Paging: the quiet way a network reveals where you are

A handset that is not actively doing anything is not holding a connection open. Keeping one would drain the battery and consume capacity for no benefit, so an idle handset maintains only a coarse registration: the network knows roughly which area it is in, not which cell.

When something arrives for that handset, a call or a message or a notification, the network has to find it. It does so by broadcasting a page across the cells of the area it believes the handset to be in, effectively calling its name and waiting for it to answer. The handset hears its own identity, responds, and a connection is established.

The design is efficient and the alternative is worse, but it has an unavoidable property: the call is broadcast, it names the recipient, and it is sent to a specific area. A listener who hears a page learns two things at once. It learns which identity the network is looking for, and it learns that the network expects that identity to be somewhere within earshot.

Networks do not page by permanent identity in normal operation. They allocate a temporary identifier and page by that, which is the same defence used to keep the permanent identity off the air during attach. The protection this provides is entirely a function of how often the temporary value is replaced.

Replaced frequently, it is genuinely temporary and an observer who hears it twice cannot assume the two pages concern the same subscription. Left in place for days, it is a permanent identifier wearing a different label, and the effort of concealing the real one is largely wasted, because the substitute has taken on the property that made the original dangerous. Research on deployed networks has repeatedly found reallocation happening far less often than the design intent implies, and it is one of the clearest cases where a specification permits a good outcome and a configuration produces a poor one.

There is a further wrinkle: something has to trigger a page before it can be observed, and triggers are available to anyone who can cause traffic to be directed at a subscription without the subscriber noticing. The general pattern is that a low-visibility contact attempt is enough to make the network go looking, and each look is an observation opportunity. This turns a passive exposure into something an observer can schedule, which is a materially different problem.

Paging exposure explains why identity concealment is described on this site as closing the largest hole. Concealment addresses what a device discloses about itself when it attaches. It does not address what the network discloses about the device afterwards, and the two are separate channels with separate lifetimes.

It also explains a limit on detection. The tools described on the detection page look for anomalies in the cells a handset can see, because that is what a handset can observe. An observer collecting pages is not operating a cell and is not transmitting anything: there is no anomalous cell to notice, because there is no cell. Nothing on the handset can see this at all, and no app can, which is the reason the countermeasures for it are all on the network side.