Invoices show Israeli surveillance firm Rayzone leased access to SS7 traffic from a Channel Islands mobile operator to spy on cell communications and locations

The Guardian 2020-12-17

Context & Ripple Effects

The Guardian's invoice trail shows Rayzone did not rely on its own product alone to reach targets: it sells the Echo system, which repurposes advertising-industry data for phone tracking, but this reporting reveals a second, older vector — leased SS7 signaling access from a Channel Islands mobile operator that exposed cell communications and locations directly at the telecom layer.

The finding lands five days after Forbes reported that Israeli vendors like Verint-backed Bsightful siphon app location data through ad exchanges, sketching an industry that treats telecom interconnects and ad-tech pipelines as interchangeable surveillance inputs sold to government buyers — the same buyer base as NSO Group's Pegasus deals in the Gulf.

First-order effects

The unnamed Channel Islands mobile operator now faces questions over how a surveillance vendor came to lease SS7 access on its network, and every carrier connected to it inherits exposure to the same signaling path.
Government agencies already buying Rayzone's Echo ad-data tracking gain a complementary capability: SS7-level interception of communications and locations that does not depend on the advertising ecosystem.

Second-order effects

Mobile operators worldwide come under pressure to audit and restrict who can lease SS7 access, since the invoices show the interconnect market functions as a commercial surveillance supply chain.
Rival vendors' reliance on ad-exchange data — Bsightful's model, echoed in Echo — looks more fragile by comparison, pushing the competitive question toward which access surface regulators scrutinize first.

Third-order effects

If the pattern holds, commercial spyware firms are assembling portfolios of access surfaces — telecom signaling, ad-tech data, device exploits — meaning defenses and export controls aimed at any single vector leave the others open, and regulators must police the whole portfolio rather than individual tools.

The trend: Commercial surveillance vendors are diversifying across multiple access surfaces — telecom signaling, ad-tech data, device exploits — turning each into a separately sellable interception channel for government clients.

Discussion

@jsrailton John Scott-Railton on x
1/ BREAKING: Island of #Guernsey sold global SS7 access to corporate spy firm Rayzone. Letting them track & intercept any phone in the world. By @skirchy & @dansabbagh Explainer THREAD... https://www.theguardian.com/ ... https://twitter.com/...
@jsrailton John Scott-Railton on x
2/ Yesterday @skirchy reported that China abuses the SS7 system to track Americans around the world. Today its a private surveillance firm... https://www.theguardian.com/ ...
@jsrailton John Scott-Railton on x
4/ Takeaway: The SS7 system is broken & constantly being abused. Future: 5G means moving to new systems...but they are inheriting many weaknesses of legacy systems. Just ask @enisa_eu https://twitter.com/...
@zackwhittaker Zack Whittaker on x
Holy shit. Rayzone, an Israeli corporate surveillance firm, got access to a Channel Islands cell network in order to tap into SS7, “potentially enabling its clients at that time to track the locations of mobile phones across the world.” https://www.theguardian.com/ ...
@jsrailton John Scott-Railton on x
6/Things are especially broken in the US. Experts have made the problem clear, @DHSgov has laid out what needs to be done....but @FCC under @AjitPaiFCC has blocked serious policy fixes. https://twitter.com/...
@2b_as Tobias Engel on x
“Track & intercept any phone in the world” is not as easy anymore as it was five years ago. Many network operators take measures to protect their own subscribers. But they can't protect you once you are roaming in another network, and most networks don't protect inbound roamers. …
@fabiochiusi Fabio Chiusi on x
“The investigation has found that private intelligence companies are able to rent access from mobile phone operators and this can then be exploited to allow the tracking of the physical location of users across the world” https://t.co/rC5NvZax96
@marietjeschaake Marietje Schaake on x
More evidence of how the corporate surveillance technology and intelligence market is toxic and out of control ↘️ https://twitter.com/...
@vijayshekhar Vijay Shekhar Sharma on x
A network is as strong as, its weakest link. https://twitter.com/...
@tbij @tbij on x
“The Channel Islands cannot allow itself to be used as an offshore global spy centre,” says @Edin_O, advocacy director at Privacy International
@jsrailton John Scott-Railton on x
3/ Furthermore we @citizenlab just reported that Circles, another private surveillance firm sells SS7 abuse as a service has deployments in countries around the world. https://twitter.com/...
@razhael Raphael Satter on x
Wow. This report says that tiny Channel Islands telcos are being abused for SS7 surveillance - including, allegedly, in a bid to help abduct Dubai Princess Latifa. https://www.thebureauinvestigates.com/ ...
@ronwyden Ron Wyden on x
Spies around the world are tracking Americans, because shady foreign companies are selling access to our wireless networks. Meanwhile the Republican-controlled FCC won't lift a finger to protect our privacy and national security. https://www.thebureauinvestigates.com/ ...
@karlbode Karl Bode on x
A major flaw in international wireless networks lets companies track user location and intercept communications, and the FCC has done jack shit to stop it. we did, however, spend most of the year hyperventilating over a Chinese teen dancing app https://www.theguardian.com/ ...
@campuscodi Catalin Cimpanu on x
A telco in the British island of Guernsey sold SS7 access to an Israeli firm named Rayzone, which advertises on its site the ability to provide intelligence-based solutions for national agencies... aka Phone-Tapping-as-a-Service https://www.theguardian.com/ ... https://archive.fo…

Chronicles