The UK's culture secretary wants to eradicate the nation's patchy cell phone coverage. UK cell phone users aren't able to switch towers on the fly -- something residents of other EU countries (as well as the US) enjoy -- but are forced to connect only with their provider's towers.

But Home Secretary Theresa May would rather UK citizens suffer through a plethora of dead zones (or "not spots" -- the term of choice for these no-service areas) than put her country in harm's way. According to an internal letter written by May, providing near-seamless coverage for UK phone users will open the door for increased terrorist activity.

[M]ay argues in the leaked internal Whitehall letter that Javid’s plans to end “not-spots”, by allowing customers to roam between rival networks, could aid criminals and terrorists. The Times reported that May’s objections centre around concerns that roaming would make it more difficult for the agencies to track suspects.

This is, of course, ridiculous. In the US, cell phone subscribers hop from tower to tower freely, and yet, law enforcement and national security agencies have plenty of options to track suspects and terrorists. It's hard to believe the GCHQ and UK's law enforcement agencies don't have access to the same methods and technology.

For one, IMSI catchers (Stingray devices) are able to spoof any service provider's tower and, if need be, force every phone in its effective range down to a 2G connection for easier surveillance. So, it ultimately doesn't matter whether these "not spots" exist or have been papered over by legislation or cooperative agreements between service providers.

On top of that, these agencies have access to "tower dumps," often without anything more powerful than a subpoena. This gives agencies a record of every connection made to these towers, whether it was a phone call or simply a ping for a viable signal.

Given what we've learned over the past year, UK's intelligence and law enforcement agencies likely have access to plenty of this information already. Even if they don't, they certainly have the power to compel it. In addition, the GCHQ has the invaluable assistance of the NSA -- an agency that isn't weighed down by the nominal privacy protections granted to UK citizens.

It would seem that the nation's security -- at least under the current "Five Eyes" regime -- would be more threatened by dead zones in coverage than vice versa. Going off the grid would seemingly be more conducive to bad behavior than flouncing about from carrier to carrier, spilling your secrets to at least two powerful intelligence agencies.

But even worse than Theresa May's display of ignorance and fear is her suggestion that the public's connectivity be sacrificed on the altar of national security. David Mitchell -- of That Mitchell and Webb Look -- says it best:

Theresa May is the first person, as far as I know, to suggest that people’s activities should be restricted in order actually to facilitate the security services’ surveillance – to claim not only that it’s permissible for the police to snoop on everything we do and say, but also that we should be discouraged or prevented from doing things the police might have trouble keeping track of.

“Come off it!” some of you may be thinking. “She can’t be the first!” And of course you’re right – I’m exaggerating. She’s certainly not the first person ever – throughout history her point has frequently been made. In fact, the states of the former communist bloc were entirely predicated on this principle, as were most fascist regimes. It’s one of the issues over which Lenin and Tsar Nicholas II would probably find common ground if they got stuck with each other at an awkward drinks party in hell.

Mitchell's response is exactly what May's little written panic attack deserves. Politicians who filter everything through the terrorism lens tend to develop outsized blind spots. May would rather have UK citizens deal with lousy coverage (and being one step behind their EU counterparts) than perhaps have a terrorist jump towers and ditch pursuing GCHQ agents. Ridiculous.

49 Comments

As we just got done stating, the wireless industry would have you believe that it doesn't need net neutrality rules applied to wireless because the sector is just so damn competitive, and all that competition will keep companies on their very best behavior. In a recent Wireless Week editorial, former FCC Commissioner-turned-Comcast-lobbyist-turned-wireless-industry lobbyist Meredith Attwell Baker proudly proclaimed that we don't need neutrality rules because of "82% of Americans having four or more providers competing for their broadband business."

Except the number of major wireless carriers doesn't really mean much when AT&T and Verizon together dominate 85% of retail sales, and have an 80% plus market share of the special access market -- the lines that feed cellular towers. And while it's true that T-Mobile has disrupted the industry of late with some more consumer friendly policies and a lot of highly-entertaining rhetoric, there's only so much the company can do with that kind of duopoly in place. In a recent filing with the FCC, T-Mobile highlighted how AT&T charges them an arm and a leg for roaming. AT&T shot back insisting that T-Mobile should spend less time complaining and more time building their own network, but that can be hard to do when AT&T and Verizon also own the lion's share of available spectrum.

