Well it can't be entirely passive for time-sensitive/comprehensive monitoring, because telemetric data won't cross one of their numerous tap points unless the t

Well it can't be entirely passive for time-sensitive/comprehensive monitoring, because telemetric data won't cross one of their numerous tap points unless the target is roaming or the target's carrier is being queried by a roaming partner (or partner of a partner of a...). I'm sure they've got taps inside of major carriers, but I doubt they're inside every network. Considering how regularly ss7 is abused for criminal/commercial activity, they may not have to do much active probing for intra-network monitoring - but the barrier to entry is so low that it would be silly for them not to front a carrier with direct access. I can accept the excuse that ss7 was designed for a world with a few trusted carriers, but the latest stuff (that isn't even backwards compatible) has the exact same class of security flaws. The only rational explanation for the obviously insecure standard defining LTE RRC connection setup (base station control, no mutual auth, no crypto, identifying info in the clear - often with lat/lon) is intentional design. So the argument that the leak had any operational impact sounds pretty silly to me, but I won't deny that it caused serious embarrassment to people who really don't take criticism well.