German expert's statement on SMS sender identification in Amphon's case | prachatai.com

German expert's statement on SMS sender identification in Amphon's case | prachatai.com
prachatai.com, August 25, 2012

Poonsuk Poonsukcharoen, lawyer for Amphon Tangnoppakul, has published a letter from an expert on telecommunication technology in Germany on her Facebook page.  The letter was intended to be used in the Appeals Court before the appeal was withdrawn.

000

SR Security Research Labs GmbH   Veteranenstr 25   10119 Berlin

Cross Cultural Foundation (CrCF)
111 Soi Sitthichon Samsennork Huaykhwang
Bangkok 10310
Thailand
Dr. Karsten Nohl
Chief Scientist
nohl@srlabs.de
+49-3089392996

Berlin, January 30th 2012

Expert statement on SMS sender identification

To whom it may concern:

Security Research Labs is a risk management think tank in Berlin, Germany that advises European telecommunication network operators and governments in mitigating risks arising from cell phone technology.

We were asked to provide a subject matter expert opinion on the reliability of mobile phones identifiers used in determining the sender of an SMS message.

The attached statement was prepared based on extensive knowledge of GSM standard, the operation of GSM networks in general, and measurements of the GSM networks in Bangkok, Thailand in particular. The statement reflects the current state of GSM security research and was prepared to the best of our knowledge.

Best Regards,

Dr. Karsten Nohl

-------------

Expert statement on SMS sender identification

This statement discusses the question of whether a mobile phone sending a text message can be identified reliably based on data records in the phone network. This question is to be investigated for the dtac GSM network in Bangkok, Thailand.

Question 1: Does an SMS identify a phone (IMEI)?

An SMS transaction contains multiple small data packets exchanged between a phone and the radio network. These packets negotiate encryption, establish the transaction type, and exchange data. One example SMS transition on the dtac network included 107 packets.
Phones are identified by their IMEI numbers, which act as serial numbers.
One packet, called the “Cipher Mode Command”, can ask the phone to send its IMEI number in the next packet. However, the dtac network does not use this option in SMS transactions as shown in Figure 1. This was verified at multiple locations in Thailand.
No other message in an SMS transaction can include the IMEI number.

Answer 1: An SMS transaction on the dtac network does not identify a phone (IMEI).
[See images below]

Figure 1. Partial trace of an SMS transaction on the dtac network in Bangkok, Thailand. The “Ciphering Mode Command” message does not ask the phone to send its IMEI number.


Question 2: How does the dtac network assign an IMEI to an SMS transaction?
The mobile network and phones execute different types of transactions including SMS messages and voice calls. The only type of transaction on the dtac network that include the IMEI number are “Location Update” transactions. These transactions are done when the phone is switched on, when it changes location significantly (ie, to a different part of a city), and also periodically.
The phone identity included in a dtac SMS record most likely is copied from the most recent “Location Update” the network observed for a given subscriber account.

Answer 2: The IMEI is most likely copied from an older transaction into the dtac SMS record.

Question 3: How does the dtac network assign a location to an SMS transaction?

Answer 3: The possibility exists that the location is copied from an older transaction into the dtac SMS record. Further information from dtac is needed for a conclusive answer.

Question 4:  Can an SMS message be sent without a phone?

Answer 4: SMS messages can be sent from the Internet with arbitrary spoofed sender numbers. If the dtac network creates delivery records for such transactions, it would likely include the IMEI number of the most recent “Location Update” message from the spoofed phone number. Further information from dtac is needed for a conclusive answer.


Question 5: Can individuals observe IMEI numbers on the GSM network?
“Location Update” transactions that include a phone’s IMEI number are sent encrypted over the air. The GSM standard uses outdated security that can be broken within seconds.
Software that has been available on the Internet since 2008 can be used to break the encryption of a “Location Update” message in less than one minute on a standard computer.
Since the release of the software, it has been installed in hundreds of locations around the world. Engineering students take less than one week to create a functioning intercept and decryption setup.

Answer 5: Technologically-savy individuals can extract IMEI numbers from GSM messages.


Question 6: Can SMS be sent from a phone using somebody else’s identify?
The IMEI number on almost all phones can be changed using widely available software.
Answer 6: An individual can easily change the IMEI of his/her phone to the IMEI of somebody else’s phone.


