As marketers, data Brokers and tech giants endlessly expand access to personal data and web movement, and tools like VPNs or cookie blockers can become increasingly weak and futile. Without being completely off the grid forever, the average person has few options to meaningfully resist online tracking. Even after laying out a technical solution last year for how phone carriers could stop automatically collecting users’ locations, researchers Barath Raghavan and Paul Schmitt knew it would be a challenge to convince telcos to implement the change. So they decided to be the vehicle they wanted to see in the world.
The result is a new company called Invisv that provides mobile data designed to separate users from specific identifiers, so companies can’t access or track customers’ metadata, location information, or mobile browsing. The company’s Pretty Good Phone Privacy, or PGPP service, launched in beta on Android today, will replace the mechanism carriers typically use to turn cell tower connection data into a treasure trove of information on users’ mobiles. It will also provide a relay service that separates users’ IP addresses from their web browsing.
“If you can separate the identity of the user from the way they connect to the network, that’s a universal hammer that can solve a lot of privacy problems,” said Barath Raghavan, who is also a professor at the University of Southern California. “Privacy should be the default, but it’s not currently, so we’re working on it. As people become more concerned about what their phones are leaking to telecom and tech companies, there’s a growing appetite.”
PGPP’s ability to mask cell phone identities from cell towers came from a revelation as to why cell towers collect unique identifiers called IMSI numbers, telecommunications and other devices deploying devices called IMSI catchers (often referred to as “stringrays”) ”) can track these identifiers. , which mimics a cell tower used for surveillance purposes. Raghavan and Schmitt realized at their core, the only reason operators need to track an IMSI number before allowing a device to connect to a cell tower for service is so they can run a billing check and confirm A given SIM and device are paid to the operator. By acting as the operator themselves, Invisv can implement their PGPP technology which simply generates a “yes” or “no” as to whether the device should get service.
On the $90 per month PGPP “Mobile Pro” plan, users get unlimited mobile data in the US and, at launch, unlimited international data in most EU countries. Users also get 30 random IMSI number changes per month, which can happen automatically (basically once a day) or on-demand when the customer needs them. The system is designed to be blind, so INVISV and the cell towers you are connected to have no idea which IMSI is yours at any given time. There’s also a $40 per month “Mobile Core” plan that offers 8 IMSI number changes per month and 9 GB per month of high-speed data.
Both plans also include PGPP’s relay services. Similar to Apple’s iCloud Private Relay, PGPP’s Relay is a way to keep everyone (from your internet provider or carrier to the websites you visit) from knowing who you are and what you’re viewing online at the same time. Such relays send your browsing data through two relay stations that allow you to browse the web as normal while shielding your information from the outside world. When you navigate to a website, your IP address is visible to the first relay (Invisv in this case), but the information about the page you are trying to load is encrypted. The second relay then generates an alternate IP address and connects it to your request, at which point it is able to decrypt and see the website you are trying to load. Content delivery network Fastly is partnering with Invisv to provide a second relay. Fastly is also one of the third-party providers of iCloud Private Relay.
