Citizen Lab Uncovers Telecom Vendors Exploiting SS7 and Diameter to Track Users

Why It Matters

The exposure of SS7 and Diameter exploitation reveals a systemic vulnerability that affects billions of mobile users worldwide. Because signalling protocols are the invisible glue that routes calls and texts, any breach enables real‑time location tracking without a warrant, undermining privacy protections and potentially facilitating state‑sponsored espionage. The report also pressures regulators to move beyond advisory guidelines toward enforceable security standards, compelling carriers to invest in network hardening, which could reshape capital allocation in the telecom industry. Beyond immediate privacy concerns, the findings could trigger a wave of litigation and regulatory fines for carriers that fail to secure their signalling planes. Investors may reassess risk exposure in telecom stocks, especially for operators with legacy infrastructure in emerging markets where upgrade cycles lag. In the longer term, the push for secure signalling could accelerate the adoption of end‑to‑end encrypted communication services, reshaping the competitive landscape for both traditional telcos and over‑the‑top (OTT) players.

Key Takeaways

• Citizen Lab identified two surveillance campaigns abusing SS7 and Diameter protocols.
• Three carriers—019Mobile, Tango Networks, and Airtel Jersey (Sure)—were used as entry points.
• SS7 lacks authentication and encryption, allowing unauthenticated location queries.
• Diameter, the 4G/5G protocol, is not uniformly implemented, leaving fallback to SS7.
• Sure CEO Alistair Beak pledged monitoring and blocking measures; 019Mobile could not confirm infrastructure use.

Pulse Analysis

The Citizen Lab report is a wake‑up call for an industry that has long treated signalling security as a low‑priority legacy issue. Historically, telecom operators focused on capacity and coverage, assuming that the closed nature of SS7 provided sufficient protection. The reality—exposed by multiple high‑profile breaches—shows that the protocol’s design, conceived in an era before smartphones and mass data analytics, is fundamentally incompatible with modern privacy expectations.

Regulators are now faced with a choice: impose strict, enforceable standards that mandate end‑to‑end encryption and robust authentication for all signalling traffic, or risk a patchwork of voluntary measures that leave gaps for sophisticated adversaries. The EU’s push to deprecate SS7 and the FCC’s pending rules could set a global benchmark, but implementation will be uneven, especially in regions where network upgrades are capital‑intensive. Carriers that proactively retrofit their signalling layers may gain a competitive edge, positioning themselves as privacy‑first providers—a narrative increasingly valuable to consumers and enterprise clients alike.

From an investment perspective, the report could reprice risk in telecom equities. Operators with aging 2G/3G infrastructure may see higher capex requirements, while those that have already migrated to secure 5G cores could benefit from a perception of lower regulatory risk. Moreover, the exposure of third‑party “ghost” vendors underscores the need for tighter supply‑chain governance, prompting carriers to audit and possibly terminate relationships with opaque service providers. In sum, the breach is not just a technical flaw; it is a catalyst for a broader shift toward security‑by‑design in the telecom sector.