May 26, 2026News / AnalysisUnited Kingdom Bahrain Cambodia China Israel Italy Liechtenstein Poland Switzerland Thailand United States

Fifteen Thousand Seven Hundred

On April 23, 2026, the Citizen Lab published "Bad Connection," documenting two multi-year surveillance campaigns that exploit the signaling protocols underlying every mobile phone call on earth. The campaigns tracked targets across multiple countries using shell companies with legitimate telecom licenses — "ghost operators" whose infrastructure serves as a trusted gateway into the global signaling network. Three entities are named: 019Mobile, a privately owned Israeli mobile virtual network operator; Tango Networks UK, a British subsidiary of a Texas-based enterprise mobility company; and Airtel Jersey, a Channel Islands operator now owned by Sure. The first campaign rotated through 11 operator identities across ten countries to disguise surveillance traffic as legitimate roaming queries, using coordinated alternating access through SS7 and Diameter protocols — when one was blocked, the system automatically switched to the other. The second campaign sent invisible SMS commands directly to targets' SIM cards, instructing the cards to report location data back to the attacker. No notification appeared on the target's phone. No trace was left in the message log. Citizen Lab documented more than 15,700 such tracking attempts since late 2022. SS7, the signaling protocol designed in the 1970s, has no authentication, no encryption, and no verification that a signaling request comes from a legitimate operator. Diameter, the protocol designed to replace SS7 for 4G and 5G networks, was built with stronger security controls, but operators have "largely failed to implement" them, continuing to rely on the same peer-to-peer trust model. The structural finding is that the vulnerability is not a bug. It is the architecture. The telecom interconnection system assumes every operator is who it claims to be. Ghost operators exploit that assumption. Every mobile phone with a SIM card is in the attack surface — not by misconfiguration or user error, but by design. No VPN protects against it. No encrypted messenger prevents it. No privacy-focused browser blocks it. The attack operates below the IP layer, at the signaling infrastructure that connects every call, every text, and every data session on every mobile network in the world. The user-side defense is the same defense this publication has been documenting across every domain of internet freedom: operate outside the intermediary layer. The peer-to-peer overlay that does not route through the carrier's signaling infrastructure. The mesh network that does not require a SIM card. The transport that does not traverse the trust model the ghost operators exploit. Meanwhile, in the same month Citizen Lab published its findings, DHS told NPR that ICE has "no relationship" with Paragon Solutions, the Israeli commercial spyware maker — while declining to clarify whether ICE can still access Paragon-developed tools through a third party. The ghost operator pattern is the same pattern at a different layer: legitimate-looking entities serving as intermediaries for surveillance capabilities that the end target cannot detect, cannot block, and was never told about. Fifteen thousand seven hundred tracking attempts. No trace on the phone.

URnetwork editorialSan Francisco — May 26, 2026

Fifteen thousand seven hundred

The number is the count of invisible operations.

Since late 2022, surveillance actors have sent more than 15,700 tracking queries through the global mobile signaling network, targeting individuals across multiple countries using telecom infrastructure that appears — to every network it touches — to be legitimate roaming traffic. The targets' phones displayed no notification. Their message logs recorded no event. The tracking was invisible at the device layer because it operated at the signaling layer beneath it.

The Citizen Lab at the University of Toronto published the findings on April 23, 2026, in a report titled "Bad Connection," authored by Gary Miller and Swantje Lange. The report documents two distinct surveillance campaigns, names three telecom entities whose infrastructure served as the gateway, and identifies the structural property that makes these campaigns possible: the global telecom interconnection system is built on a trust model that was never designed to verify whether signaling traffic is what it claims to be.

The ghost operators

The three named entities are not intelligence agencies. They are not traditional surveillance vendors. They are telecom companies with legitimate licenses.

019Mobile is a privately owned Israeli mobile virtual network operator that brands itself as Telzar 019. It operates its own core network on Partner Communications' radio access network. The Haaretz investigation that followed Citizen Lab's publication — headlined "Ghost Operators: How Israeli Telecoms Were Exploited to Track Citizens Worldwide" — documented dozens of tracking attempts routed through 019Mobile's infrastructure. The company's head of IT and security stated that "no risk to our customers has been identified" and could not confirm the infrastructure belonged to 019Mobile.