While AT&T and Verizon fend off neutrality rules by over-stating competition, the press helps their case by repeatedly over-stating T-Mobile's impact on the overall market (price war! price war!). If you pay closer attention, all of the industry's big four players make it clear that despite all the noise, not much has changed. In an investor research note this week, several Jefferies analysts say they've spoken with Verizon Wireless, which doesn't plan to seriously compete with T-Mobile (or a growing chorus of MVNOs) because they feel they simply don't have to:

"According to the note, Verizon's management "does not believe the wireless industry feels much different than in the past, contrary to the broad view that competition is intensifying to detrimental levels." Verizon Communications CEO Lowell McAdam and Fran Shammo have made similar comments in public at recent investor conferences. "Management again highlighted that it does not intend to broadly price down its subscriber base, but instead offer discounts to at-risk customers while making surgical plan changes," the Jefferies analysts wrote."

And by "surgical," Verizon means "largely cosmetic." So far, Verizon Wireless has pretended to compete by offering superficial price reductions on only their most expensive plans -- with the goal of heavily upselling users. Even T-Mobile, whose escape from AT&T's hungry maw has resulted in a shift away from device subsidies (and toward phone financing plans that may not be any better a value), admits they're not eager to have a price war, even if they could get roaming issues sorted out. Underneath the dull roar of their faux-punk rock CEO Tom Legere, the company's CFO concur's with Verizon's take that meaningful pricing changes really haven't occurred:

"The carrier says it has been competing more effectively by doing away with subscriber "pain points" like service contracts and international data fees. But its executives have also been signaling that they don't plan to start a price war. "When you really analyze a lot of the pricing moves that have been made, there has not been a significant repricing," (T-Mobile) Chief Financial Officer Braxton Carter said at a Morgan Stanley conference last week."

It's rather nice for them that they have the choice. As we've long noted, you probably don't need net neutrality rules if you've got meaningful competition, but what the broadband industry generally engages in is superficial theatrics, or what I affectionately refer to as "wink wink, nod nod" competition. It's that lack of more meaningful competition that has allowed Verizon and AT&T to engage in all manner of anti-competitive behavior, whether that's attacking users for tethering, blocking Facetime, blocking competing mobile wallet platforms, disabling device GPS so you'll use their more expensive services, cramming, or just good-old fashioned ripping people off with false advertising and stealth charges.

Limited competition from T-Mobile can't magically change these realities all alone, and it certainly can't automatically thwart the dumb, anti-competitive ideas to come. That's not to say things can't improve down the road (especially if Sprint can turn its fortunes around and MVNOs improve service coverage and reliability), but declaring that you don't need consumer neutrality protections on wireless simply because four carriers exist isn't much of an argument.

14 Comments

Over the last few years, Verizon has been ramping up its behavioral tracking efforts via programs like Verizon Selects and its Relevant Mobile Ad system, which track wireless and wireline subscriber web behavior to deliver tailored ads and sell your information to third parties. Unknown until a few weeks ago however was the fact that as part of this initiative, Verizon has started using what many are calling controversial "stealth," "super" or "perma" cookies that track a user's online behavior covertly, without users being able to disable them via browser settings.

Lawyer and Stanford computer scientist Jonathan Mayer offered up an excellent analysis noting that Verizon was actively modifying its users' traffic to embed a unique identifier traffic header, or X-UIDH. This header is then read by marketing partners (or hey, anybody, since it's stamped on all of your traffic) who can then build a handy profile of you. It's a rather ham-fisted approach, argues Mayer, who notes that while you can opt-out of Verizon selling your data, you can't opt out of having your traffic embedded with the unique identifier. He also offered up a handy graphic detailing precisely how these headers work:

As the story grew the last few weeks, ProPublica noted that Twitter's mobile advertising arm is already one of several clients using Verizon's "header enrichment" system, though Twitter didn't much want to talk about it. Several tools like this one have popped up since, allowing users to test their wireless connections (note it doesn't work if your cellular device is connected to Wi-Fi, and may be masked by the use of Google Mobile Chrome, Opera Mini, or if viewed through apps like Flipboard).

Kashmir Hill at Forbes also has a great article exploring the ramifications of the system and asked Verizon and AT&T (who has started trials of a similar system) what consumer protections are in place. Both companies proclaimed that the characters in their headers are rotated on a weekly and daily basis to protect user information. But as we've noted time and time again, there's really no such thing as an anonymized data set, and security consultant Ken White argues that only part of the data in the headers is modified, if at all:

"White has been tracked for the past 6 days across 550 miles with a persistent code from both Verizon and AT&T. He has a smartphone with Verizon service and a hotspot with AT&T service. In AT&T’s case, the code has four parts; only one part changes, he says. “It’s like if you were identified by a birth month, a birth year, a birth day, and a zip code, and they remove one of those things,” said White. You’d still be able to reasonably track that person with the other three. Verizon’s code meanwhile hasn’t changed for him, and it’s been almost a week."

