Anyone have any idea how cell phones can be tracked? I know it is possible as E911, US Marshalls and others can do it. I am a bounty hunter and private investigator and would really like to be able to do this.
Printable View
Anyone have any idea how cell phones can be tracked? I know it is possible as E911, US Marshalls and others can do it. I am a bounty hunter and private investigator and would really like to be able to do this.
Bounty hunters are evil. Show up at my door and meet
my 12 gauge point blank. BTW, I'm tracking your cell
phone and know your movements 24/7.
:cool:
I would guess most of the time they're less evil than the people they're hunting. However I believe tracking cell phones would be illegal for a civilian to do, so we would not be able to help you with this
Um its simple. Triangulation. Cell towers can tell the company how far away the cell is by its signal strength, but not what direction. Then if there are 3 or more towers in the area they can triangulate the persons exact location.
Quote:
I am a bounty hunter and private investigator and would really like to be able to do this.
Their are a few articles other places on the net.
When you make a call it goes to the nearest cell phone tower. Each cell phone tower has it's own unique number. From this, they know they only get within a so many mile radius(area) but not your exact physical location.Quote:
Cell towers can tell the company how far away the cell is by its signal strength, but not what direction. Then if there are 3 or more towers in the area they can triangulate the persons exact location.
someone went to high school; cell phones don't use three towers at onceQuote:
Triangulation
Acepi > if you are serious about cell phone tracking here's a few topics you should study:
multilateration through GSM localization (I went to college),
cell sites,
base stations,
portable cell sites (in industry these are called COWs "Cell On Whells"),
standard cellular frequencies,
et al
Get yourself a friend whom works for one of the telco company's, they have access to cell phone tracking with a few clicks of there mouse and keyboard. ;)
To all who answered, thank you. As for illegal, so far as I know it is not illegal to do, they just won't put the software out for sale. To rcgreen, we are not evil by birth it comes from the company we keep.
http://www.travelbygps.com/articles/tracking.php
LOL. Maybe it's not yet commonplace, but the technology
is in the phones. It just needs to be activated.
I think that we need a new forum for "CSI/NCIS Mythology" :rolleyes:
If your cellphone has GPS and it is switched on, you can be located. If not then you can't.
Otherwise you can only trace as far as the receive/transmit station and narrow that down by looking at other locations in the vicinity. That will give you an area, given that the phone will lock on to the closest.
Triangulation is feasible. For that you need two scanners to lock on to the same phone at the same time. This is WWII technology :D
I wonder why not?.........................................Quote:
As for illegal, so far as I know it is not illegal to do, they just won't put the software out for sale
Quote:
Originally Posted by The3ntropy
They dont USE three towers at once but they can be seen by more then 3 at any given time. You do hop from tower to tower while on your phone other wise you would have a lot of dropped calls.
If its a radio signal it can be measured in units of strength i.e. DBi. Answer is Triangulation.
And who decides if they do so?Quote:
They dont USE three towers at once but they can be seen by more then 3 at any given time.
The phone surveys the signals. On nokias you can enter a field service mode and see the strength of 3 or 4 towers near by, look at screen 9
http://www.geckobeach.com/cellular/s...crets_6188.php
That is proof that even simple phones query signal strengths continuously.
Hi oofki,
I am in total agreement as to how the actual cellphone works............ it is the possibility of tracing that I am not sure of?
You can scan them, but do they scan you?
:confused:
Sure, they have to make some type of communication with every reachable tower in order to make sure if it becomes the closest tower it will transition the call smoothly. Other wise you would be waiting every time your cell hops towers..
In the united states the FCC requires all wireless carriers to implement Location Based Services (LBS) for E911 use. Most if not all carriers meet this requirement by using Time Difference On Arrival (TDOA) aka multilateration technology. TDOA works as follows:
Base Transceiver Stations (BTS) aka cell towers have both a GPS receiver with them as well as something called a Location Measurement Units (LMU). LMUs measure signal strength of Mobile Stations (MS) aka handsets within range, regardless of whether or not the BTS is currently serving the MS.
All cell towers in a market will send the data collected via LMUs to a Serving Mobile Location Center (SMLC) for that market. The SMLC gathers all signal measurement for all cell towers in their market as well as the long and lat of those cell towers. The SMLC applies TDOA algorithms to the data collected and cross references it with map data they have loaded to determine the location of a MS. How exactly the LMU will get its data tot he SMLC will vary between two options. Option 1 is there is a Lb interface between the BSC for that market and the SMLC which the data is sent over. Option 2 is used when there is no Lb link and relies on a Abis Monitoring System (AMS) to monitor the Abis interface and send the data to the SMLC.
All SMLCs in a market then forward the locations to a Gateway Mobile Location Center (GMLC). A GMLC is used by multiple SMLCs and serves a whole region.
The GMLC will make the data available for applications to connect to it in order to lookup MS locations.
