Edward Snowden said that in an interview. Is it exactly true? Does it have to do with SSN (sim serial number)?

Is the SSN broadcasted with encryption and modulation done to it or is the IMEI number?

  • "Do mobile phones continuously broadcast their IMEI number so that other cell towers can find it?" Not continuously, but they regularly ping towers in order to find the closest. Remember that this is "mobile," so the closest tower can change at any moment.
    – Ron Maupin
    Jun 19, 2020 at 10:15

1 Answer 1


Wireless cellular systems typically distinguish between the mobile equipment and the subscription. The subscriber's subscription is tied to the SIM card. Hence, you can move your SIM card from one phone to another, and your subscription moves along with the SIM card. There is an identifier associated with your SIM card, but it is not the IMEI. It is the IMSI - International Mobile Subscription Identifier. There is also a unique serial number of your SIM.

IMEI stands for International Mobile Equipment Identifier, and it is tied to the device. Since your service provider cares more about your subscription (they don't want to provide free service to all, but only to paying subscribers .. with exceptions like free emergency calls), the IMSI is the one that is used in the various authentication flows as your mobile moves along and sees various cells.

Now, in idle mode (not in a call or active communications), the phone sends its IMSI to cell towers around, in location update messages. It does this so the system can keep track of where the phone (actually, the SIM card) is located, so incoming calls can be routed there. However, as an optimization, while in idle mode, the mobile need not send these location update messages to every cell they hear. Multiple cells might be in the same location area, and only when a mobile (actually, a SIM card) crosses boundaries, and hears a different location area ID, it then does a new location area update. This is a tradeoff, to reduce the needed updates, while keeping the size of the location area not too large (the system has to search within the last known location area for the SIM, when there is an incoming call).

One last twist - rather than periodically sending out its IMSI, a phone uses a Temporary Mobile Subscription Identifier (TMSI) most of the time, where the system knows the association of TMSI to IMSI, but its adds a degree of privacy that makes it harder for an attacker to associate those location updates with a particular IMSI.

  • 2
    the above answer doesn't answer the question. the question is about IMEI broadcasting. not what IMSI which is all the person above talked about.. wtf
    – ROB' EM
    Feb 20, 2021 at 18:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.