All Rights Reserved—John B. Minor

    Home      About       Articles        Graphics/FAQ’s       Recent Projects         Areas of Expertise         Contact

A Litigators Guide to Historical Cell Phone Location Evidence – Centroids & Working Range

 

 

Cell phone usage and cell phone location tracking data has become important evidence in many civil and criminal cases today. Using cell phone carrier Call Detail Records (CDR’s), which contain numbers called, date and time of calls, and the cell tower and sector or cell from which each call was placed, investigators often determine whether an individual's cell phone was in the vicinity of an event related to a civil or criminal case. In some instances determination of how close to the event location the cell phone was actually located is crucial to an individual's culpability.

 

Two technical terms are sometimes used by experts when describing historical cell phone location tracking, Centroid and Working Range.

 

THE CENTROID CONCEPT

 

Generally speaking, a cell or sector, or one antenna face of a cell tower, is viewed by the cellular industry for location determination purposes as a centroid. A centroid is the calculated algorithmic center of the cell or sector.

 

A geographic centroid of each cell's coverage is stored in a Base Station Almanac (BSA) which is a component database of the cell phone carrier's Location Based Services that stores an “almanac” or database of the GPS coordinates of the cell towers within the location area code (LAC). The centroid location coordinates are used in live cell phone location tracking for an initial position estimate until more accurate cell phone location results are obtained during the live location calculation process which is called an Idle Mode Query (IMQ). A centroid is sometimes the location referred to by carrier engineering employees when reviewing Call Detail Records historical location data.

 

 

CENTROID.bmp 

 

Cell Centroid

 

A centroid is only the general area location of a cell phone in either live or historical cell phone location tracking. The area of the cell or sector corresponding to a centroid can vary from less than 2 square miles to over 10 square miles.

 

 

WORKING RANGE

 

The ability for a cell phone to place a call using a specific cell tower, known technically as a Base Transceiver Station, within the carrier’s network depends on the working range of the cell tower and the cell phone's proximity to other cell tower sites in the network. Working Range is affected by 3 major factors: Topography, Capacity & Network Architecture. These factors are taken into consideration during the planning and design phase of the cellular network. A so-called "drive test, walk test or capacity test" during the implementation testing phase is accomplished by technicians literally driving, walking or capacity load testing around the area of each cell tower using sophisticated radio reception gear to determine the quality of implementation.

 

An optimization and verification routine follows the drive test. Several parameters may be adjusted according to priorities determined during the network design phase.

 

Topography

 

The topographical features within the geographical area of a cell tower’s intended coverage is carefully calculated to ensure minimal signal fading during a call. The significance of hills, valleys, ravines and other topographic features must be evaluated and the network architecture designed so as to minimize dropped call traffic or cell phone call handover issues.

 

Capacity

 

Capacity planning involves consideration of the volume of anticipated call traffic associated with the expected population density of a geographical area. The call traffic in high capacity public venues is predicted and network equipment capacity adjusted to accommodate the call traffic volumes.

 

Network Architecture

 

The following list of specifications are typically reviewed and adjusted during the cell tower design phase before construction:

 

             Radio Frequency (RF) coverage interference reduction design factors:

                   

Antenna Type Used in cell tower construction

Configured Antenna Height

Configured Antenna Azimuth

Configured Antenna Downtilt

 

The antenna type will determine the radio communications beam width, the antenna's gain factor, and the polarity orientation of the antenna. The antenna placement height will be one factor in determining the distance radio communications will reach from the cell tower. The azimuth or compass orientation of the antenna will determine the coverage direction of the antenna once mounted on the cell tower. Antenna down tilt is used as another means of controlling the distance communications will reach from the cell tower.

 

The following list of parameters is often reviewed and adjusted during implementation and testing prior to placing the cell tower into service:

 

             Cell Phone Call Handover Parameters:

 

Active Set Size (WCDMA/UMTS/GSM)

Handover Thresholds

Handset Handover Parameters

 

The design of a cell tower relative to neighboring cell tower is critical to optimizing handover issues. A poor design can result in cell phones switching cell tower frequently thereby destabilizing the network and reducing call quality. A cell or sector overlap factor of no more than 30% is the normal design criteria and an active set size of 2-4 cells in UMTS networks is the average to assure network stability.

 

             Network Equipment Parameters:

 

Transmitter Power Setting

Channel Assignment

Admission or Overload Control Settings

 

 

Cell Phone Communications Capability

 

Another important factor in determining working range is the transmission capability of each cell phone connecting to the carrier network. Handset or Cell Phone Communications Specifications and Handset Radio Power Specifications must be considered during the calculation of working range. The chart below illustrates the maximum output power of several types of cell phones.

 

 

 Cell Phone Radio Output Power Chart.bmp

Chart Exhibiting Maximum Output of Different Cell Phone Types

 

Maximum Working Range

 

Maximum Working Range can be calculated by using known antenna heights, antennae gain, output power, and frequency in use to access the cellular network, and cable loss, structure and foliage attenuation factors. The example below calculates the theoretical attenuation or path loss out to 5.6 Kilometers or 3.5 Miles for 1900 Mhz cell phone to cell tower communications.

 

RF Path Loss Calc.JPG

 

Calculated Theoretical Working Range

 

Maximum Working Range is visualized in a carrier’s “best coverage” or radio frequency propagation maps. These maps normally exhibit the extent of coverage but do not account for the factors mentioned above including the normal overlap factor of up to 30% between cell towers, call traffic redirection caused by cell tower call traffic loading issues or carrier network component downtime factors.