Tango Networks UK is a British MVNO, a subsidiary of Texas-headquartered Tango Networks Inc. It was assigned UK Mobile Network Code 53 by Ofcom in 2022. It was used "over several years for surveillance activities," per Citizen Lab. The company declined to comment.

Airtel Jersey is a Channel Islands operator now owned by Sure, itself part of Beyon Group, which is partially owned by the Kingdom of Bahrain. Sure's CEO stated the company "does not lease access to signalling directly or knowingly to organisations for locating or tracking individuals."

None of these entities is a surveillance company on paper. Each holds a legitimate telecom license. Each passed whatever regulatory scrutiny exists in its jurisdiction. The "ghost operator" designation comes from their function: real companies whose infrastructure is used — knowingly or otherwise — as a trusted entry point for surveillance traffic that the target network accepts because it appears to come from a legitimate peer.

Campaign one: the rotating identity

The first campaign exploited both SS7 and Diameter protocols with coordinated alternating access. When SS7 queries were blocked by a target network's firewall, the system automatically switched to Diameter. When Diameter was blocked, it fell back to SS7.

The surveillance traffic rotated through 11 operator identities across ten countries. The countries whose operator identities were spoofed include Cambodia, China, Israel, Italy, Liechtenstein, Morocco, Poland, Switzerland, Thailand, and the United Kingdom. Three distinct routing patterns were used to disguise the true origin: direct access through Tango Networks UK into the BICS IPX network, direct access through 019Mobile into the Comfone IPX, and a spoofed identity path combining AIS Thailand hostnames with China Unicom network realm identifiers routed through 019Mobile into the Syniverse IPX.

The IPX — the IP Packet Exchange — is the interconnection fabric through which international roaming traffic flows. Companies like BICS, Comfone, and Syniverse operate the IPX networks. Ghost operators inject surveillance traffic into these networks, which route it to target operators as though it were legitimate roaming queries. The IPX providers do not necessarily verify whether the traffic passing through them is genuinely roaming-related.

Citizen Lab researcher Gary Miller assessed the vendor behind Campaign One as "likely an Israeli-based commercial geo-intelligence provider" with possible connections to Circles, Cognyte, and Rayzone.

Campaign two: the invisible command

The second campaign was qualitatively different. It did not query the network for the target's location. It commanded the target's SIM card to report it.

The technique is known as SIMjacker, first documented in 2019 by Cathal Mc Daid at AdaptiveMobile Security. It exploits the S@T Browser application embedded in SIM cards — a legacy component designed to allow mobile operators to send service messages to handsets. The attack sends a specially formatted binary SMS to the target's SIM card. The SIM processes the command without displaying any notification to the user, without recording any event in the message log, and without requiring any interaction. The SIM card then responds with the phone's location data.

Citizen Lab documented more than 15,700 such tracking attempts since late 2022. From a single Global Title — a signaling identifier — more than 1,700 privacy attacks were recorded between October 2023 and April 2025. Ninety-two percent of the traffic from that identifier was linked to location tracking.

The SIMjacker attack surface is the SIM card itself. It does not require internet access. It does not require app installation. It does not require user interaction. It requires only that the target has a SIM card in a phone connected to any mobile network. Every phone with a SIM card is in the attack surface, not by misconfiguration but by design.

What the user cannot do

The structural finding is that the target of SS7, Diameter, or SIMjacker surveillance cannot mitigate the risk through their own actions.

Using a VPN does not help. The attack operates at the signaling layer below the IP stack. The VPN encrypts data traffic; the signaling traffic that reports location is separate from data traffic and is invisible to the VPN.

Using encrypted messaging does not help. Signal, WhatsApp, and Matrix protect message content. SS7 and SIMjacker attacks do not access content. They extract location. The encryption is irrelevant because the attack does not interact with the data layer.

Switching phones does not help. The attack targets the SIM card and the phone number, not the handset.

Using a privacy-focused browser does not help. The attack does not interact with the browser, the operating system, or any application.

The only user-side mitigation is removing the SIM card entirely — which eliminates cellular connectivity and is not a practical defense for the billions of people who depend on mobile phones.

The architectural lesson: when the attack surface is the carrier layer itself, the defense must operate outside that layer.

The protocol that was supposed to fix this

Diameter was designed in the 2000s as the replacement for SS7, specifically to address the security weaknesses that make signaling-layer attacks possible. Diameter includes authentication mechanisms, encryption capabilities, and access controls that SS7 lacks.

