Research details how vulnerabilities in signaling protocols used by mobile network operators for international roaming can be exploited to geolocate devices
Gary Miller / The Citizen Lab :
Context & Ripple Effects
Citizen Lab’s research extends a long-running record of signaling-layer exposure in mobile networks: SS7 weaknesses were previously tied to location tracking and communications interception, while later research identified 4G/5G attack paths that could also reveal a target’s location. The significance is that international roaming creates an inter-operator trust boundary where such flaws can affect subscribers beyond their home carrier.
The issue remains relevant across generations of mobile infrastructure: subsequent Citizen Lab coverage described spying campaigns abusing SS7 and Diameter weaknesses across 2G through 5G networks.
First-order effects
- Mobile operators using vulnerable roaming-signaling paths face an immediate risk that a device’s location can be requested or inferred by an unauthorized party exploiting those protocols.
- Subscribers’ location privacy depends not only on their own carrier’s controls but also on the security of roaming interconnections and counterpart networks.
Second-order effects
- Operators and roaming partners are pressured to tighten signaling filtering, monitoring, and access controls, since a weakness at an interconnect can expose customers of other networks.
- The findings reinforce that newer radio generations do not automatically eliminate signaling-layer risk: earlier 4G and 5G research also linked protocol flaws to targeted location tracking.
Third-order effects
- If cross-network signaling trust remains broadly permissive, mobile privacy becomes a supply-chain security problem in which the weakest participating operator can affect users elsewhere.
- The pattern points toward sustained scrutiny of legacy and transitional signaling systems, reflected in reported SS7 and Diameter abuse across 2G to 5G, rather than a clean security break with each new network generation.
The trend: Mobile-network security is shifting from a focus on radio-generation upgrades toward securing the inter-operator signaling and trust layers that persist across them.