`It is possible to eavesdrop on a certain cellphone if one actively monitors either the handovers or the connection set-up messages from the OMC [operations and maintenance centre] or if one knows the Ki in the smart card. `Both options are entirely possible. The first option, which relies on knowing the A5 encryption key, requires the right equipment. The second option, using the Ki, means you have to know the A3/A8 algorithms as well or the Ki is useless. These algorithms can be obtained by hacking the switch manufacturer, i.e. Siemens, Alcatel, Motorola ... `As a call is made from the target cellphone, you need to feed the A5 key into a cellphone which has been modified to let it eavesdrop on the channel used by the cellphone. Normally, this eavesdropping will only produce static--since the conversation is encrypted. However, with the keys and equipment, you can decode the conversation.' This is one of the handover messages, logged with a CCITT7 link monitor, that he saw: 13:54:46"3 4Rx< SCCP 12-2-09-1 12-2-04-0 13 CR BSSM HOREQ BSSMAP GSM 08.08 Rev 3.9.2 (BSSM) HaNDover REQuest (HOREQ) -------0 Discrimination bit D BSSMAP 0000000- Filler 00101011 Message Length 43 00010000 Message Type 0x10 Channel Type 00001011 IE Name Channel type 00000011 IE Length 3 00000001 Speech/Data Indicator Speech 00001000 Channel Rate/Type Full rate TCH channel Bm 00000001 Speech Encoding Algorithm GSM speech algorithm Ver 1 Encryption Information 00001010 IE Name Encryption information 00001001 IE Length 9 00000010 Algorithm ID GSM user data encryption V. 1 ******** Encryption Key C9 7F 45 7E 29 8E 08 00 Classmark Information Type 2 00010010 IE Name Classmark information type 2 00000010 IE Length 2 -----001 RF power capability Class 2, portable ---00--- Encryption algorithm Algorithm A5 000----- Revision level -----000 Frequency capability Band number 0 ----1--- SM capability present -000---- Spare 0------- Extension Cell Identifier 00000101 IE Name Cell identifier 00000101 IE Length 5 00000001 Cell ID discriminator LAC/CI used to ident cell ******** LAC 4611 ******** CI 3000 PRIority 00000110 IE Name Priority 00000001 IE Length 1 -------0 Preemption allowed ind not allowed ------0- Queueing allowed ind not allowed --0011-- Priority level 3 00------ Spare Circuit Identity Code 00000001 IE Name Circuit identity code 00000000 PCM Multiplex a-h 0 ---11110 Timeslot in use 30 101----- PCM Multiplex i-k 5 Downlink DTX flag 00011001 IE Name Downlink DTX flag -------1 DTX in downlink direction disabled 0000000- Spare Cell Identifier 00000101 IE Name Cell identifier 00000101 IE Length 5 00000001 Cell ID discriminator LAC/CI used to ident cell ******** LAC 4868 ******** CI 3200