A company called Path Intelligence has a product called Footpath which uses the TMSI, WiFi MAC address, and bluetooth MAC address to track phones as they move through stores.

However, I don't see how they are able to get anything useful with the TMSI, since it's temporary and is supposed to change. How often does it actually change?


A TMSI is a randomly generated 32 bit number assigned to a mobile device, allowing it to be paged without using its permanent and immutable IMSI number. This number is assigned to a device by a Visitor Location Register (VLR) when the device enters (or is switched on within) the geographical area covered by that VLR. The assigned TMSI remains the same until the device connects to a base station under the control of a different VLR.

From the description of Footpath on the page you linked to, it sounds like these systems are used in shopping centres (malls), which are spread over a reasonably small area. Much smaller than the area an individual VLR will cover. This would mean that the TMSI would (with high probability) remain the same for the entirety of a shopper's visit to the area, allowing them to be anonymously tracked as they move around the centre.

While this technology would probably not be useful for tracking multiple visits of the same customer, analysis of the data could produce information on trends and patterns in customer actions.

| improve this answer | |
  • Thanks. Would you happen to have a source for this? I couldn't find a straight answer when researching it; some sources seem to say the TMSI changes on every call, some say it will just change randomly every few hours, and some between cells. – sciencectn Dec 12 '12 at 18:41
  • Much of that description is based on knowledge I acquired from a Master's degree course, but backed up with the TMSI section of the Mobility Management article on Wikipedia. Also have a read of this page on VLRs. – mckiethanks Dec 12 '12 at 19:31

The answer is TMSI generation in real systems is weak and hence it cannot protect from tracking.

There is an excellent research done which answers your question.

Here is the paper and here is the presentation slides.

Here is an executive summary from that paper.

  • Pesudonym (TMSI) changing mechanism impletented in realtime networks is flawed, and hence does provide the intended privacy goals.
  • According to 3GPP 33.102 v9.30, TMSI should be changed periodically. But it is rarely done.
  • According to the standards, on each location update, TMSI should be changed. But in reality it doesn't. So tracking acros different location by passive sniffing is possible.
  • Surprisingly, session kets along with TMSIs are reused, So replay attacks are possible, which increases the chances of tracking.

On the other hand, if you ever think what can be just using TMSI. Here is my explaination.

Collected the TMSIs and encrypted traffic. Use the TMSI to ask HLR (impersonate as MSC - one of the core network side attack) for session keys. Once you get the session keys, decrypt all the encrypted conversation you have recorded.

| improve this answer | |
  • Would you mind expanding your answer including the relevant points from the paper? – Deer Hunter May 25 '15 at 13:04
  • I updated my explaination. Thanks for pointing it out @DeerHunter – kingmakerking May 25 '15 at 13:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.