-To: <19980417175445.54922@die.com>
Message-ID: <199804220039.RAA16621@ideath.parrhesia.com>
MIME-Version: 1.0
Content-Type: text/plain


At 03:08 PM 4/21/98 -0700, Phil Karn wrote:
>This is a really difficult issue. Even the most diehard cypherpunk
>cannot doubt the usefulness of a cellular position reporting
>capability in an emergency situation, when the user *wants* the cops
>or whoever to know where he is.  The big problem is how to keep it
>from being used (or abused) for "law enforcement" purposes without the
>consent of the user.

Arguments about the "utility" of the technology are distracting - lots of
things are useful in some rare circumstances, not in others. If I were held
hostage in my apartment, I might wish there were hidden video cameras
installed in every room so the SWAT team snipers would be able to shoot the
bad guys without endangering me. If I were injured badly in a single-car
accident in a desolate place, I might wish that the government had the
means to track every automobile's location. The rest of the time, I think
those technologies are very distasteful and unwelcome. People dying of
thirst drink urine. It's not necessarily useful to use a worst-case
scenario when deciding how we'd like to organize and technologize our
ordinary lives.

The question is not whether or not cypherpunks want cellphone-locating
technology to be built - because it will be built. People who aren't happy
with that, for whatever reason, must fight that technology with technology
- arguments and proclamations are helpless against technology, as the
ridiculous export control "debate" makes clear. Once the technology exists,
it will be used.

What we need are cellphone remailers - they'll accept cellphone traffic
sent via nonstandard means (a different spread-spectrum
arrangement/protocol, or different frequencies for analog, or ..) and relay
it onto the ordinary (subject to surveillance) cell frequencies/spectrum.
Third parties who want to use ordinary/automated cellphone tracking systems
will get the physical address of the relay, not that of the phone. And
(hopefully) the relay won't keep logs of its traffic, nor attempt to track
down its users. (Operators of relays likely won't have access to nearly the
number of antennae/base stations that the regular cellphone folks do, so
it'll be harder for them to use trianguation and timing to derive physical
location. At least that's what my relatively RF-clueless understanding is.)
Do you (or other folks familiar with ham radio technology and repeater
technology) have any comments on the ease/difficulty of building a cellular
remailer? I assume it'd be necessary to modify a cellphone to use the
nonstandard remailer setup, which may be difficult.


>I expect the main countermeasure to cellular position tracking will be
>the use of one-way pagers. Keep your cell phone turned off, and if you
>get a page when you're someplace you don't want them to know, wait
>until you leave before you return the page.

But one-way pagers are a dying technology - and I'll bet that within 3-5
years, it'll no longer be possible to turn off cellphones, at least without
removing the batteries. I think that change won't be driven by surveillance
needs, but because the setup time required where the phone and the network
do their handshaking is annoying. It's likely to get worse as crypto is
added to cellphones, and if batteries get better it won't be crucial to
have the phone turned off when not in use.

Then again, you probably know a lot more about cellphone design than I do. 

>Perhaps if the "just turn it off" approach is widely promoted, the
>carriers and vendors will see the threat to their business and press
>for some safeguards. Otherwise they just won't give a damn.

If we want safeguards, we're going to have to build them ourselves. Laws
won't help, neither will carefully crafted, reasonable arguments. 


--
Greg Broiles        |History teaches that 'Trust us'
gbroiles@netbox.com |is no guarantee of due process.
                    |_Kasler v. Lundgren_, 98 CDOS 1581
                    |(March 4, 1998)