On August 3, T-Mobile shut down the last major 2G GSM network in the United States. Most of the coverage framed it as a nostalgia piece: the original iPhone finally has nowhere to connect. AT&T turned 2G off in 2017, Verizon in 2020, and now the lights are out across the major U.S. carrier networks.

That's a fine story, and it's the least interesting thing about the event.

What I'd rather talk about is how long we kept infrastructure we knew was broken because things depended on it—and how little the shutdown actually does about the vulnerability underneath.

If you run a connected device fleet, the shutdown didn't make you safer. It simply changed the shape of your exposure.

Why 2G was indefensible

GSM was designed in the late 1980s, and it shows. Three problems stand out, and all three are structural rather than implementation bugs:

• Authentication only runs one direction. The handset proves itself to the network. The network never proves itself to the handset. That single design decision is the entire foundation of the IMSI catcher industry—a device that broadcasts a plausible cell tower identity and waits for handsets to attach. There’s no certificate to validate, no chain to verify, nothing to check.
• The ciphers are broken. A5 is the family of stream ciphers GSM uses to encrypt the radio link between the handset and the tower—a role equivalent to the one that AES plays in a modern TLS session. There are three variants in practice:

A5/1 was the standard-strength version for most of the world; it fell to precomputed rainbow tables in 2009 and is crackable in real time on commodity hardware today.

A5/2 was deliberately weakened to satisfy export controls and was never meaningfully secure.

A5/0 is the null cipher—no encryption at all—and the network gets to pick, with no meaningful signal to the user that the choice was made.

• Downgrade is a feature, not a bug. 2G exists in the standards as the universal fallback. Jam or degrade the LTE and 5G bands, and a modern device will politely step down to the one generation that can't authenticate the network it just attached to.

Put those together and you get one current abuse pattern: SMS blasters. Rogue base stations force a downgrade and inject messages directly into every handset in range, bypassing the carrier entirely—and with it every piece of filtering, reputation, and sender authentication the carrier has built.

The shutdown doesn’t fix this

Here’s the part that gets lost: Retiring the network removes the legitimate 2G service, but it doesn't remove GSM support from the baseband in the device.

An attacker running a rogue base station doesn't need T-Mobile's cooperation. If the modem in your device will still answer a 2G page, that device is still attackable—in a country where no legitimate 2G network exists to explain the traffic. In some ways, the situation got worse: The anomaly is now unambiguous, and almost nobody is watching for it.

Android exposes a “2G” toggle and disables it by default on some hardware. iOS drops 2G only under Lockdown Mode. Most embedded cellular modules in the field have no such control exposed at all, and firmware defaults leave the fallback enabled because that's what shipped.

And 2G is far from globally dead. Sub-Saharan Africa still runs primarily on it. India, Brazil, and Mexico have active GSM networks with no announced sunset. If your fleet roams, "the U.S. turned 2G off" is not a statement about your risk.

What actually happened to the devices

The honest answer is that they weren't all migrated. A meaningful number simply stopped working.

There’s no over-the-air path off GSM. LTE-M and NB-IoT modules are not backward compatible with 2G silicon, so migration means replacing hardware—a truck roll to every site. When AT&T retired 2G in 2017, roughly four million lines went dark, most of them machine-to-machine.

The categories that made it through did so because someone forced the issue years earlier. Payment terminals largely moved to 3G and then LTE under processor and PCI pressure well before 2017. Alarm panels went through industry-wide communicator swap campaigns during the 3G sunset. Multimode devices with 2G as fallback were never really at risk of immediate service loss.

What died is the long tail: asset trackers, remote sensors, utility gear, unattended kiosks—the hardware installed a decade ago by a team that no longer exists, in an inventory nobody maintained.

And the fleets that just completed this migration should mark their calendars. LTE refarming is already on the roadmap toward the end of this decade. The LTE-M and NB-IoT deployments being stood up right now are the subject of the next forced migration.

The actual lesson: Stop trusting the transport

Every one of these problems traces back to one assumption: that the network is a trust boundary. It isn't, and it hasn't been for a long time. The 2G sunset is just an unusually clean demonstration of it.

The devices that came through this fine are the ones that never depended on the radio for security to begin with. They carry a cryptographic identity that’s independent of the bearer, they mutually authenticate to their endpoint, and they sign what they send. Downgrade the radio underneath them and you gain traffic analysis—not impersonation, not injection, not a foothold.

That's the design goal. The network becomes a transport layer, and it doesn't matter which generation you're using.

Where DigiCert fits

This is the problem DigiCert® Device Trust Manager was built for. A few pieces matter specifically here:

• Identity that starts in the factory: Birth certificates provisioned during manufacturing, including through third-party contract manufacturers, so identity is established before the device ever sees a network it can't trust
• Hardware-backed keys: An identity bound to a secure element can't be lifted by a rogue base station or extracted from a captured session Enrollment that meets the fleet where it is—and moves it forward: Support legacy deployments while creating a path toward automated enrollment, renewal, and stronger device attestation
• A real inventory: Managed device identity records that help teams understand what’s deployed and plan for future migrations
• Crypto-agility: The ability to rotate algorithms and re-provision identity in the field

Enrollment deserves a little more attention. Real device fleets are mixed, and not every deployed device can move to a newer enrollment protocol. DigiCert supports protocols like SCEP and CMPv2 for those existing environments, while newer designs can move toward ACME and ACME device attestation. That shift makes enrollment and renewal more automated and allows the device to prove its hardware identity as part of the certificate process.

More broadly, it reflects the direction device security is moving: toward verifiable identity, managed credentials, and lifecycle accountability that don’t depend on the underlying network.

Regulatory pressure is converging on the same place. The U.S. Cyber Trust Mark and the EU Cyber Resilience Act both reinforce expectations around unique device identity, secure updates, and lifecycle accountability as baseline security practices rather than differentiators.

My direct ask to anyone still shipping 2G fallback

If you build devices, operate a fleet, or write the firmware in between, three things are worth doing now.

1. Turn the fallback off and make “off” the default.

If your product doesn't need GSM to function in its deployment markets, disable it in the modem configuration. Ship it that way. Make enabling it a deliberate, documented decision with a named owner—not an inherited default nobody has looked at since the module was selected.

2. Instrument for downgrade

In a country with no operating 2G network, a device that attaches to one is an incident, not a coverage event. That signal should reach your SOC. Almost nobody is collecting it today.

3. Assume the pipe is hostile

Mutual TLS with a hardware-backed device identity. Signed telemetry. Certificate lifecycles you actively manage. If the security of your product changes materially when the radio generation changes, the architecture is wrong, and 2G won't be the last thing to expose that.

The network will change. Your trust model shouldn’t

The original iPhone losing its last network is a footnote. The more important lesson from the 2G sunset is that transport will keep changing, and every transition will expose devices that depend too heavily on the network beneath them.

2G won't be the last migration. LTE refarming is coming, cryptographic requirements will change, and device fleets will continue to outlive the assumptions they were built around. The way to make those transitions less disruptive is to move trust into the device itself: a cryptographic identity established early, protected in hardware, enrolled and renewed throughout the device lifecycle, and managed independently of the network carrying the traffic.

The fix for a broken transport was never going to arrive from the carriers, and it didn't arrive with the 2G shutdown. It arrives with the identity you put in the device.