Investigation: Swiss company Mitto, which offers automated text messages to companies in 100+ countries, helped governments secretly surveil mobile phone users
Mitto AG's network used to track people via mobile phones, former employees say. — The co-founder of a company that has been trusted …
Context & Ripple Effects
Mitto AG sits in an unglamorous but critical position: it sends automated texts at scale for clients including Google, Twitter, and WhatsApp, meaning its routing network touches two-factor codes and account notifications for much of the consumer internet. The investigation alleges former employees say that same network was used to help governments secretly track mobile users — turning a trusted business-messaging vendor into suspected surveillance infrastructure.
Switzerland is the ironic setting here: Philip Zimmermann moved his encryption startup Silent Circle to the country back in 2015 specifically to escape surveillance, yet the related coverage keeps surfacing Swiss telecom intermediaries in spying cases. The arc continued days after this story when co-founder Ilja Gorelik departed amid the accusations, and later reporting traced similar patterns to Andreas Fink's firms and to whistleblower data showing over a million 2FA SMS messages routed through Fink Telecom, a small Swiss company linked to spy agencies.
First-order effects
- Mitto's marquee clients — Google, Twitter, WhatsApp — now have to weigh whether their authentication and notification traffic flows through infrastructure accused of government surveillance, and the co-founder's exit signals the company is already managing client trust fallout.
Second-order effects
- Brands that depend on A2P SMS for security-critical traffic gain a reason to audit and diversify their messaging vendors, shifting procurement toward providers who can prove where their routes terminate — pressure that lands on every intermediary in the SMS wholesale chain, not just Mitto.
Third-order effects
- If the pattern holds across Mitto, eSurv's spyware abuse, NSO Group's use of harvested location data, and the Fink Telecom routing disclosures, telecom middlemen become a recognized layer of the surveillance supply chain — inviting regulatory scrutiny of message-routing practices and eroding Switzerland's standing as a privacy-safe jurisdiction.
The trend: Commercial messaging and telecom-intermediary infrastructure is being repurposed as state surveillance plumbing, forcing the consumer internet to treat its SMS vendors as a security surface.