Ad intelligence and other ways to find someone by their phone

In brief

A survey of ways to track a person by their phone with open-source methods — from the historical HLR lookups through SMS centers, which closed in 2018, to ADINT, intelligence from advertising identifiers. The way it is split is simple: if there is physical access to the device — install parental control or turn on live location sharing and delete the chat; if there is no access — collect the digital trace, log the visits, use leaked passwords and lost-phone search services, listen to the Bluetooth airwaves and MAC addresses, read the advertising identifiers. The heaviest thing in the talk is the ending: according to the speaker, the marketing platforms of Yandex and the mobile operators hand out data on the number and composition of devices in a given area with almost no barrier to entry, and that is already a matter of exposing troop positions and guiding weapons. In the questions the speaker is asked point-blank on what grounds he does all this — and that is the most substantive exchange.

Key points

• The frame of the talk: tracking a mobile phone with competitive intelligence and OSINT methods. A disclaimer right away: "I'm not law enforcement, and I'm in no way encroaching on that delicate, mostly unnecessary domain".
• Before 2018 it was all elementary: through SMS centers you got the LAC and CID — the base station's coordinates — practically in real time: a ping SMS, then an HLR lookup. Later the operators started returning a code instead, but the code was geographically determined: it was enough to drive around the cities and collect the ties to areas.
• In April 2018 "that Overton window closed": the SMS centers started returning the center's own data. In Ukraine the option survived for about another year; in the United States it faded away gradually.
• The economics of the time: detectives sold the "flash" service and call detail records for 10–20 thousand rubles, "we did it for 29 kopecks", and "completely legally, through an equally legal SMS center".
• From there everything splits into two categories: methods that require physical access to the device, and methods without access.
• With access: parental control software (Kaspersky, Google's standard app and dozens of others) — they track a child's or an employee's phone; operator services for tracking employees and relatives.
• The live location trick: open the messenger on the target's phone, start a chat with yourself, set up continuous sharing of the location to your own device, and delete the chat on the other person's phone — the sharing will remain, "until they turn off GPS or reboot the phone".
• On unlocking a device: "there are very experienced people who have Mobile Criminalist… We, of course, don't have that", in the field you work with what you have — with social engineering. In most cases a person shares the password themselves; what works is "can I borrow your phone for a call", watching the password being entered, the repeatability of pattern-lock shapes, talcs and powders for developing fingerprints. A television example: a girl was given Turkish delight and then her phone — the greasy marks stayed in the right places.
• Without access the surveillance is not of the phone but of the whole set of devices and data associated with its owner. The simplest thing is a call under the cover story of a courier or a flower delivery, asking when the person will be home.
• Then the digital trace: social networks, Google and Apple accounts, messengers tied to the number; reviews, comments, what is uploaded to the cloud and "turns out to be tied to Maps".
• Working practice: when vetting candidates for positions of responsibility, they pull out the entire digital background — subscriptions, public messages in chats, channels, communities — and analyze it with a neural network; the output is a map of movements, a heat map, connections and ties to addresses.
• Logging: when the target visits a prepared web resource, a digital fingerprint is taken — the IP, data about the device and the browser, the screen resolution, language settings, cookies; with extra settings — the linked social accounts, geolocation, "in some cases" a photo from the front camera and a voice sample.
• Mass messaging with logged objects via bots, ad networks and email makes it possible to record a person's presence at a certain place and time. The technical basis is the HTML5 GeoAPI ("already 12 years old"): GPS, Wi-Fi, cell towers, IP. In a browser permission is required, but on mobile phones "that permission is often on by default".
• Leaked passwords plus the built-in lost-phone search services: knowing the email and the current password, you can watch the location online — there is nowhere to confirm two-factor authentication, the phone is "lost" after all. A personal example: this is how the speaker keeps an eye on his daughter, "bypassing the parental apps that annoy her terribly".
• The airwaves: phones, watches, earbuds and rings constantly broadcast Bluetooth identifiers, LoRa, MAC addresses. An outside observer with a scanner (WiGLE, nRF, LightBlue, BLE Radar) sees them around.
• Application: during physical surveillance, check whether a device with a known MAC address is within range of your own phone. And a grid of such receivers — like the Wi-Fi radars once proposed for shopping malls — gives the same thing the operators get from cell towers: movement tracking, and "this is no longer a phone number that can change, this is actual detection of the device by its MAC address".
• Trackers: over the past year the speaker has had several cases involving AirTags used to spy on people, up to claims of a planned attempt on a life. Modern iOS and Android detect most trackers; if needed, an extra app is installed.
• A non-obvious conclusion: a tracker that has been found gives itself away — the person realizes they are being followed. But a "lost" earbud from the same ecosystem, which is likewise located through the maker's device network, prompts no such thought when it is found, so for surveillance it makes more sense to use ordinary Internet of Things objects.
• The advertising identifier assigned by the corporations is available to private individuals as well — hence the transition to ADINT.
• ADINT — intelligence from advertising identifiers; it emerged in late 2017 in a university lab in the United States, and the speaker's first Russian paper on the subject dates to 2019. The researchers' original question: why an ad "follows" a user across sites, that is, what identifier links it together.
• The result: what is under control is not only location and movement but also the number of users in a given geolocation, their gender, age, interests, income level, relatives and the connections between them — "everything we used to associate with the results of serious analytics on telecom operator data. Today a machine does it all". The first products were Israeli; the data is enriched with OSINT and leaks.
• The main practical meaning for investigations: changing the phone, the email and the number does not save you — the corporations stitch the portrait together and issue a single advertising identifier by which a person is found in the systems of the major platforms. The speaker's wording: "the IT corporations work in the interests of law enforcement, constantly stitching our portrait".
• What this gives: a digital portrait, movements, social connections and monitoring of people's presence in a particular area at a particular time.
• The harshest claim of the talk: through the ad audience service and the operators' marketing platforms you can see the number of devices in a chosen area, the number of their users, the breakdown by gender, age and interests and the cities they came from — and if you "walk along the line of contact", that exposes troop positions and is material for guiding precision weapons. Cited as examples are the cases from the start of the year where Israel used ADINT, including the strike on a girls' school; the same technique is used to deliver spyware.
• The conclusion about the barrier to entry: domestic marketing services and ad audiences are available "completely free of charge, after the simplest registration, or not registering in those services at all", whereas the foreign platform requires taking part in auctions, access to mobile app SDK data and "a hefty deposit". The appeal is for the operators and the platforms not to dump such data into practically open access.
• His own project: a free portable browser based on Opera for OSINT research — messengers, websites, cryptocurrencies, "1000+ different OSINT sources", neural networks and accounts inside, it runs off a flash drive and stores the logs there too.

