The problem with all of this is that you would need to swap SIM cards on the cellular-wifi router almost every time you change locations -- and that's if you can even find a data vendor willing to sell you a prepaid data plan without a credit card on file.

Practically, this solution you've come up with is too fragile to be relied upon. It's only secure if you can maintain this level of care with every operation you perform on the phone. This is why the NSA's data collection is so insidious -- it only takes one slip-up to connect everything you ever did anonymously to your "profile".

With the type of data collection that is done today, it's nearly impossible to avoid unless you use the Internet in a very different way than the average person. Avoiding data collection through technical means is a futile exercise at this point -- if you object to the data collection, public policy is the best avenue to prevent it at this point.

I'm not sure how any of this will help, if there's a chance they can link the phone/router IMSEI[1] to your person in some way.

It's reasonable to assume, that any network provider will, for billing, internal use (eg: document/fight network abuse) and/or as mandated by data tracking laws store IMEI, MAC and IMSEI numbers, along with connection meta-data (tower, exact location if available, timestamp etc).

I don't think it's possible to get meaningful privacy from an attacker that either a) is your service provider, or b) works with your service provider (eg: NSA, buyers of data for "advertising")?

You could use TOR - but you'd have to use it for everything -- which pretty much rules out real-time voice/video chat AFAIK. Perhaps a VPN that crosses jurisdictions and corporate ownership would help against "commercial" attackers (eg: the ad networks). I'm doubtful how effective such a "single-hop" defense would be against state actors.

Not that I necessarily think all threat models should try to circumvent illegal government wieretaps - just pointing out that if that is wanted in addition to just un-linking meta-data on data/communication from meta-data/data on shopping/banking -- the needed security measures are likely to be inconvenient.

[1] https://en.wikipedia.org/wiki/International_Mobile_Station_E...

> you would need to swap SIM cards on the cellular-wifi router almost every time you change locations

Assuming the user can get an anonymous pre-paid service (which I agree isn't certain), why would they need to change SIMs? The cellular provider only sees an unknown person sending encrypted data to a VPN hosting service.

Assuming there selling your home address to stores you visited. If you carry the same phone to the same house every day for a month they can guess your home address.(1) boom targeted direct mail.

Let's take this a step further, they link your phone's location to when you leave the checkout line, now they know where you live and what your buying.

(1) They may or may not be doing this, but at a technical level it would be easy.

Yes, I assume that a store could very easily link WiFi MAC addresses to CC numbers, and then loyalty cards.

The probability that someone checks out and leaves the store at the same time that you do is high. But two times in a row? Lower. 5 times in a row? Extremely small.

Identifying home or work location is something Google Maps does for your convenience. It would be trivial for cell operators.

Carrier don't have data that specific, cell phone triangulation isn't that precise.

There is a very thorough guide for achieving pretty much this from the Tor Project blog.[0] The most significant part in this process is completely separating the baseband from your user device.

[0] https://blog.torproject.org/blog/mission-impossible-hardenin...

Sounds great so far. There would have to be a temporary switch for 911 emergency calls from the user-endpoint. I have heard that VOIP services are not compatible with the phone/location trace programming necessary for emergency dispatch centers.

VoIP uses E911. Usually you pre-register your address with the VoIP service. But services with dedicated apps may pass along your GPS location today, I'm not too sure there.

There are ways to pass the coordinates in a VoIP 911 call. Unfortunately, these standards are designed by astronaut architects and are rather cumbersome. For instance, one uses MIME multipart bodies inside a SIP message. Which few systems handle properly (because it's such a bad idea and has no practical use cases).

Instead of being engineers and saying "ok, well just throw in a header X-911Location" or something simple, they gotta make shit complicated. It's ridiculous.

They also use this IETF designed address format. Which is rather ... comprehensive. All sorts of designation for streets and branches and so on. Except... none of the 911 systems actually use that. So they design this protocol with no care to how actual systems work. Or how actual street addresses in the US work. They basically made up their own idea of how address topographies could work.

