This kind of device matching can be done across any of the carriers or their MVNOs, all of them give up the data when asked by a government entity. Many tower locations will even be identical across carriers, making the matching even easier.

Also this correlation could be done with stingray towers without bringing the cell carriers into the loop.

With the higher clustered protestors the tower linking won't be as identifiable as you might think.

It may take longer to get enough samples to filter out unwanted user associations but if you have all the data points from every tower retroactively over ~10 weeks of protest it's going to be difficult to hide.

I don't think gp here is in china, but rather just offering their procedure for acquiring a burner phone.

Depends on the standard of proof that is required.

Just to clarify - I have nothing to do with HK or the riots going. I am just stating that I was able to use my somewhat "burner" setup to register the App. What happens after that is whole different story.