A phone can be protected against having its identity or location exposed and still be prevented from connecting to a legitimate cellular network.
That is the important finding in a new National Institute of Standards and Technology draft paper on false base stations. NIST tested six simulated scenarios on its operational 5G cybersecurity testbed and found that improvements in successive cellular standards have reduced several privacy and tracking risks. The tested devices, however, remained vulnerable to denial-of-service behavior in some circumstances.
The result is narrower—and more useful—than the usual warning that “fake cell towers” can spy on every phone. NIST’s work does not establish that all 5G devices behave identically, that attackers can routinely decrypt ordinary 5G traffic or that false-base-station attacks are common in American neighborhoods. It demonstrates a different problem: protecting the secrecy of a connection is not the same as guaranteeing that the connection will remain available.
A false base station does not need to read everything
A false base station, also called a rogue or fake base station, imitates equipment used by a legitimate carrier. A nearby phone must discover radio networks and establish enough communication to begin authentication before stronger protections are fully active. That early process creates opportunities for a deceptive radio system to influence how a device behaves.
The technical details matter, but the basic idea is straightforward. A phone can be prevented from completing a legitimate connection without an attacker defeating every encryption mechanism used after the connection is established.
A locked conversation can still be interrupted by someone standing in the doorway. The lock protects the contents of the conversation. It does not guarantee that the conversation can begin.
NIST describes the equipment used for false-base-station activity as increasingly accessible through inexpensive, commercially available hardware and software. The paper evaluates how tested 5G devices respond to six simulated scenarios and identifies protections available through standards and device configuration. Its conclusion is not that 5G security has failed. It is that some availability problems remain even as other risks have become harder to exploit.
Confidentiality and availability are different security claims
Security discussions often compress several properties into one word. A system is described as secure when what is really meant is that it offers stronger encryption, improved authentication, better subscriber-identity protection or reduced exposure to location tracking.
Those improvements matter. Earlier generations of mobile networks left more room for identity exposure and certain forms of tracking, and the 5G standards include capabilities intended to reduce those risks. NIST’s broader 5G cybersecurity project is built around the same practical premise: standards-based protections must be implemented alongside security for the cloud, hardware and software that support the network.
But none of those protections automatically guarantees availability. A device may keep its permanent subscriber identity concealed and still lose service. A conversation may be encrypted once established and still fail to start. A network may resist interception while remaining vulnerable to disruption at an earlier stage of the connection process.
This is not a contradiction. It is the normal result of engineering security against different failure modes. The problem begins when broad phrases such as “secure 5G” imply protection against every relevant failure.
The testbed is evidence, not a national outage estimate
The draft is an evaluation of tested devices in a controlled NIST environment, not a measurement of how often false-base-station attacks occur in the real world. Device configuration, carrier behavior, network architecture and the type of 5G deployment can all affect the result.
That limitation should prevent both complacency and panic. The paper does not show that a false base station can broadly disable emergency calling, nor does it provide a national estimate of exposed phones. It also does not establish that a future standards change will eliminate the problem.
What it does show is that standards testing should ask more than whether a device protects sensitive data. It should also ask whether the device recognizes a suspicious radio environment, recovers automatically, alerts the user or operator and returns to a legitimate network without requiring specialized intervention.
The paper is open for public comment through October 30, 2026. That process is important because the remaining questions are implementation questions as much as protocol questions: which scenarios produced the disruption, how consistent the behavior was across devices and what controls carriers or manufacturers can realistically deploy.
Why service disruption may matter more than interception
For an ordinary user, a deliberate disruption may look like a dead zone, congestion or a carrier problem. Most people have no practical way to distinguish malicious radio interference from a failed network component.
That ambiguity becomes more consequential when cellular access is part of a larger operating system. Mobile networks support payments, logistics, transportation, remote work, industrial monitoring and emergency communications. A localized disruption may not steal credentials or expose a database, but it can still interrupt an activity that assumes the radio path will be available.
NIST’s broader project is explicitly concerned with the full hardware-to-software stack of 5G systems, including private networks and supporting infrastructure. That matters because private 5G deployments are often promoted as a way for factories, ports, campuses and utilities to gain local control. Local control does not automatically produce local expertise, redundant connectivity or tested recovery procedures.
A factory that loses cellular connectivity may have a different tolerance for disruption than a consumer checking a text message. A hospital communications system, a warehouse robot and a public-safety network will all define acceptable availability differently. Security standards can provide common mechanisms, but operators still have to decide what failure means for their particular mission.
The accountability problem is distributed
Responsibility for this layer of cellular security is divided. Standards bodies define many of the mechanisms. Phone and modem manufacturers decide which capabilities are implemented and enabled. Carriers control authentication, radio configuration and network operations. Operating-system vendors influence device behavior. Enterprise operators configure private networks. Regulators and public agencies decide which risks receive formal attention.
That division is manageable when a problem is easy to classify. It is less manageable when a phone loses service and nobody can immediately determine whether the cause was the handset, modem firmware, carrier configuration, standards design or local radio interference.
For carriers and enterprise operators, the practical response should therefore include more than standards compliance. They need visibility into suspicious connection behavior, clear ownership of radio-security events, tested fallback paths and a way to determine whether a device can recover without remaining attached to a deceptive or unusable cell.
For public-safety and other critical users, the lesson is not to abandon cellular networks. It is to avoid treating one radio path as permanently available. Depending on the mission, layered alternatives may include local radio, wired connections, satellite service or another independent communications path.
The question security marketing tends to skip
The most useful question is not whether 5G is secure. It is: secure against which failure, under what conditions and with what recovery path?
NIST’s draft shows measurable progress. False-base-station attacks have become less effective against 5G devices in several privacy-related respects, and standards improvements have reduced some exposure to identity and location tracking. That progress should be recognized rather than buried beneath a dramatic headline.
It also shows why security claims need to be specific. A network can improve confidentiality while leaving availability concerns unresolved. It can make interception harder without making disruption impossible. It can satisfy a technical requirement while still leaving operators uncertain about detection and recovery.
A secure cellular system is therefore not merely one that keeps outsiders from reading a message. It is one that can authenticate the participants, communicate reliably, detect interference and continue operating—or fail in a controlled way—when part of the connection is under attack.
