SS7, Diameter and SIMjacker: invisible telecom surveillance also concerns Africa

An almost invisible surveillance layer

On 23 April 2026, Citizen Lab published Bad Connection, a technical investigation into two telecom surveillance campaigns exploiting the global mobile interconnection ecosystem. The report describes actors using 3G and 4G signalling protocols, including SS7 and Diameter, as well as hidden SIM commands delivered by SMS, to attempt location tracking of targets.

For Africa, this is not theoretical. Citizen Lab reports that attacks leveraged identifiers and infrastructure associated with operators in many countries, including Mozambique, Uganda, Rwanda, Morocco, Namibia and Lesotho. The report also makes an important limitation clear: the presence of operator identifiers does not prove that the operators knowingly participated in the attacks. Such identifiers can be obtained or abused through intermediaries, commercial arrangements or interconnection paths.

Why SS7 and Diameter still matter

SS7 is often described as a legacy protocol, but it remains important for international roaming, SMS and some continuity services. Diameter, associated with 4G and parts of the 5G ecosystem, was supposed to improve security. In practice, Citizen Lab argues that operators often continue to rely on a peer-to-peer trust model inherited from SS7, with insufficient controls over the real origin of messages.

That architecture creates a structural weakness. Mobile networks are designed so operators around the world can communicate when subscribers travel, receive SMS or authenticate. But the same trust can be abused. An actor with access to the signalling ecosystem can send requests that appear to come from a legitimate operator while actually supporting location tracking or surveillance.

SIMjacker: when the SIM becomes the vector

One campaign described by Citizen Lab used an SMS containing hidden SIM commands. The objective was to extract location information and attempt to turn the phone into a tracking beacon. This technique, often associated with the name SIMjacker, is especially concerning because the user may see nothing. The attack does not necessarily depend on clicking a link or installing an application.

In African markets, the SIM card remains central to mobile identity, mobile money, government access and daily communication. That invisibility is therefore a sovereignty problem. A citizen cannot defend alone against a malicious signalling request. The defensive layer sits with the operator, interconnection provider, regulator and oversight authorities.

The risk for African operators

An African operator can be exposed in two ways. It can be the target: its subscribers are located or monitored through abusive requests. It can also be used as apparent origin: identifiers linked to its network are used to make suspicious traffic appear legitimate. In both cases, trust in the network is weakened.

The report highlights weaknesses in inter-operator filtering and the difficulty of attribution. Attacks can take interconnection routes that differ from those expected in roaming documentation, and can be masked through providers. This means that an internal-only operator audit is insufficient. Partners, routes, international messaging providers and third-party signalling access must also be examined.

What regulators should require

African telecommunications authorities should treat SS7, Diameter and SIM commands as national security issues. Operator licences could include requirements for filtering, logging, interconnection partner review and notification of suspicious activity. Regulators should also ask for evidence: independent testing, aggregated incident reports, third-party access reviews and maps of international routes.

The challenge is that this domain is technical and rarely visible publicly. It is not enough to ask whether an operator has an SS7 or Diameter firewall. Regulators need to understand which rules are active, how exceptions are approved, whether anomalies are investigated, and whether observed routes match declared agreements.

Why this is also a human-rights issue

Location surveillance is not an abstract network event. It can reveal where a journalist meets a source, where an opposition figure travels, whether a lawyer visits a client, or when a business executive crosses a border. In countries where political pressure, corruption or armed conflict already create risks, silent telecom surveillance can amplify real-world harm. That is why technical controls should be paired with oversight, lawful request procedures and independent audit.

A regional trust problem

Roaming and interconnection only work because operators trust each other across borders. Abuse of that trust can damage the credibility of African networks internationally. If identifiers associated with an African network are repeatedly observed in suspicious signalling activity, partners may apply stricter filtering or commercial pressure. Protecting signalling infrastructure is therefore not only about subscriber privacy; it is also about preserving the reputation and interoperability of African telecom markets.

Operational recommendations

• Audit observed SS7 and Diameter routes against IR.21 information and declared roaming agreements.
• Block or challenge abnormal location requests, repeated queries or messages arriving through unexpected interconnection paths.
• Monitor binary SMS and SIM commands associated with SIMjacker-style behaviour.
• Review contracts with roaming hubs, SMS providers, MVNEs and intermediaries that have signalling access.
• Create confidential regulatory notification duties for suspected location-tracking campaigns.

Conclusion

Citizen Lab's investigation is a reminder that digital sovereignty is not only about data centres and data protection laws. It also includes the invisible telecom layer that allows a phone to exist on the network. In Africa, where mobile is often the primary digital infrastructure, securing SS7, Diameter and SIM cards is a condition for public trust.

— ◆ —