Alright, here's what Daniel sent us. Quote, "We talked in an episode about the diagnostic codes on phones and how they were inherited from the early evolution of the GSM stack. I'd like to talk today about the history of GSM itself, but more specifically and pointedly, why or whether we still need it. We are moving towards a reality in which telephony is entirely IP-based. The move towards IPv6 means that there will not be any addressing constraints for IoT devices and phones and things that might be thought of as residual elements of that time. The IMEI could probably be done away with. If one were to rip out the entirety of cellular connectivity infrastructure, which of course nobody is proposing or will even be remotely willing to do, and we were to replace it with something designed solely to provide wireless IP coverage for both telephony and IoT devices, what radio and protocol would make the most natural sense for the actual bandwidth and the architecture being served?"
That's a good prompt.
It is. And I want to sit with the last part for a second — the "which of course nobody is proposing" bit. Daniel's not naive. He knows nobody's going to rip out cellular infrastructure and start over. But the thought experiment is the point. If the answer is "we'd build something that looks almost nothing like what we have," then all those legacy pieces — the IMEI, the SIM, the circuit-switched core — they're not necessities. They're just... still there.
They're fossils in the walls.
Right. So let's start where the prompt starts — with the history. Because you can't understand what GSM is still doing in the network until you understand what it was built to do.
Nineteen eighty-two. The European Conference of Postal and Telecommunications Administrations — the CEPT — forms a group called Groupe Spécial Mobile. The problem they're trying to solve is genuinely messy. Europe in the early eighties had a patchwork of incompatible national cellular systems. The Nordics had NMT, the UK had TACS, France had Radiocom 2000. None of them talked to each other. If you drove from Paris to Bonn, your car phone was a brick the moment you crossed the border.
Which is exactly the thing a mobile network is supposed to prevent.
So the mandate was: create a single pan-European standard. And that mandate shaped everything. The most important decision they made — and this is the one that still echoes — was that subscriber identity had to live on a removable card. Not in the network. Not in the handset. On a card you could pull out and put in a different phone. That's the SIM. It exists because roaming across national borders was the whole point.
So the SIM was never really a security feature in the way we think about it now. It was a portability hack for a continent with a lot of borders.
And it solved a real problem. But it also baked in an assumption: that identity and device are separate things, managed by separate systems. Which is why we ended up with the IMSI on the SIM and the IMEI in the phone — two parallel identity layers that don't really know about each other.
The IMEI. Fifteen digits. What was that actually for?
Theft deterrence, mostly. The International Mobile Equipment Identity was designed as a hardware serial number that carriers could blacklist. There's a database called the Equipment Identity Register — the EIR — and if your phone was reported stolen, the IMEI went on the blacklist and the network would refuse to let it connect. In theory.
In theory.
The problem is, the IMEI has no cryptographic binding to the device. It's just a number. It can be spoofed. It can be changed. It was designed in an era before public-key infrastructure was a thing anyone thought about for consumer devices. So you've got this theft-deterrent system that's trivially bypassed, but it's still baked into every phone and every network because... it's there.
Alright, let's talk about the voice side. The circuit-switched core. This is the part that feels most alien if you're looking at it from an IP perspective.
The circuit-switched core is a direct inheritance from the public switched telephone network. The PSTN was built around sixty-four kilobit per second channels — that's the "unit of telephony," the bandwidth needed for one uncompressed voice call in the digital phone system. When GSM was being designed, the natural thing to do was to build a mobile network that plugged into that same architecture. So GSM allocates dedicated circuit-switched channels for voice. The voice is encoded — thirteen kilobits per second for the full-rate codec, later twelve point two for enhanced full-rate — and then it's stuffed into a time slot in a TDMA frame. The entire radio interface, from the frame timing to the frequency hopping patterns, is built around the assumption that you're carrying a circuit.
And then data comes along and they have to bolt it on.
GPRS. General Packet Radio Service. Late nineties. It's a packet-switched overlay, but — and this is the part most people miss — it runs on the same radio frame structure. The same TDMA slots. The same timing. You're doing packet data, but you're doing it inside a radio interface that was designed for circuits. It's like running Ethernet over a telegraph wire. It works, but you're constantly fighting the underlying assumptions.