In general, TDOA relies on 3 or more LMUs to determine the location of a MS.
Hacking opportunities from the outside are limited since the LMU works by passively measuring signal strength. If an attacker could compromise the link to the SMLC some interesting opportunities may then present themselves. Getting access to explore those opportunities could be as simple as compromising the physical security of a BTS site. Additionally, access to the SMLC, GMLC, etc. SHOULD be very restricted, but again those restrictions might not be a problem if someone does something along the lines of compromising other parts of the carriers infrastructure that have the access like a BTS.
Quick recap on the overall design. One BTS site has one LMU. Multiple LMUs in a market send their data to a SMLC for the market. Multiple SMLCs for a market will send their data to a GMLC for a region. 3 or more LMUs should be able to measure the signal strength in order to accurately determine the location. Systems will interface with the GMLC to pull locations. These systems might provide a UI for people to use, or might use location information to provide other services.
Something interesting to consider is how this all works for non-traditional telephone service like VOIP and VOIP-like services. I will leave that up for you to play with and explore.
-p
of coarse doing this without the proper authority is illegal. As for the software you are referring, it does not use the systems in place by the wireless carriers. Rather for the most part it requires you to plant a GPS device or is a hoax much like the penis enlargement pills you read about in your e-mail.Quote:
To all who answered, thank you. As for illegal, so far as I know it is not illegal to do, they just won't put the software out for sale.
Remember, telecommunications networks like the wireless carriers running the systems are considered national infrastructure. Messing with them could (of coarse this is dependent on you getting caught and then some) result in some hefty penalties. Wireless carriers are given rather large fines by the FCC for any downtime the location systems have. If you manage to DoS the location services in your exploring, and you manage to get caught, you will likely have charges pressed against you by the wireless carrier to compensate for the FCC fine.
this is in fact not the case. location services used for identifying a MS do not currently use or rely on a GPS radio in the MS itself. More phones in Europe are starting to have GPS radios embedded within and there is talk about building a location system around it but I'm sure it will be backwards compatible with TDOA for when the GPS radio is not functioning correctly.Quote:
If your cellphone has GPS and it is switched on, you can be located. If not then you can't.
sorry, this is just falseQuote:
Otherwise you can only trace as far as the receive/transmit station and narrow that down by looking at other locations in the vicinity. That will give you an area, given that the phone will lock on to the closest.
actually by definition triangulation requires 3 receivers, not two. TDOA algorithms use 3 or more and are essentially performing triangulation as oofki has suggested.Quote:
Triangulation is feasible. For that you need two scanners to lock on to the same phone at the same time. This is WWII technology
-p
have anyone read this article so far?
http://www.tinhat.com/cell_phone/tracking_examples.html
:D
As Winston Churchill observed, we are two nations divided by a common language.:D
No, it is absolutely correct as this service provider explains when suggesting the radii of the circular area of probability:Quote:
Quote:
Otherwise you can only trace as far as the receive/transmit station and narrow that down by looking at other locations in the vicinity. That will give you an area, given that the phone will lock on to the closest.
sorry, this is just false
Again:Quote:
URBAN AREAS
Built up areas and cities such as London, Birmingham, Manchester, Leeds and Glasgow can expect accuracy between 150m to 400m. SUBURBAN AREAS
Suburban areas vary between 450m and 2km
RURAL AREAS
Due to the sparse nature of the operator base stations in rural areas the accuracy can vary from 1.5km to 9km.
Yes it is. If your GPS is on, you certainly can be traced and the accuracy is something like 1 metre. What you have failed to notice is the fact that I used the specific "you" twice in that paragraph? The original poster is a Bounty Hunter? Now, as I understand things, these are people who go looking for those who have violated the terms of their bail?Quote:
Quote:
If your cellphone has GPS and it is switched on, you can be located. If not then you can't.
this is in fact not the case.
So, it seems implicitly logical (to me) that these are specific "you"s rather than just "any sundry cell phone". The bottom line is that if you have GPS or a tracing service you can be located because YOU are identified (hell, you have paid for the service!). If, on the other hand, I went and bought a "pay as you go" cellphone for cash, I would be indistinguishable from all the other cell traffic out there?
Totally incorrect! both mathematically and linguistically :rolleyes:Quote:
actually by definition triangulation requires 3 receivers, not two
A triangle is a geometrical shape determined by three points. Hence, we have a "target" and two towers (receivers). TDOA would be more correctly described as "multiple triangulation" IMO. My reference to WWII technology was as to how they would locate spy/resistance transmissions from a static location. More recently the same methodology has been used to locate pirate radio stations.
Basic "triangulation" only requires two receivers, if you have more, it makes it easier to track a moving target or improves accuracy on a static target because you average out the error margins.
