I'm surprised cell towers can't tell connected phones what the local emergency number is, and then dial that instead when 911 isn't working correctly.

That sounds like a MITM attack waiting to happen.

Isn't that exactly what cops or others do when they use a Stingray phone tracker and intercept people's mobile phone connections?

I still remember in late 2013/early 2014 when I lived in Kyiv, Ukraine, and my friends at the Maidan protest against the government said everybody within geographic proximity of the protest received SMS messages from an unlisted number telling them their protest wasn't 'legal'. Everybody assumed it was the Ukrainian government security forces using a Stingray or similar device as a MITM between their devices and the network.

The thing is if the tower is serving a lot of people you could end up sending the message to people not involved so you could use a IMSI catcher (you can even make them out of a TV Tuner turned SDR receiver[0]) to catch IMSI's in a smaller area or use triangulation to narrow down the pool of devices in an area and then use that list to send SMS from the network itself.

The UK did trails of using location based text messages back in 2013 in order to be used for Public emergency alerts [1]

When you can gain access to the network their is no real need to MITM it, but yeah I believe a sting ray type device could also do the same as they act as a tower and trick your phone into connecting to it.

[0] https://github.com/Oros42/IMSI-catcher

[1] https://www.gov.uk/government/publications/mobile-alerting-t... (link to the info about the trial and the final report)