In many dictatorships SIM card cloning is used by the police (working together with the telco) to spy on dissidents, journalists etc. Some people say that you need the authentication key on the SIM card to clone it so that physical access to the card is a pre-requisite for cloning. However, if we assume that the telco works for the political police can they design the SIM card in such a way that they can work without an authentication key on them? This would make the process of SIM card cloning much easier and therefore dangerous for civil society.
No, telecom providers do not need physical access to the SIM.
They can change the allocated number or any SIM unique ID, therefore they can:
assign the number to any new SIM and unassign it from the old one (this is actually a standard procedure for anyone losing their phone/sim)
clone the number to any SIM
References- cellphone operator sites:
Third-party articles with more detailed explanation:
Not only do you not need physical access to the SIM, you don't even need cooperation from the telecom provider. There have been instances where SIM card encryption keys were obtained directly from the company that manufactures the SIM card.
No, the telco has unlimited control over your number. It doesn't need physical access to do whatever it wants.
This is similar to most internet-based communication services. If you need protection against the service provider (and entities coercing, bribing or deceiving the service provider) you need to use end-to-end encryption, and a open source implementation (or, at least, a implementation that is independent from the provider). For concrete options, see the EFF messaging scorecard
It's worth mentioning that mobile networks are, in general, incredibly insecure (from a modern security perspective). Many telcos will happily give anyone a new SIM card bound to your phone number after a minimal amount of social engineering (for example, by claiming that you lost your old SIM). Also, the protocols used by telcos are riddled by security vulnerabilities that can't be fixed. This insecurity is not an accident - it's intentional:
[Standards designers] had to respect strict controls on the type and strength of encryption they could use.
"It was as strong as we could make it," said Mr Brookson.
Your default assumption when using a phone network should be that everything you say on it is intercepted.
Technical details about SIM cards
There's 3 important pieces of data stored on a SIM card: the ICCID, the IMSI and the authentication key.
The ICCID Is the closest there is to a "uncloneable" identity, as it's used to identify the physical SIM card. However, it's just a data field without a backing cryptographic mechanism. It's written to the SIM in a process called "personalization", and, at least technically, everyone with writting equipment seems free to write whatever they like there.
The IMSI identifies you to the network. This is the closest identifier to the "phone number" (but is not a phone number). The IMSI is written to the SIM card, so, again, everyone is free to say they are whoever they want to be.
The authentication key seems to be the only field with a cryptographic purpose. In theory, it's impossible to read it from the SIM, even with physical access. Unfortunately, it's also written during the "personalization" process, and the telco retains a copy in the authentication center, so anyone with access to it and a SIM card writer would be able to clone it.