Cheap travel eSIMs, home routing, and why the jurisdiction matters more than the price
Every time somebody asks for a travel data recommendation the thread fills up with the same handful of $8-for-10GB global eSIM resellers, and nobody ever asks the obvious question: whose network is this actually, and where does my traffic come out? I want to lay out how the technology works underneath, because the answer isn’t “it’s a SIM card but digital,” and the risk profile follows directly from the architecture.
The eSIM is a computer, not a file
Start with the eUICC. That’s the embedded chip, and it is a genuine little computer running a Java Card platform. It has its own OS, its own filesystem, its own applets, and it sits below the phone’s operating system entirely. Android and iOS cannot see what it does and cannot audit it.
What you download when you scan a QR code is a profile: the IMSI, the Ki authentication secret, the operator’s file structure, and optionally applets. The download runs over the GSMA RSP (Remote SIM Provisioning) protocol. Your phone’s LPA (Local Profile Assistant) talks to an SM-DP+ server, they mutually authenticate against certificates chaining to the GSMA Certificate Issuer root, and the profile arrives encrypted end to end to the chip. This is why “malicious profile from a random QR code” is mostly a non-threat — you can’t mint a profile without an accredited SM-DP+ and a valid cert chain. The realistic risk was never a forged profile. It’s a completely legitimate profile from an operator whose interests are not yours.
Once a profile is installed, whoever holds its OTA keys (KIc/KID) can send authenticated commands to the card via SMS-PP — special SMS messages addressed to the UICC that never appear in your messages app. Those commands can install applets and drive SIM Toolkit operations. PROVIDE LOCAL INFORMATION returns your serving cell. OPEN CHANNEL uses BIP (Bearer Independent Protocol) to open a data channel through the modem that the phone OS never sees. This isn’t theoretical: Simjacker and WIBattack (2019) abused the S@T Browser and Wireless Internet Browser applets shipped on ordinary SIMs to do silent location tracking at scale. And in 2025 Security Explorations published work against a Kigen eUICC showing Java Card VM weaknesses that allowed installing arbitrary applets and extracting the chip’s identity key material — which would let someone pull and decrypt operator profiles. The trust model has real dents in it.
One more thing people miss: on Android the UICC can carry ARA-M rules listing app signing certificate hashes. An installed app matching one of those hashes gets carrier privileges — modify network config, read the subscriber number, and so on — with no user prompt. The SIM can’t install an app, but it can silently elevate one.
Where your packets actually go
Now the routing, which is the part that surprises people most.
Nearly all of these cheap global eSIMs are MVNO profiles in permanent roaming. In 3GPP roaming there are two possible data paths. Local breakout means your session exits at the visited network — you’re in Taipei, your traffic hits the internet in Taipei. Home routing means the visited network builds a GTP tunnel and hauls your entire PDU session back to the home operator’s gateway before it touches the internet. Home routing is the default in most roaming agreements and it’s what these resellers ride on, because it’s what their upstream sells them.
So the question becomes: who is the upstream? In this market it’s very often a Hong Kong or mainland aggregator — China Unicom (HK), CMLink / China Mobile International, and a rotating cast of HK wholesalers. Which means every packet from your phone, no matter where you physically are, egresses in that jurisdiction. Nothing has been compromised. That is simply where the gateway lives. Check it yourself: bring up the eSIM, hit an IP-info endpoint, look at the ASN. It takes thirty seconds and it is frequently not what people expect.
DNS rides along with this. During session setup the network hands your device resolver addresses in the PCO (Protocol Configuration Options) field, and the modem takes them. Whatever you think you configured for DNS, on cellular you’re using theirs. Plenty of operators also transparently redirect outbound port 53 regardless of your settings, so pointing at 1.1.1.1 accomplishes nothing. DoH or DoT does defeat this, since it doesn’t look like DNS on the wire — but it’s opt-in and most people never touch it.
Why “it’s just lawful intercept, everyone does it”
Lawful interception exists everywhere. CALEA in the US, ETSI LI across Europe, TKÜV in Germany. The capability is not the differentiator. What differs is who authorizes it, what the operator is obliged to do, and whether interception is where it stops.
Counter-Terrorism Law Art. 18 requires providers to furnish technical interfaces and decryption support. Cybersecurity Law Art. 28 requires technical support and assistance to public and state security organs, deliberately unbounded. National Intelligence Law Arts. 7 and 14 require all organizations and citizens to support and cooperate with intelligence work, and let intelligence organs compel it — no warrant, no adversarial process, no notification. MPS Order 151 gives public security organs a standing right to conduct on-site and remote inspection of ISPs, including remote testing and copying of data. That last one is the “intrusion” half that gets left out of these discussions: it’s not a tap bolted onto the side, it’s an inspection right over the operator’s own infrastructure. PIPL genuinely constrains commercial data handling, but state security processing sits outside it, so none of those protections transfer.
And Hong Kong is no longer a separate jurisdiction for this purpose, which matters enormously given how much of this traffic gateways there. Under the NSL Art. 43 implementation rules and the 2024 Safeguarding National Security Ordinance, interception and covert surveillance in national security cases are authorized by the Chief Executive rather than a judge, providers can be compelled to assist, and they can be compelled to stay silent about it. Anyone still treating an HK egress as firewalled from Beijing is running a pre-2020 mental model.
What that yields in practice
TLS still bounds content, so nobody is reading your email over this. The realistic harvest is the metadata graph: destination IPs, SNI unless ECH negotiated, timing, volume, session patterns, plus DNS if you didn’t force encrypted resolution, plus IMSI-to-identity binding, plus continuous coarse location from the signaling plane, plus SMS and voice in the clear, plus anything still riding plaintext. That’s a detailed portrait of a person without decrypting a single payload. Sitting at your session gateway also positions an operator for injection into anything unencrypted and for downgrade attempts — and, as above, for the OTA channel into the chip itself, which is below anything you can configure.
If you’re in or connected to Taiwan this stops being abstract. PRC national security law asserts extraterritorial reach, Taiwan-related matters are a core national security category, and the assistance obligations bind the operator regardless of where the subscriber sits. A lot of these resellers do passport-level KYC. A durable record linking that identity to an IMEI and a movement history is a different class of artifact from “someone saw my streaming traffic.”
So what do you actually do
Understand that this is a jurisdiction problem, not a configuration problem. Full-tunnel VPN plus DoH covers the content and DNS layers and is worth doing regardless — but nothing you run in user space reaches the modem, the signaling plane, or the eUICC. You cannot patch your way out of who owns the gateway.
The fix is boring: buy the local carrier’s own prepaid eSIM at your destination instead of a global reseller. For Taiwan that’s Chunghwa, Taiwan Mobile, or FarEasTone directly — domestic breakout, domestic gateway, no HK hop. In Europe, an EU MVNO with EU-anchored routing. If you do use a reseller, ask them in writing which network the profile runs on and whether it’s home-routed or local breakout, and verify with an egress IP check rather than taking the answer at face value. Keep travel profiles data-only, disable them when you’re not travelling, and never let SMS-based 2FA land on one.
It costs a bit more and it’s marginally less convenient than one QR code that works in 140 countries. It also removes the entire problem instead of layering countermeasures over it.
I’ve ever seen! 
)
)