Telstra-Owned Digicel Pacific Network Used by Private Spy Firms for Global Phone Tracking, Data Theft
Telstra-owned mobile phone operator Digicel Pacific, based in the Pacific Islands, has potentially been utilized by private spy firms to track individuals across the globe and steal their data. Expert cybersecurity analysis conducted by the University of Toronto’s Citizen Lab, shared with the Organized Crime and Corruption Reporting Project (OCCRP) and the ABC, reveals that the network resources of Digicel Pacific have been exploited in order to target unsuspecting mobile phone users in Africa. This type of attack has previously been employed by spy-for-hire operations and state actors.
The emergence of these findings comes in the wake of Telstra’s acquisition of Digicel Pacific in July 2022, a purchase that was backed by over $2 billion in financing from the Australian government. The concern was that China’s government might exploit the network, operating in six Pacific countries, for the purpose of spying in this increasingly contested region. However, Citizen Lab’s analysis suggests that Telstra is now grappling with another security threat on the network: spy firms driven by profit.
Typically based in Western countries, these operations market their services to governments as a means of tracking down criminals and terrorists. However, previous investigations have indicated that these services are often used to spy on journalists, activists, and political dissidents. Using data from the Mobile Surveillance Monitor project, Citizen Lab discovered that actors who are likely private spies-for-hire have been targeting phones globally by leasing or gaining access to global titles belonging to Digicel Pacific.
Global titles function as addresses on 3G networks and can be utilized to send queries to phones connected to mobile providers anywhere in the world. This allows for the location of a person’s phone to be determined or their messages and calls to be intercepted. Spy operations that have obtained a global title and registered it on international phone networks can conduct their attacks using free software and hardware costing as little as $200.
Interestingly, the analysis conducted by Citizen Lab indicates that while Digicel’s global titles were used, the attackers bypassed the company’s networks. After receiving the Citizen Lab data, Telstra responded by stating that it had already terminated the majority of Digicel Pacific’s global title leases. It further noted that an additional lease had been canceled upon being brought to their attention by reporters. Telstra intends to exit the remaining leases by April 2024, or earlier if investigations uncover any breaches of contractual obligations.
Abuse of Digicel Pacific’s global titles had been occurring prior to Telstra’s acquisition of the network and was initially exposed by journalists from Lighthouse Reports, a European investigative newsroom, during their reporting on Italian surveillance company Tykelab last year. The global titles were also found to have been exploited by a for-profit spying operation based in Switzerland during a joint investigation conducted by Lighthouse Reports and its partners in May of this year.
Back in October 2021, Telstra acknowledged that their global titles had been used but claimed to have taken action to review and reduce the leasing of Digicel Pacific’s global titles to third parties. However, recent analysis from Citizen Lab demonstrates that the abuse of Digicel Pacific’s global titles continued after this point. In the twelve months leading up to July 2022, Digicel Pacific’s global titles from five countries—Fiji, Papua New Guinea, Samoa, Tonga, and Vanuatu—were involved in over 21,000 suspicious queries. In October 2022 alone, there were 9,115 such queries, many of which aimed to identify individual phones or track their locations.
Following a temporary decrease, suspicious queries have surged again in recent months. The latest available data shows that nearly 922 likely attacks were recorded in June and July 2022. Gary Miller, a research fellow at Citizen Lab, believes that further steps could have been taken to prevent this activity. While terminating the leases is a positive step, it is crucial to remove the addresses from global networks. As of now, this has not been observed.
Although there is insufficient data to attribute the current attacks to a specific state or actor, China has been known to employ similar tactics facilitated by the network. Miller points out that if leasing global titles is easy for individuals or organizations, it is equally straightforward for China or any other adversary to do so.
The Department of Foreign Affairs and Trade referred inquiries from reporters to Telstra while highlighting that the company brings robust capabilities to Digicel Pacific and possesses the requisite experience and expertise to enhance the security and reliability of its networks.
