Mobile devices: theft

Background

Policymakers in many countries are concerned about the incidence of mobile device theft, particularly when organised crime becomes involved in the trafficking of stolen devices to other markets.

The GSMA has been leading industry initiatives to block stolen mobile devices based on a shared database of the unique identifiers of devices reported lost or stolen. Using the IMEI of mobile devices, the GSMA Device Registry maintains a central list, known as the GSMA Block List, of devices reported lost or stolen by mobile customers. The GSMA Device Registry is accessible to mobile operators around the world to ensure that stolen devices transported to other countries can be denied network access.

The effectiveness of blocking stolen devices on individual network EIRs depends on the secure implementation of the IMEI in all mobile devices. Leading devicemanufacturers are  encouraged to support a range of measures to strengthen IMEI security and reliability in accordance with GSMA-defined security requirements.

Debate

What can industry do to prevent mobile phone theft?

What are the policy implications of this rising trend?


Industry position

The mobile industry has led numerous initiatives and developed a range of enablers in the global fight against mobile device theft.

Although the problem of device theft is not of the industry’s creation, the industry recognises it is part of the solution. When lost or stolen mobile devices are rendered useless, they have significantly less value, removing the incentive for thieves to target them.

The GSMA encourages mobile operators to participate in its Device Registry service to report and block the IMEIs of devices flagged as stolen on the global block list. Typically, operators deploy EIRs on their networks to deny connectivity to flagged devices and share identifiers of devices from their local network’s block list to ensure devices stolen from their customers can be blocked on the networks of other participants. These block list solutions have been in place on some networks for many years.

To enable a wider range of stakeholders to combat device crime, the GSMA provides services that allow eligible parties, such as law enforcement, device traders and insurers, to check the status of devices against the GSMA Block List and, in some cases, to also flag stolen devices.

IMEI blocking, when combined with other multistakeholder measures, can be the cornerstone of a highly effective anti-theft campaign.

Consumers who have had their devices stolen can be vulnerable to their personal data being used to commit a range of additional crimes. Industry, law enforcement agencies and regulators are recommended to provide anti-theft consumer education material on their websites with advice and measures appropriate to their markets.

The concept of a ‘kill switch’ – a mechanism that disables a stolen phone remotely – has been developed for a range of devices. The GSMA supports device-based anti- theft features and has defined feature requirements for a globally applicable solution. These high-level requirements have security solutions on mobile devices can also help render devices useless and unattractive to criminals by preventing those devices from working on non-mobile networks such as Wi-Fi, where EIR blocking would otherwise be ineffective.

National authorities have a significant role to play in combating criminal activity. It is critical that they engage constructively with the industry to ensure the distribution of mobile devices through unauthorised channels is monitored and that action is taken against those involved in the theft or illegal distribution of stolen devices.

A coherent cross-border information- sharing approach involving all relevant stakeholders makes national measures more effective. The GSMA advocates the sharing of stolen device data internationally for blocking and status-checking purposes, which can be facilitated by the GSMA Device Registry and Device Check services. Only if regulation allows and encourages stolen device information to be shared across all countries will this deterrent have a global impact.

In markets with a national homologated list, lost and stolen device information can be exchanged between mobile operators through the GSMA Device Registry. Alternatively, if a national device block list system is already in place and complies with GSMA requirements, it may be approved to use the GSMA Device Registry to exchange block list information.

Resources

The Global Source of IMEI Data, GSMA IMEI Services

Preventing Device Crime website, GSMA Device Information Services

IMEI Security Technical Design Principles, GSMA, August 2016

IMEI Security Weakness Reporting and Correction Process, GSMA, November 2016 Anti-Theft Device Feature Requirements, GSMA, May 2016

Security Advice for Mobile Device Users website, GSMA