Signals at Sea

Technical breakdown

Signalling System No. 7 (SS7) is the global signalling layer of the public switched telephone network. It is the set of protocols that tells one phone network how to reach a subscriber on another phone network: how to route a call, deliver a text message, charge a roaming visitor, or hand a session off between cell towers. It was standardised by the International Telecommunication Union in 1980. It was designed for an era in which the only entities connected to it were national telecommunications monopolies, all of whom could be trusted by virtue of being national telecommunications monopolies.

That assumption has not aged well.

The architecture is layered. The Message Transfer Part (MTP) handles physical transport and routing. The Signalling Connection Control Part (SCCP) handles end-to-end addressing using a value called a Global Title, which can be thought of as the international address of a piece of telecom infrastructure. The Transaction Capabilities Application Part (TCAP) handles database queries between network elements. Sitting on top is the Mobile Application Part (MAP), which is where the protocols a mobile network actually uses for roaming, location, and short message routing live. When a phone receives a text from another country, the message it receives is the visible top of a small cascade of MAP queries between the originating network and the home network of the recipient.

Two MAP entities are central to understanding what can be done. The first is the Home Location Register (HLR), the master subscriber database in the home network. It knows that subscriber number X belongs to subscriber identity Y, and it knows which network is currently providing service to Y. The second is the Visitor Location Register (VLR), the working subscriber database of the network actually serving Y at the moment, which knows the cell tower Y is connected to.

In a normal roaming scenario, when a text message from Dubai is sent to a phone roaming in India, the originating network asks the HLR in the home network something like, who is currently providing service to this subscriber; the HLR replies with a pointer to the VLR; the VLR provides the routing information needed to deliver the message. Each step assumes the asker is a legitimate carrier. There is no cryptographic check on whether that is true.

If a party with access to the SS7 network sends the same query for a subscriber they have no commercial reason to be asking about, the network answers anyway. If they send a query that asks the VLR to report the cell tower the subscriber is connected to, using the MAP function ProvideSubscriberInfo, the VLR returns a Cell Identifier. Cell Identifiers are not secret; cross-referenced against public databases of cell tower coordinates, they pin a phone to a tower, which on land is usually a few hundred metres of certainty and at sea is a different kind of fix entirely. There are not many cell towers on the Indian Ocean.

There are other queries that do other things. AnyTimeInterrogation, intended for legitimate operator diagnostics, returns the serving network and a coarse location. SendRoutingInfoForSM, intended to route inbound text messages, also reveals the serving network. UpdateLocation, intended to register a subscriber on a new network when they roam, can be abused to register a subscriber on an attacker's fake serving network, after which short messages destined for that subscriber are routed to the attacker until the legitimate device next attaches to a real tower. ProcessUnstructuredSS, intended for the menu-style codes that run mobile money services in much of the world, can be abused to push convincing fake prompts to a target's screen.

Defenders looking at this protocol family monitor for query traffic that is anomalous in three ways: queries from a Global Title that should not be asking about that subscriber, query rates that suggest reconnaissance rather than legitimate operations, and pattern combinations that suggest an attacker walking through the protocol family in sequence. Public reporting on the Latifa case provides a worked example. Across a short window, the captain's phone was apparently hit by a rapid burst of identity and location queries from multiple Global Titles leased across different jurisdictions; several were caught by signalling firewalls on the carriers they touched, and at least one, sent from a Global Title the defending network had no reason to flag, went through unlogged. The signalling firewall standards published by the GSM Association (GSMA), principally FS.11 and FS.07 for SS7 and the IR.82 family for SS7 and Diameter (the 4G/LTE successor protocol), describe what those defences look like. The standards are not secret. The reasons many operators do not implement them in full are commercial rather than technical: signalling firewalls cost money, and the entity bearing the cost is rarely the entity bearing the loss when an SS7 abuse succeeds.

Public demonstrations have made the abstract concrete. In December 2014, two German researchers, Tobias Engel and Karsten Nohl, presented separate analyses at the Chaos Communication Congress in Hamburg showing that an attacker with SS7 access could locate, intercept, and impersonate arbitrary subscribers. Nohl's work appeared on US television in 2016 in an episode of 60 Minutes, in which his team, with the consent of US Congressman Ted Lieu, tracked Lieu's iPhone, intercepted his texts, and recorded his calls.

The intervening decade has made clear that the access required to do this is no longer the exclusive preserve of state actors. Commercial surveillance vendors lease Global Titles from small operators in jurisdictions where the lease is not closely scrutinised, the Channel Islands among them, and run targeting campaigns from those leased points. The most recent and most carefully evidenced public account is the Citizen Lab report Bad Connection: Uncovering Global Telecom Exploitation by Covert Surveillance Actors, published 23 April 2026, which links observed real-world attack traffic to specific carriers and identifies two distinct surveillance campaigns operating across SS7 and Diameter, one of them combining signalling abuse with malicious binary SMS payloads. An earlier Citizen Lab report, Finding You: The Network Effect of Telecommunications Vulnerabilities for Location Disclosure, sets out the location-disclosure mechanics in technical detail.

The same family of techniques has been used against money. In May 2017, Süddeutsche Zeitung reported that a coordinated attack against customers of the German operator O2 Telefónica had used SS7 routing manipulation to intercept the SMS one-time codes used to authorise online banking transactions, draining accounts at scale; O2 confirmed the SS7 component of the attack. In February 2019, Motherboard reported that a similar attack had succeeded against customers of UK challenger bank Metro Bank, in what was understood at the time to be the first publicly reported SS7 incident against a UK bank. The attacks did not depend on compromising any individual phone. They depended on the network believing that the attacker was a legitimate carrier asking a legitimate question.

What ties the bank fraud cases to the boat off Goa is not the target. It is the trust assumption. The protocol cannot tell why the question is being asked. It can only answer it.