TAG:

<META NAME="ROBOTS" CONTENT="INDEX, FOLLOW, ARCHIVE" />

    Home      About       Articles        Graphics/FAQ’s       Recent Projects         Areas of Expertise         Contact

Cell Phone “Pinging” for Real-Time Location Tracking: Fact or Fiction

 

By John B. Minor, CSA CCE CSE, Communications Expert

 

Throughout the cyber-world myths abound regarding the ability to “ping” a cell phone and determine its real-time geographic location. Virtually all cell phone carriers worldwide have implemented location based services (LBS) to the carrier’s subscriber base. The primary purpose of LBS on a carrier network is twofold. 1) In the USA and some other countries LBS is used for emergency services to locate the cell phone thereby locating the subscriber during an emergency and 2) LBS provides geo-location mapping services for subscribers needing directions to a location such as a shopping destination or where a friend is located. Geo-locating a cell phone can occur only under specific circumstances because the LBS portals do not readily give up location information publicly due to privacy concerns.

 

A cell phone can be located real-time using a procedure called an "idle mode query" (IMQ). Cell phones operate on multiple channels, one of which is a voice channel, but other control channels include paging, pilot and synchronization channels, of which cell phone subscribers are unaware, are streaming data about the cell phone, the carrier network condition and communications conditions.  Within the United States, in only four scenarios can lawful real-time cell phone tracking of geographical location occur outside of the U.S. intelligence community and the Patriot Act’s Carnivore/DCS1000 lawful intercept tool capabilities.

 

Sadly, some investigative companies claim to be able to perform real-time “ping” geo-location tracking of almost any cell phone. Uninformed buyers are often told that the cell phone is “being pinged” but has not answered and expenditures for these scams, ranging up to hundreds of dollars, are seldom refunded.

 

Lawful Cell Phone Real-Time Tracking Scenarios
  
Scenario 1: During an E911 call from a cell phone the geo-location of the device is determined and transmitted to the 911 call center. Documentation or evidence of the geo-location event is available under the Freedom of Information Act. The reported location varies from a few feet to several square miles depending on which cell phone carrier is involved, the number of cell sites in the general vicinity of the cell phone and, finally, the geo-location calculation technique successfully employed during the location calculation.

 

 

E911 Cell Phone Location Tracking Example

 

Scenario 2: Federal Law Enforcement can perform real-time geo-location tracking, under minimal judicial supervision, using carrier portals available only to Federal Law Enforcement. For example, Sprints Law Enforcement Portal performed over 8 million real-timelocates in 2008.

 

Example of U.S. Law Enforcement Real-Time Cell Phone Tracking

 

Scenario 3: Declaration of exigent circumstance to the carrier can escalate the IMQ to immediate for LE or others with the technical knowledge and authority to act (this example would be an emergency locate for a missing person’s cell phone).

 

Example of E911 Idle Mode Query Cell Phone Real-Time Locate

(Note that the screen depicted on the left is the actual Sprint Exigent Circumstance Query Interface) 

 

Scenario 4: Location based services are in use by all carriers and, depending on the cell phone model and applications in use on the cell phone, real-time geo-locates can occur during regular usage and can thus be utilized to perform a real-time locate on the cell phone by anyone gaining access in this manner including friends, investigators and criminal stalkers. Example applications are the family plan locate services offered by carriers, social networking applications that, if enabled, allow a real-time locate to occur, and the iPhone/MobileMe or iPhone finder app, if in use. Real-time and historical trend geo-location tracking is a very real possibility when social network applications such as MotionX, Facebook Places, Foursquare.com, Gowalla.com and Scvngr.com.  Geotagging photos from a mobile and then uploading the images to Flickr or Picasa can also result in historical trend geo-location tracking. A relatively unsophisticated perpetrator can figure out where a target lives, works, socializes and much more using simple trending analysis techniques.

 

Loopt provides cell phone based GPS social network sharing that enables subscribers to visualize each other’s location and share information.

The U.S. military statement regarding the social networking media that “something as simple as loading a photo of your bunk in Afghanistan to Flickr, then geotagging it, can bring a mortar right into your area of operation” should be considered a warning that criminal elements can determine where someone works and lives and perform real-time tracking of a person’s movements in some cases.

 

Example of iPhone Google Mapping Exhibiting the Location of the Cell Phone During Travel

 

 

Example of Cellular Carrier Commercial Cell Phone Real-Time Locator Services

 

 

Although cell phone carrier location based services are active 24/7 the servers prevent outside unauthorized access to location based services by responding only to authorized or properly coded and encrypted requests.

 

Private investigators often use social engineering or “pretext” techniques to fool a cell phone user into providing an address or divulging a current location. These techniques involve sending false SMS text messages or voice calls to the cell phone declaring the cell phone user a major prize winner or the recipient of lost funds or an inheritance.

 

Some private investigators engage in cell phone location “pings” charging for the search even when no location result is returned.

This type of cell phone “ping for location” service is, at best, unethical and will not produce any useful results but will cost an unwitting consumer.

 

 

Unlawful Cell Phone Real-Time Tracking Scenarios

 

Scenario 1: Unlawful tracking of cell phone geo-location can occur if spyware has been installed in a cell phone, usually without the users consent. As a side note, most cell phone spyware infections occur when the user surrenders physical possession of the cell phone for a few minutes but can also occur if an email or other communications message infected with the spyware installer is accessed by the subscriber.

Scenario 2: Although several software vendors and investigators claim to be able to remotely access a cell phone via the Bluetooth communications port this technique more often ends in failure. Many newer cell phone models have security activated on Bluetooth ports thereby preventing immediate access to data via Bluetooth.

 

If the cell phone is in another country then access to location based services varies depending on local law and who is performing the query. For example, the Honduran Anti-Kidnapping Task Force or Grupo Especial Anti-Secuestro (GEAS), a covert national police force, used a communications expert to learn about real-time location tracking to locate kidnappers demanding ransom has wide latitude in performing. This group gains direct access to location based services by appearing at carrier switch centers armed with cell phone numbers and weapons to obtain full access to location based services inquiries.

 

In the European Union privacy is assured by EU Directive 95/46/EC, and in many other countries privacy protection laws prevents easy access to cellular location based services (LBS) records.

 

 

About the Author – John B. Minor is a practicing communications expert, cell phone signals analyst, digital Investigator and forensic examiner. John has leveraged major successes for litigation teams by locating digital evidence under unusual scenarios. John’s casework takes his expertise to the corners of the globe in a variety of investigations ranging from terrorism threats to corporate financial fraud and to more common civil and criminal venues including homicides. See http://johnbminor.com for more information about Mr. Minor.