Every tower essentially allows an unauthenticated device to log on as an 'emergency' user to a special 'emergency' APN and grants an IMS connection to the emerg

Every tower essentially allows an unauthenticated device to log on as an 'emergency' user to a special 'emergency' APN and grants an IMS connection to the emergency number (112/911/etc). See: https://www.sharetechnote.com/html/IMS_SIP_PSAP.html https://www.sharetechnote.com/html/IMS_SIP_PSAP.html ("Emergency Call without Normal Registration") My CBRS test networks all have their cells configured to explicitly deny an emergency bearer request for life-safety purposes. As soon as they see the deny they keep moving on to the commercial networks.