Explainer: Your phone and surveillance: five things you should know

Seldom does a week pass without another murder by Kenyan security forces, reflecting the will of a deeply corrupt and insecure ruling class. School teacher Albert Ojwang was their latest victim, and without seismic political reforms there will be more.

Civil society and political opposition have responded with outrage, expressing fears that Albert’s phone was used to surveil and track him.

Phone surveillance can include all manner of interceptions: from establishing who you’re speaking to, to tracking your location, and listening to the contents of your calls. As we explain below, you don’t need spyware to do that.

While these fears are yet to be confirmed, they remain justified, especially since our investigation for the Nation revealed that mobile networks through which the state conducts its largest surveillance operation. 

As Kenyans organise to challenge another state crime, we have often seen protestors employ ineffective counter-surveillance tactics, leaving them vulnerable. 

We were told that during last year’s protest, some youth believed that swapping their smartphones out for dumb phones would evade surveillance. They were wrong.

With a decade’s experience investigating digital surveillance, including in Kenya, we share five things you should know about your phone and what it says about you. 

You cannot ‘opt-out’ of “near-perfect surveillance”

Telecoms networks are always logging your location, specifically to base station you connected to, for every single call, message or internet connection. These are known as ‘call data records’ (CDRs), and similar applies to mobile money transfers. This isn’t peculiar to any specific provider: it is essential to network function and billing.

On average, we log around sixty events a day. Some people log many more. In Kenya, CDRs have been found to be stored for years, and retrieved by police when convenient for them, but routinely denied to victims of state-enforced disappearances.

In 2019, the US Supreme Court ruled that searches of CDRs by police constitute “near-perfect surveillance”, since your daily pattern of life, work, rest, and who you speak to can be easily mapped. The Court judged that a warrant was necessary for each search. In theory, that should be the case in Kenya. In practice, we now know it isn’t.

You can be live-tracked to the nearest 5 metres

If you are being actively watched by the security services using telecoms networks, then you’re in trouble, particularly if you have GPS enabled on your smartphone. Unknown to you, police can use the network to ‘ping’ your phone and query its location. It does this by asking your phone to communicate with all available phone masts, calculating your position and distance from masts using relative angles and signal strength. 

The more masts there are in range, such as in densely populated areas, the more masts your phone can connect to, and therefore the more accurate the location tracking. As such, location tracking will be far more accurate in Nairobi’s CBD than in rural Mandera. And it is even more accurate if your Wi-Fi and GPS functions are turned on. 

Switching to a ‘dumb phone’ won’t help

Dumping your smartphone for a dumb phone won’t help you: it simply lacks the GPS function, but police can still use the network to roughly locate you, and then deploy with a fake base station (known as an IMSI catcher), forcing your phone to lock on to it, and reveal its precise location.

In any case, if you’re being watched then your telecoms provider (and therefore police) will know that you have switched phones. Every time you interact with the network, your telco logs your phone number, SIM and phone card serial codes (known as IMSI and IMEI numbers).

So, if those numbers are associated with you, either through SIM registration, or having previously used them, police can use the network to independently track where your phone or SIM card are being used.

Police routinely access sensitive phone data without warrant

From our October investigation, as well as prior publications by the Nation, we now know that Kenyan police and intelligence routinely access call data records, for historic surveillance, and use live tracking to locate and ‘neutralise’ targets.

The law on this is clear and has been repeatedly stated by Kenyan telcos and the Communications Authority Kenya alike: a judicial warrant is required for police to search this data. But this is Kenya, and the state is a law unto itself.

And when ‘national security’ is at stake, even basic formalities fly out of the window. This is in large part due to the thuggery of the Kenyan ruling class, but also the inherently amoral corporate instinct to comply, thereby surviving to generate profit. This is capitalism, after all.

Put simply, your sensitive personal telecoms data is not yours alone.

Geofencing, and ‘proximity alarms’

The sophistication of technological applications on telecoms networks has grown exponentially. Among the various technologies available to telcos are software that ‘geofences’ sensitive sites. In simple terms this means that when police flag a certain phone or SIM card, and those numbers approach a site already marked as ‘sensitive’, it sets off an alarm. 

This can be very useful to protect vital infrastructure, for example. Who would argue against proximity alarms used to prevent an attack on a school? But this is Kenya, and the ruling class isn’t batting for your side. Tech is primarily used by the powerful to serve and maintain power. In other words, regime protection.

The power of telecoms tech is admittedly grim. So let’s end on a positive note: Kenyans have a proud reputation for protest and challenging state crime. Historically, much of it was organised offline. If it could be achieved then, it can be achieved now. So, if in doubt, turn your phone off. You have many other means to achieve change.

Namir Shabibi and Claire Lauterbach are independent investigative journalists based in London, UK.