Citizen Lab's finding is that operators have "largely failed to implement" these protections. The Diameter deployment across 4G and 5G networks continues to rely on the same peer-to-peer trust model that makes SS7 vulnerable. The operators who built the new network imported the old trust model.

This means the migration from 3G to 4G to 5G — the infrastructure upgrade that was supposed to close the signaling vulnerability — has not closed it. The protocols changed. The trust model did not. The ghost operators exploit the trust model, not the protocol.

The GSMA, the global standards body for mobile operators, published a Code of Conduct for Global Title Leasing two years before Citizen Lab's report. The Code is voluntary. Citizen Lab found it has "no meaningful signatories."

The spyware parallel

In the same month Citizen Lab published "Bad Connection," the spyware ecosystem continued its own pattern of intermediary-layer exploitation.

On May 22, DHS told NPR that ICE has "no relationship" with Paragon Solutions, the Israeli commercial spyware maker whose Graphite tool can remotely infiltrate devices and access encrypted messages without the target clicking a link. But DHS declined to clarify whether ICE can still access Paragon-developed tools through a third party. The Paragon contract was listed as "closed out" on January 20 in federal procurement records. But it had been reactivated once before — in August 2024 under the Trump administration — after a prior pause.

ICE's acting director Todd Lyons acknowledged in an April 1 letter that he approved the use of "cutting-edge technological tools" for counterterrorism and fentanyl enforcement. DHS's statement — "ICE has no relationship with Paragon Solutions, Inc. or with the company that acquired them" — is carefully worded to address the direct contract while leaving third-party access unaddressed.

The ghost operator pattern and the spyware procurement pattern share a structural property: legitimate-looking entities serving as intermediaries for surveillance capabilities that the end target cannot detect, cannot block, and was never told about. The ghost telco routes tracking queries through the signaling network. The spyware vendor routes access through a contractual intermediary. In both cases, the intermediary layer is the attack surface.

What the signaling network sees

The global mobile signaling network — the SS7 and Diameter infrastructure that connects every mobile operator in the world — processes these surveillance queries as routine roaming traffic. When a phone travels from one network to another, the visited network sends signaling messages to the home network to authenticate the subscriber and route calls. This is the legitimate function of the signaling system.

Ghost operators inject queries that look identical to legitimate roaming queries. The network cannot distinguish between a legitimate roaming authentication and a surveillance query disguised as one. The trust model assumes that every entity with signaling access is a legitimate operator with a legitimate operational need to query another network's subscribers.

The number of entities with signaling access is large and growing. Every mobile operator, every MVNO, and every signaling hub that connects to the IPX network can potentially inject queries. The attack surface expands with every new entity that gains signaling access. The GSMA's voluntary Code of Conduct has not constrained this expansion.

The architectural response

The defense against signaling-layer surveillance is the same defense this publication has documented against carrier-layer censorship, mandatory-platform breaches, and server-side tracking: operate outside the intermediary layer.

Mesh networking that does not require a SIM card. Peer-to-peer overlays that do not route through the carrier's signaling infrastructure. Satellite transport that bypasses the mobile network entirely. Wi-Fi-based communication that does not interact with the SS7/Diameter system.

Briar communicates over Bluetooth and Wi-Fi without cellular connectivity. Meshtastic builds mesh networks on LoRa radios. Reticulum provides cryptographic networking independent of the carrier layer. URnetwork's peer-to-peer overlay abstracts transport from the carrier.

None of these tools require a SIM card. None are visible to the signaling network. None can be tracked through SS7 or SIMjacker because they do not traverse the infrastructure those systems monitor.

The 15,700 tracking attempts documented by Citizen Lab operated through the carrier layer. The transports that operate outside it were invisible to every one of them.

The trust model is the vulnerability

The conclusion is structural, not technical.

SS7's lack of authentication is a 1970s design choice that persists because the cost of replacing it exceeds any individual operator's incentive to act. Diameter's unenforced security controls are a 2000s design that operators declined to implement because the trust model was already in place. The GSMA's voluntary Code of Conduct is a 2020s response that operators declined to sign because the consequences of non-compliance are zero.

The ghost operators exploit a trust model that has been documented as vulnerable for over a decade, that has been the subject of multiple Citizen Lab reports since 2018, that has been flagged by the GSMA's own working groups, and that remains structurally unchanged. The vulnerability persists not because it is unknown but because fixing it would require every operator in the global network to enforce authentication at the signaling layer — a coordination problem that no single actor can solve and no regulatory body has the authority to mandate.

