Home Routing is limiting law enforcement evidence gathering, warns Europol

In a position paper published today, Europol sounds the alarm on how Privacy Enhancing Technologies (PET) used in Home Routing are representing a serious challenge for lawful interception of information in the context of law enforcement and judicial investigations.

The paper delves into the problems that Home Routing creates for law enforcement agencies in carrying out their duties, as well as presents possible avenues for safeguarding and maintaining law enforcement’s ability to protect citizens and investigate criminals. 

What is Home Routing?

Home Routing makes it possible for a telecommunication service provider to (continue to) provide a service to a customer when they travel abroad. This means that when a customer travels internationally, their communications (calls, messages and data) are still processed through their home network rather than the network of the country they are visiting.

Consequently, this means the service provider abroad is not able to deliver communication data to law enforcement upon a judicial request, if the domestic service provided has enabled PET in Home Routing.

Once Home Routing is deployed, any suspect using a foreign SIM card can no longer be intercepted. This problem occurs both when a foreign national uses their own (foreign) SIM card in another country, and when citizens or residents use a foreign SIM card in their own country. The only current exception for this is when a domestic service provider (to whom domestic interception orders can be sent) has in place a cooperation agreement which disables PET in Home Routing with the service provider of another country.

Why is this a problem?

Criminals know of this loophole, and have been abusing it to evade law enforcement. This creates an uneven equilibrium between malicious actors and law enforcement, whose capabilities at this point do not allow for them to carry out the duties society has entrusted them with.

In the case of Home Routing, a national interception order cannot be enforced across borders. Instead, a European Investigation Order can be issued, but a response can take up to 120 days, which is too long when emergency interception is needed. In addition, being dependent on the voluntary cooperation of a foreign service provider for the exercise of national investigatory powers is undesirable.

Way forward

With this position paper, Europol wishes to open the debate on this technical issue, which at present is severely hampering law enforcement’s ability to access crucial evidence.

A solution must be found that enables a country’s authorities to lawfully intercept the communications of a suspect within their territory, while not impeding secure communications disproportionately.

The paper offers key elements which should be considered as part of the societal response, looking at operational, technical, privacy and policy aspects.

Digital challenges

This position paper is part of a series of Europol publications which are pivotal in anticipating technological innovations and the resulting modifications in the security landscape.

At Europol, we take our responsibility as the EU Agency for law enforcement seriously; the fundamental role of policing in democratic societies has always been to keep the public safe.

To achieve this, we need to strike a balance between harnessing technical innovation for social good, such as protecting privacy rights, while preventing it from being abused for criminal purposes.

Find out more about the Digital Challenges.