Cell Broadcast Messages

Cell phone networks support a type of broadcast mode where a single message can be sent to all cell phones in a specific region. This is useful for things like emergency messages for dangerous weather conditions, disasters and even abducted children. Mobian does not yet have support for the correct and reliable delivery of such messages, but it appears to be possible to do so in the hardware. This is however difficult to test unless someone waits for the next emergency alert in their area, which could be a long time.

Having seen cell broadcast messages (CBM) and/or wireless emergency alerts (WEA) before we know that they can be much longer than a normal SMS. They are generally just plain text and are received by a number of cell phones at very nearly the same time in the same area. The existing modemmanager support for SMS does _not_ currently receive these messages, so there is some missing support for them in the hardware and/or software stack. It is also possible that the hardware needs to be configured to receive CBM and that configuration could depend on your location in the world. There are websites in US and Canada that give you an idea of what these alerts can look like on a supported device.

• https://www.weather.gov/riw/WEA_Info
• https://www.alertready.ca/

There is some evidence that these messages can also include geo-location geometry to allow the phone to determine whether a particular message covers the current location of the phone. To properly support this the phone will need to regularly update its position and not just when a navigation application is running. Alternately, the phone could be set to deliver the message if the geolocation intersects a user-set area; this would work even on phones where the satellite location may be airgapped, or on phones without satellite location. For small-area messages, like tornado warnings, the user would then have to manually decide whether they applied.

https://www.att.com/support/article/wireless/KM1009041

It appears that the concept of CBM is part of the worldwide 3gpp standard and WEA is a US-specific implementation. There are more details in the CBM wikipedia page.

https://en.wikipedia.org/wiki/Cell_Broadcast

An outline on the situation in the Americas is given in https://www.5gamericas.org/wp-content/uploads/2019/07/Public_Warning_Systems_Americas_WhitePaper___Final_for_distribution.pdf

Some details on the EU-Situation is given in Wikipedia on the EU-Alert keyword, Particularly in the document ETSI Technical Specifications

EU-Alert is active in a few Member States already. Following the summer 2021 flash flooding in Germany the federal Government has decided to implement CBS. It is supposed to be operational by February 2023, with first public tests due on december 8, 2022. A test message of highest priority is planned to be broadcast. Technical specifications for the implementation can be found in this document.

The pinephone cellular modem is a Quectel EG25. Since CBM's are known to come through the cell phone network any pre-existing hardware support would come from there. It is known that the Quectel EC25 is a similar modem and shares some of the same modem commands. The EC25 commands manual is found here.

https://www.quectel.com/UploadImage/Downlad/Quectel_EC25&EC21_AT_Commands_Manual_V1.3.pdf

Note that section 9.14 is called “Select Cell Broadcast Message Types.” There is a command called AT+CSCB that allows the modem to control the CBM message types. It appears to be some kind of hardware-level filter mechanism and it can be invoked on the pinephone's modem like this.

$ sudo mmcli -m 0 --command='AT+CSCB=?'
response: '+CSCB: (0,1)' # The manual says that this indicates that mids and dcss can be accepted or not accepted in this modem
$ sudo mmcli -m 0 --command='AT+CSCB?'
response: '+CSCB: 0, "4370,4370-4379,4381-4399",""' # This particular modem (Canadian) is currently configured to "allow" message ids (MIDS) and ranges shown and the "default" data coding scheme (DCS)

From these traces from a real Pinephone it can be assumed that there is at least some support for CBM's in the PinePhone's modem. Also, the CBM's can be filtered directly at the modem level ahead of time using the CSCB command that controls both the message ids (MIDS) and data coding schema (DCS) of the messages that are received by the modem.

The MIDS are specified in the 3GPP Technical Specification 23.041 and seems to have a partial overlap for the most important messages among all countries. Some of the MIDS are used to silently distribute GPS assistance data.

Note that the above list of MIDS was not set by the user and unlikely to have been set by Mobian/Debian software. The SIM card came from a previous phone and was issued by the cellular network operator so these likely came from either of those places instead. From the 3GPP 23.041 it appears that the modem is currently set to receive a range of messages from presidential level, extreme, severe and child abduction (4370-4379). Also, it is configured to capture carrier test messages (4381 and 4382) as well as alternate language alerts matching the alert levels of the 4370 range (4383-4389). The latter makes sense since the SIM was originally configured in a bilingual country. Configuring the modem to receive MID 4380 might catch a “monthly test” message for further analysis.

• http://rfmw.em.keysight.com/rfcomms/refdocs/gsm/gprsla_gen_bse_sms_cell_broadcast.html#BHADGHEF
• https://itectec.com/spec/16-3a-short-message-service-cell-broadcast-discontinuous-reception-drx/

The data coding scheme is mentioned elsewhere in 3gpp standards. It roughly equates to the character set used in the bytes of the message, whether 7-bit or 8-bit.

https://en.wikipedia.org/wiki/Data_Coding_Scheme

It might be possible to assign a very wide range to the MIDS and DCS on the PinePhone in order to receive an broadcast message in the wild, but it is unclear how this might impact the modem or even modemmmanager since it it not entirely clear how the messages are actually received. However, there is a clue in the EC25 modem manual in section 9.6 “List Messages” where different responses are shown for SMS versus CBM messages in the list. It would seem that the same command lists both types of messages received by the modem, but with different response formats.

https://www.quectel.com/UploadImage/Downlad/Quectel_EC25&EC21_AT_Commands_Manual_V1.3.pdf

Since the response format is different than SMS it is not yet known how modemmanager would respond to them. It is likely that it would produce some kind of warning or error if the modem were configured to allow through a CBM with the CSCB command shown above.

If a CBM message were to be retrieved and made available in modemmanager with some yet to be written software it is unknown what the payload of the message would look like. The current assumptions are that the message would be similar, but perhaps longer than normal SMS. But, we know that systems such as the US WEA might add extra positional information on top. There is no way to be sure about this until enough people have received a CBM on their PinePhone in different countries around the world or the specific 3gpp or other standards can be found that describes it.

Discussion on Cell Broadcast support on Modem Manager is found here: https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/issues/253