But I'm guessing some of the larger companies doing VoIP probably have it sorted (like when you do a VoIP call on T-Mobile and there's no GSM just WiFi).

> prepaid so the provider doesn't need your personal info.

I don't think this is possible in the USA anymore. I tried with ATT Verizon and Tmobile but I'm sure they are smaller players. All required somewhat my personal info altho for prepaid Tmobile did not ask for SSN. All told me this is due to the fact you're getting equipment "practically free". When offered to actually pay for it, I was always told "we don't have option like that".

Europe is much simpler. I walked into Play store [1], put $60 on table, and got USB dongle with prepaid scratch card of 6GB on a 3G network. No IDs, no documentation, nothing. Refills are very simple - you purchase a scratch offs for 3/6/9 GB or more, over the counter, no ID required.

[1] http://www.play.pl

I think you can still get around that with some effort.

In 2010, I purchased a dumb phone/sim card for use on a prepaid plan. At the time it was the only way to get onto a super cheap prepaid plan since they wouldn't sell you a sim/the plan directly. I then put the sim into my own purchased smart phones(multiple nexus devices and a one plus one). For convenience reasons, I refill my account online with a cc but I technically could simply buy the t-mobile refill cards for cash then activate the time on them.

As far as I know, there's nothing stopping me from doing this fresh again with a new prepaid phone and then never associating my real identity in any way.

They don't even need to; your telco can know your home address based on a week's worth of location data, and could likely determine more about you based on where you go to work, shop, etc. Humans are creatures of habit, so it's relatively easy to draw inferences from simple patterns (i.e. if you spend 6-8 hours in the same location every night, that's probably where you live.) All it takes is one time checking your e-mail from an IP address to forever link that IP address to you. Know enough IP addresses someone has connected from and you can come up with a pretty good picture of their friend circle, their movements, how old they probably are, etc.

I work in the telecom industry, and this behavior exists because it's not explicitly illegal. This type of data mining is just scratching the surface of their capability -- turns out that a combination of about 30 seconds worth of data scraped off http traffic (not https, though even https can tell you something) and a location are enough to identify most individuals and link them to a profile in a DMP -- which can tell you all sorts of information like which products you've purchased recently (both online and in brick and mortar stores with a credit card), any relevant demographic information, and even what kind of porn you like.

The real restraint on this has been in the use of this information. Marketers have been remarkably conservative in using this information; likely for fear of scaring off customers with "creepy" data. But rest assured they know more about you than you do yourself.

Thanks; that is valuable information. So my whole plan (in the top-level post at the root of this discussion) is hopeless, at least in terms of having anonymous, untracked phone usage?

> your telco can know your home address based on a week's worth of location data

How accurate is that location data, do you know? Within 10 yards? 100 yards?

I can't remember the limit, but it's a legal one not technological. The military has a legal monopoly on precise GPS.

Similar here. I too have used my CC for refills and may have given my name for caller ID purposes, but I don't think it was mandatory nor do they have my SSN or other hard details on my identity.

AFAIK you shouldn't have to get a throwaway phone either. "SIM Card Kit" or "Bring your own phone/device" may be keywords to research -- you should be able to get a SIM that you can put in any GSM phone, and it will come with instructions about a website to visit, or phone number to call, to activate it. If they insist on names etc and it's prepaid, you could give a fake name since it will have no bearing on your ability to use it, although I'd be worried that it might be illegal for some stupid reason.

Go to a smaller vendor like Cricket, they will still do cash prepaid.

Computer + wifi hotspot is a strong local optimum. I started down this road, and ended up with a Samsung i9500 because I wanted something small enough to fit in my pocket (everything without a baseband was too big, or wicked old). Hotspot is from Freedompop - $4/mo is great for experimenting.

I didn't have a clear direction after that, so I proceeded with the works-right-now solution of Google Hangouts (with all of its associated proctology). I haven't done much else with it besides backslide a bit by getting a cheap SIM so that it would ring reliably (Hangouts is a flaky POS).

