Introduction

I attended a protest in October last year and decided to take some extra precautions with my phone usage. It has been widely reported that Cell-Site Simulators (CSS) are being deployed near protests. A CSS (also called an IMSI catcher or stingray) spoofs a cell tower, causing phones in the area to connect to it instead of the tower. It then records the IMSI of each connected device. The IMSI (International Mobile Subscriber Identity) is a unique identifier that is stored on a devices SIM card. Under normal circumstances, the IMSI allows a network to verify that a device belongs to it. In essence, it identifies the owner of the device and authenticates it for use on a particular network. A CSS intercepts this process and uses the IMSI to identify the device and potentially uncover all sorts of personally identifiable information (PII) about the user.^[1]

One can imagine several benefits this provides to investigators when it comes to catching criminal behavior, but even in those circumstances, there can be legal problems with using a CSS.^[2] They are certainly a problem when being used to surveil citizens exercising their constitutional right to protest.

Preparation

To prepare, I grabbed two old phones, a Samsung Galaxy Note II and a Samsung Galaxy S9, and made sure they had no SIM cards—they were already removed. Though both phones had nothing on them and hadn’t been used in years, I wiped them both. They would be our cameras while our everyday phones were powered off and placed in Faraday bags.

There seems to be some skepticism online about the effectiveness of DIY Faraday bags made out of aluminum foil. I decided to experiment. It seemed to me that I would have to prove three things to determine effectiveness:

1. The foil must block all calls and texts such that there's no record of them even when the phone is removed from the bag.
2. The recorded RSRP and RSRQ dBm values must be low enough so as to assume no signal.
3. The recorded cell id should never change: once the phone is placed in the bag, I'll record the cell id, drive many miles away, and record it again. It should remain unchanged. If the cell id changes, some RF signal was able to penetrate the foil to establish connection to another tower, albeit with an extremely weak signal.

Initial Steps

I wrapped my phone in 3-ply of foil, not pulling it too taut to avoid tearing. Then, I tested the first criterion. Success. No calls or texts got through, and when I removed the phone from the foil, there was no record of them.

Next, I noted the dBm measurements RSRP (Reference Signal Received Power) and RSRQ (Reference Signal Received Quality) for my phones signal while in standard use, not wrapped in foil. To do that on the iPhone, I opened Field Test Mode (Android has its own method). Here are the steps to open it and measure cell signal.

1. Turn off the WiFi on your phone.
2. Open the Phone app, dial $*3001\#12345\#*$, and call. The following screen appears (several values removed for privacy).

RSRP measures the strength of the signal and is generally in this range:

$$ -120\ dBm <= RSRP <= -50\ dBm $$

Less than $-120\ dBm$ is a weak or nonexistent signal. My $-77\ dBm$ signal is pretty good.

RSRQ measures the quality of a signal. The range for RSRQ is generally as follows

$$ -20\ dBm <= RSRQ <= 0\ dBm $$

Below $-20\ dBm$, a signal is unintelligible or nonexistent.^[3]

To test my phone signal while wrapped in foil, I adjusted the Auto-Lock setting to never so the screen would stay on indefinitely, opened Field Test Mode, wrapped the phone in foil, and used the side buttons to take a screenshot. This was the result.

My results of $RSRP = -131\ dBm$ and $RSRQ = -38\ dBm$ are well below operational values, which is as expected.

Before moving on to my final step, the following card digresses briefly to examine the unit for measuring cell signal, the $dBm$. Skip it if you aren't interested!

wTf is dBm?

The decibel is a confusing unit. It's a relative unit, which means it has no meaning by itself. It measures something on a logarithmic scale according to a reference point. The milliwatt (mW), used to measure power, it an absolute unit: it expresses a quantity by itself.

These two units are paired to create the decibel-milliwatt (dBm) by establishing the reference point like this:

$$ 0\ dBm = 1\ mW $$

Let's explore the utility of this unit with an example. Suppose we have a cell tower capable of generating a signal with a maximum power of 1 milliwatt (mW), so the signal range we're working with is

$$ 0\ mW <= signal <= 1\ mW $$

I have a cell phone that is receiving that signal: the further the distance between my phone and the tower, the more attenuated the signal. It will diminish and approach $0\ mW$, at which point the signal is effectively lost. We could show this change in power like so.

$$ \begin{aligned} 0.8\ mW \\ 0.03\ mW \\ 0.001\ mW \\ 0.00002\ mW \\ 0.000005\ mW \\ 0.0000001\ mW \end{aligned} $$

I don't know of a situation where the power of a cell signal is actually something like $0.8\ mW$. However, the last value, $0.0000001\ mW$, is much closer to a genuine signal strength. It is plain that such a number is awkward to deal with. Our scale, $0\ mW <= S <= 1\ mW$, will necessarily deal with small, awkward values. We can transform this range so that it becomes easier to comprehend.

The decibel-milliwatt transform this scale, allowing us to use integers instead of very wide floating point numbers. Setting $0\ dBm = 1\ mW$, the dBm unit will always be negative since in practice a signal never achieves full power at $1\ mW$.

The mW to dBm conversion formula is $D(m) = 10\log(m)$, so if you input $m = 0.001$, you will get $D(0.001) = -30$, which is the corresponding dBm value. In order to graph this relationship in an intuitive way, I inverted the formula to get dBm to mW: $M(d) = 10^{d/10}$, which is pictured below.

In the case of RF signals, the primary benefit of the $dBm$ unit is clarity: it is simply easier to work with values such as $-90,\ -80,\ -70$ than it is with $0.0000000001,\ 0.00000001,\ 0.0000001$. However, it's worth noting that the decibel provides other benefits when used to measures things like sound. The decibels logarithmic scale corresponds nicely with the way the human ear perceives sound. For more information, look into Weber's Law.

Final Step

References