Ghost Carriers Turn Telecom Trust Into Location Tracking
The weak point is not the phone. It is the trust between carriers. Surveillance vendors can pose as legitimate cellular providers, then use interconnect access to query location data across global networks. Standard defenses that focus on device security miss this operator-level abuse path.
Citizen Lab says it found two separate campaigns using fake “ghost” carriers and telecom signaling flaws to track victims worldwide. The report points to SS7, and to Diameter where protections are not fully deployed, with some cases falling back to SS7. The abuse ran through access to three telecom providers that repeatedly acted as the surveillance gateway.
The risk is persistent because the same signaling trust model still underpins global roaming and location lookups. As long as carriers accept weakly authenticated interconnect requests, location tracking remains available to operators that can buy or fake network access.