Security Engineering: Part 11. Electronic and Information Warfare, as well as Telecommunications Security

October 26, 2026 • 27 min read • Security Engineering • #Security • 👁 8

Electronic Warfare, Information Warfare and Telecommunications Security: Fundamental Principles and Threats

Electronic and Information Warfare (Basics, Communications and SIGINT)

"All warfare is based on deception... entice the enemy with a bait... feign disorder and crush him." — Sun Tzu, "The Art of War".
"Force and fraud are in war the two cardinal virtues." — Thomas Hobbes.

For decades electronic warfare (e-war) remained a separate discipline, parallel to computer security, despite the use of common technologies such as cryptography. However, today these fields are merging into a new discipline — information warfare (i-war). The adoption by the Pentagon of the term "information warfare" at the end of the 20th century consolidated its importance, and cyberattacks such as the Russian DDoS attacks on Estonia in 2007 brought these threats up to the level of state policy.
Electronic warfare provides unique lessons for security engineers. The struggle for control of the electromagnetic spectrum has required billions of dollars and has given rise to strategies of deception of incredible depth and subtlety. This is the only area of electronic security that has undergone a long evolution of attack and defense with the participation of capable and motivated adversaries. In addition, it is precisely electronic warfare that is the main teacher in the field of denial-of-service (DoS) attacks.
While classical computer security focuses on confidentiality, integrity and availability, electronic warfare turns these priorities upside down:

Denial of service (jamming, mimicry, physical attack).
Deception (directed at automatic systems or at people).
Exploitation (interception and the obtaining of any operational information from the adversary's electronic systems).

Basic Concepts of Electronic Warfare

The goal of electronic warfare is control of the electromagnetic spectrum. It is traditionally divided into three components:

Electronic Attack (EA): Jamming the adversary's communications or radars, as well as disrupting the operation of his equipment with the help of powerful microwave radiation.
Electronic Protection (EP): Designing systems resistant to jamming, protecting equipment from attacks by high-power microwaves, and destroying enemy jammers with the help of anti-radar missiles.
Electronic Support (ES): The gathering of intelligence data and the recognition of threats, allowing attack and protection to be carried out effectively. This includes the search for, identification of and localization of the sources of intentional and unintentional electromagnetic radiation.
Traditional cryptography (communications security, or COMSEC) is only a small part of electronic protection.

Communications Systems and Threats

Military communications historically evolved from physical couriers to the telegraph, the telephone and modern radio networks. Without situational awareness and means of controlling troops, a commander is ineffective.
Types of traffic and threats:

Strategic networks (between headquarters and the political leadership): The main threat is the breaking of ciphers, sabotage, the theft of keys or the injection of false messages. Protection includes not only encryption, but also protection against traffic analysis (for example, end-to-end encryption of channels). A secondary threat is the physical destruction of cables or relay stations.
Networks for covert assets (agents in the field): Besides cryptographic protection, locational security is critically important. The agent must minimize the risk of detection by means of radio direction finding and traffic analysis. If a public network is used, the agent's efforts are focused on masking the fact of communication.
Tactical communications (between a headquarters and a unit in the field): Vulnerable to jamming and to the injection of deceptive messages. For example, there exists equipment allowing the voice commands of an enemy air controller to be intercepted, cut into phonemes and glued together in order to transmit false commands to pilots.
Command and telemetry networks (signals from an aircraft to a just-launched missile): They must be protected against jamming and modification. It is desirable that they be covert (not triggering the adversary's warning receivers), which conflicts with the need for high power to overcome protective jamming. The solution is adaptive systems that begin operating in a low-probability-of-intercept (LPI) mode and raise their power only when jamming is detected.

