Why are IMSI and IMEI still used?

Question

While I understand their function, both IMSI and IMEI makes tracking and surveillance possible by virtue of being persistent idenfitiers for SIM and handset, respectively.

Why aren't these replaced with a more secure scheme, maybe something along the lines of randomizing publicly visible device identifier every now and then (sort of like Bluetooth/WiFi MAC randomization) and sending some session-details (instead of a person/SIM-identifier) over an encrypted connection?

Is it mostly (only?) backward compatibility?

Answer 1

The purpose of MAC address randomization in Wi-Fi and Bluetooth is so that probe devices cannot consistently identify user devices in their immediate vicinity. These devices do not wish to actively communicate with the devices they probe, but only to record their presence and correlate with previous sightings.

However, once a device wishes to register with a network and communicate over any higher-layer protocol (such as IP), it must present a consistent MAC address to the network so it can be associated with the higher-layer address it is assigned. Some MAC address randomization implementations revert to the hardware-encoded MAC address for this purpose, while others record a consistent MAC address per network (SSID) so that only one network knows the real MAC address the device has synthesized for its use. Regardless, a non-randomized MAC address is required for the device to participate in higher-layer communication.

With mobile telephony devices, the only way for the device to receive calls or data once it comes into range of a cell tower is to register with that cell tower, so the routing infrastructure knows where it is and can refer to the device by any higher-layer address such as a phone number or IP address. Thus it is pointless to try to randomize the IMEI or IMSI, because as with MAC addresses a consistent identifier is required to register.

The only solution to not being tracked is not to use mobile telephony; it is inherent in the provision of the service that the location of the device be known (to within a cell tower's range) at all times. About the best you can do is to separate your billing information from the phone itself by tactics such as burner phones prepaid in cash. Governments are clamping down on the ability to do this.

Answer 2

The assumption is not really correct. There is is randomization of identity in mobile telephony networks, at least GSM. There is the TMSI (Temporary Mobile Subscriber Identity) that is used to avoid exposing the IMSI over their airwaves. And it is a specification that dates from the early design of GSM.

The problem is that the IMSI still has to be sent in a number of circumstances (switching on the mobile phone, cell handover). Then, it can still be observed but is protected most of the time.

As for the IMEI I don't think you can easily observe it unless you are the network or running a rogue base station to trick devices into connecting to your own network.

So tracking mobile phones is not that easy. Especially if all you can do is passively monitor the airwaves in the vicinity with software defined radio equipment for example.

If you are a government or the network operator, sure you can do more, track people, listen to their calls. Police too (they use Stingrays, which can act as a rogue base station or passive sniffer).

If you are not the network or the government but an amateur, you could still set up a rogue station or spoof an existing one, but that is not very discrete and technically challenging. Think for example about the inability to route incoming calls to your victims.

Keep in mind that the standards are old, upgrading the equipment and the software would be damn expensive. Operators want to recoup their investments, not invest on privacy which is not a profit center. While the current standards can be improved, nobody really has an incentive to tighten things, possibly make the job of law enforcement more difficult.