04-03-2022, 03:17 PM
I'm new to the forum, but I felt the need to speak up about this as I have extensively worked on this exact feature and the legality of it in the past. I've been a hardware/software developer for over 20 years with many of those years focused on privacy enhancing technologies. I think a short story about my past could help clear some things up.
The issue of changing an IMEI showed up while working for a former employer. Someone in the company (we'll call him Chad), much like some people here, ignorantly believed it was illegal for us to do so. Chad had no real reason, no proof, no cited sources for this believe. It was his own believe because he thought it was "immoral". Chad always loved to point out the evil and scary things that could *possibly* be done with certain features on products even though he usually did not fully understand what was really going on. Chad always assume just because one or two people *might* use a product in an undesirable way, he should be the protector of the world and put a stop to it from ever happening in the first place. Chad made a big issue out of changing MAC and IMEI addresses, so the CEO went to an attorney to get clarity. Long story short, it was NOT illegal for the company to change the IMEI and MAC addresses of the devices the company purchased before reselling them. Chad was finally fired some time later, thankfully.
Every device we received had the same IMEI and WiFi MAC address (crappy manufacturing in China). So we had to fix these issues before reselling the product. Here's another CURRENT example of cheap manufacturing from China; Bitmain's Bitcoin miners all have the same ethernet MAC address from the manufacturer, and Bitmain "fixed" this through software at boot. So please don't think this isn't problem because it still happens more often than you think. Having the same static addresses, whether MAC or IMEI, from Chinese manufacturers is very common and well know problem that requires resellers or developers to come up with a fix. To that point, when a manufacturer allows you *AND* provides a way to change these addresses, it is on purpose. This is an intended feature because is NOT illegal and is usually REQUIRED at some point in the development cycle.
So I will put this out there in regards to changing the IMEI, at least in the USA. A bill was introduced in the United States by Senator Chuck Schumer in 2012 that would have made the changing of an IMEI illegal, but the bill was not enacted. Zero efforts since then have been made, in a legal way, to try and do this again. It is 100% LEGAL to do this in the USA. Period. Now I know someone out there is going to point out what the GSA has published, but the GSA does NOT DEFINE LAWS. It's only a recommendation.
Now USA laws don't rule the rest of the world. I'm not a legal expect for every law in every country, so I cannot speak to the legality of this in other countries. Check your country accordingly. However, by being a Chad and saying "it's illegal in country XYZ so we have to ban it altogether" is a very ignorant and dangerous way to view the world. Don't be a Chad, you're not protecting anyone.
As for the "stealing someone's identity". Just stop. That's not the way the cellular network works. It's sad that I should have to explain this to those who do not understand it, but I'll try and make this short.
Your cellular account has three unique parts. IMEI, IMSI, and MSIDIN.
The MSIDIN is your phone number (+1-212-555-1234 for example of a number in New York).
The IMSI is the serial number of your SIM card.
The IMEI is the serial number of your phone.
It is NOT possible to just steal someone's MSIDIN (phone number) by cloning their IMEI. Further more, even if someone is sniffing the GSM band with a SDR, they still never see your IMEI. They will sometimes catch your IMSI or TMSI (Temporary IMSI), but this is still not enough to steal your MSIDIN or account. The SIM card also requires a private key, that is burned into the SIM card, to get on the network.
Now for the reason(s) why everyone should be ALLOWED to change their IMEI.
Many providers (AT&T in the USA; Three(3) in the EU) do not activate a pre-paid SIM card if the SIM card is used with an unsupported brand or model of phone (stupid, greedy logic). I spent over an hour on the phone with AT&T trying to activate my prepaid SIM with the PinePhone. They were clueless, but provided me with a bunch of clues. First was "That brand isn't supported" is what they kept saying. Basically, their network did not recognized my device as being a "supported" device on the network. I had to take my new SIM, put it in an old AT&T phone I had, and let it register on the network which took about 2-5 minutes. After that, the network activated my SIM, and I was able to put it back into my PinePhone and IT FINALLY WORKED! There was nothing technically wrong with what I was trying to do and it should have worked, but AT&T must have a team of Chad's working for them just to make everyone else's life harder. If I had an easy way to change the IMEI on my PinePhone to the IMEI of my old AT&T phone, it would have worked immediately. T-Mobile doesn't have this problem. You can just buy a SIM, put it in any phone or modem, and it works (as it should!)
Another example: The telcom MEO in Portugal. They don't even tell you what the MSIDIN is through your phone or SIM card. They send you a SMS after the SIM is activated on the network that tells you what your phone number is. Or you have to call a friend and see their caller ID. Again, this has nothing to do with the IMEI.
Moral of this long post; DON'T BE A CHAD!!! Changing the IMEI is often necessary and required in many cases, countries, and telco's; and just because you haven't run into these types of problems yourself doesn't mean other people won't. You don't know how every network on the planet works, and MANY people are going to run into this exact problem when using this product considering ZERO, NONE, NOT A SINGLE TELCOM IN THE WORLD SELLS PinePhone's AS A NORMAL CONSUMER PRODUCT! Being able to trick the network into thinking you have a supported phone model in order to get working service is not a crime, IT'S A REQUIREMENT! I bet the Chad's didn't stop and think about that. I've been to over 25 countries and have purchased SIM cards in everyone of them. I've tested more networks and SIMs than most people on this forum. So to the Chad's, just stop it. The only people you are helping is the other Chad's at places like AT&T that want to make it impossible to use a PinePhone out of the box with their network, even though it should work out of the box because we bought and paid for both the product and the service!!
I say, put it on the Wiki and tell the Chad's to be quiet because he doesn't know everything. If, and that's a big IF, some company of legal office sends a letter to PinePhone to remove it from the wiki, then go ahead and take it down. I'd bet a whole bitcoin that it would never happen though!
