What is the maximum amount of imformatiom about a user and the user's phone that can be obtained by a wireless carrier on a GSM network? Here is a list of the things I know, but are there more?

  • IMEI, a theoretically unique identifier of the phone. Can, however, be spoofed om many phones.
  • IMSI, an identifier embedded into the SIM card. Can be changed by swapping SIM cards, and if done at the same time as IMEI is spoofed to another one, should make tracing the chamge difficult.
  • Data about calls and SMS as the carrier must process it in order for calling/SMS to work. Not much can be done about it.
  • Device location, by triangulating it's position based on signal strength. Nothing can be done to prevent the carrier from accessing it, either.

What can be done to minimize the amount of sensitive data available to the carrier? Again, is there anything more than what I already know?

  • Use a data-only SIM, bought in cash, in combination with an online phone number provider with a good privacy policy order to prevent your identity and location data from being associated. However, this requires that you trust the provider in question, an does nothing to prevent SMS and calls from being snooped on.
  • If possible, use an encrypted chat app such as Signal instead of regular calls or SMS
  • Regularly discard and change the SIM card, taking care to change the IMEI at the same time.

Anything more that can be done, while still having a working phone number? What data is still leaked?

  • With any data-capable phone, unless using something like Tor or VPN, carrier will also see full HTTP URLs, domains of HTTPS requests, DNS requests, etc. Some discussion of that here: freedom-to-tinker.com/blog/feamster/… – pseudon May 29 '16 at 14:21
  • what CAN they access? your carrier can typically OTA an app or even OS patch, as can google, so anything on the sd card, gps coords, motion data, camera and mic, keystrokes, screenshots, contacts, full web history, keys in ram, etc. just about everything... CAN!=WILL, but under court order, they have been know to push "malware" to specific phone that can silently gather all the above. – dandavis May 30 '16 at 6:20
  • You can also use AIMSICD (Android IMSI Catcher-Detector) to detect when a stingray is in use nearby. This way, you can protect your device from being fully compromised by an IMSI Catcher. – Paradox Jun 29 '16 at 14:36

Your Answer


Browse other questions tagged or ask your own question.