I recently read about a proposal by the military government in Thailand to make tourist SIM-cards "trackable". That got me thinking about security when accessing the Internet via a mobile connection using a SIM-card. More specifically, can SIM-cards be linked to the data stream sent/received on the connection?

While normal Internet protocols like HTTP don't have specific support for carrying SIM-card data (I think?), are there other means of linking data to a specific SIM-card?

If yes, does using a VPN service over a mobile internet connection make it as anonymous as using the same VPN service over any other internet connection?

  • 1
    Using a VPN on any connection may, or may not, prevent others from reading the data in the tunnel, but the tunnel will still have its packets marked with your IP address, so that it can be seen that you are using a tunnel. The VPN tunnel itself is not anonymous, but the data carried in the tunnel may be protected from prying eyes. – Ron Maupin Aug 12 '16 at 13:56

Your mobile provider will be able to link your SIM card with your IP address and you data. This helps with routing, billing, service selection, optimisation, and child-protection. This is all loggable and whether or not government agancies have access to this data is a matter for local legislation.

The VPN will be linked to your SIM card but the data streams within the VPN are protected. A VPN will give you the level of security inherent in the end-points and the protocol.

If you want to be paranoid, how much do you trust your browser for instance? Have you recently checked your certificate store?

| improve this answer | |
  • When you say that "The VPN will be linked to your SIM", what does that mean? If I run a VPN service over a mobile connection, is that less anonymous than if I use the same VPN service over some other type of connection, say a normal residential connection? – Magnus W Aug 12 '16 at 13:41
  • I rephrased the question to make it more clear what I'm asking. – Magnus W Aug 12 '16 at 13:48
  • As Ron commented above, the fact that you are using a VPN and the end-point of that VPN can be logged and therefore linked to your SIM. You get no privacy advantage from mobile, except that you may be able to buy a pre-pay SIM for cash and dispose of it after use as in all the movies. In some ways mobile is less private, in that the association between your SIM and the services visited is always inspected for technical reasons. That is not the case on a fixed line. Notice the only anonymity that a VPN provides is that the far end of your network streams doesn't know your real IP address. – marctxk Aug 12 '16 at 14:14
  • This is probably off-topic – marctxk Aug 12 '16 at 14:15

Regarding "super awesome Swedish VPN service providers". Swedish service provider obey the 'Electronic Communications Act 2003 389'. Sections 5, 6, and 7 under "Processing of traffic data" completely protect your privacy, but go a little further and read section 8

The provisions of Sections 5 to 7 do not apply

  1. When an authority or a court needs access to such data as referred to in Section 5 to resolve disputes.

  2. For electronic messages that are conveyed or have been dispatched or ordered to or from a particular address in an electronic communications network that is subject to a decision on secret wire-tapping or secret tele-surveillance.

  3. To the extent data as referred to in Section 5 is necessary to prevent and expose unauthorised use of an electronic communications network or an electronic communications service.

In case the authorities order secret wire-tapping, the service provider shall not disclose information about it

Section 19 An operation shall be conducted so a decision on secret wire-tapping and secret tele-surveillance can be implemented and so that the implementation is not disclosed.

Update 2: Regarding other highly recommended super anonymous VPN services (I'll go over only the top two)

BTGuard: You only need to take one look at the Privacy Policy to know that there's something shady going on.

  • Before or at the time of collecting personal information, we will identify the purposes for which information is being collected.

  • We will collect and use of personal information solely with the objective of fulfilling those purposes specified by us and for other compatible purposes, unless we obtain the consent of the individual concerned or as required by law.

  • We will only retain personal information as long as necessary for the fulfillment of those purposes.

  • We will collect personal information by lawful and fair means and, where appropriate, with the knowledge or consent of the individual concerned.

You can clearly see the intentionally vague language: "fulfilling those purposes specified by us", what are those purposes specified by them? Nobody knows. They even clearly say that they'll collect personal information when required by the law. In the last point they even state that they even don't have to inform you about the collection of your personal information unless it's "appropriate".

PrivateInternetAccess: This is probably one of the easiest legal language in the business.

You agree to comply with all applicable laws and regulations in connection with use of this service. You must also agree that you nor any other user that you have provided access to will not engage in any of the following activities:

  • Uploading, possessing, receiving, transporting, or distributing any copyrighted, trademark, or patented content which you do not own or lack written consent or a license from the copyright owner.

  • Accessing data, systems or networks including attempts to probe scan or test for vulnerabilities of a system or network or to breach security or authentication measures without written consent from the owner of the system or network.

  • Accessing the service to violate any laws at the local, state and federal level in the United States of America or the country/territory in which you reside.

If you break any of their conduct conditions (mentioned above)

Failure to comply with the present Terms of Service constitutes a material breach of the Agreement, and may result in one or more of these following actions:

  • Issuance of a warning;
  • Immediate, temporary, or permanent revocation of access to Privateinternetaccess.com with no refund;
  • Legal actions against you for reimbursement of any costs incurred via indemnity resulting from a breach;
  • Independent legal action by Privateinternetaccess.com as a result of a breach; or
  • Disclosure of such information to law enforcement authorities as deemed reasonably necessary.

From the source : https://security.stackexchange.com/questions/39788/how-can-you-be-caught-using-private-vpn-when-theres-no-logs-about-who-you-are

I hope this will help you with your doubt.

| improve this answer | |
  • Link-only answers should not be used since links can change or fail over time, and this site is meant to be a permanent archive. You should quote the relevant text from the link, and include the link for proper attribution. – Ron Maupin Aug 12 '16 at 18:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.