To understand why this works, start with what a phone does when it is idle. It is not silent. It stays registered with the network, and the network knows which cell it is attached to, because that is the only way an incoming call can be routed to it. That much is unavoidable in any cellular system.
But an idle phone updates its registration lazily. It reports in when it crosses into a new location area, on a periodic timer, and when it has traffic. In between, the network's record of where it is can be coarse and stale. A location area can cover a lot of ground.
What an observer wants is a way to make the phone announce itself right now, precisely, without the user noticing. That is what a silent SMS provides.
What the standard actually says
SMS is defined in 3GPP TS 23.040. Each message carries a protocol identifier field and a data coding scheme field, and between them they let a sender describe a message that is not intended for a person to read. The relevant case, commonly called Type 0, instructs the receiving handset to acknowledge receipt and then discard the message. It is not stored in the inbox. It is not written to the SIM. No notification is raised, no sound plays, and nothing appears on screen.
The acknowledgement is the point. To send it, the handset must have an active radio connection with the network. Establishing that connection makes the phone identify the cell it is on, and depending on the network generation and configuration, produces measurement reporting about neighbouring cells too. The message content is irrelevant and is usually empty. The delivery is the payload.
The mechanism exists so that networks and handset vendors can send control and diagnostic messages that should not clutter a user's inbox. That is a legitimate need. The property that makes it useful for that purpose, delivery without user-visible trace, is identical to the property that makes it useful for locating a person. There is no version of the feature that has one without the other.
From a ping to a location
A silent SMS by itself does not return coordinates. It provokes a response, and the response is observed somewhere else. Three combinations show up in practice.
| Who sends the ping | Where the location comes from | Precision |
|---|---|---|
| Law enforcement with a court order, via the carrier | The carrier's own records of which cell served the acknowledgement | Cell-level, from a few hundred metres in a dense city to several kilometres rurally |
| An operator, or a party with signalling network access | Interconnect queries that return the serving cell identity | Cell-level, and available across borders without the home network's cooperation |
| An operator of an IMSI catcher already near the target | The device's own radio measurements as the phone responds | Metres, because signal strength and timing can be measured directly |
The last row is where the technique earns its reputation. An IMSI catcher operator standing in an apartment building knows the target is somewhere inside, but not which unit. Pinging repeatedly and watching signal strength change as the operator moves converts a building into a door. Without the ping, they would have to wait for the target to use the phone.
How much this is used
This is documented, and the documentation comes from an unusual place. In Germany, members of the Bundestag have repeatedly submitted formal parliamentary questions asking federal agencies how many silent SMS they sent in a given period, and the answers are published. They are the reason the technique is discussed concretely rather than as a rumour, and they show sustained routine use across multiple agencies over many years rather than exceptional deployment. France has had comparable parliamentary and press attention.
We are not quoting a figure here, because the counts are reported per agency and per reporting period and are easy to get wrong at second hand. The parliamentary answers themselves are the primary source, and they are public.
The pattern in the disclosures is the part worth noting. Silent SMS is not a last resort. It is cheap, it requires no equipment near the target, and in most jurisdictions it is authorised under the same provisions as ordinary location data rather than under the stricter rules that govern interception of content. Something that is legally cheap and technically cheap gets used a lot.
Can you detect it
Not from a normal application. The discard happens below the layer any app can see. The Android and iOS APIs deliver messages that were meant to be delivered, and a Type 0 message by definition was not.
Detection requires access to the baseband, the separate processor that runs the cellular stack. Security Research Labs published SnoopSnitch for exactly this: an Android application that reads diagnostic messages from the modem and flags silent SMS, IMSI catcher indicators, and other anomalies. It needs root access and works only on certain Qualcomm chipsets, because it depends on a vendor diagnostic interface that most devices do not expose.
That constraint is worth stating plainly rather than glossing. On the great majority of phones in ordinary configuration, a silent SMS is undetectable by the person holding the phone, and there is no setting that changes this. The baseband is a separate computer running proprietary firmware, and the operating system you interact with is its client.
The security boundary most people imagine is between them and their apps. On a cellular device there is another one underneath, and the user is on the outside of it.
What actually reduces exposure
There is no clever configuration that defeats this, and anyone offering one is selling something. What exists are structural choices, each with a real cost.
- The radio has to be off, not the screen. A phone in a pocket is a phone that answers pings. Airplane mode genuinely stops it. A signal-blocking bag stops it without trusting the software.
- Separate the identity from the movement. A silent SMS has to be addressed to a number. Location follows whoever carries the SIM that number is on, so the exposure is decided by which device carries which subscription, not by which messaging app you use.
- Data-only devices reduce the surface but do not eliminate it. A device with no telephony subscription cannot be reached by SMS, and it still registers with the network and can be located by other means. This narrows the technique available, not the underlying visibility.
- Encryption is the wrong tool for this problem. Nothing about end-to-end encrypted messaging affects a Type 0 SMS, because the attack never touches your messages. Believing otherwise is the dangerous mistake, and it is a common one.
That last point is the one worth carrying away, and it is why we wrote this. Haven encrypts what you say and to whom you say it inside the app. It does not, and cannot, change the fact that a phone is a radio transponder registered to a subscriber identity, and that the network it registers with knows where it is. Those are different layers with different adversaries, and the physical device is the one that moves through the world.
Anyone whose threat model includes being located rather than being read needs to reason about the handset and the SIM, and treat the messaging layer as solving a different problem. Conflating the two is how people end up feeling protected in exactly the situation where they are not.