Maintaining Device and Subscriber Identity Across Borders

Cross-border device awareness lets lawful intelligence recognize a single device continuously as it travels across jurisdictions. That continuity is critical to international investigations, as intelligence gets fragmented when analysts can't recognize a handset as the same device encountered elsewhere. Traditionally, devices could be recognized wherever they operated using the IMSI (International Mobile Subscriber Identifier), a 15-digit number unique to each SIM card that is broadcast openly by every device on the network.

The 5G standard introduces privacy measures that hide subscriber identity by replacing the IMSI with the SUPI (Subscriber Permanent Identity), which is never sent out over the air. Instead, 5G devices emit constantly-changing, encrypted identifiers called SUCIs (Subscriber Concealed Identifiers) designed to be understandable only by the home network. This transition breaks traditional investigation measures to establish subscriber identity and to link multiple communication sessions to a single device. In cross-border investigations, the need to bridge legal and technical differences across jurisdictions makes device identification even harder.

These changes don't effect the first generation of 5G networks, which use the legacy 4G core and continue to broadcast IMSIs in the clear. As networks fully upgrade their networks to native 5G, the new constraints will become ubiquitous. Early industry solutions partially address the problem but fall short in terms of comprehensiveness, speed, and complexity. SS8's standards-based, patented solution overcomes those limitations.

ETSI's Limited Framework for 5G Device Identity

As a preliminary means to identify devices in 5G native networks, ETSI standards establish a baseline framework for resolving subscriber permanent identities. The framework introduces a new observation function provided by the telecom infrastructure vendor that detects changes in device identifiers on the network and alerts the lawful intelligence platform about them. Within the lawful intelligence platform itself, SS8 provides a network function that caches those transient identifiers (SUCIs) and translates them into permanent device identities (SUPIs). A second SS8 function receives and responds to authorized inquiries from investigators, allowing them to identify and associate individual devices.

This approach restores a degree of visibility across geographical and jurisdictional lines, with a controlled, standards-based approach to identity association. At the same time, the ETSI baseline framework imposes substantial practical obligations, alongside operational limitations. The architecture depends on the observation function being present and correctly implemented across international networks, which are outside investigators' visibility and control. In many cases, it also requires pre-provisioning based on authorized targeted intercepts that may be difficult or impossible to get authorization for, especially in uncooperative jurisdictions.

Extended, Standards-Based Capabilities of the SS8 Platform

SS8 Xcipio Identity (XCID) overcomes the limitations of the ETSI baseline solution, providing near-instantaneous SUCI-SUPI lookup using existing network components and signaling, without judicial authorization. The patented solution uses standard interfaces to exchange queries and identifiers with law enforcement monitoring facilities, making it transparently compatible with existing systems that expect standardized handovers. Because XCID integrates with communication networks using 3GPP standards, it is compatible across global geographies and network system providers.

The solution also improves on the efficiency of the ETSI baseline solution. Because it leverages the network's own signaling paths and message formats, XCID implementations do not require bespoke vendor-specific integrations. By performing subscriber identity lookups without pre-stored subscriber mappings, it reduces implementation complexity and avoids potentially massive storage costs.

XCID delivers authoritative identity associations fast enough to support time-sensitive missions, even across multiple communications networks and countries. It is engineered specifically to deploy smoothly across diverse operator environments without vendor lock-in, reducing implementation and operating friction. The flexibility of this architecture is particularly well suited to the incremental and uneven deployment of native 5G networks around the world.

Superior Mission-Readiness with SS8 XCID

Operational scenarios for identity resolution in the field illustrate the advantages of the SS8 XCID solution. When the Locate mission calls for tracking a device of interest's dynamic location, the ETSI baseline framework requires provisioning an intercept on the device. Investigators often don't have the basis to seek that authorization, and in certain cases, doing so may even compromise the investigation by alerting foreign state actors.

That limitation also limits the scope of the Locate mission using the ETSI baseline framework to known individuals who have been identified in advance. Likewise, intractable obstacles emerge with the Identify mission to determine the identities of people at a given location and time. It's implausible to obtain search warrants for intercepts on the devices of unknown parties, causing the Identify mission to fail.

The ETSI baseline framework must also query the database of SUCI-SUPI mappings for millions of subscribers, which incurs cost, delays responsiveness, and interferes with real-time tracking of suspects. By contrast, XCID uses existing network components and messaging. Both approaches are viable, and SS8 maximizes flexibility and choice by supporting both the ETSI baseline framework and XCID for customers all over the world.

About Stef Waring

Stef Waring is a seasoned professional with over a decade in business development across cybersecurity, network operations, and intelligence sectors. Her expertise includes managing cross-functional collaborations, driving customer-focused outcomes, and achieving mission success. Known for her leadership in high-growth, dynamic environments, Stef holds degrees from Munster Technological University and Cork College of Commerce. Learn more about Stef on her LinkedIn profile here.

About SS8 Networks

As a leader in Lawful, Location, and Data Intelligence, SS8 is committed to making societies safer. Our mission is to extract, analyze, and visualize critical intelligence, providing real-time insights that help save lives. With 25 years of expertise, SS8 is a trusted partner of the world's largest government agencies and communication providers, consistently remaining at the forefront of innovation.

Discovery is the latest solution from SS8. Provided as a subscription, it is an investigative force multiplier for local and state police to fuse, filter, and analyze massive volumes of investigative data - in real time.

Intellego® XT monitoring, data fusion, and analytics portfolio is optimized for Law Enforcement Agencies to capture, analyze, and visualize complex data sets for real-time investigative intelligence.

LocationWise delivers the highest audited network location accuracy worldwide, providing active and passive location intelligence for emergency services, law enforcement, and mobile network operators.

Xcipio® mediation platform meets the demands of lawful intercept in any network type and provides the ability to transcode (convert) between lawful intercept handover versions and standard families.

To learn more, contact us at [email protected].

Follow us on LinkedIn or X @SS8