Signals Intelligence (SIGINT)

Before attacking a network, it must be mapped. SIGINT is divided into COMINT (communications intelligence — content and metadata) and ELINT (electronic intelligence — the recognition of enemy radars and non-communications sources).
SIGINT techniques:

Radio Frequency Fingerprinting: The identification of particular equipment by the unique characteristics of its signal. These include unintentional frequency modulation, the shape of the transient process when the transmitter is switched on, the exact carrier frequency and the harmonics of the amplifier. This technology, formerly secret, was declassified in the 1990s to combat the cloning of mobile telephones.
Radio Direction Finding (RDF): Historically used directional antennas at two stations. Modern systems use TDOA (Time Difference of Arrival) — the comparison of the phases of signals received at two separated points, which allows the source to be localized quickly, accurately and automatically.
Traffic analysis: The study of the volume and patterns of messages. Even encrypted traffic betrays information. The classic example is the "snowball search". If the suspect "Alice" is under surveillance, analysts record everyone she calls and everyone who calls her. Having screened out the "white lists" (banks, doctors), the analysts recursively apply this method to the remaining contacts. As a result an array (a snowball) of thousands of contacts is formed, in which hidden connections and nodes of the network are revealed.

Attacks on Communications

An attack may include physical destruction (a hard kill) or jamming/deception (a soft kill).
Jamming and deception:

Barrage jamming: The generation of powerful noise in the adversary's frequency band. The countermeasure is the use of a guard band receiver on an adjacent frequency; when noise is detected, the useful signal is blocked.
Deceptive transmitters (Repeater/Transponder): Interception of the adversary's signal, its modification and transmission back.
Voice morphing: In air combat and in conflicts (for example, in the wars in Korea, Vietnam and the Middle East), "identify friend or foe" (IFF) systems and voice communications were subjected to attacks. Intercepted voice commands were cut into phonemes and glued together to create convincing false orders.

Methods of Communications Protection

Specific technologies are used to protect against interception and jamming.
Directional and covert channels:

Optical lines (infrared lasers) or microwave lines with narrow-beam antennas and extremely high frequencies.
LPI (Low-Probability-of-Intercept) and LPPF (Low-Probability-of-Position-Fix) — technologies with a low probability of interception and of direction finding.

Spread Spectrum:
Originally developed for military purposes, this technology formed the basis of modern commercial standards (CDMA, GPS, WiFi).

Frequency Hopping: The transmitter rapidly switches between frequencies according to a pseudo-random algorithm known only to the legitimate parties.
-- Historical fact: This technology was invented in 1940 by the actress Hedy Lamarr and the composer George Antheil. They proposed a system for controlling torpedoes, in which the transmitter and the receiver synchronously retuned their frequencies using a perforated tape analogous to that used in mechanical pianos. The patent was handed over to the US Navy, but was implemented only decades later.
-- Protection: If the adversary does not know the hopping sequence, he has to jam the whole band, which requires colossal power.
Direct Sequence (DSSS - Direct Sequence Spread Spectrum): The information signal is multiplied by a pseudo-random sequence at a much higher (chip) rate. This "smears" the signal over a wide frequency band, making it resemble background noise. At the receiver the signal is recovered by correlation with the same sequence.
Burst Communications / Time-hop: The data are compressed and transmitted in short bursts at unpredictable times. If the duty cycle is low, the adversary's scanning receiver may simply miss the transmission.
Meteor Scatter: The use of the ionization trails of micrometeorites in the atmosphere to create temporary communication channels over distances of 500–1500 km. The mother station transmits continuously, while the daughter station, having entered the "visibility" zone of a trail, rapidly sends data packets. It is applied for communication with remote early-warning radars and, for civilian purposes, for the monitoring of precipitation in developing countries.

Nicky Hager and the Echelon System

The journalist Nicky Hager, who in his book "Secret Power" described in detail the operation of the global interception system Echelon, run by the UKUSA countries (the USA, Britain and others). He described how "dictionaries" automatically filter intercepted traffic by keywords, and how the intelligence communities use these data for economic and political espionage.

Surveillance and Target Designation

Although some sensor systems use passive direction finding, the main methods of detecting enemy targets and of guiding weapons onto them are sonar, radar and infrared systems. If sonar was born in the First World War, radar became a key factor in the Second. It was in the field of radiolocation that the arts of attack (jamming) and of protection (electronic protection) were developed to the greatest extent.

