Appendix I: Detail Analysis of MTP Network Security In this section, SRLabs, who maintain the GSM Map Project, detail the missing data protection measures evident in Myanmar and uncovered by their analysis of the delegations GSM measurement data. The following information is for a more technical reader familiar with GSM communication protocols. The following reference missing network security protection features observed from MPT’s GSM network: A5/1 + Randomization The A5/1 cipher can be broken with moderate effort and investment. Even so, it is better than no encryption in the first place. As A5/1 decryption attacks rely on a known plaintext, knowledge about the full content of any encrypted message provides attack surface, so the following additional measures need to be implemented when using A5/1: Fill bit randomization As the information transmitted in most GSM control messages does not fill the whole SDCCH frame, message length is indicated at the beginning of the frame, with following unused bytes traditionally being padded with static bytes. By randomizing these so-called "fill bits," plaintext prediction and cryptographic attacks can be mitigated. SI/5 randomization System information type 5 (SI5) messages cannot be scrambled using padding randomization since they are of full length and hence contain no padding. Additionally, their content is predictable, as they are also sent in plaintext before encryption starts. There are several approaches for randomizing or omitting these messages, some of which are standardized through 3GPP and some of which are individual ideas by equipment manufacturers. A5/3 encryption The A5/3 encryption derives from a standard introduced by 3GPP for third generation mobile networks, but can also be backported to GSM. As of today, no practical attacks on A5/3 encrypted GSM traffic have been demonstrated. Usually, not all cells in a network are capable of A5/3, which is why the additional measures for A5/1 are necessary. Hopping entropy During call setup, the BTS defines a frequency hopping sequence to the handset. For the time of the call, the transmission frequency is constantly switched following the specified pattern. The function to generate the frequency hopping sequence is relying on 4 variables that are either known to the attacker or highly predictable. Introducing entropy into this function will make it much harder for an attacker to record encrypted traffic for later decryption. Note: In Myanmar, the hopping entropy score is relatively high because they are using all available frequencies. However, since they are not encrypting at all, this doesn't really help against intercept. 30