Thank you for reading this long post and best regards!
The issue of changing an IMEI showed up while working for a former employer. Someone in the company (we'll call him Chad), much like some people here, ignorantly believed it was illegal for us to do so. Chad had no real reason, no proof, no cited sources for this believe. It was his own believe because he thought it was "immoral". Chad always loved to point out the evil and scary things that could *possibly* be done with certain features on products even though he usually did not fully understand what was really going on. Chad always assume just because one or two people *might* use a product in an undesirable way, he should be the protector of the world and put a stop to it from ever happening in the first place. Chad made a big issue out of changing MAC and IMEI addresses, so the CEO went to an attorney to get clarity. Long story short, it was NOT illegal for the company to change the IMEI and MAC addresses of the devices the company purchased before reselling them. Chad was finally fired some time later, thankfully.
Every device we received had the same IMEI and WiFi MAC address (crappy manufacturing in China). So we had to fix these issues before reselling the product. Here's another CURRENT example of cheap manufacturing from China; Bitmain's Bitcoin miners all have the same ethernet MAC address from the manufacturer, and Bitmain "fixed" this through software at boot. So please don't think this isn't problem because it still happens more often than you think. Having the same static addresses, whether MAC or IMEI, from Chinese manufacturers is very common and well know problem that requires resellers or developers to come up with a fix. To that point, when a manufacturer allows you *AND* provides a way to change these addresses, it is on purpose. This is an intended feature because is NOT illegal and is usually REQUIRED at some point in the development cycle.
So I will put this out there in regards to changing the IMEI, at least in the USA. A bill was introduced in the United States by Senator Chuck Schumer in 2012 that would have made the changing of an IMEI illegal, but the bill was not enacted. Zero efforts since then have been made, in a legal way, to try and do this again. It is 100% LEGAL to do this in the USA. Period. Now I know someone out there is going to point out what the GSA has published, but the GSA does NOT DEFINE LAWS. It's only a recommendation.
Now USA laws don't rule the rest of the world. I'm not a legal expect for every law in every country, so I cannot speak to the legality of this in other countries. Check your country accordingly. However, by being a Chad and saying "it's illegal in country XYZ so we have to ban it altogether" is a very ignorant and dangerous way to view the world. Don't be a Chad, you're not protecting anyone.
As for the "stealing someone's identity". Just stop. That's not the way the cellular network works. It's sad that I should have to explain this to those who do not understand it, but I'll try and make this short.
Your cellular account has three unique parts. IMEI, IMSI, and MSIDIN.
The MSIDIN is your phone number (+1-212-555-1234 for example of a number in New York).
The IMSI is the serial number of your SIM card.
The IMEI is the serial number of your phone.
It is NOT possible to just steal someone's MSIDIN (phone number) by cloning their IMEI. Further more, even if someone is sniffing the GSM band with a SDR, they still never see your IMEI. They will sometimes catch your IMSI or TMSI (Temporary IMSI), but this is still not enough to steal your MSIDIN or account. The SIM card also requires a private key, that is burned into the SIM card, to get on the network.
Now for the reason(s) why everyone should be ALLOWED to change their IMEI.
Many providers (AT&T in the USA; Three(3) in the EU) do not activate a pre-paid SIM card if the SIM card is used with an unsupported brand or model of phone (stupid, greedy logic). I spent over an hour on the phone with AT&T trying to activate my prepaid SIM with the PinePhone. They were clueless, but provided me with a bunch of clues. First was "That brand isn't supported" is what they kept saying. Basically, their network did not recognized my device as being a "supported" device on the network. I had to take my new SIM, put it in an old AT&T phone I had, and let it register on the network which took about 2-5 minutes. After that, the network activated my SIM, and I was able to put it back into my PinePhone and IT FINALLY WORKED! There was nothing technically wrong with what I was trying to do and it should have worked, but AT&T must have a team of Chad's working for them just to make everyone else's life harder. If I had an easy way to change the IMEI on my PinePhone to the IMEI of my old AT&T phone, it would have worked immediately. T-Mobile doesn't have this problem. You can just buy a SIM, put it in any phone or modem, and it works (as it should!)
Another example: The telcom MEO in Portugal. They don't even tell you what the MSIDIN is through your phone or SIM card. They send you a SMS after the SIM is activated on the network that tells you what your phone number is. Or you have to call a friend and see their caller ID. Again, this has nothing to do with the IMEI.
Moral of this long post; DON'T BE A CHAD!!! Changing the IMEI is often necessary and required in many cases, countries, and telco's; and just because you haven't run into these types of problems yourself doesn't mean other people won't. You don't know how every network on the planet works, and MANY people are going to run into this exact problem when using this product considering ZERO, NONE, NOT A SINGLE TELCOM IN THE WORLD SELLS PinePhone's AS A NORMAL CONSUMER PRODUCT! Being able to trick the network into thinking you have a supported phone model in order to get working service is not a crime, IT'S A REQUIREMENT! I bet the Chad's didn't stop and think about that. I've been to over 25 countries and have purchased SIM cards in everyone of them. I've tested more networks and SIMs than most people on this forum. So to the Chad's, just stop it. The only people you are helping is the other Chad's at places like AT&T that want to make it impossible to use a PinePhone out of the box with their network, even though it should work out of the box because we bought and paid for both the product and the service!!
I say, put it on the Wiki and tell the Chad's to be quiet because he doesn't know everything. If, and that's a big IF, some company of legal office sends a letter to PinePhone to remove it from the wiki, then go ahead and take it down. I'd bet a whole bitcoin that it would never happen though!
Thank you for reading this long post and best regards!