Types of Radars

A wide spectrum of systems is used, including search radars, fire-control radars, terrain-following radars, counter-battery radars and meteorological radars. Each of them has its own signal characteristics: for example, radars with a low radio frequency and a low pulse repetition frequency (PRF) are better suited to search, whereas high-frequency systems with a high PRF are more effective for tracking targets.

Jamming Techniques

Electronic attack may be passive or active.

Chaff (Dipole reflectors): A classic passive measure. Thin strips of conducting foil, cut to half the wavelength of the target signal, are dropped from an aircraft in order to create false echo signals. During the Second World War the Allies dropped up to 2000 tons of chaff a day in order to blind German air defense. The main countermeasure against them became the use of Doppler radars, since the cloud of foil rapidly loses speed and is easily separated from a moving target.
Decoys: They may be small devices with active repeaters, or large platforms that simply reflect radio signals. They are applied to divert the attention of air defense systems or of radar-guided missiles.
Active jamming methods:
-- Barrage/Noise jamming: The generation of powerful noise in the radar's frequency band. The countermeasure is the use by radars of pulse compression or Doppler filtering.
-- Inverse gain jamming: The radar emits a signal not only through the main beam, but also through the side lobes of its radiation pattern. The jammer analyzes these side lobes and broadcasts a distorted signal back, forcing the radar to "see" a target where there is none, or distorting the data on range and azimuth.
-- Cover jamming: The creation of a powerful signal that covers the weak echo signal from the target, making it invisible against the background of the interference.

Modern Radars and Countermeasures

To combat jamming, radars are evolving:

Pulse compression: Allows long but complex pulses (for example, with phase modulation) to be transmitted, which on processing are compressed into a narrow peak. This gives high resolution and protection against simple noise interference.
Pulsed Doppler radars: Critically important for singling out moving targets against the background of ground clutter. They analyze the frequency shift caused by the Doppler effect.
Monopulse radars: They use several radiation patterns simultaneously for the high-precision determination of the angular coordinates of a target in a single pulse, which makes them extremely resistant to angular jamming.

IFF Systems ("Identify Friend or Foe")

Identify-Friend-or-Foe (IFF) is a critical and at the same time extremely controversial area. IFF errors lead to "blue-on-blue" friendly fire incidents, which inflict heavy moral and political damage.
The history of IFF goes back to antiquity, but the technical era began in the Second World War, when the speed of aircraft made visual identification impossible. Early systems simply broadcast a serial number or a "code of the day", which made them vulnerable to spoofing (imitation). Later, cryptographic challenge-response systems were introduced.
Modern systems, such as Mark XII, use cryptographic units (predecessors of DES) to encrypt a 32-bit challenge and a 4-bit response. To prevent "MIG-in-the-middle" attacks (the relaying of challenges and responses), the antenna of the radar generating the challenge is narrow-beam (usually this is the fire-control radar), while the receiver of the response operates in a wide sector.
Problems and organizational barriers:
Despite technological progress, "blue versus blue" incidents continue. In the Gulf war and in Iraq they occurred because of the incompatibility of the equipment of different coalition countries, delays in updating databases and the human factor. Attempts to create a single IFF system for NATO often bog down because of political friction: countries do not want to disclose their cryptographic keys to allies, fearing leaks. As a result, coalition forces are often forced to rely on procedural measures (for example, flight "corridors"), which are less reliable than technical means.

Improvised Explosive Devices (IED)

Improvised Explosive Devices (IEDs) became the "signature weapon" of insurgents in Iraq and Afghanistan. Since 2003 there have been more than 80,000 attacks using them.
Initially many IEDs were detonated by radio signal (using key fobs, mobile telephones). In response the coalition forces deployed a large-scale program of radio-electronic warfare (EW), installing on vehicles and bases powerful jammers suppressing the frequencies of cellular communication and radio control.
However, the enemy quickly adapted. This is a classic example of an asymmetric conflict:

The transition to command wires (wired detonators), which cannot be jammed by radio-electronic means.
The use of passive infrared sensors and pressure sensors (the victim himself drives over the mine or passes by it).
The tactic of "soft failure": the use of timers or the closing of the circuit only under specific conditions (for example, at a certain level of vibration).

