The tunnels between carriers could be encrypted. They don't _have_ to be. The LTE S1 link (eNodeB <-> packet core) may not be. Like, if your eNB is a picocell

The tunnels between carriers could be encrypted. They don't _have_ to be. The LTE S1 link (eNodeB <-> packet core) may not be. Like, if your eNB is a picocell or feeding a DAS, it probably is doing backhaul over IPSec over internet or dedicated circuit, but if it's normal carrier network, likely not. ref Page 37 of https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-187.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.S...