In a recently published research paper, Europol sounds all the alarms about how privacy-enhancing technologies (PET) used in Home Routing pose a serious challenge to the lawful interception of information in the context of judicial and law enforcement investigations.

The document delves into the problems that Home Routing creates for law enforcement in the exercise of their duties, as well as the fact that it presents possible ways to safeguard and maintain the ability of police to protect citizens and investigate criminals.
Home Routing makes it possible for a telecommunications service provider to provide a service to a customer when travelling abroad. This means that when a customer travels around the world, their communications (calls, messages and data) are still processed through their home network rather than the network of the country they are visiting.
Consequently, this means that the overseas service provider cannot hand over communication data to law enforcement upon a judicial request, if the domestic service provided has enabled PET in Home Routing.
Once Home Routing is implemented, any suspect using a foreign SIM card can no longer be intercepted. This problem arises both when a foreigner uses their own (foreign) SIM card in another country, and when citizens or residents use a foreign SIM card in their own country. The only current exception to this is when a domestic service provider (to whom domestic interception orders can be sent) has a collaboration agreement in place that disables PET in Home Routing with the service provider in another country.
Criminals are aware of this loophole and have been abusing it to evade law enforcement. This creates an unequal balance between malicious actors and law enforcement, whose capabilities at the moment do not allow them to carry out the duties that society has entrusted to them.
In the case of Home Routing, a national interception order cannot be enforced across borders. Instead, a European Investigation Order can be issued, although a response can take up to 120 days, a period that becomes too long when an emergency interception is needed. Furthermore, it is not desirable to rely on the voluntary cooperation of a foreign service provider for the exercise of domestic investigative powers.
With this position paper, Europol wants to open the debate on this technical issue, which currently severely hampers law enforcement’s ability to access vital evidence.
A solution must be found that allows a country’s authorities to lawfully intercept a suspect’s communications within their territory without disproportionately impeding secure communications.
The document provides key elements to be considered as part of the company’s response, taking into account operational, technical, privacy and policy aspects.
This document is part of a series of Europol publications that are instrumental in anticipating technological innovations and resulting changes in the security landscape.
_____
Aquest apunt en català / Esta entrada en español / Post en français

