  To receive service in today's cellular architecture, phones uniquely identify
themselves to towers and thus to operators. This is now a cause of major
privacy violations, as operators now sell and leak identity and location data
of hundreds of millions of mobile users.
  In this paper, we take an end-to-end perspective on the cellular architecture
and find key points of decoupling that enable us to protect user identity and
location privacy with no changes to physical infrastructure, no added latency,
and no requirement of direct cooperation from existing operators.
  We describe Pretty Good Phone Privacy (PGPP) and demonstrate how our modified
backend stack (NGC) works with real phones to provide ordinary yet
privacy-preserving connectivity. We explore inherent privacy and efficiency
tradeoffs in a simulation of a large metropolitan region. We show how PGPP
maintains today's control overheads while significantly improving user identity
and location privacy.