So the thing Daniel's really asking is: if you started from scratch today, with modern spectrum, modern silicon, and the assumption that everything is IP from the ground up... what would you actually build?
Let's separate this into three layers. The radio layer, the core network layer, and the identity layer. Because the answer is different for each.
Radio first.
The honest answer is: you'd keep something very close to what we already have in 5G NR. OFDM — orthogonal frequency-division multiplexing — is optimal for the kind of wideband, multipath-prone channels that mobile networks deal with. MIMO and beamforming let you pack more bits into the same spectrum. These aren't GSM-era ideas. They're physics. The radio layer is not where the legacy problem lives.
So the physical layer is fine. It's everything above it.
Everything above it. The core network is where GSM's assumptions are still embedded. The circuit-switched core, the SS7 signaling, the home location register, the visitor location register — all of this is designed around the idea that a phone call is a dedicated circuit that needs to be set up, maintained, and torn down. In an all-IP world, a phone call is just a media stream. You don't need a circuit. You need SIP, you need RTP, you need a packet scheduler that can guarantee quality of service.
And we already do this. VoLTE does exactly this.
VoLTE encodes the call as IP packets right at the handset. It runs over the LTE data channel. There's no circuit-switched fallback — well, there is in some implementations, but in a pure VoLTE deployment, the call never touches the circuit-switched core. And VoNR — Voice over New Radio — does the same thing for 5G. The technology exists. It's deployed. The question is why we're still maintaining the circuit-switched core alongside it.
Because of the installed base.
Billions of devices. Feature phones, IoT sensors, alarm systems, elevator phones, point-of-sale terminals. Some of them are fifteen years old. Some of them are in places where upgrading means sending a truck. The circuit-switched core is still there because those devices don't speak IP.
There's an interesting case study that just came up. Xinhua ran a piece a few days ago — July twenty-eighth — about Rwanda's telecom modernization push. Rwanda is interesting because they never had the kind of copper-wire PSTN infrastructure that Europe and North America had. They leapfrogged straight to mobile. And even there, even in a market that's effectively greenfield relative to the old world, they're still dealing with GSM-era device compatibility constraints. Because the global device ecosystem is built around those assumptions.
That's the trap. You can build a brand-new network from scratch in Kigali, and you're still going to have to support phones that expect a circuit-switched core. Because those are the phones that exist in the world. The supply chain, the certification process, the roaming agreements — they all assume GSM.
Alright, let's get to the identity layer. The IMEI. Daniel says it could probably be done away with. Can it?
In an all-IP world, absolutely. The IMEI is a pre-PKI identifier. It's a serial number. What you'd replace it with is a device certificate — a public-private key pair issued to the device at manufacture, signed by a trusted certificate authority. When the device connects to the network, it presents its certificate. The network verifies the signature. That's device attestation. It's more secure than an IMEI, it can't be spoofed without extracting the private key, and it can be revoked the same way you revoke any other certificate.
And the stolen-phone database just becomes a certificate revocation list.
It's the same model that TLS uses for websites. We've been doing this on the internet for decades. The IMEI is just... a number someone writes down.
But that certificate infrastructure has to exist. Someone has to run the certificate authorities. Someone has to manage the revocation lists. That's not free.
No, but it's already being done. The GSMA — the industry association — has an eSIM certification program that uses PKI. Device manufacturers already embed secure elements and hardware security modules. The pieces are there. It's not a technical problem. It's a coordination problem.
What about the SIM? The IMSI?
The SIM is already evolving. eSIM — embedded SIM — decouples the subscriber identity from a physical card. iSIM goes further and integrates it into the device's system-on-chip. But the IMSI itself — the International Mobile Subscriber Identity — still lives in a GSM-era namespace. It's a fifteen-digit number structured around a mobile country code, a mobile network code, and a subscriber number. In an IP-native world, your subscriber identity could be... an email address. Or a SIP URI. Or any standard IETF identity authenticated via EAP — the Extensible Authentication Protocol — over IP.
So instead of your phone presenting an IMSI to the network, it presents a certificate that says "I'm daniel at my weird prompts dot com" and the network says "yep, that checks out."