Fifteen thousand seven hundred tracking attempts. No notification on any target's phone. No trace in any message log. No defense available to any target through any action they could take. The signaling infrastructure that connects every mobile call in the world is the surveillance infrastructure. The trust model that makes the network function is the trust model that makes the surveillance function.

The architecture that operates outside that trust model is the architecture that is not in the attack surface.

URnetwork is a peer-to-peer overlay for censorship-resistant transport. The URnetwork overlay does not route through the SS7 or Diameter signaling infrastructure. It does not require a SIM card. It is not visible to the signaling network the ghost operators exploit.

https://ur.io

References (8 sources)

References

Further Discussion

No Trace

**Position.** Citizen Lab documented more than 15,700 invisible tracking operations since late 2022 — surveillance queries routed through the global mobile signaling network using ghost operators with legitimate telecom licenses. The targets' phones displayed no notification. Their message logs recorded no event. No VPN protects against it. No encrypted messenger prevents it. No privacy-focused browser blocks it. The attack operates below the IP layer, at the SS7 and Diameter signaling infrastructure that connects every mobile call on earth. Three telecom entities are named: 019Mobile (Israel), Tango Networks UK, and Airtel Jersey (Channel Islands). Campaign one rotated through 11 operator identities across ten countries to disguise surveillance as roaming traffic. Campaign two sent invisible SMS commands directly to targets' SIM cards — SIMjacker attacks that instruct the phone to report location data with no trace on the device. SS7, designed in the 1970s, has no authentication, no encryption, no verification. Diameter, designed to fix SS7 for 4G and 5G, has security controls that operators "largely failed to implement." The GSMA's voluntary Code of Conduct has "no meaningful signatories." The vulnerability is not a bug. It is the architecture. Every phone with a SIM card is in the attack surface by design. The only defense is a transport that does not traverse the signaling network the ghost operators exploit. **Headline candidates.** - No Trace · 15,700 Invisible Tracking Operations Through Your Carrier's Network - Ghost Operators · The Telecom Companies That Track Phones Worldwide - The Signaling Layer · The Surveillance Infrastructure You Cannot See or Block - Below the VPN · Why No Privacy Tool Stops SS7 Tracking **Kicker.** 15,700 tracking attempts. No notification. No trace. No VPN, no encryption, no app change helps. The attack is below the IP layer. The only defense is a transport that doesn't use the signaling network.

The Phone Call

**Position.** On April 27, 2026, one day after the Zambian government endorsed RightsCon — the world's largest digital rights conference — organizers received a phone call. Chinese diplomats had pressured the Government of Zambia because Taiwanese civil society participants planned to attend. The government demanded organizers moderate specific topics and exclude communities at risk. Access Now cancelled the conference rather than comply. 2,600 in-person participants, 1,100 online, 150 countries. Amnesty International called it "a brazen act of Chinese transnational repression." The world's largest gathering dedicated to fighting censorship was cancelled by the same authoritarian infrastructure it exists to oppose. In the same month: Citizen Lab documented ghost telecom operators routing 15,700 invisible tracking operations through the signaling network. DHS denied ICE's relationship with Paragon spyware while refusing to clarify third-party access. An 18-year-old NGINX vulnerability was exploited within 72 hours using AI-assisted scanning tools. The Clearview AI settlement gave facial recognition scraping victims a 23% equity stake in the surveillance company. The most dangerous infrastructure is the infrastructure you cannot see — a phone call that cancels a conference, an invisible SMS that tracks a phone, a protocol that hides a bug for eighteen years, a financial structure that aligns victims with their violator. The invisible layer is the load-bearing layer. **Headline candidates.** - The Phone Call · How Chinese Diplomats Cancelled the World's Largest Digital Rights Conference - Twenty-Six Hundred Delegates · One Phone Call and RightsCon Was Gone - The Invisible Layer · What You Cannot See Is What Controls You - Brazen · Amnesty International's Word for What Happened in Zambia **Kicker.** One phone call. 2,600 delegates. 150 countries. The world's largest digital rights conference, cancelled by the authoritarian infrastructure it exists to fight. The invisible layer is the load-bearing layer.

Comics

Comic: The Phone Call — #2The Phone Call