A typical pager is about 60 x 40 x 20mm. Much of this volume requirement is driven by the 16mm diameter 34mm long CR123 battery, a lot of it could be empty.
That battery is a relatively safe lithium primary chemistry, not a rechargeable Lithium polymer pounch or lithium ion cylinder that would risk fire and explode if the overpressure vents were omitted and the BMS corrupted, but the primary lasts for years.
I bet you could use a CR1216 battery (1.6mm thin, 30mAh, instead if 34mm long and 1500mAh) instead and have quite a good deal of spare volume in the battery for an explosive. If you filled the entire pager, that would be even more room, but much more easily detected.
I'd be fascinated if that was the physical vector...
However, tainting a component pre-integration seems a lot more likely than simply packing explosive in the case.
Israel inserts the compromised components upstream in the supply chain, they're duly assembled into pagers, which then make their way to Hezbollah, where they're inspected, look normal, and work normally, and are then distributed.
That would still require a firmware hack to presumably trigger though (incoming message stack to component trigger).
Swatch actually used to sell a wristwatch that includes a pager! Battery life was pretty bad though; it came with a keychain accessoire to store a spare CR2032 and a battery swapping tool.
Active mode, 260mA to 790 mA (!)
Modem sleep, 20mA
Light sleep: 0.8 mA
Deep sleep: 10 uA
Hibernate: 2.5 uA
Even with fancy DTIM beacons, Wifi and Bluetooth IoT devices just have a really power-hungry protocol stack and radio system to run.Compare that to something like an STM32U5 microcontroller [2]:
3.1 mA Run mode at 160 MHz
19.5 μA/MHz Run mode at 3.3 V
6.6 µA stop 2 mode with full SRAM
1.7 μA stop 3 mode with 16 Kbyte SRAM
0.5 uA standby mode with RTC
0.3 uA standby mode (24 wakeup pins)
0.1 uA shutdown mode (24 wakeup pins)
And probably more importantly, an actual low-power microcontroller can wake from sleep in something like 4 microseconds, do something for a few cycles, and go back to sleep. Pager protocols are designed for this, putting the pager to sleep for sometimes an hour, and the crystal oscillator restarts the battery-powered device moments before the frame arrives, then goes back to sleep. Conversely, booting up the whole protocol stack on the ESP32 and acquiring a connection can take literally 4 seconds.That results in a power consumption ratio on the order of 100,000,000. ESP32s are not efficient.
[1]: https://lastminuteengineers.com/esp32-sleep-modes-power-cons...
[2]: https://www.st.com/en/microcontrollers-microprocessors/stm32...
Disclosure: my first job was in the Australian Defence Science Technology Organisation, Materials Research Lab, Explosives Instrumentation Group.
Pagers—especially commodity models—aren’t profitable enough to warrant cutting edge tech with the latest advances in microelectronics. Lots of room to improve things if you are making a set of them at a loss.
If they were using a AA battery, replace the battery with something that provides you space to work (e.g. put in a AAAA or button cell that would provide appropriate power but lower capacity) because you don't really care if the battery life drops from months to weeks.
Supplier: “Hey, we’ve got a refreshed model of the pager you wanted to buy in bulk. Interested?”
Buyer: “I don’t know, how do they work?”
Supplier: “Same as the other ones, minus a bit less plastic protection. With the weight savings they’ve added a new hardened receiver that’s supposedly more secure and will keep communications private. Also, they are 50% cheaper per unit…”
Buyer: “Say no more. We’ll take them.”
The internals could be replaced with modern smaller and lower-power equivalents, requiring a smaller battery, and saving enough space.
(Or maybe somebody just donated a batch of innocent-looking devices to 'the cause', or offered a bargain on some 'extra secure' pagers?)