Reducing Mobile Device Theft

Submitted by: Crime Prevention Committee and Police Investigative Operations Committee

CPC.002.t2017

WHEREAS, on February 10, 2012, the Major Cities Chiefs Association issued a resolution which included calling on the United States (US) Federal Communications Commission (FCC) to require communication companies to implement technology to activate tracking devices and disable stolen mobile devices to deter the commission of these thefts; 1 and

WHEREAS, on June 13, 2013, a multinational coalition of law enforcement members, elected leaders and consumer advocates created the "Secure our Smartphones" (SOS) Initiative to end the disturbing trend of robberies involving mobile devices. The SOS lead an initiative to have the mobile device industry to mandatorily implement on-device security features, which allows a consumer to remotely locate, lock, and wipe their mobile device; 2 and

WHEREAS, the SOS published statistics following a manufacturer's adoption of Activation Lock—the first ondevice security feature commercially available in the US—which validated the on-device security feature as an effective tool to deter smartphone crime. For example, during the first five months of 2014, shortly after the introduction of Activation Lock, the theft of devices with this security feature fell by 17 percent in New York City; in the six months after the introduction of Activation Lock, the theft of devices with this security feature fell 24 percent in London, and robberies fell 38 percent in San Francisco. Theft of devices without this feature increased in all three of these jurisdictions; 3 and

WHEREAS, in late 2014, the FCC established the Technological Advisory Council, Mobile Device Theft Prevention (MDTP) Working Group whose mission is to work with industry and law enforcement to increase the security of mobile devices, facilitate coordination of theft related data between industry, law enforcement and the consumer, and track trends in the theft of mobile devices; and

WHEREAS, the MDTP Working Group lead an initiative to have the mobile device industry to voluntarily implement on-device security features which allows a consumer to remotely locate, lock, and wipe their mobile device; and

WHEREAS, while there are no specific nationwide data available for mobile device theft there are multiple datasets regarding crime. Consumer Reports published a survey that an estimated 4.5 million smartphones were lost or stolen in 2013 survey.4 The MDTP Working Group obtained preliminary data from 21 US based police jurisdictions with a population of over 19.7 million which indicated the 2013 phone theft rate of 368.9 phone thefts per 100,000 individuals. Collected law enforcement data combined with FBI crime data would estimate that for 2013 one tenth of all thefts and robberies committed in the US is associated with the theft of a mobile device;5 and

WHEREAS, in 2016, there were nearly 396 million active cellphone subscribers in the United States (US), representing more than one device for every person in the US. For some, mobile devices are their sole means of accessing the internet.6 The sophistication, and value, of mobile devices has increased and have become an integral part of modern society, thus increasing exposure to the user to potential victimization; and

WHEREAS, in 2015, approximately two-thirds of victims of property crimes did not report the crime to law enforcement.7 This would include victims of mobile device theft. However, these same victims often do not wish to incur unauthorized charges and fees for data, minutes and messaging on their lost or stolen devices and will call their wireless service provider to report their device lost or stolen. Wireless service providers report these lost or stolen devices to a global registry operated by the Groupe Spéciale Mobile Association (GSMA); and

WHEREAS, every mobile device (cell phone, tablet, etc.) has a unique serial number known as the IMEI (International Mobile Equipment Identifier.) The GSMA is the custodian of all the IMEIs ever issued to equipment makers.8 Network operators in over 110 countries report lost or stolen mobile devices to the GSMA Device Check database in order to block the reutilization of lost or stolen mobile devices on cellular networks throughout the globe. This global mobile device "blacklist" diminishes the value of stolen devices for criminals and deters the trafficking of stolen devices. Furthermore, this mobile device blacklist can also be used by consumers and legitimate businesses which purchase used mobile devices to screen for, and prevent the purchase of, lost or stolen mobile devices; and

WHEREAS, law enforcement officers may not be aware of the significance or existence of the device identifier, IMEI nor are they fully aware of how to access information that is in the GSMA IMEI Database; 9 and

WHEREAS, law enforcement has the need to identify the status of a mobile device which has been reported stolen by the owner, or has been recovered or otherwise in possession by law enforcement. Status of a device for the purposes of law enforcement includes whether the device has been reported lost or stolen to the service provider last providing service to that device; whether the device is on a "blacklist" identifying it was reported lost or stolen; the enrollment status of on-device theft prevention solutions; whether an individual with whom law enforcement comes into contact is the rightful owner of the smartphone;10 and

