The key factor is the compatibility with international roaming - customers, manufacturers and operators really want the phone to "just work" when you step out of a plane in a random place where the only cell tower in range is run by an operator that was established after your phone was made. There can't be a global list of 'trusted operators' for political reasons (long story), and in order to make calls, your phone needs to work with that operator directly - it can't do end-to-end to your home provider, your data streams won't get routed halway across the world and back for no good reason, they'll route only the billing info and metadata as per the roaming agreements.

The other problem IIRC is virtual towers - when operator A gains improved coverage by renting capacity on a tower of operator B, they want the phone to seamlessly connect to that tower as if it's run by operator A (even if it's not) without the phone being able to inform the customer that hey, you're now connected to operator B - because it might rise confusion about roaming charges, and also give bad PR about coverage which might suggest the customer to switch to that competitor.

What could work is the combination of (a) your phone being able to cryptographically verify if it's really connected to your 'main' operator or someone they explicitly authorized (isn't this something that 5g and even 4g protocol supports?) and (b) requiring explicit confirmation if connecting to someone that's not. Of course, (a) would mean that police Stingrays would be recognized as legitimate cell towers, they'd need cooperation from the cell network, but's IMHO not really a problem, just some paperwork whenever they need to activate a new batch of intercepting devices.

> The key factor is the compatibility with international roaming

You could have an encryption setting in the phone, and the handshake with the network could have a bit telling you the setting isn't supported.

>can't do end to end ....

so then you use a vpn and voip instead of using the phone system directly...

Actually it looks like the two problems with your obvious solutions (political and companies being cranky about you noticing you're on a different tower) are complete bullshit and can be solved with very simple legislation. The more complicated and expensive solution doesn't need to happen.

> Why can't we encrypt calls and texts in a way which doesn't let all this stuff get read? Like (handwaving) either trust the network and encrypt with a key they provide, or else some form end-to-end encryption (where maybe generating keys is part of what happens when you activate a sim card or something)?

We can have E2E encryption on cellphones today, just make calls and send texts over Signal (with other people who also have Signal installed).

Here's an article on using SIM cards as a secure element: https://nelenkov.blogspot.com/2013/09/using-sim-card-as-secu...

I would really like a hardware interface for changing a key, or a mechanism where you flip the card over to expose a separate set of contact plates which have write permissions. Stock Android will allow carriers to fuck with your SIM card sans user permissions.

Interestingly, at DefCon last year, a presentation was talking about how in Africa there are interposer SIM shims that slip over the top of the simcard and provide additional functionality. Citation needed, but I was impressed they could fit a small MCU in such a thin form factor!

Oooh, I like that idea. I've seen those used to bypass carrier locks, but never considered the possibility of restricting write access with one.

I don't think American carriers care at all about preventing government spying.

The CEO of Qwest did and he was subsequently jailed.

https://www.washingtonpost.com/news/the-switch/wp/2013/09/30...

From a YCombinator comment: "The way that Qwest CEO Joseph Nacchio so meaningfully resisted the government that he was convicted of insider trading for telling people his company would be successful when it actually relied on a government contract that was pulled in retaliation, which he couldn't use as a defense in court because of national security concerns? For which he served four years in prison, and Qwest no longer exists? That sort of meaningfully resist? The message to me from that case is clear—if the US government tells you to jump, you answer, how high."

https://news.ycombinator.com/item?id=20369120

If he's telling the truth, major props to that guy for sticking to his principles regardless of what he had to lose.

5G is by nature shorter range, which at least makes the surveillance harder to do and more targeted when it happens. But I can't say much for the protocol, having not done much with it.

On the flip side, I think this would make pinpoint the device‘s geo-location much easier.

Yeah that seems true, if there's more signal towers in a particular space it'll make triangulation of a person and their device easier to achieve through an increase of reference points.

I don't see this as being a stop gap, the short comings (not an intended pun) of the range and potential penetration of 5G almost certainly means 4G is going to be around in the long term.

mmWave 5G is shorter range.

5G runs also on sub-6. The spec defines the modulation and the network, it doesn't hard-spec the frequency.

So the coverage on low band 5G will be the same as 4G

Since the FCC sanctions stingray use for law enforcement I'm sure they make sure that any new mobile radio technology is compliant with police spying requirements.

Last I heard these things were FCC licensed for "emergency use only". The issue is that the FCC can't override federal law and deliberate interference with radio communications is illegal under such law.

It used to be that only 2G was vulnerable, but newer devices don't depend on downgrading. But with suitable phones, I gather that one can detect suspicious baseband activity. However, by the time that's obvious, the phone will already be pwned.

https://www.tomsguide.com/us/cellphone-tracker-stingray,news...

https://www.tomsguide.com/us/imsi-catcher-catcher,news-19438...