track cell phones?

[oofki]

someone went to high school; cell phones don't use three towers at once

They dont USE three towers at once but they can be seen by more then 3 at any given time. You do hop from tower to tower while on your phone other wise you would have a lot of dropped calls.

If its a radio signal it can be measured in units of strength i.e. DBi. Answer is Triangulation.

[nihil]

They dont USE three towers at once but they can be seen by more then 3 at any given time.

And who decides if they do so?

[oofki]

The phone surveys the signals. On nokias you can enter a field service mode and see the strength of 3 or 4 towers near by, look at screen 9
http://www.geckobeach.com/cellular/s...crets_6188.php

That is proof that even simple phones query signal strengths continuously.

[nihil]

Hi oofki,

I am in total agreement as to how the actual cellphone works............ it is the possibility of tracing that I am not sure of?

You can scan them, but do they scan you?

[oofki]

Sure, they have to make some type of communication with every reachable tower in order to make sure if it becomes the closest tower it will transition the call smoothly. Other wise you would be waiting every time your cell hops towers..

[liquidfish]

In the united states the FCC requires all wireless carriers to implement Location Based Services (LBS) for E911 use. Most if not all carriers meet this requirement by using Time Difference On Arrival (TDOA) aka multilateration technology. TDOA works as follows:

Base Transceiver Stations (BTS) aka cell towers have both a GPS receiver with them as well as something called a Location Measurement Units (LMU). LMUs measure signal strength of Mobile Stations (MS) aka handsets within range, regardless of whether or not the BTS is currently serving the MS.

All cell towers in a market will send the data collected via LMUs to a Serving Mobile Location Center (SMLC) for that market. The SMLC gathers all signal measurement for all cell towers in their market as well as the long and lat of those cell towers. The SMLC applies TDOA algorithms to the data collected and cross references it with map data they have loaded to determine the location of a MS. How exactly the LMU will get its data tot he SMLC will vary between two options. Option 1 is there is a Lb interface between the BSC for that market and the SMLC which the data is sent over. Option 2 is used when there is no Lb link and relies on a Abis Monitoring System (AMS) to monitor the Abis interface and send the data to the SMLC.

All SMLCs in a market then forward the locations to a Gateway Mobile Location Center (GMLC). A GMLC is used by multiple SMLCs and serves a whole region.

The GMLC will make the data available for applications to connect to it in order to lookup MS locations.

In general, TDOA relies on 3 or more LMUs to determine the location of a MS.

Hacking opportunities from the outside are limited since the LMU works by passively measuring signal strength. If an attacker could compromise the link to the SMLC some interesting opportunities may then present themselves. Getting access to explore those opportunities could be as simple as compromising the physical security of a BTS site. Additionally, access to the SMLC, GMLC, etc. SHOULD be very restricted, but again those restrictions might not be a problem if someone does something along the lines of compromising other parts of the carriers infrastructure that have the access like a BTS.

Quick recap on the overall design. One BTS site has one LMU. Multiple LMUs in a market send their data to a SMLC for the market. Multiple SMLCs for a market will send their data to a GMLC for a region. 3 or more LMUs should be able to measure the signal strength in order to accurately determine the location. Systems will interface with the GMLC to pull locations. These systems might provide a UI for people to use, or might use location information to provide other services.

Something interesting to consider is how this all works for non-traditional telephone service like VOIP and VOIP-like services. I will leave that up for you to play with and explore.


-p

[liquidfish]

To all who answered, thank you. As for illegal, so far as I know it is not illegal to do, they just won't put the software out for sale.

of coarse doing this without the proper authority is illegal. As for the software you are referring, it does not use the systems in place by the wireless carriers. Rather for the most part it requires you to plant a GPS device or is a hoax much like the penis enlargement pills you read about in your e-mail.

Remember, telecommunications networks like the wireless carriers running the systems are considered national infrastructure. Messing with them could (of coarse this is dependent on you getting caught and then some) result in some hefty penalties. Wireless carriers are given rather large fines by the FCC for any downtime the location systems have. If you manage to DoS the location services in your exploring, and you manage to get caught, you will likely have charges pressed against you by the wireless carrier to compensate for the FCC fine.