 

RF Propagation Map.jpg 

 

 

Example Best Coverage Map Demonstrating Maximum Working Range

 

Growth of the cellular network requires planning to deploy new cell tower sites using a carefully calculated geographic Search Area for each new site. Real estate for the new cell tower site is sought within the Search Area.

 

Cell Phone Handoff - Search Area Determination Illustration.JPG

 

Carrier Network Design Accounts for Sector Overlap & Cell Phone Handoff Zones

 

The Search Area mentioned in the above graphic is only used during planning for a new cell tower deployment. The geographical “search area” radius determines the region within which a new cell tower must be located to function optimally within the network. According to telecommunications master planner CityScape Consultants, Inc., “Generally accepted cellular engineering principles define a search area for new cells as a circle of one-quarter radius of the design coverage area of the proposed cell, centered at the perfect location. Thus, for a base station proposed to cover two miles, a radio frequency (RF) engineer studies the grid to determine the desired antenna location and issues coordinates containing a circle one-half mile in radius to a real estate consultant to search for the new site”. Sector Overlap & the resulting Cell Phone Handoff Zones are also calculated during the planning for new cell tower placement but can vary depending on some of the factors mentioned earlier in this article. The calculations are potentially important factors in determining the theoretical Working Range of a cell phone during an actual call.

 

Calculation techniques for network planning account for the variety of interference or attenuation factors expected during actual network operations. Calculation methodologies include the Okumura or Hata formulas (named after their creators) or COST-231 and have proven to be accurate predictors of network performance.

 

The chart below illustrates the numerically calculated cell tower radius, Cell Phone Handoff Allowance radius, and the Search Area calculation for both the 850Mhz and 1900Mhz frequencies. Note that the higher the operating frequency the shorter the potential operating radius and cell phone handoff zone radius.

 

Okumura-Hata-COST 231 Range Calculations.JPG

 

Network Planning Calculations Include Maximum Working Range & Cell Phone Handoff Allowances

 

 

MEANWHILE…BACK AT THE OMC

 

Once the cell tower is in service the maintenance and configuration of handover parameters, equipment parameters and other essential components of the cellular network are managed through the network Operations & Maintenance Center (OMC) by Network Engineering department personnel.

 

All voice and data traffic within the cellular network are documented by logging recorded on a variety of devices that are consistently the same components from carrier to carrier such as the Equipment Identity Register, the Home Location Register, the Visitor Location Register, the Authentication Center, the Location Based Services Server, the Short Message Service Center and the Mobile Switching Center.

 

The graphic below illustrates both the flow of a cell phone call and the various activity logging points in the cellular network during the call. Note that the GMSC or Gateway Mobile Switching Center would be the jump off point to another carrier’s network when inter-carrier calls are placed.

 

Cellular Logging Devices Diagram.bmp

Cellular Network Logging Devices Diagram

 

 

The maintenance and configuration activities occurring at the OMC are logged extensively on a continuous basis. An alarm system notifies OMC personnel monitoring the network of any network outages. Alarm notifications require varying responses depending on the nature of the alarm. The alarm logging data can be examined for historically significant events near an event location.  This logging activity results in potentially important activity and maintenance records and can prove to be valuable evidence in a criminal or civil case.

 

Cell Carrier MNOC Alarm Logging.bmp

 

Example Carrier Network Alarm Logging Exhibiting Cell Sites and Sectors Down

 

 

 

Manufacturers such as Nokia, Ericsson and others provide cell phone carrier infrastructure electronics equipment. Although the equipment may differ in brand the litigation team should bear in mind that the fundamentals are the same from carrier to carrier. Some fundamental differences will be encountered between AMPS/CDMA (Sprint & Verizon) and GSM (AT&T and T-Mobile) foundation carrier networks. Always consult a communications expert for clarification of these differences.

 

Dynamic factors such as weather conditions and the region’s general climate can affect the carrier’s network stability or Working Range of a cell tower’s sectors.

 

Significant public events that may have affected call traffic loading, historical weather conditions that may have destabilized the carrier network, and planned maintenance by the carrier that may have redirected call traffic should be considered in an effort to validate the Working Range of specific cell phone calls.

 

Cell tower or Sector downtime caused by the environment or improper network tuning caused by the carrier, which results in dropped calls or other coverage lapses, can affect the stability of a carrier’s network. These dynamic factors should be reviewed to verify the possibility of carrier network instability during an event timeline.

 

The litigation team should be aware that network driven churn, known otherwise in the industry as subscriber loss from dropped calls, results from carrier network instability issues and carriers typically resist the public release of evidence that demonstrates any network instability.

 

A Communications Expert should be consulted before attempting to request any of the cell phone carrier evidence referenced in this article.

 

John B. Minor, CSA CCE CSE

Communications Expert

 

About the Author – John B. Minor is a practicing communications expert, cell phone signals analyst, digital Investigator and forensic examiner. John has leveraged huge successes for litigation teams by locating digital evidence under unusual scenarios. John’s casework takes his expertise to the corners of the globe in a variety of investigations ranging from terrorism threats to corporate financial fraud and to more common civil and criminal venues including homicides. See http://johnbminor.com for more information about Mr. Minor.

 

References:

 

Qualcomm University Course Textbooks – “Network Planning” & “End-to-End Location Based Services”

 

http://w3.antd.nist.gov/wctg/manet/calcmodels_r1.pdf

 

Telecommunications Master Plan documents produced by CityScape Consultants, Inc., for various communities.

 

dBm Chart Illustration - Wikipedia.org

 

 

Bookmark and Share