The experience of Iraq showed that radio-electronic warfare is effective only for as long as the enemy is tied to radio electronics. As soon as the threshold of entry is lowered (a wire, a pressure sensor), technological superiority is neutralized, and entirely different methods of protection are required (armoring, trawling, reconnaissance).

Specific Statistics on IEDs (Improvised Explosive Devices) in Iraq

Since 2003 there have been more than 81,000 attacks using IEDs. The Pentagon spent more than $1 billion on the development of jammers. As a result of radio-electronic warfare, the percentage of radio-controlled IEDs fell from 70% to 10%, which forced the terrorists to switch to wired detonators and passive IR sensors.

Directed Energy Weapons

Directed Energy Weapons include lasers, microwave guns and electromagnetic pulse (EMP) generators.

Electromagnetic pulse (EMP): During a nuclear explosion in the atmosphere or in space, gamma radiation knocks electrons out of the molecules of air, creating colossal currents. An EMP is capable of putting out of action the entire electronic infrastructure of a continent. It is precisely because of this threat that critically important military systems (command posts, ICBM silos) are shielded to TEMPEST standards and protected against EMP.
Microwave weapons (High-Energy RF / HERF): There exist devices capable of generating directed microwave pulses in order to "fry" electronics at a distance (for example, to destroy the engines of missiles or to switch off computers in a bunker).
The terrorist threat: There are fears that terrorists may use compact EMP generators or microwave guns for attacks on financial centers. However, physics requires enormous power sources and antennas, which makes the creation of a "suitcase" EMP bomb extremely unlikely. The real EMP threat comes primarily from state structures (nuclear weapons), and not from lone terrorists.

Information Warfare

The term "Information Warfare" (I-war) became popular after Operation "Desert Storm", when it became clear that dominance in the collection and processing of information is as important as firepower.

Definitions and Doctrines

As in classical electronic warfare, the goals of information warfare can be divided into three categories:

Denial (Denial of service): The destruction or blocking of the adversary's communication channels, databases or control systems.
Deception: The injection of false information into the adversary's systems (for example, through the hacking of databases or phishing).
Exploitation: The theft of data (espionage, traffic interception).

Doctrinally, information warfare rests on ancient principles. Sun Tzu wrote: "All warfare is based on deception". Thomas Hobbes called force and fraud "the two cardinal virtues in war". In the modern Pentagon the concept of I-war is regarded as a way of achieving "information superiority", allowing operations to be conducted without effective opposition.

Lessons from Electronic Warfare

Information warfare largely inherits the principles of electronic warfare:

Guard band receivers (filters of protective bands): In e-war this is used to detect noise jamming. In I-war the analogue is the creation of "honey traps" or of systems for monitoring anomalies in databases, in order to distinguish legitimate traffic from an attack.
False alarms: In e-war an excessive number of false targets reduces the vigilance of operators. In I-war DDoS attacks or spam mailings can be used not so much for direct damage as to "exhaust" the protection systems and the personnel, in order to conceal the true goal of the attack.
Soft kill vs Hard kill: In e-war a "soft kill" (jamming) is reversible, while a "hard" one (the destruction of an antenna) is not. In I-war a "soft kill" may be the alteration of records in a database or the injection of a logic bomb, and a "hard" one the physical destruction of a server room.

The Differences Between E-war and I-war

Despite the similarity, there are fundamental differences between classical electronic warfare and modern information warfare, connected with the nature of networks:

Asymmetric and guerrilla conflict: In e-war (for example, in an air battle) technologically comparable adversaries usually clash. In I-war asymmetric conflicts dominate. Lone hackers or small groups (script kiddies, hacktivists) can inflict damage comparable with the actions of whole armies, using cheap tools against expensive infrastructure.
The openness of the environment: Electronic warfare is conducted in a controlled electromagnetic spectrum. Information warfare is conducted in the open Internet. The attacker may be anywhere in the world, using anonymous proxies and botnets. Perimeter protection here is practically impossible.
The absence of clear boundaries: In e-war there is a clear division into "own" and "alien" radio frequencies. In I-war the adversary's traffic may be indistinguishable from the traffic of peaceful users (for example, in DDoS attacks using the suborned computers of ordinary citizens).
The human factor: In e-war the main targets are technical systems (radars, radios). In I-war the main target and at the same time the most vulnerable link is the human being. Social engineering, phishing and psychological operations (influencing public opinion through social networks) play a far greater role in I-war than in classical e-war.

