EPIC v. CISA (SS7 Cybersecurity Report)

Background

Signaling System 7 (SS7) is a global protocol for telecommunications traffic, known to have significant security weaknesses for more than a decade. Exploitation of these weaknesses can result in determining the physical location of a device, disrupting phone service, intercepting or blocking text messaging, and redirecting or eavesdropping on voice conversations. In 2022, the Cybersecurity and Infrastructure Security Agency (CISA), a component of the U.S. Department of Homeland Security (DHS), commissioned an independent expert report that included discussion of SS7 vulnerabilities. Although unclassified, this report remained unpublished. In a Feb. 2024 letter to President Biden, Sen. Ron Wyden noted that:

“In addition to not taking responsibility for [the wireless industry’s failures to protect subscribers from SS7 vulnerabilities], CISA is actively hiding information about it from the American people. The agency commissioned an independent expert report on this topic in 2022 which it permitted my staff to read at CISA’s office in the fall of 2023. CISA refuses to publicly release this unclassified report, which includes details that are relevant to policymakers and Americans who care about the security of their phones.”

EPIC’s FOIA Request

On March 12, 2024, EPIC submitted a Freedom of Information Act (“FOIA”) request to DHS, the agency responsible for responding to FOIA requests on behalf of CISA. EPIC sought expedited processing because of the urgency to inform the public about possible risks to their location privacy and the privacy of their communications, as indicated by what Senator Wyden’s staff had read in the report.

On November 19, 2024, DHS denied EPIC’s request, claiming the entirety of every page of the report was protected by deliberative process privilege. On December 19, 2024, EPIC appealed this decision.

On April 9, 2025, Sen. Wyden noted that:

“this report is a technical document containing factual information about U.S. telecom security. The report does not recommend or discuss specific policy options that CISA could take to address this threat. As such, this report contains important factual information that the public has a right to see and CISA should stop withholding the entire report under a purported ‘deliberative process privilege’ claim.”

On June 4, 2025, more than 365 days after submitting its initial FOIA request and more than 100 days after filing its appeal, EPIC filed a lawsuit against CISA to compel disclosure of the unclassified report.

EPIC’s Interest

The location data and communications data created by our mobile phones are extremely revealing types of information, cataloging where we go, who we talk to, and in some instances what we say. This can include religious, medical, or other personal information.

Securing our nation’s communications systems is essential to protect national security, public safety, consumers, and our economy. Especially in light of attacks on our communications infrastructure such as the ongoing Salt Typhoon incident and persistent individual takeover attacks such as SIM swapping and port-out fraud, the American public must be able to benefit from the information contained in the unclassified CISA report to better safeguard the sensitive data their devices may be exposing about them.

FOIA Documents

• EPIC’s FOIA Request (Mar. 12, 2024)
• DHS/CISA Response to EPIC’s Request (Nov. 19, 2024)
• EPIC’s Appeal (Dec. 19, 2024)

Legal Documents