Softpedia >News >Security
Softpedia Homepage   

What Data Carriers Can Collect About You Using Just the Phone Number

According to data retention laws in specific countries

Feb 6, 2020 13:37 GMT  ·  By
Carriers can determine your location when connecting to their cell towers
   Carriers can determine your location when connecting to their cell towers

A couple that traveled from Wuhan to Australia for an auction was diagnosed with coronavirus, and in an attempt to find all those who the two have been in contact with during their stay in the country, law enforcement turned to a phone tracking system typically used for locating criminals.

Aussie authorities said they turned to such systems because they wanted to know precisely where the two have been in the Australia, so they can then find any individual who might have been exposed to the coronavirus.

The phone tracking system doesn’t need more than a mobile phone number to work because technically, it can access data stored by mobile phone carriers to determine both the past and the current locations of a device.

No physical access to the device is required and no cloud data is necessary.

The data retention laws in Australia are what make this possible, as phone carriers are required to store metadata for a period of two years. Similar rules also exist elsewhere, albeit with small differences, and pretty much come down to the carrier logging certain details, including the location, when a person uses their phone for things like calling or texting.

Furthermore, the tracking system automatically collects location information when the device connects to a cell tower, so from a technical perspective, the law enforcement is capable of determining things like your address, where you work, where you go on vacation, and even see your route based on the logged data.

But more specifically, what information must a carrier collect? As I said, this depends from state to state, but using just your phone number, without physical access to the device or hacking, the following details can be determined by a carrier:

  • The location of the device when you make a call
  • The number of the contact that you call
  • The date, time, and duration of the call
  • The contact that calls you
  • The contact that you’re sending a text message to
  • The location where you are when sending a text message
  • The date and time when you send a text messages
  • The email address you use to send emails
  • The email address of the contact you’re sending an email to
  • The date and time when you send an email
  • The size of the attachments in emails and the used file formats
  • The IP of your Internet connection
  • The location when your phone connects to a cell tower
  • The unique identifier number of a mobile phone
Based on all of these, and using location data, the law enforcement can easily create a profile for any individual, essentially being able not only to track calls, but also to see when and where they’re going. Put this on a map and you get an accurate picture of one person’s activity, especially after tracking such information for a longer period of time, as patterns could help determine very accurate information.

On the other hand, sensitive information is not logged, and this includes:

  • Phone calls
  • The content of text messages
  • The content of emails
  • The email attachments
Phone tracking systems aren’t used to monitor the entire population and are typically employed against criminals. In most of the cases, a warrant is required for the law enforcement to access the collected data about a specific person, but there are also cases when this can be done without a legal request.

In Australia, for example, the metadata, which includes all the aforementioned details is available to a total of 22 state agencies without a warrant, including here state police forces, the Australian Security Intelligence Organization, and the Australian Crime Commission.

Again, this is different from one state to another, if data retention laws are used locally. Similar rules also exist in the European Union, after the adoption of the Data Retention Directive in March 2006 and which requires certain data to be stored between 6 months and 2 years for the investigation, detection, and prosecution of crimes.