The Guardian, in a joint reporting project with the Bureau of Investigative Journalism, alleged Channel Islands-based networks were being exploited for nefarious means.
The reports focused on the alleged use of global titles – a unique address used in telecoms networks for the purpose of sending and receiving information. These titles are used by protocols to allow networks to exchange information needed for passing calling and text messages, roaming on other networks, and ensuring correct billing.
Sure and Guernsey Airtel stressed network and customer security was of critical importance and taken seriously.
‘Sure would like to reassure our Bailiwick customers that data privacy and cybersecurity are of paramount importance,’ said a spokesman.
‘On a strategic level Sure works closely with the UK National Cyber Security Centre and the States of Guernsey. In addition, Sure’s chief security officer sits on a UK industry working group involving the UK operators and the National Cyber Security Centre and is notified and immediately acts on any potential issues.’
It continued: ‘Global titles are a niche type of telecommunications service Sure supplies to a small number of specialist providers of legitimate services such as anti-fraud detection for the retail banking sector, telecommunications for the maritime sector and SMS two-factor authentication services.
‘As with many aspects of digital services, global titles have the potential to be misused and this is why we take a number of actions to mitigate this risk.
‘Sure does not lease access to global titles directly or knowingly to organisations for the purposes of locating and tracking individuals or for intercepting communications content.’
It added: ‘Sure works with global telecommunications companies, including all UK operators, to monitor signalling traffic (the type of traffic used by global titles). Any evidence or complaint, provided by authorities, such as the NCSC or operators, results in the service in question being ceased immediately and subsequently permanently terminated if malicious or inappropriate traffic is discovered upon investigation.’
Guernsey Airtel Ltd said: ‘We take network and customer security seriously.
‘SS7 is part of the global mobile network infrastructure and we are vigilant about its vulnerability. We have an SS7 firewall solution from a trusted and reputed vendor which helps in preventing misuse, thus our SS7 security is more robust than of average operators.
‘Further, we are working closely with regulators and government to take necessary steps in the security sphere. Guernsey Airtel, along with other operators are part of the telecoms security regulation initiative in the Channel Islands in adopting the right security measures required for the islands based on the broader TSR guidelines.’
The States said it worked very closely with the National Cyber Security Centre and the UK Department for Digital, Culture, Media and Sport. ‘NCSC and DCMS have dedicated officers for the three Crown Dependencies and communicate regularly with them on a range of security matters, including telecoms security.
‘Guernsey takes extremely seriously its role as a good neighbour to the UK and other jurisdictions and its role internationally in ensuring telecoms security meets the highest standards. As part of the British family, the Guernsey and UK governments are working together to make sure that the telecoms security policies and regulation are closely aligned.
‘Like the UK, the Crown Dependencies each have telecom security policies. Guernsey is also developing telecoms security requirements which will align with the UK’s approach and timeframes and will be legislated for, and regulated, in a similar manner.’
The Guernsey Competition and Regulatory Authority also noted the States of Guernsey was developing frameworks in line with the UK Security Bill.
The authority also said it had licence obligations in place which oblige its telecommunications licensees to take reasonable steps to prevent their licensed networks and services from being used in, or in relation to, the commission of offences against the laws of Guernsey.
‘A consideration of any action in this regard would be based on specific concerns or cases coming to the attention of the authority,’ it said in a statement. ‘No investigations of this nature have been carried out in the absence of specific concerns or cases brought before the Authority.’
You need to be logged in to comment. If you had an account on our previous site, you can migrate your old account and comment profile to this site by visiting this page and entering the email address for your old account. We'll then send you an email with a link to follow to complete the process.