Having a little bit of experience in the telco industry, I could really say a lot of this topic even without knowing the details of the hacks. For instance on

Having a little bit of experience in the telco industry, I could really say a lot of this topic even without knowing the details of the hacks. For instance on the IMSI catcher, from what I understood they are a form of MIM attack where a fake base station connect to your phone and forces it to switch to non-encrypted mode. Why non-encrypted mode exists? Well, in the past (20 years or more) encryption was expensive and base station huge and bulky, none believed it was a conceivable attack. So they introduced a signal to switch of encryption to increase capacity in emergency. Now you could trick cellphone to switch to un-encrypted and intercept traffic. Why this vulnerability hasn't been closed? Many reasons, first of all even if base station are no longer configured to support this mode, they should accept unencrypted traffic for inter-operability and the same it's for phones. Furthermore, it makes a lot easier to implement devices like personal base station to enhance network coverage in buildings. Also, there's the "next gen" bug. It is almost 8 years that telco company think about 4th gen technology, the LTE network and VoLTE. This is an paper a totally new systems built with new technology and new threat model in mind. It is not perfect but far better. The issue? Implementation took longer than expected (as usual) and none want to spend money and time in fixing something that will be replaced. Sounds familiar?