That's the model. And it's not science fiction. Eduroam — the academic Wi-Fi roaming network — has been doing exactly this for years. You connect to a university Wi-Fi network in another country, your device presents a certificate, and you're authenticated against your home institution's RADIUS server. It's federated identity over IP. The cellular world could adopt the same model tomorrow if the coordination problem were solved.
But it won't be. Tomorrow.
No. Because the coordination problem is enormous. You've got hundreds of carriers, thousands of device manufacturers, and billions of devices that expect the old system. Changing the identity layer means changing every device and every network. That's a decade-scale transition.
Which brings us to the thought experiment. The rip-it-out scenario. Daniel's asking: if you could start from zero, what radio and protocol would make the most sense?
Radio: 5G NR's physical layer. OFDM, MIMO, beamforming. Maybe with some tweaks for the specific spectrum bands you're using, but the fundamental approach is sound. For IoT, you'd use NB-IoT or LTE-M for the low-power, low-bandwidth stuff — those were designed from the start with IP connectivity in mind.
And the core?
Pure IP. SIP for call setup, RTP for media, EAP-TLS for authentication, certificates for device and subscriber identity. Mobility management via something like Proxy Mobile IPv6 — PMIPv6 — which handles handoffs between base stations without the phone needing to know it moved. The entire GSM core — the MSC, the HLR, the VLR, the AuC — all of it goes away. You're left with routers, SIP servers, and certificate authorities.
And the thing is, this isn't a fantasy. 5G standalone mode — 5G SA — already supports an all-IP core with no circuit-switched fallback. It's deployed. It's running. The future exists. It's just not evenly distributed.
That's the William Gibson line, and it's exactly right. The future is here, it's just that most of the network is still running the past alongside it.
So the transition is happening. It's just happening through sunsetting, not through replacement. Two-G and three-G networks are being shut down — partly for spectrum reclamation, but also because maintaining the circuit-switched core alongside the IP core is expensive and complicated. Every time a carrier shuts down its two-G network, a piece of the GSM legacy dies.
And it's worth being precise about what's actually dying. The radio layer — the GSM air interface — is being replaced by LTE and NR. But the radio was never the legacy problem. The legacy problem is the core network protocols. The circuit-switched voice path, the SS7 signaling, the MAP protocol for mobility and roaming. Those are the parts that were designed in the eighties for a world that doesn't exist anymore.
SS7. That's a whole other episode.
SS7 is a security nightmare wrapped in a protocol specification. But the point is, it's still there. It's still handling call setup and SMS delivery in networks all over the world. And it'll be there until the last circuit-switched core is powered down.
Let's talk about what this means for people who are actually building things. If you're an IoT developer right now, designing a device that's going to be in the field for ten years, what do you do?
You assume the GSM-era identity layers are transitional. Don't design your device around the IMEI. Don't hard-code IMSI-based logic. Build with IP-native identity from the start — device certificates, EAP-TLS, mutual authentication. Your device should be able to connect to a pure IP core without any GSM-specific assumptions. Because at some point during that ten-year lifespan, the network it's connecting to may drop the circuit-switched core entirely.
And if you're a network engineer, managing a carrier network?
Understand which protocols are GSM-era and which are IP-native. The sunsetting of two-G and three-G is not just a spectrum play — it's the gradual dismantling of the circuit-switched core. Every time a legacy component is decommissioned, you need to know what depended on it. VoLTE and VoNR are the migration path. If you've still got services that require circuit-switched fallback, you need a plan.
For consumers, the practical thing is: the IMEI you see in your phone's settings is not a permanent identifier. It's a legacy artifact. The blacklist system that's supposed to prevent theft is going to be replaced by certificate-based attestation. So the whole "IMEI unlocking" industry — the sketchy websites that claim to remove your phone from the blacklist — that's going to change. Certificate revocation is a different beast.
Much harder to circumvent. If your device certificate is revoked, you're not getting back on the network without a new certificate signed by a trusted authority. That's a real security improvement. But it also means device ownership and transfer get more complicated. How do you sell a used phone if the certificate is tied to the original owner?
That's the coordination problem again. We haven't solved it for the web — certificate management is still a mess for normal users — and we'd be importing that mess into the phone system.
