Cell towers, Cell Phones and Pings: The Ability to Track Your Every Movement
Did you know that your cell phone, and cell phone company for that matter, has the ability to track your every movement? Sure, maybe you did, but did you know how or why this is possible? If not, I will break down the basics for you here.
What is a call detail record?
Cell phone companies keep call detail records, or “CDRs” for every cell phone associated with their network. A call detail record is legal proof of a service provided, and essentially the technical road map of a phone call or text message.
How is a CDR obtained?
An account holder can always request their own call detail records with a notarized letter. But what about others, such as law enforcement? Well, that is where things get interesting. Prior to the United States Supreme Court’s decision in Carpenter v. United States, the police could obtain an individual’s call detail record without a warrant, but with a court order. The difference between the two being the standard used to grant such an order. Under the old interpretation, the police could obtain an individual’s CDR when they “offer specific and articulable facts showing that there are reasonable grounds to believe” that the records sought “are relevant and material to an ongoing criminal investigation.” However, following Carpenter, the police can only obtain an individual’s CDR with a showing of probable cause, as required by the Fourth Amendment, unless an exception applies. This is a drastic change, one that I will explore further in a future post focused on the case.
How are CDR’s used?
A call detail record can associate a phone call with a specific cell phone tower. It also shows the connections between phone numbers, i.e. both incoming and outgoing phone calls and possibly text messages, depending on the carrier.
How long are CDR’s retained?
The answer to this question essentially comes down to the provider in question. Let’s use Verizon as an example. Verizon keeps an individual’s subscriber information, or user information for seven to ten years. Verizon also keeps a subscriber’s call history for seven years. However, a subscriber’s call history with tower location information is only retained by Verizon on a rolling 12-month basis. Similarly, text message information is only retained for three to ten days. Finally, Verizon only keeps the precise location of the phone, which is coordinated using GPS for approximately 8 days. As it relates to criminal investigations, the most frequently obtained information is an individual’s call history with tower location information.
What about a burner phone?
Oddly enough, many people think that a burner phone will somehow prevent law enforcement from obtaining a call detail record. That simply is not true. The truth of the matter is that all burner phones use a cell phone company such as T-Mobile, Metro PCS, Verizon etc. Further, with the phone in hand, law enforcement can use fonefinder.net to find the carrier associated with the burner phone. With that said, pre-paid phone records may have a shorter retention period than a post-paid phone. Such records are generally retained for only 90 to 180 days in many cases.
How does this all work?
This is the big question. How does this all work? Let’s start at the basics.
What is a cell phone?
In its simplest form, a cell phone is merely a two-way radio. However, due to technological advances, the current smart phones are much more than a two-way radio. A smart phone is also a camera, a messaging machine, and the host of many applications.
How do cell phones work?
A cell phone uses two channels, one to send and one to receive. However, current cell phones also have a Bluetooth radio and a wifi radio. It should be noted that with current cell phones wifi can be used to make a phone call. With a wifi call there is NO LOCATION INFORMATION. In other words, a call made using wifi will not ping a cell phone tower.
How does a phone choose a tower?
Generally, a cell phone connects to the nearest tower. However, if a phone were to be perfectly between two cell phone towers, or “equidistant,” there is no way to know why one tower was picked over the other tower.
Can a further tower be chosen over a closer tower?
Yes. This can be due to an occlusion, or something blocking the signal, such as a mountain or a really tall building. It can also be due to the fact that all the channels on the close tower are busy, resulting in the phone choosing a different tower.
What exactly is a cell-site or tower?
A cell-site is made up of two different components: antennas and a base station transceiver. The antennas send and receive cell phone signals, while the base station transceiver manages the tower and the calls received on the tower. The base station transceiver also “talks” to a cell phone via network cables.
What is the sector layout and azimuth of a cell-site?
Currently, cell towers in the United States can have zero to nine sectors. However, most cell towers have three sectors. But what is azimuth? Azimuth is the direction that an antenna on the tower points. This is often improperly used to “pinpoint” a cell phone’s location within a particular sector.
For example, a photo of a cell-site can be found at the beginning of the article. In the picture, the red “pie shaped” graph is what law enforcement use when attempting to show the coverage area for a tower that has three sectors. However, the purple “blob” represents the actual coverage of the lower-right sector, which can change daily depending on numerous factors.
How large of an area does one cell-site cover?
The answer to this question depends on the customer need in a specific area, i.e. more people, more towers. As subscribers in an area increase, the coverage size per tower gets smaller. This is because each cell-site may have only 200 channels, which would allow it to hold 100 calls at a time. Thus, as subscribers increase, more towers are needed to hold the calls.
Hypothetical: How far could a cell phone be from a tower and still make or receive a call?
Assuming a perfectly flat earth, an extremely tall cell tower, and the maximum legal power output allowed without any other towers in the area: A cell phone tower using GSM, such as AT&T or T-Mobile, could hypothetically be 22 miles from the phone. Alternatively, a cell phone tower using CDMA, such as Sprint or Verizon, could hypothetically be 35 miles away. Of course, such distances would be limited in the real world due to terrain, ground, and building occlusions.
*It should be noted that a lot of this information was adopted from a lecture given by Larry Daniel. He is a true expert on this topic, and can be found at www.envistaforensics.com
Contact me today if you are facing criminal charges in which cell phone location information may be used as evidence. Let me fight for your interests in court and help you get on with your life. Call me today at 248-227-1978, or set up a free initial consultation.