IC Technology — 2026-04-23

Citizen Lab links commercial surveillance vendors to covert exploitation of global telecom signaling protocols

The University of Toronto Citizen Lab published research on April 23 documenting the first confirmed linkage of real-world attack traffic to mobile operator signaling infrastructure used for covert surveillance. Two unknown surveillance campaigns mimicked mobile phone operator identities and manipulated SS7 and Diameter signaling protocols to track targets, using infrastructure associated with operators in 17 countries including Israel, China, Poland, and the UK. Citizen Lab director Ron Deibert described the actors as ghost operators within the global telecom ecosystem, noting the activity blends into billions of normal roaming signals.

Analysis
Citizen Lab's April 23 research (reported by CyberScoop; TechCrunch adds nothing substantive) converts a twelve-year-old theoretical vulnerability into documented commercial exploitation. Two covert campaigns mimicked legitimate mobile operator identities to manipulate SS7 and Diameter signaling across infrastructure spanning 17 countries, traffic that blends invisibly into billions of routine roaming signals. The ghost-operator scale confirms a commercial surveillance industry operating beyond any single national regulator's reach. Formal regulatory action to address these vulnerabilities is unlikely within 90 days. Twelve years of inertia since initial disclosure and the FCC's failure to advance beyond a 2024 Notice of Inquiry leave no plausible near-term enforcement pathway. The campaigns may instead represent lawful-intercept vendors operating under national legal authority, with the ghost-operator framing reflecting Citizen Lab's institutional skepticism toward government surveillance programs.

2 sources