Europol says mobile roaming tech is making its job too hard

Top Eurocops are appealing for help from lawmakers to undermine a privacy-enhancing technology (PET) they say is hampering criminal investigations – and it's not end-to-end encryption this time. Not exactly.

Europol published a position paper today highlighting its concerns around SMS home routing – the technology that allows telcos to continue offering their services when customers visit another country.

Most modern mobile phone users are tied to a network with roaming arrangements in other countries. EE customers in the UK will connect to either Telefónica or Xfera when they land in Spain, or T-Mobile in Croatia, for example.

While this usually provides a fairly smooth service for most roamers, Europol is now saying something needs to be done about the PETs that are often enabled in these home routing setups.

According to the cops, they pointed out that when roaming, a suspect in a criminal case who's using a SIM from another country will have all of their mobile communications processed through their home network.

If a crime is committed by a Brit in Germany, for example, then German police couldn't issue a request for unencrypted data as they could with a domestic operator such as Deutsche Telekom.

Now, it wouldn't be a law enforcement complaint against tech if encryption wasn't mentioned at least somewhere, and there's no need to worry since we're not deviating from the norm today.

The specific part of home routing that's causing all the fuss is the service-level encryption used when enabling home routing by the network operator. Law enforcement can see a suspect communicating from a device that may provide evidence of a crime being committed, but as ever, encryption stymies their ability to access it in a usable way.

Europol said: "For service-level encryption, the subscriber (user) equipment exchanges session-based encryption keys with the service provider in the home network. If PET is enabled, the visiting network no longer has access to the keys used by the home network and therefore data in the clear cannot be retrieved."

One exception to home routing being a cop blocker is when a domestic service provider has a cooperation agreement with the network provider of another country that forbids the enabling of PETs in home routing.

If this cooperation agreement isn't in place, the only alternative left for law enforcement is to issue a European Investigation Order (EIO), but responses for these can take up to 120 days, which isn't ideal when you want to catch a drug dealer who's only in the country for a weekend.

"A solution to the situation described above is urgently necessary. Under home routing, the current investigatory powers of public authorities should be retained and a solution must be found that enables lawful interception of suspects within their territory," reads Europol's paper.

"In addition, an optimal solution should not impede secure communications disproportionately, ensure the confidentiality of criminal investigations, and ultimately enable member states to execute their legal jurisdictional prerogative to execute investigatory powers. 

• Europol nukes nearly 600 IP addresses in Cobalt Strike crackdown
• Snowflake breach snowballs as more victims, perps, come forward
• Dark-web kingpin puts 'stolen' internal AMD databases, source code up for sale
• Ukrainian cops collar Kyiv programmer believed to be Conti, LockBit linchpin

"Moving forward, the design and implementation of (new) technologies should be done in the manner that ensure lawful access to data necessary for investigatory powers to carry out their obligations."

Next steps

Two possible solutions were suggested, but the wording of the paper clearly favored a legal ban on PETs (service-level encryption) in home routing over making it possible for one EU member state to request the comms from another country.

The first, seemingly preferred option would remove the additional encryption layer implemented when home routing was active and simply keep the same level of comms encryption as the suspect would enjoy in their home country.

"This solution is technically feasible and easily implemented," Europol said. "This solution maintains the current level of security, including privacy, and is equal for roamers and local users.

"National authorities supervising the telecommunication market can enforce an EU regulation mandating the design of the network in this manner."

Various drawbacks were highlighted with the second suggestion. Having another EU member state aware that a person of interest is walking within their borders "might not always be desirable" from an operation perspective, Europol said.

It also warned that there is no established method for sharing and interpreting the data requested by law enforcement authorities.

There is one that was developed for EIOs but cops are concerned this could lead to scenarios where law enforcement efforts are dependent on foreign service providers, which isn't ideal.

"With this position paper, Europol wishes to open the debate on this technical issue, which at present is severely hampering law enforcement's ability to access crucial evidence," it said.

"A solution must be found that enables a country's authorities to lawfully intercept the communications of a suspect within their territory, while not impeding secure communications disproportionately.

"The paper offers key elements which should be considered as part of the societal response, looking at operational, technical, privacy and policy aspects." ®