If your cellphone has GPS and it is switched on, you can be located. If not then you can't.

this is in fact not the case. location services used for identifying a MS do not currently use or rely on a GPS radio in the MS itself. More phones in Europe are starting to have GPS radios embedded within and there is talk about building a location system around it but I'm sure it will be backwards compatible with TDOA for when the GPS radio is not functioning correctly.

Otherwise you can only trace as far as the receive/transmit station and narrow that down by looking at other locations in the vicinity. That will give you an area, given that the phone will lock on to the closest.

sorry, this is just false

Triangulation is feasible. For that you need two scanners to lock on to the same phone at the same time. This is WWII technology

actually by definition triangulation requires 3 receivers, not two. TDOA algorithms use 3 or more and are essentially performing triangulation as oofki has suggested.


-p

[yatot]

have anyone read this article so far?

http://www.tinhat.com/cell_phone/tracking_examples.html

[nihil]

As Winston Churchill observed, we are two nations divided by a common language.

Quote:
Otherwise you can only trace as far as the receive/transmit station and narrow that down by looking at other locations in the vicinity. That will give you an area, given that the phone will lock on to the closest.
sorry, this is just false

No, it is absolutely correct as this service provider explains when suggesting the radii of the circular area of probability:

URBAN AREAS
Built up areas and cities such as London, Birmingham, Manchester, Leeds and Glasgow can expect accuracy between 150m to 400m. SUBURBAN AREAS
Suburban areas vary between 450m and 2km
RURAL AREAS
Due to the sparse nature of the operator base stations in rural areas the accuracy can vary from 1.5km to 9km.

Again:

Quote:
If your cellphone has GPS and it is switched on, you can be located. If not then you can't.
this is in fact not the case.

Yes it is. If your GPS is on, you certainly can be traced and the accuracy is something like 1 metre. What you have failed to notice is the fact that I used the specific "you" twice in that paragraph? The original poster is a Bounty Hunter? Now, as I understand things, these are people who go looking for those who have violated the terms of their bail?

So, it seems implicitly logical (to me) that these are specific "you"s rather than just "any sundry cell phone". The bottom line is that if you have GPS or a tracing service you can be located because YOU are identified (hell, you have paid for the service!). If, on the other hand, I went and bought a "pay as you go" cellphone for cash, I would be indistinguishable from all the other cell traffic out there?

actually by definition triangulation requires 3 receivers, not two

Totally incorrect! both mathematically and linguistically

A triangle is a geometrical shape determined by three points. Hence, we have a "target" and two towers (receivers). TDOA would be more correctly described as "multiple triangulation" IMO. My reference to WWII technology was as to how they would locate spy/resistance transmissions from a static location. More recently the same methodology has been used to locate pirate radio stations.

Basic "triangulation" only requires two receivers, if you have more, it makes it easier to track a moving target or improves accuracy on a static target because you average out the error margins.

[liquidfish]

A triangle is a geometrical shape determined by three points. Hence, we have a "target" and two towers (receivers).

You're right, I had that one wrong. Regardless, I had stated previously it uses TDOA aka Multilateration which does require at least 3 receiving units. See http://en.wikipedia.org/wiki/Multilateration

No, it is absolutely correct as this service provider explains when suggesting the diameters of the circular area of probability:

there absolutely is a circular area of probability the location systems determine someone to be within. However, you are inferring the concept of it only measuring an area around a single BTS. The reference you provided does not support this claim at all. Multilateration, using multiple measuring points (the LMUs at the BTS sites) is what is used to find this circular area. Not, as you suggested, a single BTS.

Yes it is. If your GPS is on, you certainly can be traced and the accuracy is something like 1 metre.

are you suggesting that these phones are constantly calculating and uploading their current location to a system within the carrier? Sorry it just doesn't work that way. Read my first post in this thread for a description of how it actually fits together.

If, on the other hand, I went and bought a "pay as you go" cellphone for cash, I would be indistinguishable from all the other cell traffic out there?

this is completely false. location services work just as well for prepaid phones as they do post paid. statements to the contrary are simply ridiculous and would suggest that E911 services would not work for people using prepaid phones (which hopefully everyone here knows isn't true)

Thank you for an interest in the LBS technology

-p