Edizione originale in inglese. La traduzione di questa nuova analisi è in preparazione.

Policy & leadership

Telecommunications Interception While Travelling: Where Encryption Helps—and Where It Stops

A layered analysis of hotel Wi-Fi, mobile roaming, telecom infrastructure, cloud services and endpoint compromise, with practical protection choices.

Published: 9 October 2026

Begin with the path, not a product

A traveller’s message passes through several different trust boundaries: the device, local access network, network providers, application service and recipient. Some services add cloud backups, linked computers or organisational archives. Our analytical model asks which party can observe content, metadata or account activity at each stage. Protecting one stage does not establish the security of the others. Before selecting a VPN or messaging application, define what needs protection: the conversation itself, the identity of participants, their location, the ability to issue a trusted instruction, or the availability of the service.

Layer one: the hotel or airport connection

A local network controls the connection being offered, but that does not mean it can automatically read every correctly encrypted application session. Our recommended policy is to treat public access as untrusted transport: use managed devices, approved services and valid encrypted connections; never resolve a certificate warning by installing an unfamiliar certificate or profile. Confirm the network name with the venue, while recognising that a name alone is not authentication. Avoid automatic joining and local sharing. A captive portal should not require granting a venue administrative control of an official device.

Layer two: the mobile operator and roaming partners

Mobile access changes the dependencies; it does not remove them. ENISA’s 2018 signalling study examined security risks in telecom interconnections, including SS7, Diameter and the evolution toward 5G. [1] It is historical technical background, not proof that a particular current operator is compromised. Our assessment should identify roaming arrangements and avoid treating a local SIM, an eSIM or a 5G indicator as a confidentiality guarantee. Operator infrastructure still participates in delivery. A different subscription can provide practical connectivity, but cannot by itself make endpoint software or application accounts trustworthy.

Layer three: compromise inside communications infrastructure

CISA’s December 2024 mobile guidance followed espionage activity affecting telecommunications infrastructure, including stolen call records and private communications involving highly targeted people. [2] A related joint guidance addresses infrastructure visibility and hardening. [3] This shifts part of the problem beyond anything a traveller can configure. Our procurement recommendation is to ask service providers about incident notification, access controls, logging and resilience, while acknowledging that customers cannot independently inspect every network component. Security policy should therefore reduce reliance on the network’s confidentiality rather than promise to eliminate all infrastructure risk.

Layer four: the application and its recipients

CISA recommends end-to-end encrypted communications for highly targeted users. [2] Our implementation advice is to verify that the particular conversation mode actually provides that protection, including group membership, linked devices and backup behaviour. A service’s general claim to encrypt data does not establish end-to-end protection for every feature. Confirm sensitive contacts through a trusted process and review membership when roles change. Encryption cannot stop an authorised recipient from copying a message, and it does not resolve whether an organisation is permitted to use that application for official records or restricted information.

Layer five: the endpoint where content becomes readable

Citizen Lab’s 2023 investigation of targeting against Ahmed Eltantawy described network injection associated with attempts to deliver Predator spyware. [4] This is a documented example of a particular campaign, not evidence that all hotel or mobile networks behave that way. Our broader security conclusion is that network and endpoint risks can interact. Once a device is compromised, an adversary may obtain information where an application legitimately displays or processes it. End-to-end encryption remains valuable, but it cannot be treated as a repair mechanism for a compromised phone.

What an organisational VPN changes

In our recommended design, an approved VPN can protect traffic between the device and the organisation’s chosen gateway, reducing exposure on the local access path. Trust then includes that gateway and the device running the client. The tunnel does not erase mobile registration information, protect data after it leaves the tunnel without further encryption, or prevent an authorised application from mishandling content. It also does not guarantee availability. Configure routing, DNS handling and failure behaviour deliberately, and test them. Check destination rules with the organisation before departure instead of improvising a consumer service overseas.

Metadata is a separate exposure

Even when content is encrypted, some parties may still observe connection timing, traffic volume or account and routing information, depending on the architecture. Our threat assessment should specify which metadata matters and which party can see it rather than make blanket claims of anonymity. A carrier’s knowledge of a device’s network presence is different from a messaging provider’s knowledge of account activity. Restrict unnecessary application permissions and public location sharing, but do not promise that switching off GPS makes a connected phone unlocatable. Operational planning must account for residual observability.

Authentication should not depend on the weakest channel

Our recommendation for official accounts is phishing-resistant authentication where supported, with recovery procedures that receive equal scrutiny. A strong primary login is undermined if a help desk can reset it after an unverified urgent request. Avoid making ordinary SMS the only means of recovering a high-value identity. Provide a tested contingency that does not require restoring access through the same suspected phone. This is particularly important while travelling, when a lost device, changed number or unavailable roaming service can turn an otherwise routine authentication problem into pressure to bypass controls.

Match communication modes to consequences

We propose three operational categories, to be adapted to the organisation’s classification rules. Public logistics may use an approved ordinary service. Sensitive but unclassified work requires a managed endpoint and an approved protected application, with identity and recordkeeping controls. Classified or exceptionally sensitive matters require the specifically authorised environment, or must wait. These are editorial categories, not a substitute for national classification policy. The traveller should know which category applies before making the call. An application being convenient, popular or encrypted is not enough to approve it for every type of information.

Test the arrangement before relying on it

Our proposed test plan includes a simulated hotel portal, loss of the primary connection, an expired session and replacement of a lost authentication factor. Verify whether the device blocks access when required protection fails, whether staff receive a useful explanation and whether an approved fallback works. Check the actual application behaviour rather than relying on a diagram. NIST’s mobile guidance provides lifecycle context for managing these devices. [5] The organisation’s evidence should include the tested platform versions, service configuration, known limitations and the person responsible for reviewing changes.

Recognise an incident without overinterpreting symptoms

Battery drain, weak signal or a delayed message alone does not establish interception. Our recommended reporting threshold includes more concrete events: unexpected configuration changes, credible provider warnings, an unexplained account recovery, an unfamiliar linked device or a material break in custody. Record observations without experimenting with suspicious software. Move sensitive work to an independently trusted channel and let the response team decide collection and containment. The objective is a proportionate investigation, avoiding both complacency and a culture where every ordinary network problem becomes a confident accusation of espionage.

The CISO’s decision is an allocation of trust

No single product can protect every layer. Our recommended travel architecture combines reduced data and access, managed devices, approved encryption, strong identity controls and an available response service. Document the remaining dependencies and the consequences of failure. Ask separately whether content is protected, the participants are authentic and the mission can continue. This makes the limitations visible to leadership. The strongest practical improvement is often to remove a sensitive activity from an unsuitable environment, while providing a workable alternative, rather than add another security application to the same overloaded phone.

References

1. ENISA · Signalling Security in Telecom SS7/Diameter/5G, 2018
2. CISA · Mobile Communications Best Practice Guidance, December 2024
3. CISA and partners · Visibility and hardening of communications infrastructure
4. Citizen Lab · Predator in the Wires, 2023
5. NIST · SP 800-124 Rev. 2

Original editorial analysis and paraphrases. Recommendations are distinguished from documented facts; references do not imply institutional endorsement.

Francisco Javier Jurado Alonso