[General Topics] Mechcondrid:
actually, yes i am familiar with the federal definition of it; I actually design, build and implement custom IoT CnC (command and control) systems, of which one connection option offered is embedded cellular modules (other options include point to point microwave links as well as satcom links like the U-Blox system).

I do this as part of my job for a DoD contractor, so reading up on the compliance requirements of it is basically required to design and sell these systems unless i'd like the company to run afoul of a number of DFARs regulations/clauses and various federal contracting laws/regulations.

i have to even go as far as what specific brands and SoCs i use in a design depending on the customer, contractual context and if it's DoD related or not.

i research and read far more about the legality of things than you would ever expect a system architect to do.

you are coming into the scenario under the presumption that the IMEI is only ever altered (or at least the majority of the time) for illegal or duplicitous means, while that is a possibility, equally a possibility (or even more likely since there is considerable effort and technical skill involved and criminals generally would want easier methods) is a legitimate reason to do so.

the assumption of prima facie evidence runs under the understanding that the particular action is distinctly common to allude to or point to the very likely commission of a crime and only in the absence of competing evidence.

even then it generally requires the prosecution to provide point by point evidence pointing to the confirmation or the support of the prima facie assumption.

someone gets caught with 5 lbs of marijuana (pre-decriminalization/legalization, but this is an apt example that happened quite a bit) and says it's for "personal use"; it's FAR more likely that amount was purchased with the intent to resell (prima facie) than it is that one person is going to go through 5 whole lbs of weed in any realistic amount of time.

i believe there is also the same kind of law concerning liquor reselling without a liquor license somewhere but the core concept remains the same.

a legal non-blacklisted device, active paid carrier account registered to the person in question, and the IMEI being from a device that is also legally owned by the same user and no other active device used on the network with that IMEI would all be competing points of evidence that are easily verifiable by both third parties and the carrier's own records in conjunction with various forms of proof from the person in question themselves.

in one non-DoD customer scenario (that i've actually had to deal with) a cat 18 lte module we had deployed and provisioned would continuously get throttled and deprioritized as a type of hotspot device when it was in fact a single node communications module due to some issue on the carriers backend management in the regional tower software (passadena, ca area to be specific), the module does not move and is simply in a location where running conventional wired or directed microwave networking infrastructure is both financially and physically infeasible; despite working with the carrier's enterprise support, every time we would get the modem back online to realistically usable speeds, about 72-84 hours later the module would again get deprioritized and return to sub megabit speeds on the upstream; this was a implementation that needed near-realtime data relay (less than 1 minute between data collection and upload/reception) which those kind of abysmal upload speeds completely blew out of the water.

after spending a cumulative 80 man hours attempting to work and troubleshoot with the carrier via normal support channels we decided to alter the imei using a cellular capable samsung tablet we purchased specifically to scavenge the IMEI.

The actual tablet itself is not and was never activated on any network and to this day sits on the server room shelf gathering dust and was never even turned on and had it's first boot setup performed.

i'd honestly be very surprised if the tablet is even still functional considering it's sat there for years in a discharged state.

this was a legal purchase, is not a duplicated hardware node on any carrier network and is being used to access a legally and properly registered service that is being paid for by the registered account owner.

so: no fraud, no cloned device on any network and everything registered as it should be regarding the account owners, simply what amounts to a system repair using IMEI modification.

to date (going on roughly 3 years now) this fix has been rock solid and the only service interruption has been when the local power supply failed after the NEMA enclosure gasket had gotten damaged from a local tech's improper closure of the lid.

there is no specific law (in the USA) forbidding the alteration of an IMEI in and of itself without consideration to the intent or specific actions/activity being performed with the completion of that modification.

a prima facie case would likely be valid if we are talking about an actual cell phone as opposed to a hotspot or other data only terminal since there is little to no legitimate benefit to altering phone IMEIs (smart phone IMEIs are already one of the highest priority devices on carrier networks behind enterprise and first responder/mission critical nodes) outside of some very specific and niche scenarios;

but again, there COULD be legitimate reasons to do so and much of those are relatively easy to prove or disprove with information external to the person that is in question.