Local and national regulators may ban global titles leasing

The Guernsey Competition and Regulatory Authority and Ofcom have both launched a consultation on a possible ban on the leasing of global titles created from the +44 number ranges.

The GCRA said that it had been ‘provided with evidence which suggests that malicious use of global titles leased in Guernsey may pose significant security risks to telecommunication customers and networks in Guernsey, the UK and globally’.

It is concerned about consequences including the possibility of infiltrating global telecoms networks and intercepting data on individuals, and international fraud that could harm the island’s reputation.

The evidence received by GCRA indicated that bad actors misusing the messaging system had enabled spy attacks worldwide and offered cyber criminals and surveillance companies the opportunity to secretly locate people. Some had been subjected to ‘targeted assassinations’.

Security vulnerabilities in global titles can be exploited to monitor the location of the user or to monitor voice and text messages.

Global titles are a unique address used in telecoms networks for the purpose of sending and receiving information.

These titles are used by protocols to allow networks to exchange information needed for calling and text messages, roaming on other networks, and ensuring correct billing.

The threat of leasing is that it increases the number of providers, enables bad actors to gain access to the SS7 signalling network and reduces its transparency.

In April 2023 the GCRA wrote to local operators assigned +44 number ranges from Ofcom. Two replied that they did not use their allocated Guernsey number ranges to lease global titles, but one admitted that it did have global titles leased. That company went on to outline how it carried this out.

None of the operators have been identified by the regulator.

Early in 2024 Ofcom told the GCRA that the UK National Crime Agency had concerns about the practice.

The UK National Cyber Security Centre had briefed the Guernsey and Jersey governments about its concerns, and Ofcom confirmed that the availability and access to UK number ranges by CI operators was ‘a significant contributing factor’ to the increased threat to UK national security from the misuse of global titles.

The issue was first highlighted late in 2020 in national media reports. At the time local operators, the States and the GCRA all said that they took responsibilities in this area seriously.

The consultation runs until the end of February.

If approved, the ban would come into force in January 2026.