Decoding virtual SIMs — tech used by Pulwama terrorist that allows calls without SIM cards

The suicide bomber who carried out the 14 February Pulwama terror attack as well as his handlers reportedly used virtual SIM cards to stay in touch.

File photo of security personnel at the site of suicide attack in Pulwama | PTI

Bengaluru: The virtual SIMs reportedly used by the Pulwama suicide bomber and his Pakistan- and Kashmir-based handlers to stay in touch have emerged as the latest clue in India’s investigation into the 14 February attack.

According to a report by news agency PTI, the service provider of the virtual SIMs — used in sync with social media — is based in the US, and Indian central security agencies plan to approach the company for details of the cards.

While the information may not lead investigators to identify the buyers — securing services via fake IDs is a common criminal modus operandi — the terrorists’ use of a fairly less-known technology like virtual SIMs has stoked much curiosity among people.

ThePrint explains how a virtual SIM works and how it differs from an e-SIM.

What is a virtual SIM?

To use mobile services, customers need to insert a conventional SIM card into their phones. Each new mobile number requires a new SIM card.

A virtual SIM, meanwhile, lives on a server. To use this, customers sign up for a service by installing an app on their phone. This app generates a phone number without linking it to a physical SIM and, instead, syncs it with an email account or a social network like Facebook.

With this mechanism, a caller can make calls from within the app, over the internet, with most providers offering the service for free. The voice-over-internet-protocol (VoIP) calls made from such a phone will connect directly to the receiver’s handset, without the need of an app at that end.

Some providers even switch the call to phone or voice mail when there is no internet connection for an incoming call. This service is also called a virtual number, and popular providers include Exotel and Knowlarity, often used by businesses for customer-service calls, and Skype and Google Voice, for personal interactions.

Born out of thrift

Virtual services were invented in the mid-1990s as a way to combat long-distance phone charges.

They are similar to a SIM card — with the primary difference being the mode of storage. When you employ a virtual service, all the features and contents are downloaded directly to the phone inside an app instead of onto a physical SIM card.

The service provider used by the terrorists seems to have also guaranteed anonymity and data encryption.

Virtual SIM vs e-SIM

The phrase ‘virtual SIM’ is also often used to describe a different product called the e-SIM. This involves a dummy SIM card that doesn’t have a fixed number. An e-SIM can be purchased online and a new number tied to it.

This then functions like a regular phone number operating out of a conventional SIM card, without the need for an internet connection to place calls. When a number needs to be changed, it can be replaced by attaching a new number to the same physical SIM.

The use of such a service would entail using the mobile network of the e-SIM provider, and using a phone without additional security or encryption. It is, therefore, unlikely to have been used by the terrorists in Kashmir.

What information can be extracted from virtual SIMs?

While users might not be able to access someone’s encrypted phone records, the service provider will have a database of all calls, messages, and other forms of activity from a virtual SIM.

In this instance, India’s central security agencies will approach the unnamed US-based provider, who had given the terrorists a number that started with the country code +1, for information about the buyers and the associated IP addresses.

Details of phone numbers that were dialled from or called the virtual number will also be sought.