Telecommunications as a Testing Ground for Security Engineers

The protection of telecommunication systems represents a most important case study for security engineers. Firstly, many distributed systems in one form or another rely on fixed or mobile telephone networks, and the ways in which these dependencies manifest themselves are often not obvious. The reliability of these networks is steadily declining. If formerly telephone exchanges (POTS) were equipped with backup diesel generators capable of working for weeks, modern cellular towers run on batteries that last at most 48 hours. Moreover, the electric power companies themselves now rely on mobile telephones to coordinate repair crews, creating vulnerable circular dependencies.
Secondly, the history of telecommunications vulnerabilities is instructive. The first attacks were carried out by enthusiasts ("phreaks") for the sake of free calls; then the vulnerabilities began to be exploited by fraudsters in order to evade wiretapping, with the appearance of premium-rate numbers scales arose for large-scale fraud, and after the liberalization of the markets the telephone companies themselves began to attack each other's customers (and even their own). This same pattern is repeating itself today on the internet, only with a many-times accelerated history. Many political questions, such as wiretapping, have already been played out on telephone networks and are now being reproduced in the IP environment.
Finally, the telecom industry teaches us how technical protective measures interact with business models. The transition to IP networks and the convergence of services create new, unforeseen vulnerabilities.

Phone Phreaking

Aborigines used optical telegraphs (semaphores and heliographs) back in classical times, but with the invention of the electric telegraph in the middle of the 19th century the first abuses also began. For example, bookmakers bribed operators or used telescopes in order to intercept the results of horse races before they reached the official telegraph lines. Laws prohibiting such machinations turned out to be ineffective.
With the appearance of the telephone, history repeated itself. Below we will consider the main vectors of attack on traditional telephone networks.

Attacks on Metering

Early metering systems were ridiculously vulnerable. In the 1950s, when the operator needed to hear the sound of coins falling in a payphone in order to credit the payment, some people learned to strike the coin slot with a piece of metal, producing a sound that the system recognized as the denomination of a coin.
Later, when the operator himself connected long-distance calls and asked for the subscriber's number in order to raise the bill, fraudsters simply gave someone else's number. To protect against this, operators began to call back the number given for confirmation. In response the phreaks invented a trick with payphones: they dialed a number, waited until they were connected, put down the receiver and immediately dialed the number again. On redialing, the "call from a payphone" signal was not transmitted to the operator, and the fraudster could talk on someone else's account.
Another method became "clip-on fraud". Attackers physically connected their telephone to someone else's line in order to steal service. In the 1970s and 80s this was popular among foreign students, who in this way called home, while the bills came to unsuspecting landlords.

Attacks on Signaling

Until the 1980s telephone networks used in-band signaling, when control tones were transmitted along the same line as the voice. This opened the way to the famous "blue boxes".
Phreaks discovered that if a tone of frequency 2600 Hz was fed into the line, this simulated the "clear down" signal, breaking the connection on the side of the telephone exchange but leaving the trunk seized on the user's side. After this, with the help of a "blue box", one could generate control pulses to dial any long-distance or international numbers free of charge.
Phone phreaking also had an ideological subtext. In an era when telephone companies were perceived as faceless monopolies and the counterculture of the 1960s challenged them, the phreaks were considered a kind of heroes. However, with the transition to digital networks and dedicated (out-of-band) signaling channels, these attacks became history, giving way to more sophisticated methods.

Joe Engressia and "Absolute Pitch"

Joe Engressia — a deaf boy who in the 1960s discovered that he could control the AT&T telephone network because he possessed absolute musical pitch. He could determine by ear and reproduce the tone frequencies (including the famous 2600 Hz tone) used for routing long-distance calls, simply by whistling or by using tone generators.

