Generated by Codex with GPT-5

What happened

Techmeme surfaced this April 25, 2026 story through TechCrunch’s report, and the direct source used here is Citizen Lab’s Bad Connection: Uncovering Global Telecom Exploitation by Covert Surveillance Actors.

Citizen Lab says it uncovered two sophisticated telecom-surveillance campaigns that exploited the global signalling systems connecting mobile carriers, combining older SS7 pathways with Diameter traffic used in 4G and most 5G roaming. One campaign targeted a “VVIP” company executive across multiple 3G and 4G networks. Another used a specially formatted SMS carrying hidden SIM card commands intended to turn the victim’s device into a tracking beacon. The larger point is that both campaigns treated the mobile network itself as the surveillance platform.

What makes the report stronger than a generic warning is the attribution work around infrastructure. Working with Cellusys, Telenor Linx, Roaming Audit, and P1 Security, Citizen Lab correlated signalling logs, packet captures, routing data, DNS records, and operator filings. It says the attackers reused operator identifiers over multiple years and hid behind legitimate telecom pathways associated with providers in places including the UK, Israel, and Jersey, while routing activity through a much wider set of networks around the world. The researchers stop short of naming a government customer, but argue the behavior is consistent with commercial surveillance vendors supporting state intelligence activity.

The report also argues that the weakness is not a single bug that can be patched away. SS7 is still deeply embedded in global roaming and messaging, and Diameter has better security features on paper but often inherits the same trust assumptions in practice because operators do not consistently enforce them. Citizen Lab highlights “combined attach” behavior, where devices and networks maintain continuity across 3G and 4G, as one reason advanced actors can move between older and newer signalling environments instead of being stopped by a generational upgrade.

Why it matters

The interesting part of this piece is not just that researchers found another telecom-tracking campaign. Security reporting has been warning about SS7 for years. The more important finding is that the surveillance market appears to have matured into a durable commercial operating model that can persist across multiple generations of mobile infrastructure.

That matters because the attack surface is unusually hard to govern. These actors do not need to phish the user, compromise an app, or break into a handset vendor. If they can buy, lease, or otherwise obtain access to the interconnect ecosystem, they can make malicious requests look like legitimate carrier traffic. Citizen Lab’s report suggests that weak screening and poor operator operational security let attackers route through trusted pathways and blur who is actually responsible. In other words, the system’s business relationships become part of the exploit.

There is also a policy and sovereignty angle. Mobile networks are treated as critical infrastructure, but the report describes a world in which private signalling access, third-party service providers, and international roaming arrangements can be repurposed for covert tracking without obvious accountability. That turns telecom security into more than a carrier engineering problem. It becomes a regulatory, diplomatic, and civil-liberties problem, especially when commercial vendors sell the capability across borders.

For everyday users, the uncomfortable implication is that moving from 3G to 4G or 5G does not automatically solve the privacy problem. The telecom stack still depends on legacy trust models, interoperable fallbacks, and opaque commercial intermediaries. That is exactly the kind of environment where surveillance systems can stay effective even after their underlying weaknesses are widely known.

Takeaway

The strongest idea in this Techmeme-surfaced story is that telecom surveillance is no longer best understood as a relic of broken legacy infrastructure. It is an active and adaptive business.

Citizen Lab’s report shows how commercial surveillance actors can mix signalling abuse, spoofed operator identities, and SIM-level tricks into long-running tracking systems that hide inside normal telecom operations. The headline is about two campaigns, but the deeper message is that the global mobile network still contains a trusted core that sophisticated actors can rent, borrow, or manipulate.

That is why this piece stands out. It does not just say “SS7 is still bad.” It shows how the economic and operational structure around mobile interconnects keeps turning old protocol weaknesses into a modern surveillance industry.