Location tracking is my biggest concern (Getting on the PSTN anonymously seems like a completely different problem, and I'm less interested in tackling it), but I don't see much way around it when you're using the cell network for backhaul. Unless you religiously shut off your wifi point, pay for a new wifi point + plan in cash every few weeks, and get enough people doing this that you can blend in.

IMHO all of these guides that talk about prepaid sims and burner phones really only work for exceptional situations where someone is willing to jump through many opsec hoops. They aren't congruent with people's standard expectations of cell phones. Any solution has to roughly work with people's expectations to be adopted, since most people only casually want to defend their privacy.

The proper privacy-preserving cell solution would use bearer tokens to pay for network access, and have no device identifier tokens. This is obviously a pipe dream. The only advance I see on the horizon is as more wifi points open up, ideally coupled with software control of your identifiable cell radio that would selectively allow tracking for checking in if it had been too long since seeing a wifi spot. Most people are probably only out of the range of wifi for an hour at most times, so if it was acceptable to delay reception of messages that long, a lot of every day privacy could be practically achieved.

If you had $100M perhaps it would be possible to start a privacy-preserving MVNO with devices that shuffled identifying information every day.

Thanks for the comment -- just a reminder for people reading this that in the wifi hotspot solution case, in order to thwart location tracking you should change your device MAC address, otherwise the wifi providers can identify your device (and some of them will!).

An unexpected obstacle about the privacy-protective MVNO that I heard about from someone who was investigating this is taxes on "telephone lines" that the MVNO is supposed to pay whenever it "activates" a "line". It may be difficult to reconcile this with changing subscriber identities every day (assuming you can get ahold of devices that change device identity every day).

Whenever I talk about this I say: it's too late to change the cell phone network cheaply now (though we should still be vocal about the problem and not give up: we shouldn't accept that there is someone who knows where almost everyone is almost all of the time, which is the case today). If you're designing a new communications system, make sure that it starts with privacy protection and user and device anonymity, and layers optional identity on top where needed, rather than the reverse! Let's not be saying in 2030 "oh, if only people in 2015 had thought about the privacy issues with this technology...".

It seems like you could solve the "new line" problem within a constant factor - just pay the cost for a pool of triple the number of "lines", which then get allocated a day ahead of time by spending a bearer token (round-tripped through eg TOR such that the provider cannot link the new and the old). Device "identities" can be reused because the mix pool is constrained by the subscriber base anyway.

I'd worry about the IMEI/etc becoming a secret token that could be reused after it was assigned to someone else's device. But even if the SIM's technology couldn't fix that, it could be fixed at a higher level after gaining network transit.

But yeah, I was teetering between $30M and $100M for my estimate, and the unknown unknown wtfs pushed me on up :>

I'm not positive whether it counts as a "new line" if you swap existing lines of existing users, but maybe there's some way to arrange it to avoid triggering the tax every day for every single user.

Thanks. This deserves to be repeated:

it's too late to change the cell phone network cheaply now (though we should still be vocal about the problem and not give up: we shouldn't accept that there is someone who knows where almost everyone is almost all of the time, which is the case today). If you're designing a new communications system, make sure that it starts with privacy protection and user and device anonymity, and layers optional identity on top where needed, rather than the reverse! Let's not be saying in 2030 "oh, if only people in 2015 had thought about the privacy issues with this technology...".

Tax basis for mobile in the US is generally usage based to satisfy USAC/USF; not per act.

> Location tracking is my biggest concern ... but I don't see much way around it when you're using the cell network for backhaul

If the cellular provider doesn't know who you are, why does it matter if they track your location? Under my proposed plan, they won't know who you are because the prepaid cellular service is anonymous and all your data on the wire is encrypted and going to the same VPN host.

> Getting on the PSTN anonymously seems like a completely different problem, and I'm less interested in solving it

Is there a VOIP service that will take bitcoin or some other anonymous currency? The problem is that you have to give people your name and phone number (unless you do only outgoing calls); inevitably they will become associated in many databases.

