Now Available:

line

Featured Resources:

line

Newsletter

Email Address:


line

Ask the Expert

Have a question for our resident expert? Email your questions to Rebecca.

« DOT Stolen Laptop: Arrest Made | Main | More on Telecommunications Security: Strong Customer Identity Verification Procedures are Necessary »

Is There Security for Enroute Text Messages? Some Odd Incidents...

I have a couple of friends I exchange text messages with often. I always have my cell phone with me, so it's an easy way to just say "Hi!" or see how their day is going. When I'm out and about and see something interesting (buildings, plants, etc.), unusual (clothing or hairdos of people traveling in airports, etc.), or downright weird ("exotic" food I've ordered at restaurants, etc.), I like to take a photo and send it attached to a text message to one or more of my friends just to share the moment.

In the past two months have had some unexplainable occurrences with text messages I've sent with photos attached. I've reported it to my cell phone company, but they had no explanation and said they don't know how it happened. It makes me wonder where these text messages are actually going...or going through.

The 3 separate occurrences were all similar:
* I took a photo with my cell phone
* I sent a text message to one of my friends with the photo attached
* My friend received the message and attached photo, but the number that it showed sent the photo/txt message was not my own
* Each of my friends received the message after a slight delay compared to other text messages sent
* Each of my friends uses a different cell phone service than I

The odd thing is that each time, the number showing on each of my friend's phones was different. The first time it showed it was from a Kansas area code, and the phone was a cell phone (I called the number to ask the person if their records showed that they had sent the message; the person indicated they did not). The second time it showed it was from a Nebraska number (again, I called the person and he said he didn't even have text message capabilities, to his knowledge). The third time it showed it was from a Texas number (when I call the person this time she said she didn't know what I was talking about). I live in Iowa and have an Iowa area code.

I reported each instance to my cell phone company, and they are still scratching their heads with bewilderment (so they tell me) because they say they have no idea how it happened.

What seems odd to me is that it has happened only with text messages that have photos attached. I send many times more plain text messages (with no attachments), so you'd think the odds would be that more of my plain text messages would have shown being from someone else, instead of just some of the text messages with photo attachments.

I know there have been several articles about monitoring text messages in various locations throughout the world, such as this one from China last year. Are my incidents perhaps indications that text messages are being monitored in the U.S.?

So far I have found no information about this specific type of occurrence and the related security issues.

* Where do text messages we send really go before they get to the recipient? Do they go through, and perhaps get collected and stored within, centralized servers maintained by the phone companies?
* Are text messages with photo attachments being intercepted and perhaps analyzed? And, perhaps when they are forwarded on after being stored, they are sometimes sent from the incorrect phone number because of faulty programming in the surveillance system?
* How could the messages I sent have someone else's number show up as the recipient on the receivers' phones? Why can't my cell phone company explain this?

I have virtually no knowledge of cell phone text message technology or the related security, and it seems very few at the phone company have this knowledge either (that they are admitting, or to whom I've been routed).

This situation has really intrigued me, and raises many questions about the security of text messages. I know many people use text messages for business purposes; is business information sent within text messages being intercepted and stored?

I'm familiar with the risks involved with the originator an recipient issues (e.g., access to the storage areas, logs held by the company showing sender information and recipient informatino, etc.), but what happens with text messages during transmission is truly a black box for me.

Are any of you cell phone text message gurus? Any idea why only a few of my photo text messages have arrived on my friends' phones showing they come from completely different numbers other than my own? Is it possible my silly photos are now stored within some huge repository with many others? Do you have any flowcharts to share to show the data flow from when a text message is sent to when it reaches the recipient's phone?

Hmm...

TrackBack

TrackBack URL for this entry:
http://www.realtime-itcompliance.com/type/mt-tb.cgi/244

Post a comment

(All comments are approved by site leader before appearing here. Thanks for commenting!)

line

Rebecca Herold's Bio:

Rebecca Herold,CISSP, CIPP, CISM, CISA, FLMI, has been providing information security, privacy and regulatory assistance and services to organizations from a wide range of industries for over 18 years. Rebecca was instrumental in building the information security and privacy program while at Principal Financial Group, which was awarded the CSI Information Security Program of the Year Award in 1998. IT Security ranked Rebecca as one of the top 59 IT security influencers, and Computerworld put Rebecca their list of the 25 top privacy experts and on their list of the 9 best privacy consulting firms. Rebecca has been CPO for two consulting organizations, and has had her own information privacy, security and compliance business since 2004. Rebecca has written chapters for several books, dozens of articles, and has been writing a monthly privacy column for the CSI Alert newsletter since the beginning of 2001, and is working on her 11th book. Some of her other books include The Privacy Papers, Managing an Information Security and Privacy Awareness and Training Program, The Definitive Guide to Security Inside the Perimeter (Realtime Publishers), The Shortcut Guide to Improving IT Service Support through ITIL (Realtime Publishers), and The Practical Guide to HIPAA Privacy and Security Compliance. In addition, Rebecca is the leader of The Realtime IT Compliance Community where she posts to her IT Compliance weblog. You can contact Rebecca at: rebecca_herold@realtimepublishers.net.