:cool:
You're right, I had that one wrong. Regardless, I had stated previously it uses TDOA aka Multilateration which does require at least 3 receiving units. See http://en.wikipedia.org/wiki/MultilaterationQuote:
A triangle is a geometrical shape determined by three points. Hence, we have a "target" and two towers (receivers).
there absolutely is a circular area of probability the location systems determine someone to be within. However, you are inferring the concept of it only measuring an area around a single BTS. The reference you provided does not support this claim at all. Multilateration, using multiple measuring points (the LMUs at the BTS sites) is what is used to find this circular area. Not, as you suggested, a single BTS.Quote:
No, it is absolutely correct as this service provider explains when suggesting the diameters of the circular area of probability:
are you suggesting that these phones are constantly calculating and uploading their current location to a system within the carrier? Sorry it just doesn't work that way. Read my first post in this thread for a description of how it actually fits together.Quote:
Yes it is. If your GPS is on, you certainly can be traced and the accuracy is something like 1 metre.
this is completely false. location services work just as well for prepaid phones as they do post paid. statements to the contrary are simply ridiculous and would suggest that E911 services would not work for people using prepaid phones (which hopefully everyone here knows isn't true)Quote:
If, on the other hand, I went and bought a "pay as you go" cellphone for cash, I would be indistinguishable from all the other cell traffic out there?
Thank you for an interest in the LBS technology
-p
Hmmmmm,
Strange as it may seem, but I believe that we actually agree?
1. Your "multilateration" is what I would describe as multiple or cross triangulation? Please be aware that I do not use your terminology........... I date back to chucking 105mm pills 11,000 yards or so........ :D
2.
Bad expression on my part old chap!.............. my point was that you needed the initial point of contact as a reference? That will be the tower that the cell is using.Quote:
there absolutely is a circular area of probability the location systems determine someone to be within. However, you are inferring the concept of it only measuring an area around a single BTS
3.
Absolutely not! this is a service that you have to request or initiate. Your emergency call example is a case where this happens automatically? You need the capability, then you need to start it off?Quote:
are you suggesting that these phones are constantly calculating and uploading their current location to a system within the carrier?
4.
Of course they do. I am going back to the fact that the original poster is a Bounty Hunter. You can tell me that a cellphone has dialled 911, and you can tell me approximately where it is located. YOU CANNOT TELL ME WHO DIALLED 911Quote:
this is completely false. location services work just as well for prepaid phones as they do post paid. statements to the contrary are simply ridiculous and would suggest that E911 services would not work for people using prepaid phones (which hopefully everyone here knows isn't true)
Our Bounty Hunter is very interested in the "who" bit?
You are correct. I lost reference as to the original posters intent. As you have suggested it is entirely possible to purchase a prepaid SIM without honestly representing your real identity (here in the states they actually ask your name and address sometimes but they don't verify it is real. if you pay with cash or a prepaid card then there's no problem) and have it's location be discoverable without directly correlating back to your real identity. However, how many of the people the bounty hunter is looking for have actually bothered with this? Probably only a fraction.
Note that more and more carriers are starting to build services for customers on top of the LBS (boost mobile is an example of one mvno doing this). As access to this data and these services gets pushed out closer to the general public, so does potential surface area for attack. Additionally, popular social networking services like http://www.dodgeball.com have people willingly sharing their whereabouts. Dodgeball even bothers to tell you their favorite hangout spots. For a bounty hunter it certainly couldn't hurt to at least look in places like this for info the "target?" is willingly distributing.
-p
The technology is indeed interesting..........years ago I developed a system for routing field service engineers using our postcodes and Ordnance Survey maps.............. your ZIP code and National Cartographic?
OK it is the start of the week and you are obviously in the business so might I give you a couple of funny stories?
1. Police officer friend told me this one.
You can get these GPS maritime distress signal devices? it was Christmas and someone had sent one to a friend?............ rules are rules?........... damn thing went off in the Royal Mail truck that was delivering it..............
Royal Mail truck is proceeding down motorway with an RAF Sea King search and rescue helicopter in hot pursuit.
My police office friend had to stop the truck before the mission could be aborted:D
2. Happened to me............ I am getting a member of staff from another site............ I get a cellphone call from him:
"Johnno, my GPS says that I am here, but I cannot see you?"
Me: "We make weapons of mass destruction, of course you cannot see us"
I then gave him the detailed instructions of how to enter the site :D
Oh well! have a good week!!! :)
Quote:
Originally Posted by Acepi
Too put this politely, YOUR COMPLETELY WRONG. This is completely illegal, without the authority of the company that provides the service to the cell phones. Such as if you tried to track your Gf's Cellphone that would be considered stalking, and you can get major jail time for it. so don't be stupid and try this you'll only end up going to jail.
I was under the impression that employers could install tracking software on a company cell phone as long as they knew it was installed on the device. (Reference: www.hillstone-software.com.) I know this is a grey area especially with the all the data breaches going on as well!
Thank you for all this information . This is a new way to breach information even though the information is usually on DMZs. Very inerested to see of mobile OS hacking proceeds