> If the cellular provider doesn't know who you are, why does it matter if they track your location?

I guess they won't, so you'd defeat some commercial advertising. But the location information still gets dumped to government databases which will easily correlate your path to home/work/friends/CC etc and find an identity for that IMEI. It's similar to saying that Bitcoin is "anonymous" - sure, if you jump through a lot of opsec hoops you can achieve privacy for a particular transaction. But the system lacks the stronger property of untraceability, which is required for common casual users to retain their privacy.

Psuedononymous PSTN access doesn't actually seem that hard - a prepaid CC to some VOIP provider. It's just orthogonal to location tracking, so I haven't thought much about it.

To add, IMO there is a gap in the market for a dumb phone that can also act as a 4G router. I can then pair it with my tablet/iPod touch when I need to go online.

But most times, I want to use the phone just to make/receive calls/text & have good battery. No need for a big display or other stuff.

The biggest problem with this I think is that it files in the face of the goals and incentives of all service providers. They want your personal data for marketing (not to mention engineering reasons like infrastructure optimizations), and they need your personal data because government.

Some commenters mentioned that you can still get burner SIMs in Europe, but last time I checked it was incredibly hard anywhere in the world (maybe I don't know where to look) - even in China they want your official documents to sell you a prepaid card. The reason I always been told, that sounds plausible to me, is that easy access to burner phones leads to too much mess with criminals using them for their criminal things, and with random pranksters calling in fake bomb alerts.

> it was incredibly hard anywhere in the world (maybe I don't know where to look)

I was never asked for any sort of ID to get a SIM in Mexico or Vietnam. In any case, retail mobile store workers don't care enough / can't tell a real document from a fake one.

When I was in Europe and Latin America both, I could buy SIMs by writing down whatever number I concocted for my DNI. Now, I actually wrote my passport number down but nobody really looked. One time I used my CA drivers licence, which could have been a Boy Scout troop membership card for all anyone cared.

Note that document forgery is a "real crime" most everywhere - so if you were caught (perhaps due to some unrelated investigation) - it might not be the best idea.

I'm not saying you shouldn't break the law to preserver your anonymity (at your own discretion) -- I'm just saying it's something to take into consideration. If you for example fear that you might get dropped in a black site, fed polonium or pushed down some stairs over your on-line activities -- a little document forgery might be just the ticket.

Astonishingly simple in the states to get a SIM without an ID; a random exception.

>Android with per-app permissions controlled by user (e.g., user can enable/disable access to location data for particular apps). This could be a fork of Android or maybe there is security software that could be installed, such as on a rooted phone.

This is a built-in feature in Marshmallow [0].

[0]: http://www.greenbot.com/article/2990078/android/how-to-toggl...

Yes, one can limit some permissions, but there are others that vanilla Android will not allow one to block. For instance: Device ID. I don't have a complete list of the un-blockable permissions, but simply using Android's built-in functionality is not sufficient to block all identifiable data that your phone's apps leak.

> simply using Android's built-in functionality is not sufficient to block all identifiable data that your phone's apps leak

Do you know happen to know a solution? I know there are many confidentiality utilities and Android forks which emphasize it, but I don't know enough to evaluate them.

Not exactly. Years ago I used an app called LBE Privacy Guard with success, but it's closed-source and cannot be trusted with such a privileged level of access to my phone.

Now I use a combination of blocking with the built-in app, running a custom ROM with root (which allows you to use many of the known privacy apps at their full potential), regularly changing my DeviceID with the help of yet another app and routing some of my device traffic through Tor via Orbot. It's definitely not perfect, but I feel like I'm at least partially thwarting the rampant collection/trade of my personal and private data.

So, sorry I can't be of more help, but you really have to just dig in and read the fine print with this sort of thing. Many of the apps only work with specific versions of Android, require root, might require ROM patching, ect. YMMV, unfortunately. Good luck.