Amusingly, I remember back in 2008 when concerns about deep packet inspection and behavioral ads were heating up, Verizon declared there really wasn't any need for consumer protections or privacy rules governing such technologies, because, the company claimed, public shame and the oodles of competition in the broadband space would somehow keep them honest:

"A couple of years back during the debate on net neutrality, I made the argument that industry leadership through some form of oversight/self-regulatory model, coupled with competition and the extensive oversight provided by literally hundreds of thousands of sophisticated online users would help ensure effective enforcement of good practices and protect consumers."

Yet here we have an example where the behavior Verizon was engaged in was so surreptitious, even some of the best networking and security experts in the business didn't notice Verizon was doing it until two years after the effort was launched. Apparently, holding Verizon accountable is going to take a little more than a public scolding in the town square. The EFF has stated they're taking a look at possible legal action against Verizon for violating consumer privacy law.

46 Comments

One of the more interesting things unveiled at Apple's most recent press event was the company's AppleSIM, or universal SIM technology embedded in the iPad Air 2 that quickly allows users to switch carriers, presenting you with easy wireless broadband pricing for each carrier option. Of course, when Apple quietly announced this functionality, Verizon wasn't listed as a supporter. While AT&T was supposed to be a partner, the company later stated they wouldn't fully support the functionality either. In AT&T-fashion, they offered up a non-explanation explanation, stating that you can still switch carriers, but AT&T would just prefer it if you'd do it the old-fashioned, cumbersome way, because that's just the way they do it:

"With us you can change carriers with this iPad any time you want,” he said. “It is an unlocked device. … All [you] have to do is switch out the SIM in the device so it works on another carrier." As for why AT&T is locking the SIM card to its network while other carriers are not, Siegel said that “it’s just simply the way we’ve chosen to do it."

Of course, blocking anything that could possibly promote choice and competition is long how AT&T "does it," even if doing it that way doesn't always make coherent sense. We've documented a long and proud AT&T history of such behavior, ranging from blocking disruptive technology to trying to buy off the wireless sector's few serious competitors. You can be fairly sure Apple will have a hell of a time bringing AppleSIM technology to their phones, since that's simply not the way the old phone company guys -- pampered by a generation of regulatory capture (not to mention a massive retail and special access, or tower backhaul, duopoly) -- have chosen to do it.

AT&T can be a harsh partner if you're not familiar with the company's particular uncompetitive charms. Lee Hutchinson at Ars Technica has been a loyal AT&T customer ever since the launch of the original AT&T-exclusive iPhone, and simply wanted to unlock his device for use during an overseas trip -- yet ran into a brick wall at AT&T. After the carrier's auto-unlock website tool rejected his advances, he contacted live support, who informed him he'd need to pay a $195 early termination fee if he wanted to use his device the way he actually wanted to. That left Hutchinson justifiably annoyed and confused:

"Why all the fuss, AT&T? Why refuse to grant a simple, reasonable request from a customer who’s been with you for more than seven years, and who provides a steady $130 a month of revenue? All I wanted was to take my AT&T device with me overseas, rather than having to grab a loaner device from Ron Amadeo (who at this point basically has a Scrooge McDuck-style money vault, but filled with Android phones instead of gold coins). Now, I'm left with the option of accepting AT&T's policies—which I won't—or canceling my contract and taking my $130 a month of revenue to one of AT&T's competitors. All because they wouldn't agree to a simple request that would have had no affect on the terms of our existing agreement. In what world does that stupid calculus work out?"

Hutchinson correctly notes that even Verizon, that ever-stalwart opponent of net neutrality rules, has current unlocking rules that are much more user friendly. T-Mobile, the company that regulators blocked AT&T from acquiring, also has significantly more flexible policies (though still far from perfect) in place -- allowing you to unlock your device under contract if you've got 18 consecutive months of payments on the books.

After the DMCA kerfuffle of a few years ago, Congress passed a law making cell phone unlocking legal again last July, but it not only punted on the deeper problems inherent in the DMCA, but also on simply requiring that phones be completely unlocked at sale. Changes have come glacially, but not without a large amount of carrier whining. The FCC got the big four carriers to sign off on a set of voluntary guidelines (pdf) late last year requiring that they make phone unlocking policies clear, respond to user unlock requests within a couple of days, unlock all devices for overseas military personnel, and notify customers when their phone is eligible to be unlocked (carriers balked heavily at this last one).

Additional progress in killing off the long-term contract and ETF model here in the U.S. has come courtesy of T-Mobile, which, while not quite as disruptive on price as the press and CEO John Legere would have you believe, has done a great job in killing off a number of less consumer-friendly carrier policies. AT&T has responded to this competition the only way that pampered duopolists know how -- they first tried to destroy the competitor through buying it, and when that didn't work -- settled on clinging desperately to old anti-competitive policies like an old baby blanket, oblivious to the fact that you don't retain loyal customers by pissing them off.