Analog cellular phones are absurdly vulnerable to eavesdropping. Anyone with a radio that can be tuned to the frequency used by a particular phone can listen to all calls being made, and anyone with a transmitter that would operate on that frequency can make calls that will be billed to the subscriberâ€™s account. At a church sale while I was in elementary school, a friend of mine picked up a radio scanner capable of monitoring nearby cell calls for $20. Things improved with digital cell technology, notably the GSM standard common in Europe and the CDMA standard used in North America. As well as allowing more efficient usage of radio spectrum, the digital technologies made it such that someone with nothing more than a radio could no longer make or overhear calls.
GSM phones, the more common sort globally, employ a number of cryptographic features. The first is the use of a SIM card and a challenge-response protocol to authenticate the phone to the network. This â€˜provesâ€™ that calls are being made by the legitimate account holder and not by someone impersonating them. GSM can also utilize encryption between the phone and base station as a form of protection against interception.
Unfortunately, a design flaw in the GSM standards somewhat undermines the value of the latter. While the phone must prove to the network that it is authentic, no such thing is required in the other direction. As such, anyone with the resources and skill can build a machine that looks like a cell phone tower, from the perspective of a phone. The phone will then dutifully begin encrypting the conversation, though with the malicious man in the middle monitoring. The device impersonating a cell tower to the phone impersonates a phone to a real cell tower, allowing the person using the phone to make calls normally, ignorant of the fact that their communications are being monitored.
Of course, anyone who has access to the phone companyâ€™s network can do all this and more. This includes law enforcement personnel conducting legal surveillance with warrants. Unfortunately, it also includes potentially unscrupulous people working for the cell phone company and anyone with the capability to break into their networks.