Everything worth knowing, nothing that isn't.
What the message does
MAP-PSI is invoked by an SCP, a VLR, or an HLR against another network element to retrieve current subscriber state. The response includes location information (LAI, Cell-ID, geographical coordinates if available), the IMEI of the device currently registered, the call-forwarding state, and the active subscription services. In a healthy operator-internal use case (e.g. an SCP needing to know where a subscriber is to apply geo-policy), MAP-PSI is fast, accurate, and useful.
Why it became an attack target
Without firewall protection, an attacker with SS7 access (rented from a grey-market provider, abused through a complicit small operator, or stolen via leased signalling) could send MAP-PSI against any MSISDN from any peer and get back precise location and device data. This was the root mechanism behind a wave of high-profile location-tracking and lawful-intercept-abuse incidents in the 2010s. The defensive response: classify MAP-PSI as GSMA FS.07 Category 2 — only acceptable from confirmed roaming partners — and drop everything else.
What mitigations exist
Three layered defences. First, the SS7 firewall enforces per-peer GT/PC whitelisting and FS.07 categorisation, dropping MAP-PSI from any non-roaming-partner peer. Second, rate-limiting and reputation scoring catch even authorised peers abusing the operation (a roaming partner suddenly running 100x more PSI queries than baseline gets throttled and the operator's NOC is paged). Third, cross-operator threat-intelligence sharing through GSMA T-FCS lets operators block sources that have abused PSI elsewhere. BroadNet's SS7 firewall (/operators/ss7-firewall) ships all three layers preconfigured.
Privacy and compliance considerations
Subscriber location is one of the highest-sensitivity data classes under every modern privacy regime — EU GDPR Article 9 special-category-adjacent, KSA PDPL strict-purpose-limited, UAE Federal Data Protection Law restricted. Operators must log every MAP-PSI received and every response sent, with audit retention and access control. GSMA FS.11 is the monitoring spec that operationalises this. Educational note: this entry describes the defensive frame — what to monitor and how to block — not the offensive technique. For exploit detail, see GSMA's restricted-distribution documentation.