WHEREAS, the MDTP Working Group lead an initiative to have the Cellular Telecommunications Industry Association (CTIA) create a free law enforcement online portal in the US to the global GSMA Device Check database known as https://stolenphonechecker.org/spc/law to assist law enforcement in the identification and investigation of lost or stolen mobile devices; 11 and

WHEREAS, law enforcement is aware that mobile devices can contain critically important evidence pertaining to a variety of criminal investigations which include mobile device theft, and that on-device security features often include default device encryption without encryption key recovery. This increasingly places evidence beyond law enforcement reach no matter the circumstances; therefore, be it

RESOLVED, the International Association of Chiefs of Police (IACP) reaffirms its position that due to the vital need for access to all available evidence in criminal investigations, all mass-market device manufacturers should be required to maintain the capability to unlock their devices and make the contents available to law enforcement in response to appropriate legal demands, and that maintaining such a capability is consistent with long-standing tradeoffs on device security and privacy; and, be it

FURTHER RESOLVED, the IACP calls upon all law enforcement agencies to strongly support developing public awareness materials educating and encouraging community members to activate on-device security features on their mobile devices in an effort to prevent and reduce crime; and, be it

FURTHER RESOLVED, the IACP encourages all law enforcement agencies to use the global GSMA Device Check database which can be accessed in the US at www.stolenphonechecker.org/spc.law; in Canada at https://www.devicecheck.ca/law-enforcement/, and in other nations at https://goo.gl/YD7XP4 to identify, and investigate, lost or stolen mobile devices.

1 Major Cities Chiefs Association, Resolution, February 10, 2012, https://www.majorcitieschiefs.com/pdf/news/commdeviceresolution1.pdf

2 Secure our Smartphones Initiative, https://ag.ny.gov/feature/secure-our-smartphones-sos

3 Secure our Smartphones, 2014 Report, Page 12, https://ag.ny.gov/pdfs/SOS%201%20YEAR%20REPORT.pdf

4 4.5 Million smartphones were lost or stolen in 2013, Los Angeles Times, April 17, 2014, http://www.latimes.com/business/technology/la-fi-tn-45-million-smartphones-lost-stolen-2013-20140417-story.html Consumer Reports, May 28, 2014, http://www.consumerreports.org/cro/news/2014/04/smart-phone-thefts-rose-to-3-1- million-last-year/index.htm

5 Federal Communications Commission (FCC) Report of Technological Advisory Council (TAC) Subcommittee on Mobile Device Theft Prevention (MDTP) Analysis and Recommendations for 2015, Criminal Statistics, Page 21-22, https://transition.fcc.gov/bureaus/oet/tac/tacdocs/meeting12414/TAC-MDTP-Report-v1.0-FINAL-TAC-version.pdf

6 CTIA, Wireless Snapshot 2017, https://www.ctia.org/docs/default-source/default-document-library/ctia-wirelesssnapshot.pdf

7 United States Department of Justice, Bureau of Justice Statistics, Criminal Victimization, 2015, Summary, NCJ 250180, October 2016, https://www.bjs.gov/content/pub/pdf/cv15_sum.pdf

8 GSMA, Mobile Equipment Identity, https://www.gsma.com/managedservices/mobile-equipment-identity/

9 Federal Communications Commission (FCC) Report of Technological Advisory Council (TAC) Subcommittee on Mobile Device Theft Prevention (MDTP) Analysis and Recommendations for 2015, Law Enforcement Use Cases, Page 12, https://transition.fcc.gov/bureaus/oet/tac/tacdocs/meeting121015/Report-Mobile-Device-Theft-Prevention.pdf

10 Federal Communications Commission (FCC) Report of Technological Advisory Council (TAC) Subcommittee on Mobile Device Theft Prevention (MDTP) Analysis and Recommendations for 2015, Additional Law Enforcement Considerations, Page 8, https://transition.fcc.gov/bureaus/oet/tac/tacdocs/meeting121015/Report-Mobile-Device-Theft-Prevention.pdf

11 U.S. Wireless Industry Launches Free Tool to Combat Smartphone Theft, May 11, 2017, https://www.ctia.org/industrydata/press-releases-details/press-releases/us-wireless-industry-combats-smartphone-theft