If your phone receives a message with certain data fields properly set, the message will be discarded without becoming visible to the user, or the user visible indication may not be obvious (sending a SMS to indicate there are / are not voicemails). If the sender had requested a delivery report and the carrier (and all intermediaries) forwards the message with the delivery report request intact, and the device sends a delivery report in response, and the carrier forwards the delivery report back to the original sender, the sender may be able to infer something from when they receive the delivery report.
This is a feature the Netherlands police actually uses to track phone locations.
It’s possible to send a “silent sms” to a handset and by doing so you can discover where the receiving handset is located. This is undetectable by the user of the handset unless they use a rooted device and monitor all incoming sms payloads.
I'm kind of surprised that rooting the device allows the user of the device to become aware. It seems like the sort of thing that the baseband layer would handle without passing anything at all to the main OS. At least for the messages designed for stealth. Obviously the messages meant to influence the UI (like voicemail status) need to make their way to the OS.
I assume from the point of view of the baseband processor these are all messages meant to influence the UI, and the silent messages sent by police are an "abuse" of the feature
Anybody can send corrupt messages that the device won't show; getting your phone to send its GPS coordinates is a part of the GSM standard, but only your operator can send that kind of request (or the cops if they stingray you).
