How Surveillance Companies track you using Mobile Networks [video]
media.ccc.de
media.ccc.de
I have watched the stream, it consists of an overview of security holes in SS7 and newer protocols. The vulnerabilities are either blocked by the ISP, or not blocked but require the attacker to have a lot of information about the target. An exception to this is https://simjacker.com/ which is unlikely to be blocked and only requires the full phone number of the victim.
An interesting point in the talk was the missing "economy of scale" in the pricing system of the surveillance companies. If you want to spy on more victims, the costs rises exponentially, because it becomes more likely that the attacker will be blocked by the ISP.
ref: https://webcache.googleusercontent.com/search?q=cache:https:...
No clue if this presentation covers this, as the video is still unavailable.