Doesn't solve the problem of the network reporting your location (disabling the baseband does, but operating system level permissions don't impact the network).

I know that's outside the scope of your comment, but I wanted to point out that the baseband is not a thing the operating system really controls in any meaningful fashion.

Android tablet with no baseband, e.g. a Nexus 9 for example. Freedom pop sells such a device

permissions: Android Marshmallow has this bog standard, no root needed, so might have to watch to make sure it's available on whatever device you choose.

voip: google voice/hangouts can make this possible, also skype, hangouts, and a number of others.

VPN: basically anything android compatible.

It's not a terribly convenient thing to initially setup but it's not difficult either anymore, I actually did this for a few months when I broke my phone and just decided to go all IP instead of buying a new phone (had the tablet, and the hotspot device, previous phone didn't have data). It worked well enough in the Los Angeles area, but outside a city it was basically non-functional.

The other points about 911 and such are bigger issues than this.

VoIP calls over VPN over cellular data are likely to have extreme reliability, latency, and jitter problems.

I was wondering about that.

* Regarding the VPN: Inevitably it adds an extra hop but with a VPN that provides sufficient bandwidth, low latency, and sufficient processing resources to decrypt/encrypt at wire speed -- I assume that either it will cost extra or will be something the user has to setup at a good hosting provider -- couldn't performance be sufficient for voice? IIRC, from long ago, voice needs ~80 Kbps.

* Regarding cellular data: Cellular connections are very widely used for voice, of course. Cellular data connections are used now (e.g., VoLTE). On one hand I'd have the same doubts you do; on the other it seems to work. Aren't there already VOIP apps?

"Uncompressed" voice "needs" 64kbps (hence ISDN was 2 voice channels etc). If you use a modern codec, you could probably get away with less, for high-quality mono voice. Note that you might not want to use VBR, for other reasons (I thought this was already submitted to hn - couldn't find it - so here's a fresh submission):

"Attacks on packet length may be surprisingly good: Hookt on fon-iks": https://news.ycombinator.com/item?id=10462363

That said, I suspect that eg: Ogg Vorbis at 64kbs CBR would be fine for voice, assuming you could keep the latency down.

Latency and drops would probably be the biggest issue. And you can of course prove, that latency sets a limit to the number of hops -- say if you'd want to hop through a European jurisdiction from the West Coast.

I'm actually planning to (try to) move to a pure data-oriented (not sure if there will remain a cellular part, or if I'll just use wlan) (probably) SIP for all my phone needs. That'll probably involve a SIP server on dedicated (rented) hw in Germany, and VPN from the phone/laptop. Not quite sure yet if it'll work out, or if it'll be good enough.

I think we should differentiate two things:

First there's state level surveillance.It's a hard technical challenge and I'm not even sure those steps would help.

Second , there's what this article talks about. Probably using VPN(and maybe some software that turns down 3G/4G connection unless it's strictly necessary) would neutralize most of this issue - because planting baseband malware and maybe risking exposure doesn't seems to be worth it just for ads.

> First there's state level surveillance.It's a hard technical challenge and I'm not even sure those steps would help.

If the state is determined to track or identify the user, I agree this doesn't help. It might delay them a little. But I don't mind the state investigating people for legitimate reasons (e.g., under a warrant); I'm not trying to protect criminals. Also this won't protect people persecuted by repressive states - that's a very valuable goal, but outside the scope of this idea.

For dragnet surveillance I suspect this would work, simply by adding enough complexity to the task that it's not worth it for one more data point among billions.

Of course anyone could make a social graph based on my phone calls and learn a lot that way, but I don't think anonymous phone calls are possible. If I want to receive incoming calls then I have to give out my phone number; my name and number inevitably become associated. (I can think of a few weak solutions, such as having many phone numbers, but that's imperfect and impractical.)

The thing is: just by doing those thing - you mark yourself as a target(maybe worthy of deeper probing).

And if everybody do so(hard to believe), the state, since it seem to really value dragnets - would play another move in this probably infinite cat and mouse game.