TAG: <META NAME="ROBOTS" CONTENT="INDEX, FOLLOW, ARCHIVE" /> |
Home About Articles Graphics/FAQ’s Recent Projects Areas of Expertise Contact |
Cell Phone “Pinging” for Real-Time Location Tracking: Fact or Fiction
By John B. Minor, CSA CCE CSE, Communications Expert
Throughout the cyber-world myths abound regarding the ability to “ping” a cell phone and determine its real-time geographic location. Virtually all cell phone carriers worldwide have implemented location based services (LBS) to the carrier’s subscriber base. The primary purpose of LBS on a carrier network is twofold. 1) In the USA and some other countries LBS is used for emergency services to locate the cell phone thereby locating the subscriber during an emergency and 2) LBS provides geo-location mapping services for subscribers needing directions to a location such as a shopping destination or where a friend is located. Geo-locating a cell phone can occur only under specific circumstances because the LBS portals do not readily give up location information publicly due to privacy concerns.
A cell phone can be located real-time using a procedure called an "idle mode query" (IMQ). Cell phones operate on multiple channels, one of which is a voice channel, but other control channels include paging, pilot and synchronization channels, of which cell phone subscribers are unaware, are streaming data about the cell phone, the carrier network condition and communications conditions. Within the United States, in only four scenarios can lawful real-time cell phone tracking of geographical location occur outside of the U.S. intelligence community and the Patriot Act’s Carnivore/DCS1000 lawful intercept tool capabilities.
Sadly, some investigative companies claim to be able to perform real-time “ping” geo-location tracking of almost any cell phone. Uninformed buyers are often told that the cell phone is “being pinged” but has not answered and expenditures for these scams, ranging up to hundreds of dollars, are seldom refunded.
Lawful Cell Phone Real-Time Tracking Scenarios
E911 Cell Phone Location Tracking Example
Example of U.S. Law Enforcement Real-Time Cell Phone Tracking
Scenario 3: Declaration of exigent circumstance to the carrier can escalate the IMQ to immediate for LE or others with the technical knowledge and authority to act (this example would be an emergency locate for a missing person’s cell phone).
Example of E911 Idle Mode Query Cell Phone Real-Time Locate (Note that the screen depicted on the left is the actual Sprint Exigent Circumstance Query Interface)
Loopt provides cell phone based GPS social network sharing that enables subscribers to visualize each other’s location and share information. The U.S. military statement regarding the social networking media that “something as simple as loading a photo of your bunk in Afghanistan to Flickr, then geotagging it, can bring a mortar right into your area of operation” should be considered a warning that criminal elements can determine where someone works and lives and perform real-time tracking of a person’s movements in some cases.
Example of iPhone Google Mapping Exhibiting the Location of the Cell Phone During Travel
Example of Cellular Carrier Commercial Cell Phone Real-Time Locator Services
Although cell phone carrier location based services are active 24/7 the servers prevent outside unauthorized access to location based services by responding only to authorized or properly coded and encrypted requests.
Private investigators often use social engineering or “pretext” techniques to fool a cell phone user into providing an address or divulging a current location. These techniques involve sending false SMS text messages or voice calls to the cell phone declaring the cell phone user a major prize winner or the recipient of lost funds or an inheritance.
Some private investigators engage in cell phone location “pings” charging for the search even when no location result is returned. This type of cell phone “ping for location” service is, at best, unethical and will not produce any useful results but will cost an unwitting consumer.
Unlawful Cell Phone Real-Time Tracking Scenarios
Scenario 1: Unlawful tracking of cell phone geo-location can occur if spyware has been installed in a cell phone, usually without the users consent. As a side note, most cell phone spyware infections occur when the user surrenders physical possession of the cell phone for a few minutes but can also occur if an email or other communications message infected with the spyware installer is accessed by the subscriber. Scenario 2: Although several software vendors and investigators claim to be able to remotely access a cell phone via the Bluetooth communications port this technique more often ends in failure. Many newer cell phone models have security activated on Bluetooth ports thereby preventing immediate access to data via Bluetooth.
If the cell phone is in another country then access to location based services varies depending on local law and who is performing the query. For example, the Honduran Anti-Kidnapping Task Force or Grupo Especial Anti-Secuestro (GEAS), a covert national police force, used a communications expert to learn about real-time location tracking to locate kidnappers demanding ransom has wide latitude in performing. This group gains direct access to location based services by appearing at carrier switch centers armed with cell phone numbers and weapons to obtain full access to location based services inquiries.
In the European Union privacy is assured by EU Directive 95/46/EC, and in many other countries privacy protection laws prevents easy access to cellular location based services (LBS) records.
About the Author – John B. Minor is a practicing communications expert, cell phone signals analyst, digital Investigator and forensic examiner. John has leveraged major successes for litigation teams by locating digital evidence under unusual scenarios. John’s casework takes his expertise to the corners of the globe in a variety of investigations ranging from terrorism threats to corporate financial fraud and to more common civil and criminal venues including homicides. See http://johnbminor.com for more information about Mr. Minor. |