Joseph Cox::

In a white paper sent to members of Congress and the Department of Homeland Security, CTIA, a telecom lobbying group that represents Verizon, AT&T, and other wireless carriers, argued that “Congress and the Administration should reject the [DHS] Report’s call for greater regulation” while downplaying “theoretical” security vulnerabilities in a mobile data network that hackers may be able to use to monitor phones across the globe, according to the confidential document obtained by Motherboard. However, experts strongly disagree about the threat these vulnerabilities pose, saying the flaws should be taken seriously before criminals exploit them.

SS7, a network and protocol often used to route messages when a user is roaming outside their provider’s coverage, is exploited by criminals and surveillance companies to track targets, intercept phone calls or sweep up text messages. In some cases, criminals have used SS7 attacks to obtain bank account two-factor authentication tokens, and last year, California Rep. Ted Lieu said that, for hackers, “the applications for this vulnerability are seemingly limitless.”

In May, the DHS published an in-depth, 125-page report on government mobile device security, which noted that SS7 “vulnerabilities can be exploited by criminals, terrorists, and nation-state actors/foreign intelligence organizations.” DHS noted that it currently doesn’t have the authority to require carriers to perform security audits on their network infrastructure, or the authority to compel mobile carrier network owners to provide information to assess the security of these communication networks.

CTIA took several issues with the report. In its own white paper responding to the DHS, CTIA told US politicians in May that focusing on some SS7 attacks is “unhelpful,” said the report “focuses on perceived shortcomings” in the protocol, and claimed that talking about the issues may help hackers, according to the white paper obtained by Motherboard. Specifics from the paper were discussed by Motherboard with CTIA officials. l