Full Report
Citizen Lab doctoral fellow Swantje Lange spoke with Tagesspiegel about the Lab’s recent research on telecom surveillance campaigns. The post Spying Via Your Mobile Phone: Companies Can Locate Any Device at Any Time appeared first on The Citizen Lab.
Analysis Summary
# Threat Actor: Commercial Surveillance Vendors (CSVs)
## Attribution & Identity
* **Actor Identification:** Private sector commercial surveillance firms operating as "hired guns" for state clients.
* **Known Associations:** These actors are frequently private contractors aligned with or hired by government intelligence and law enforcement agencies.
* **Identity Notes:** The article specifically highlights a shift toward a system where state-sponsored attacks (specifically Chinese transnational repression) are carried out by these private contractors.
## Activity Summary
Recent research focuses on the exploitation of the global telecommunications interconnect ecosystem. These actors conduct covert surveillance campaigns that allow for the real-time geolocation and tracking of mobile devices worldwide. This activity is often part of broader "digital transnational repression" efforts.
## Tactics, Techniques & Procedures
* **Interconnect Exploitation:** Leveraging vulnerabilities in global telecom signaling protocols (such as SS7 or Diameter, though not named explicitly, they comprise the "interconnect ecosystem") to query provider networks.
* **Geolocation Tracking:** Constant, real-time location monitoring of mobile devices without the user’s knowledge or consent.
* **Impersonation:** Using stolen narratives and impersonating journalists or civil society members to facilitate social engineering or repression.
* **Covert Surveillance:** Operating through "shady" private infrastructure to hide the ultimate state sponsor.
## Targeting
* **Sectors:** Journalism, Civil Society, Government/Politics.
* **Geography:** Global (due to the nature of roaming and telecom interconnects); specific mention of Latin America and China-aligned operations.
* **Victims:**
* Journalists
* Politicians
* Opposition figures
* Human rights defenders
## Tools & Infrastructure
* **Malware Families:** Commercial spyware suites (names not specified in the summary text).
* **Infrastructure:**
* Global Telecommunications Interconnects.
* Commercial surveillance platforms provided by private contractors.
* Defanged reference examples: hxxps://citizenlab[.]ca/research/uncovering-global-telecom-exploitation-by-covert-surveillance-actors/
## Implications
The commodification of high-level telecom exploits by private companies lowers the barrier to entry for states to conduct global surveillance. This creates a significant threat to democratic processes and personal safety, as "any device can be located at any time." It facilitates transnational repression, allowing regimes to target dissidents even after they have fled overseas.
## Mitigations
* **Network Hardening:** Telecommunication providers must implement stricter signaling firewalls and monitoring to detect unauthorized location queries.
* **Policy & Regulation:** International pressure and regulation on the sale of dual-use surveillance technologies to jurisdictions with poor human rights records.
* **Operational Security (OPSEC):** High-risk individuals should minimize reliance on cellular connectivity in favor of encrypted data-only communication via trusted ISPs/VPNs where possible.
* **Transparency:** Continued research by organizations like The Citizen Lab to expose the "interconnect" vulnerabilities used by these vendors.