Travel eSIM Security Concerns: Study Reveals Data Routing Through Unwanted Networks

In a recent security study, experts raised concerns about the safety of travel eSIMs, which have become increasingly popular for tourists and business travelers. The study, conducted by researchers from Northeastern University, uncovered that numerous travel eSIM providers secretly route user data through foreign telecommunications networks, including China, without notifying customers. This discovery has sparked worries over privacy and jurisdictional issues.

eSIMs’ Hidden Data Routes Expose Privacy Risks

What Are Travel eSIMs?
Electronic Subscriber Identity Modules (eSIMs) are a digital alternative to physical SIM cards, offering greater convenience for international travelers. By allowing users to switch between mobile carriers without changing physical SIM cards, eSIMs offer flexibility and often better rates for roaming services. However, the new research has revealed that this convenience may come at a hidden cost: privacy risks.

In their paper titled eSIMplicity or eSIMplification? Privacy and Security Risks in the eSIM Ecosystem, the researchers, including Maryam Motallebighomi, Jason Veara, Evangelos Bitsikas, and Aanjhan Ranganathan, detailed how the data routing of travel eSIMs is far from transparent. They purchased eSIM profiles from several well-known providers, such as Holafly, Airalo, and eSIM Access, and tested how user data flows across mobile networks.

The Route of User Data: China’s Telecom Infrastructure

According to the researchers, despite the location of the users, eSIM data traffic was frequently routed through networks in unexpected countries. The study showed that many providers, including those based in countries like Ireland, routed user data through Chinese infrastructure. In one case, an eSIM purchased from Holafly, a provider based in Ireland, routed its traffic through China Mobile’s network, making the user’s device appear as if it was located in China.

The implications of this data routing are serious. When users think their data is being transmitted locally or regionally, it could instead be traveling through foreign networks, exposing sensitive information. This lack of transparency raises significant concerns about privacy and data sovereignty.

eSIM Data Routing: Unseen Consequences for Global Travelers

This opaque routing of eSIM data has other consequences. For instance, the researchers noted that when using some eSIMs, they could access content and services restricted to certain regions. In one test, they successfully streamed videos from ViuTV, an entertainment platform typically unavailable in the United States, without needing to use a VPN. This demonstrated how eSIMs could circumvent geographical restrictions, potentially breaching local laws or regulations regarding content access.

These revelations also shed light on a worrying trend in the eSIM ecosystem, where users remain unaware of where and how their data is being handled. Without clear disclosures from providers, customers are left in the dark, with little to no control over their personal information.

Ease of Becoming an eSIM Reseller: A Privacy Threat

One of the more surprising findings from the study was the ease with which individuals or companies can become eSIM resellers. The researchers found that it only took a valid email address and payment method to become a reseller on platforms like eSIMaccess and Telnyx. This lack of scrutiny means that resellers can gain access to extensive user data, including sensitive information like International Mobile Subscriber Identity (IMSI) numbers and device location data.

In one case, the researchers found that eSIM resellers had access to location information accurate to within 800 meters, which raises concerns about user privacy and consent. This situation is exacerbated by the fact that the location information is not always provided in real-time, meaning resellers could track users without their knowledge or permission.

Proactive Communication from eSIMs: A Silent Privacy Breach

Another striking issue uncovered by the researchers was the “proactive communication” behavior of eSIM profiles. Using specialized hardware, the team discovered that eSIM profiles were silently establishing connections to servers in countries like Singapore and retrieving SMS messages from Hong Kong numbers. These unsolicited connections, which were initiated by the eSIM profiles themselves, occurred without any user awareness, demonstrating a significant privacy breach.

This behavior is carried out through SIM Application Toolkit (STK) commands, a system traditionally used for legitimate tasks like network configuration. However, the researchers found that these commands could now be used for actions hidden from the user, such as unsolicited data retrieval.

Proposed Solutions for Improving eSIM Security

The researchers have proposed several measures to address the vulnerabilities identified in their study. They suggest enhanced transparency requirements, forcing eSIM providers to disclose data routing practices and clearly inform customers about how their data is handled.

Furthermore, the researchers recommend regulatory frameworks that would clarify the responsibilities of mobile network operators, resellers, and wholesale providers in ensuring that user data is protected and handled responsibly. By implementing such frameworks, the eSIM ecosystem could become safer and more transparent for users worldwide.

Conclusion: A Call for Transparency in the eSIM Market

As travel eSIMs continue to grow in popularity, it is crucial for providers to maintain transparency about their data handling practices. With the increasing use of these digital SIM cards by global travelers, ensuring data privacy and security is more important than ever. This research serves as a wake-up call for both eSIM providers and consumers to be more vigilant about how their personal data is being routed and stored.

For travelers seeking to stay connected without compromising their privacy, it is essential to choose eSIM providers that offer clear and transparent data practices. With growing concerns over security, travelers should stay informed and be cautious when selecting eSIM services.