Conclusion

The dtac SMS transaction records are not reliable in identifying a phone as the emitter of an SMS message. At least two possibilities exits where the data diverts from reality:

• SMS injected into the phone network from the Internet or SS7 network may be falsely linked to a “Location Update” message of somebody else’s phone
• Phone identities can be changed to the phone of somebody else in the same part of a city after observing a transaction of the other phone with the GSM network which requires only readily available hardware and software

Former Judge’s Views on the Case of Ah Kong | prachatai.com

Former Judge’s Views on the Case of Ah Kong | prachatai.com
prachatai.com,  August 24, 2012

Originally published on the Facebook page of Poonsuk Poonsukcharoen, lawyer for Amphon (Ah Kong); Republished on Prachatai


The below is from a lecture given by Professor Satit Phairoh, a former judge, during the 65th session of the Thai Bar Association. A senior colleague sent me a recording of the lecture and I have transcribed it so that other people can read it. Doing this case, I learned a lot of lessons. These included the difficulties with temporary release, detention, the demonstration of evidence, and the admissibility of evidence. I do not want to make excuses for myself as a lawyer, but what I want is for the judicial process to progress in a noble fashion.

The cremation of Ah Kong will be on 26 August at Wat Lad Phrao. All are invited to come bid Ah Kong farewell.

------------------------------------------------------
A question was raised about Ah Kong’s case:

Article 39 of the Constitution says that everyone is presumed innocent. It is a general principle that when a person is innocent, bail must be granted. This is simple, there is nothing profound about it. According to this principle, at the time one is charged, the court has not yet delivered a verdict of whether or not the law has been broken, and so bail must be granted. If bail is denied, a rationale for why not must be provided. And, the rationale must be a logical one. When I was assigned to dispose of case dossiers, I encountered illogical rationales.  When you dispose of dossiers, you have to read every one of them. I found many quite odd cases.  In one case, the defendant was charged with stealing an elephant. The Court ruled that “This is major theft. Bail can’t be granted.” This rationale is not in line with the Criminal Procedure Code. This is not how it is written in the law.  In another case, the defendant was accused of stealing a needle and thread. A minor theft from a house. The court ruled that, “Bail is not granted for petty theft.” It is not written in the law that bail is not granted for petty theft. There is no basis for this. 

In the case of Ah Kong, on the issue of bail, the court ruled that, “The facts concerning the offence as described in the plaint gravely impact public sentiment and national security.” They wrote in this fashion before there had been any investigation, at all. This indicates that the Court already believed that the accusation was true. If you already believe the charges when you read them, how can you be a judge? You have to listen to evidence before you can write that, “The facts of the alleged offence gravely impact public sentiment and national security.” Having only read the charges, without having heard evidence in the case, how can the judge talk about the impact? You have to investigate first. Making a decision without listening to the evidence is a definitive characteristic of how a judge should not act. No matter how terrible the indictment sounds, it is an allegation only. The facts have not yet shown whether it is true or false.

They guessed further that, “If the examination of evidence results in solid proof, the defendant may flee.”  The Court began by surmising that if the proof advanced was solid, then the defendant might flee. And if they surmised incorrectly, then who would be held responsible? Would they be jailed (instead of the defendant)? No. This decision was based on a guess. How do you know if the proof will be solid or not? By guessing. This conjecture had a disastrous effect for their defendant. An order like this is not characteristic of a Court that is supposed to be impartial.  The order violated the Constitution. The Constitution is procedural law, if you ask me.

The Court made another incorrect conjecture. Why is this? It is written in the judgment itself that, “Although the plaintiff is unable to present indisputable proof that the defendant is the person who sent the messages as charged.”  This indicates that the Court acknowledged that the plaintiff’s adduction of evidence was not indisputable.  This indicates that the ruling about bail was incorrect. But the Court committed a double fault by convicting the defendant. If the evidence is not indisputable, how can you convict a defendant?  This is a breach to Section 227 of the Criminal Procedure Code which clearly stipulates that in weighing the evidence, the Court must not render a judgment to convict until it is certain that the offence was committed and the defendant was the perpetrator. The word “certain” means indisputable.  When you say it is not indisputable, how are you able to render a conviction?

At the end of the judgment, they wrote even more incorrectly: “But it was difficult for the plaintiff to find eyewitness evidence.” Where in the law does it say that if it is difficult, then you can convict on speculation? There is only one principle here: the plaintiff must have evidence that the defendant committed the offence beyond doubt, whether it is eyewitness or circumstantial evidence. It cannot be that there is circumstantial evidence and so you can then convict on speculation.  This judgment will eternally stand and cannot be subjected to correction since Ah Kong is dead. This judgment will be eternally criticized because the Appeal Court and the Supreme Court have no chance to amend it.  I presume if this case went to a higher court, the higher court would not allow the decision to stand because it was unlawful. This decision contradicts Section 227 completely. It is a contradiction on the order of saying that the sun rises in the west. Jurists must have principles, and must not write arbitrarily. If you are a judge, do not do this. Don’t think you are powerful and can do anything at will. We are not the only ones who read the law. Professor Nidhi Eoseewong has written that the Court acts arbitrarily. He is correct.

-- Professor Satit Phairoh, lecture on criminal law, 65th session of the Thai Bar Association, 8 June 2012.

Translated by Tyrell Haberkorn and Pipob Udomittipong.