Attacks on Switching and Configuration

With the development of digital PBXs and corporate networks, the switches themselves became the target. Attackers who gained access to a corporate PBX could use it to make expensive long-distance calls (dial-through fraud).
Insiders presented a particular problem. The owners or administrators of small PBXs often entered into collusion with fraudsters, selling access to their systems for the routing of illegal traffic. In such cases protection came down not to cryptography, but to organizational measures and to the monitoring of anomalous call patterns.

Insecure End Systems

An enormous layer of vulnerabilities is connected not with the network, but with the devices on the user's side. A classic example is the attack through answering machines. Fraudsters recorded onto tape the number of a premium-rate line, and then called their victims. When the victim picked up the receiver, the fraudster "dropped" the call, and the victim's answering machine, trying to call back the dropped number, automatically dialed the recorded fraudulent premium number.
Even more large-scale became fraud with premium-rate numbers (premium rate scams). Attackers created fictitious services, promising free calls or access to content, but redirecting the calls to expensive premium lines.
One of the most famous examples became the "Moldovan scam". Pornographic sites in the USA attracted users with promises of free access, but when the modem connected, a redirection to premium-rate numbers in Moldova occurred. Users received bills for thousands of dollars for long-distance communication, without even suspecting that their modem had physically connected to another state.

Feature Interaction

Telephone networks offer a multitude of additional services, and their interaction often creates unforeseen vulnerabilities.

Directory services: The numbers of directory services (for example, 118 118 in the UK) are intended for obtaining telephone numbers. However, fraudsters learned to use them to make calls or to hide their traces. For example, unfaithful spouses used directory services to hide the fact of a call to a mistress — only the harmless number of the directory service appeared in the itemized call record.
Call forwarding: This function allows incoming calls to be redirected to another number. Attackers used it to bypass security systems or to make fraudulent calls, passing themselves off as other people whose numbers had been forwarded to lines controlled by the fraudsters.
Conference calling: The function of combining several subscribers into one call was also exploited. For example, hooligans or fraudsters could use conference calling to bypass restrictions on the duration of calls or to hide the true initiator of the conversation, creating complex chains of redirections.

These examples demonstrate how additional functions, created for convenience, often break the basic assumptions about security and metering, creating new vectors for attacks.

Mobile Telephones

Since their appearance as an expensive luxury in the early 1980s, mobile telephones have become one of the greatest technological successes. By 2007 there were more than a billion subscribers in the world. Mobile telephones are used for the most varied purposes: from buying ferry tickets to obtaining cans of cola from vending machines. Criminals also actively use these devices: in Katanga province (DRC) mobile telephones became a de facto currency, and kidnappers demand a ransom, indicating numbers to be topped up.

Cloning of Mobile Telephones

The first generation of mobile telephones used analog signals without any real authentication. The handset simply transmitted its serial numbers in the clear over the radio channel. Attackers created devices to intercept these numbers. The main consumer of such stolen numbers was "call-sell" operations (the illegal sale of long-distance communication), where fraudsters traded in minutes using cloned telephones.
Later "tumblers" appeared — telephones that generated a new identifier for each call, which made them practically untraceable. In response the industry introduced intrusion detection systems and RF fingerprinting (radio-frequency dactyloscopy), which identifies a particular device by the unique distortions of its signal arising from manufacturing tolerances in the radio components.

GSM Security Mechanisms

The transition to digital standards, in particular GSM (Global System for Mobile Communications), brought with it cryptographic authentication. Personalization of the subscriber is carried out with the help of a SIM card.
The authentication protocol works as follows:

The network sends a random challenge (RAND).
The SIM card computes the response (SRES), using the secret authentication key (K_i) burned into the card and known to the home location register (HLR).
The one-way function Comp128 (algorithms A3/A8) is used for the computation.

