Note 09
The IMSI is not the identity.
A subscriber number was always a convenient handle, not the whole person. Concealing it does not conceal the graph.
Cellular privacy conversations still orbit a single artifact: the IMSI, or its 5G successor. Concealment of that number (SUCI, better paging hygiene, fewer plaintext identities on the air) is real progress. It is also an incomplete story. Identity in a radio access network is a bundle of stable and semi-stable handles: device identifiers, location sequences, timing, accessory pairings, and the applications that wake when the modem does.
What 5G changed
The interesting design move in 5G was not a new slogan. It was the decision to stop treating a long-lived subscriber number as something that should appear in the clear during attach. That closes a class of collection that defined the previous two decades of IMSI-catcher folklore. It does not make a handset anonymous in a city, and it does not make a mixed 4G/5G estate behave like a 5G paper.
What still correlates
A threat model that stops at “the IMSI is encrypted” will miss the join keys that operations teams already use: equipment identifiers, persistent radio measurements, Wi-Fi offload, and the analytics SDK that thinks it is being helpful. Privacy failures here are usually not cryptographic. They are compositional. Two honest systems share a clock and a person.
Unlinkability is a property of the whole protocol graph, not of the most famous field in one message.
How NIIS 9 uses this
Cellular-adjacent reviews inventory identifiers across modem, OS, and application, then ask which of them survive the controls the product is proud of. The practice is not interested in cataloguing every historical paging leak. It is interested in whether a current design still yields a person when an adversary can sit in the radio neighborhood, or when an insider can sit in the logging stack.