Tools, artifacts, technologies

• Historical: SMS centers, ping SMS, HLR lookups, LAC/CID, geographically determined codes.
• With access to the device: parental control software, operator tracking services, live location sharing in a messenger, social engineering and fingerprints on the screen.
• Without access: the digital trace of social networks and clouds, neural-network analysis of public activity, logging (IP, browser fingerprint, social accounts, geolocation, front camera, voice sample), HTML5 GeoAPI, lost-phone search services plus leaked passwords.
• The airwaves: Bluetooth, LoRa, MAC addresses; the scanners WiGLE, nRF, LightBlue, BLE Radar; the idea of a grid of Wi-Fi radars; AirTag trackers and Internet of Things objects as carriers of surveillance.
• ADINT: the advertising identifier, the stitching together of a digital portrait, ad audience services and the operators' marketing platforms, Israeli commercial products; in the questions from the audience Palantir, Rayzone, Sherlock, Paragon and the Maven project were named.
• His own tool: a portable OSINT browser based on Opera.

Legal and organizational context

The speaker separates himself from operational-search activities (ORD) in advance ("I'm not law enforcement"), but almost all the techniques described come from the operational repertoire, and the audience notices it. The legal frame comes up only in the questions: whether a mobile device needs a special legal status as an instrument of technical intelligence and on what grounds a non-state structure collects personal data. The whole legitimation is built in the answer to the second question: academic work and papers written at the academies of the Investigative Committee and the Interior Ministry Management Academy, research and R&D projects, teaching at specialized educational institutions, work on reasoned requests from law enforcement bodies, and private commissions only when the client has a case file under review and a law enforcement body approaches — "in compliance with the requirements, first and foremost, of the personal data law". The historical reference in the answer to the first question is the permits for buying a phone in the 2000s.

Questions from the audience

• 1 (name not given): "You've been talking about ADINT for over a year now… And yet nothing changes". The mobile device has turned into an instrument of foreign technical intelligence — is it necessary to give it a special legal status in order to counter that more effectively? Cited in support: Palantir, Rayzone, Sherlock, Paragon, the delivery of a malicious payload through targeted advertising, the Maven project and the fact that in the special military operation zone banned phones are used anyway. → Agreement: "that's probably exactly what all the regulators' actions are saying… Regulators all over the world". The metaphor of the answer: "There's the Renaissance, and we have the Age of Return" — to a way of life where the state holds a monopoly on the means of informatization. Conclusion: create your own software and hardware products out of reach of surveillance from outside.
• 2 (name not given): "what are us mere mortals to do?" → First a joke about the mandatory installation of a messenger on your main phone, then personal experience: on an old Android he stripped out the vendor's services and automations — "it started flying", the volume of traffic dropped sharply, he put the maps and apps into offline mode, which came in especially handy during the period of blocking. The advice for those tied to proprietary services is to change the advertising identifiers and limit the collection in the settings, but "that's very naive": he does not trust the settings, just as he does not trust the platforms' claims that they collect nothing — "when Yandex needs it, it's all there".
• 3 (name not given, the sharpest): you represent an advisory body of non-state security structures — does it not bother you that you are taking on the functions of a subject of operational-search activities? For the legitimate collectors of personal data the laws are "draconian", "and you're collecting it illegally on top". → "It's very debatable that I'm collecting illegally, because it's sitting in the open"; the automated processing of "quasi-personal" data is "questionable". Then a list of grounds: academic work and papers at the departmental academies, research and R&D projects, teaching, work on reasoned requests, private commissions when there is a case file under review. He himself rephrased the question as "what the hell am I doing here".
• There was no time for a fourth question: the moderator closed the block because of a slip in the schedule, suggesting that people come up to the speaker in the hall.

The speaker's position

The tone is free, provocative in places: the speaker demonstrates surveillance methods as a technical reality rather than as an instruction, but he draws the line with words, not with content. The strong sides are the historical perspective (you can see how the loopholes were closed), the honest "we don't have that" about expensive tools and the direct criticism of domestic platforms for the availability of data. The weak one is that the question of the legality of his own practices is raised only by the audience, and the answer is built on status and academic work rather than on an analysis of which specific actions are permissible. The final part about exposing troop positions is delivered as a warning to the regulators.

Quotes

• "I'm not law enforcement, and I'm in no way encroaching on that delicate, mostly unnecessary domain".
• "They sold all that to their clients. For 10 or 15 thousand rubles, some for 20… We did it for 29 kopecks".
• "…the IT corporations work in the interests of law enforcement, constantly stitching our portrait".
• "There's the Renaissance, and we have the Age of Return".
• "And you trust those settings? No, of course I don't".