There's a clinical analogy here. I used to see this in medicine all the time. You have a treatment that works — it's not optimal, it has side effects, but it works. And you have a new treatment that's clearly better on paper. But switching means taking the patient off the old treatment, managing the transition, retraining the staff, updating the protocols. The technical superiority of the new treatment is only about twenty percent of the decision. The other eighty percent is logistics.
The GSM stack is a medication with a lot of side effects that everyone's just learned to live with.
And the patient is the entire global telecommunications system. You don't switch that patient's medication casually.
So if the transition is happening through sunsetting rather than replacement, what's the timeline? When does the last circuit-switched core get powered down?
It depends on the market. Some European carriers have already shut down two-G and three-G entirely. Others have kept two-G running for IoT and emergency services. In parts of Africa and Asia, two-G is still the primary network for a huge number of users. The last circuit-switched core probably gets turned off somewhere in the twenty-thirties. But the protocol legacy — the assumptions baked into how devices identify themselves and how calls get set up — that lasts much longer.
Because even VoLTE still carries some of that DNA. The IMS — the IP Multimedia Subsystem — that handles VoLTE call setup was designed to replicate the GSM call model over IP. It's SIP, but it's SIP with GSM-flavored extensions.
That's the part that frustrates the purists. You could do voice over IP with standard SIP and RTP. You don't need the IMS. But the IMS exists because it let carriers migrate their existing services — call forwarding, caller ID, lawful intercept — without rearchitecting everything. It's a compromise. It's the GSM call model wearing an IP costume.
The answer to Daniel's question — what would we build if we started from scratch — is: a network that looks a lot like 5G standalone at the radio layer, with standard IETF protocols at the core, and certificate-based identity throughout. And the reason we don't have that is that the installed base won't let us.
The reason the installed base won't let us is that it represents trillions of dollars of devices and infrastructure that were built around GSM assumptions. You don't replace that with a clean-slate design. You evolve it. Slowly. Painfully. With a lot of backward compatibility hacks.
The diagnostic codes I called "cockroach protocols" — they survive because nobody cares enough to eliminate them. The circuit-switched core is a cockroach protocol at planetary scale.
At least the cockroach metaphor implies it'll survive the apocalypse. The circuit-switched core won't. It's being starved. Every two-G shutdown, every three-G sunset, every VoLTE deployment is taking away its food supply.
If the transition is already happening, what does this mean for the people actually building devices and networks right now?
For IoT developers: design for IP-native identity. Device certificates, not IMEI-based tracking. Assume the network your device connects to in year seven of its deployment will not have a circuit-switched core. Test against VoLTE and NB-IoT, not GSM circuit-switched fallback.
For network engineers: the two-G and three-G sunsetting is your migration window. Every legacy component you decommission frees up spectrum and simplifies your core. But you need to audit what's still depending on those components. The elevator phone in the back corner of the parking garage. The alarm system that sends SMS alerts. They're the long tail.
For everyone else: the IMEI blacklist is a transitional system. Don't build business models around it. The fifteen-digit number in your settings menu is a relic. The future is certificates.
One last question that's been nagging at us. If the IMEI goes away, what happens to the global stolen-phone database? Is a certificate-based system actually better, or just different?
It's better in some ways — cryptographic binding means you can't spoof it, and revocation is cryptographically enforceable. But it's worse in others. Certificate management for consumers is hard. What happens when someone's private key is compromised? What happens when a certificate authority is breached? We've seen these problems play out in the web PKI for years. Importing them into the phone system doesn't make them go away.
Better, but not solved.
Better, but not solved. The next decade will see the last GSM-era cores shut down. The radio layer, in some form, will persist — because the physics of OFDM and MIMO don't care about the protocol stack above them. The question is whether the identity and core protocols catch up to the IP world, or whether we just keep layering IP costumes on top of GSM assumptions.
If you've got a weird prompt about the future of telephony, or the last GSM holdout in your network, send it to us. We want to hear about the elevator phone that still requires a circuit-switched connection. Those are the stories that make this real.
Thanks to Hilbert Flumingtop for producing.
This has been My Weird Prompts. Find us at my weird prompts dot com, or email the show at show at my weird prompts dot com.
We'll be back soon.
