You can use cyphertext inside the plaintext. Seems to be what they are doing.

You still have the metadata of sender and receiver. Your whole network is exposed.

Also your message limits are 200 characters and likely highly susceptible to correlation attacks.

Pagers are one-way, not bidirectional like cell networks. That's their whole point. Their HQ can broadcast a message and you won't find out who is the receiver, because pagers don't transmit, only listen.

I never said they were two-way. I said you have the metadata of the sender and the receiver.

The page data contains the receiver/pager address, but remember this is RF. Triangulating source of transmission on a frequency you are actively monitoring is table stakes for nation states.

Once you flag receiver addresses there are techniques to work out who that party is, especially for a nation state sophisticated enough to intercept the supply chain in the first place. Correlating transaction data to people is tedious but doable. Even with receiver addresses only though you can work out how the network works and what cells there are and that's a ton of useful intelligence already.

Also if the "code" being used was in any way breached it could be used to trick receivers into self-identifying.

Israel just skipped all of that effort with "ring ring, boom" though.

sure. But everything over cell network is anyway more or less already exposed on the metadata front so why not go "low tech" ?

And yeah it probably was more a "code" than cyphertext.

Let's be fair. This is probably the communication channel for grunts that command doesn't give a shit about and they're using E2EE apps for command and this for grunts.

Oh yes most definitely. Pagers are usually used this way in all of the other uses anyway (to quickly contact and inform ground actions like in emergency services).