Is there a log somewhere on the carrier end for MAC addresses connecting?

[TheGreyJedi]

My wife is in AIT for the US Army National Guard and when moving from one barracks to another, her device "wandered off." This was on Friday, March 6. I was visiting her this weekend, we were not using the device. But nearly 10GB worth of data was used during the day Saturday and Sunday, the time during which the device was missing.

Is there any kind of log somewhere on the device tracking or on the carrier that shows the MAC addresses of the devices using the hotspot? If we get to the point of needing to file criminal charges, it would be helpful to be able to point to which hardware is using the bandwidth.

[John_Getzke]

>Is there any kind of log somewhere on the device tracking or on the carrier that shows the MAC addresses of the devices using the hotspot?

Yes, but you need to have it enabled first.  Detailed connection logging is not always an option so it will depend on which VZW device you are referring to here.

>  If we get to the point of needing to file criminal charges

IANAL but you will likely have problems pressing charges here.  My understanding is that in the US an IP address and MAC address are not considered legal identification of a person.  MACs and IPs are easily spoofed/duped/copied and often are for somewhat savvy malicious users.  They can be a reason to investigate a problem but generally you need more evidence than that to convict someone of a crime or issue a warrant.  Plus if the device isn't yours you don't have any way to legally obtain the phantom device and prove your story.  You would have to ask the criminal nicely to turn over their device so you can press charges against them.

Best thing you can do is enable full WPA2 and pick a new and high entropy WiFi and admin password and power down the device when not in use to stop intruders in the future.

[TheGreyJedi]

It's a 6620 JetPack. WPA2 was set, and I thought I had set a new Admin password, but I can't recall specifically. The device logged almost 10GB worth of data use over a 24 hour period, a period where my wife was with me and we were NOT in the presence of the device. I was pretty sure there wasn't anything that could be done, but I thought I'd ask. It's...tricky at best with the MAC address logging. Hopefully, I can get in touch with VZW this afternoon and lock down the device/IMEI against further use. The line IS suspended.

[John_Getzke · Accepted solution]

Here is a link to the 6620L User Guide:

http://cache.vzw.com/multimedia/mim/vzw-jetpack-mifi6620l/internet-vzw-jetpack-mifi6620l-ug.pdf

On page 50 it mentions the features to display currently connected MAC/IP info.

Otherwise page 103 has some information on the logging features that are available.  As I thought this model does require you to turn them on so it likely wont help you for your situation. 

> I can get in touch with VZW this afternoon and lock down the device/IMEI against further use. The line IS suspended.

If you suspended the line, temporarily or permanently, then no one should be able to use it or your data.  However you can always check with VZW to see if they can offer you any other assistance.

[TheGreyJedi]

The data, at this point, I know isn't usable. I just want to be vindictive and make sure someone can't get a new SIM, slap it in there, and activate a new service.

[John_Getzke]

Oh I see. If the device was actually stolen then yes, definitely contact VZW and report the hardware.  It will get flagged as illegal and that IMEI will no longer work on any carrier networks.  All it will be good for is a local router at that point.