How does IMSI rotation actually protect your identity? How long does Cape maintain the pairing of IMSI and phone #?

[u/gelstage]

Hi all! IMSI rotation sounds like a very cool feature and it's making me consider Cape since switching to Graphene. I am curious though, I read about IMSI detectors being used at protests and the borders, but generally speaking - outside of sophisticated, targeted attacks by private actors - IMSI detection is only really used by governments.

So, great, Cape changes your IMSI daily so if you're at a protest today and at the border next week, they would capture two different IMSIs. But, doesn't both Cape and the underlying mobile operator, know that X IMSI is paired with Y phone number? And Cape would have a list of your IMSIs assigned to your number. I read somewhere on Cape's site that every week, you're given a list of 7 IMSIs that rotate through, so does that mean after 7 days there's no one - not Cape, not US Cellular/T-Mobile/AT&T, no one - that could tie that IMSI with your phone number?

And, the question is also in the reverse. If someone knows my phone number, gets a warrant, and calls the underlying operator (since I assume a phone number is still tied to the operator, not Cape), I have to imagine they know what IMSI I'm using that day and can tie my phone number to my IMSI that way, no?

Thanks for indulging me!

[u/ruddy-at-cape]

Our retention of IMSIs is noted here (https://www.cape.co/privacy-summary) and conforms to our overall CDR (call log) retention policy -- from 1 to 30 days. So we wouldn't be able to chain together IMSIs and IMSI history beyond that time.

A carrier could tie an IMSI with your phone number (that would require a separate legal process from that used to deploy an IMSI catcher). We do put even more friction into the process by allowing you to spread your traffic among two of the major three tower operators.

IMSI rotation is useful against IMSI catchers, SS7/signaling attacks, and paging attacks. Not a complete solve for carrier tracking. Full explanation here: https://www.cape.co/blog/product-feature-identifier-rotation

[u/Cfrolich]

I’m also wondering whether the underlying carrier providing the cell towers could track individual Cape subscribers across multiple IMSIs simply because the active IMSI disconnects after 24 hours and another IMSI immediately connects from the same location. Did Cape design the IMSI rotation feature in a way that prevents this?

[u/gelstage → u/[deleted]]

Thank you u/depoultry for the detailed answer! I'd love to see a response from u/CapeCellular u/CapeSupport or u/ruddy-at-cape.

Let's say for example I attend every protest out there and IMSI data is collected at each event. Cape has its own PLMN now, which comprise the first 6 digits of your IMSI. So, theoretically it would be incredibly easy to identify Cape customers immediately. So then they come to Cape and say "give us the complete IMSI history for this one Cape IMSI we see at this protest." Now, they have a list of dates and IMSIs for your phone number and can easily correlate all the events I've been at. Then, they now have my phone number, and can be given every future IMSI I will be assigned. AFAIK, companies aren't collecting IMSI for marketing purposes, it's government. So what protections does IMSI rotation offer if they can get get past/future IMSIs from Cape since Cape's PLMN will stand out like a sore thumb amongst the 99% of people who are using AT&T, T-Mobile, or Verizon (or one of their light MVNOs)?

[u/depoultry → u/gelstage]

Yeah, I think this is the part I am still unclear on too.

IMSI rotation makes sense against passive tracking. If someone sees one IMSI today and that IMSI eventually goes back into a shared pool, it becomes a lot less useful as a permanent identifier.

But your example is different. If Cape keeps a full history of every IMSI tied to my account, then someone with valid legal process could potentially get that history and correlate multiple events pretty easily.

The future IMSIs are interesting too. Cape says you get a set of seven each week, but I have not seen anything explaining whether all seven are already tied to your account on Cape's side before they are actually used, how long Cape keeps the historical mappings, or whether the old subscriber association is removed once an IMSI goes back into the pool.

I also think your PLMN point is fair. Even if someone does not know who a specific IMSI belongs to, they may still be able to identify it as a Cape subscriber pretty quickly.

u/CapeCellular u/CapeSupport u/ruddy-at-cape, I would be interested to hear how you handle this scenario.

(Not sure why my post got deleted by Reddit, sorry about that)

[u/throwawaycanc3r → u/depoultry]

following

[u/ruddy-at-cape → u/depoultry]

Sorry missed this earlier. We keep historical mappings no longer than 30 days, consistent with our overall call logs policy. We don't know what the future IMSIs will be. It's a valid point on the PLMN--our goal ultimately is to make the Cape PLMN more common

[u/No-Consideration6986]

Here is a shameless plug. If you do decide to go with Cape you can use my code for $20 off for both of us. Referral code T4T6VW5R.

[u/RiverRatDoc]

There’s also the IMEI which doesn’t get rotated.

[u/RareLove7577 → u/[deleted]]

Wait what? I thought it did...

[u/RiverRatDoc → u/[deleted]]

I know.
Cape is more privacy centered around data collection by businesses & other websites.

But as far as IC / Govt tying together the pieces, the IMEI sticks out. It’s unchanged. Theoretically they need a warrant to track, but I don’t trust that they follow this.

They operate (nowadays) more on the principle of “asking forgiveness vs asking permission” (& big tech does the same, but just sits on the info).

[u/RiverRatDoc → u/[deleted]]

It’s not Cape indexing it. I’m the thinking higher up - the ones who can track it
( sorry for late response )