The UK government has proposed a new law that would make it illegal to own or supply simboxes unless there is “good reason or lawful authority” to do so. Sections 80 to 82 of the Crime and Policing Bill refer to “SIM farms”, the fashionable name for the same old simboxes that have been plaguing telcos for decades.
…“SIM farm” means a device which is capable of using five or more SIM cards simultaneously or interchangeably, for the purpose of–
(a) making telephone calls to persons at telephone numbers allocated in accordance with national or international numbering plans, or
(b) sending messages to, or receiving messages from, such telephone numbers.
The legislation includes a non-exclusive list of legitimate purposes for simboxes.
(a) providing broadcasting services,
(b) operating or maintaining a public transport service,
(c) operating or maintaining an electronic communications network (as defined by section 32 of the Communications Act 2003), or
(d) tracking freight or monitoring it in any other way
I doubt this truly addresses the issue of simboxes being used for bypass fraud because businesses previously caught using simboxes to avoid termination fees typically argued they were legitimate operators of communications networks. Anyone who followed the UK’s tortuous arguments about the legality of using simboxes for bypass will appreciate that this new legislation ignores the previous methods of restricting their use. This is probably because the political motivation for the new prohibition stems from the use of simboxes to send scam SMS messages to consumers rather than older abuses that cheated telcos out of money. Bypass fraud stopped being a concern in the UK because changes in rates meant it was no longer profitable. However, older criminal technologies can come back into fashion as changes in prices or behaviors result in new opportunities for enterprising crooks.
The risk is that the new rules still leave a grey area where simboxes are used as relay stations for calls that originate in a foreign scam compound. Such calls are conveyed over the internet to the UK and then connected to a conventional mobile phone call. Simboxes are used like this to evade analytical controls that detect anomalous traffic. However, any criminal could argue this use of simboxes falls within the definition of operating an electronic communications network. Any follow-on legal arguments would concern whether there are other obligations on network operators that the criminal failed to comply with.
Care will also be needed with how this law is applied in practice. Network coverage and roaming tests should fall within the definition of operating and maintaining networks. Whilst this should be true from a legal standpoint, it may not be easy for the police to consistently tell the difference between the good and the bad reasons to use simboxes.
These are just my opinions. The UK government does not ask my advice on topics like this. They probably rely on input from experts who are so docile that they do not question why simboxes now have to be called SIM farms. Why anyone would describe a black box that holds five SIM cards as a ‘farm’ is a mystery. Is it to make them sound bigger?
If they were interested in my opinion, I would have asked why they failed to include SMS blasters (aka false base stations, aka IMSI-catchers) in the same legislation. There are fewer legitimate uses for SMS blasters than simboxes, and there has already been a case of an SMS blaster that sent smishing messages within the UK. The omission of SMS blasters is especially perplexing given that a different section of the Crime and Policing Bill prohibits the ownership of “electronic devices for use in vehicle offences”. This includes radio devices that car thieves use to relay signals from keys inside a person’s home to cars that can be opened and started remotely.
The use of IMSI-catchers is somewhat addressed by existing laws against spying, but the principle of only being allowed to have a radio communications device with “good reason or lawful authority” could have been neatly applied to SMS blasters at the same time as simboxes and vehicle signal repeaters. It would have been especially useful to have a law that prohibits the supply of SMS blasters, so this could be used to bludgeon YouTube and other social networks into removing adverts for SMS blasters. Did none of the experts who advised the government understand that it is possible to send scam SMS messages without having a SIM? Were they unaware of the extent to which Asian countries are fighting the import of SMS blasters?
Other parts of the bill give the police the power to enter a property without a warrant if there is a tracking signal that shows a stolen laptop or phone is inside. This is a sensible development that is likely to be popular with voters. There has been tremendous frustration over the police being unable to take action despite victims of theft knowing the location of a stolen device. However, it would be even better if manufacturers implemented systems that switch off some or all of a stolen device’s functionality, thus reducing the resale value of the device. There would still be an incentive for theft because even a broken phone has value when recycled for materials but the incentive would be reduced.
The coverage given to the Crime and Policing Bill focused on the police powers to recover stolen devices. This also served as a useful reminder of why we should routinely question the quality of information we receive from specific sources. We live in an era of misinformation, disinformation and overinformation. Many of us spend too much time looking at screens that bombard us with content designed to grab our attention. Much of this content comes from people who use time selfishly: they want you to spend more time paying attention to them than they spend on weeding through information to find the details that really matter to you. Many of the usual suspects have been bellowing on social media about the Crime and Policing Bill, but none mentioned anything about simboxes, even though preventing the use of simboxes by criminals is the part which is most relevant to the work of a typical telco fraud analyst. They only copied the headlines that were written for the general public, instead of highlighting details of relevance to professionals. Keep that in mind when considering how much your business pays so-called professional associations in exchange for the low-grade information they recycle, and how you get a much better deal by reading Commsrisk!
The text and the progress of the Crime and Policing Bill can be seen here.
