I've never looked into how this particular comm tech works, but surely the phones would need to explicitly transmit to the satellites? I can't imagine these satellites being able to passively snoop on phones that aren't in the middle of attempting satellite communication.
"Direct to Cell works with existing LTE phones wherever you can see the sky. No changes to hardware, firmware, or special apps are required, providing seamless access to text, voice, and data." ( from https://direct.starlink.com/ )
Seems to imply it looks just like a cellular "cell" to the phone. Which would allow for some amount of snooping.
The Starlink constellation should be able to pinpoint every handset on ground because it forms a huge phased array antenna regardless if you are a customer or not.
Eavesdropping only gets you the TMSI which tells you there's a handset, but doesn't allow track it. If you want an unique identifier (eg. IMSI) you'll have to do a MITM attack.
"So far the theory. If you look at the Paging Channel (PCH) of cells in real-world networks, you see a significant (10-20%) amount of paging requests that contain paging by IMSI. This seems strange on first sight, given the theory..."[1]
So you can't spy on everyone, but you can spy on some subscribers whose phone is in that state.
I think the receiver would need some knowledge of the fact that it’s a satellite. Doppler shift is a physical phenomenon that the baseband would probably have to deal with.
I don't know how the cell phone protocols work really. But as tyingq writes I think the satellites behave like a roaming cellphone tower from the phones point of view. And with roaming the cell towers can call my phone, so I guess some sort of id are sent to them?
