Geneva, Switzerland, November 2014 IMEI Ecosystem & its Role in Combatting Use of Counterfeit Devices James Moran, Security Director, GSM Association Combating Counterfeit and Substandard ICT Devices (Geneva, Switzerland, November 2014)

Geneva, Switzerland, November Introducing GSMA Level 1 text to appear in Verdana font, Point size 32 Founded in 1987 by 15 operators committed to the joint development of a cross border digital system for mobile communications. Became the global trade group for the mobile industry, representing the vast majority of mobile phone networks across the world Now encompassing commercial, public policy and technical initiatives, ensuring mobile services work globally The Association’s members now serve more than 6 billion customers More than 800 operator Members across 220 countries Over 200 Associate Members (manufacturers and suppliers) Success built on open standards, interoperability and scale

Geneva, Switzerland, November Identifying Mobile Devices International Mobile Equipment Identifier (IMEI) defined in 3GPP specifications to uniquely identify mobile devices IMEI originally introduced to prevent non-type approved devices from accessing mobile networks Type Approval Advisory Board (consisting of type approval and government officials) endorsed IMEI as satisfactory serial number Type approval regime disbanded in 1999 and replaced by industry initiated voluntary certification scheme IMEI is globally recognised and government approved mechanism to uniquely identify devices IMEI is the only universally applicable and necessary device identifier

Geneva, Switzerland, November IMEI Characteristics IMEI No. 15 Digits TACSerial No Check Digit NNXXXXXXZZZZZZA TACType Allocation Code, can generate 1 million IMEIs NNReporting Body Identifier XXXXXXME Type Identifier defined by the Reporting Body ZZZZZZAllocated by the Reporting Body but assigned per ME by the manufacturer ACheck digit, defined as a function of all other IMEI digits

Geneva, Switzerland, November Obtaining IMEIs Type Allocation refers to the process by which mobile devices are allocated a Type Allocation Code (TAC) and an IMEI number range The TAC is an 8 digit element of the IMEI and identifies the device make and model TACs are allocated, as part of the IMEI number ranges, to device manufacturers

Geneva, Switzerland, November History of TAC Allocation TACs originally administered and funded by national approval authorities Abolition of Type Approval in 1999 required industry to establish alternative regime GSMA given responsibility in April 2000 for IMEI number range and TAC allocation GSMA formally appointed the Global Decimal Administrator (GDA) in 2004: Appointing regional bodies to allocate TAC/IMEI ranges Maintaining list of allocated TACs/IMEIs Distributing list of allocated ranges via IMEI Database Provide expertise and advice on allocations GSMA is the sole allocation authority for 3GPP compliant devices

Geneva, Switzerland, November TAC Allocation Principles GSMA must adhere to defined principles: Process must be open, fair and transparent that allocates TACs in a non-discriminatory manner and with the minimum of delay Process must allocate unique TACs that can be universally used by manufacturers to ensure global network access Allocation of finite TAC resources must be done in an efficient manner that ensures future availability There should be one single defined process Process should be accessible on-line Database containing TAC allocations should be confidentially maintained Process and tools should be compatible with existing systems All requirements satisfied by GSMA

Geneva, Switzerland, November GSMA Responsibilities Coordinate the overall allocation of equipment identifiers Appoint Regional Bodies to allocate equipment identifiers Define and maintain equipment identifier allocation processes Ensure adherence to agreed allocation processes Resolve disputes related to the allocation of equipment identifiers Preserve confidentiality of data pertaining to the TAC allocations Maintain list of TAC allocations in IMEI Database Distribute Model Summary report (MSR) to eligible parties Provide expertise and advice on allocation and IMEI issues Work with all stakeholders to build and preserve integrity of the IMEI

IMEI Database Amazon Hosting Global repository of all TAC and IMEI number ranges allocated to device manufacturers Operationally available 24 X 7 Enabler for customs and law enforcement agencies Regulators Customs MNOs Stakeholders LEAs

Geneva, Switzerland, November Device Database Report Distributed by GSMA for the benefit of all stakeholders Facilitates the identification of devices and device characteristics Underpins efforts to control devices that attach to mobile networks and to reduce value by blocking spurious devices Facilitates identification of counterfeit devices and grey market products Deters device crime and supports prosecutions, device recovery, laundering prevention, etc. Critical to enhancing consumer education and protection

Geneva, Switzerland, November Device Database Users Network operators – over 700 GSMA members National Regulatory authorities – 14 Bangladesh, Costa Rica, Cyprus, Egypt, Gambia, India, Jordan, Mauritius, Pakistan, Portugal, Rwanda, Turkey, Uganda, UAE Law enforcement agencies – 14 Australia, Canada, Channel Islands, Czech Republic, Finland, France, Germany, Israel, Netherlands, South Africa, Sweden, Switzerland, United Kingdom, USA Customs agencies – 2 Italy, Mauritius

Conclusions and Recommendations We already have a standards based identifier – the IMEI IMEIs allocated to applicants in accordance with defined processes Effective solutions already exist that use the IMEI to identify and block devices No demonstrable failure on the part of the IMEI system Not enough use currently being made of the available data The primacy of the IMEI as a device identifier should be recognised Industry investment in IMEI needs to be supported GSMA willing to support efforts to combat counterfeits – use us! Governments and stakeholders should come take our data – it’s free! Geneva, Switzerland, November