The Comp128 vulnerability: It turned out that this algorithm has a "narrow pipe" (bottleneck). An attacker, acting as a fake base station, can send the SIM card about 150,000 specially selected challenges and recover the secret key K_i. This made it possible to clone SIM cards without physical access to them.
To protect the content (the conversations) the stream cipher A5 is used. However, it too was broken (the Fluhrer-Mantin-Shamir attack and subsequent attacks using cache memory), which allowed traffic to be intercepted and decrypted.
Another problem became IMSI-catchers. These are fake base stations that force the telephone to register with them, passing themselves off as a legitimate network. This not only allows calls to be intercepted, but also violates the confidentiality of the subscriber's location.

Third-Generation Mobile Communication (3GPP)

The 3G standard (UMTS) was developed taking into account the mistakes of GSM. The block cipher Kasumi is used. Authentication became two-way (the network and the telephone check each other), and the computations are moved from the SIM card into the network (into the VLR).
Here the problem of "backdoors" surfaced again. Governments demanded mechanisms for intercepting traffic. The Royal Holloway protocol was proposed, using public-key cryptography, but it provoked disputes because of the complexity of key management and potential vulnerabilities.

Platform Security

As mobile telephones turn into full-fledged computers (with the Symbian, Windows Mobile OSes), they face the same problems as PCs: malware, botnets and exploits.
Operators and manufacturers try to introduce DRM (digital rights management) and to control accessories (for example, by blocking third-party batteries). A conflict arises: manufacturers lock telephones to a particular operator (lock-in) in order to obtain profit, while users and hackers create tools for unlocking, which leads to legal battles.

Was Mobile Security a Success or a Failure?

The answer depends on whom you ask:

Cryptologists consider it a failure, since the basic algorithms (Comp128, A5) were broken.
Telephone companies consider it a success, since cloning has been stopped and revenues are growing.
The police consider it a failure, because the spread of prepaid (anonymous) SIM cards has made wiretapping and the tracking of criminals extremely difficult.

(Voice over IP)

Voice communication over IP (VOIP) has become a new reality. However, here technical problems (delays, jitter) are interwoven with economic ones. Traditional telephone companies, which are also internet providers, often try to block or degrade the quality of VOIP traffic in order to protect their revenues from long-distance calls. This gives rise to disputes about "net neutrality".

The Economics of Telecommunications Security

The telecommunications business is characterized by high fixed costs and almost zero marginal costs. This leads to price discrimination and to "confusion pricing", when operators complicate their tariffs in order to maximize profit, which in turn creates the ground for fraud.

Fraud on the Part of the Telephone Companies

Consumers often think that only hackers commit fraud, but the telephone companies themselves also engage in unscrupulous practices:

Cramming: Operators add small sums to the bill for supposedly rendered premium services (horoscopes, games) that the subscriber did not order.
Slamming: The illegal change of a subscriber's long-distance carrier without his knowledge.
Fly-by-night (One-day companies): The creation of shell companies to collect payments for premium services, after which the company disappears without transferring the money to the communications providers.
Short termination: A fraudulent scheme in which calls are routed through fictitious international numbers (for example, in Moldova or the Caribbean) in order to avoid paying domestic long-distance tariffs. The famous "Moldovan scam" with porn sites used precisely this billing vulnerability.

Billing Mechanisms

The protection of billing systems is critical. A Call Detail Record (CDR) is usually generated only after the call has been completed. This creates a vulnerability to attacks using long conference calls: the fraudster creates an endless conference, and the bill for it is not raised until the call is dropped.
For protection, mechanisms of "tick payments" or online cost control are required, but their implementation in legacy telephone networks (SS7) is extremely difficult and expensive.

Conclusions

The history of telecommunications security shows that the transition from analog to digital systems did not solve the problems, but merely changed their nature. If formerly the main threats were the interception of an analog signal and the theft of services, now the problems of cryptographic implementations (in GSM), of the confidentiality of metadata (IMSI-catchers) and of economic fraud in billing systems have come to the fore.
The main lesson is that telecommunications security is no longer exclusively a technical task. It is a complex problem that includes the business models of operators, legislative regulation (for example, wiretapping requirements) and the psychology of users. The security engineer must understand that perfect cryptographic protection can be completely neutralized by the greed of operators creating holes in billing, or by political requirements forcing the introduction of vulnerable backdoors.