Re: Mobile phone tracking, pagers, etc

[Dave Emery <die@pig.die.com>]

On Thu, Sep 17, 1998 at 11:56:02AM -0700, Matthew James Gering wrote:
> 
> Regarding the tracking of mobile phones, are all current types of phones
> susceptible?
> 
> There was a recent post here regarding tracking of GSM phones.
> TDMA/CDMA, analog/digital, PCS-band, etc, are they all equally capable
> of being tracked?

	All the wireless standards I am aware of allow for registration
and polling phones to find out if they are on and available without
ringing them. This provides silent location information to the nearest
cell of a phone merely turned on, location  which may be hundreds of
feet in tightly congested urban areas and tens of square miles in
suburban and less populated areas.   Some system operators apparently
use this feature with all active phones to relieve congestion on paging
channels, while others do not actively track phones not being used
except in certain situations or parts of the network.   Of course
location to a cell is always available during a call...

	The FCC has mandated that this cell-granularity location
information be made available to E-911 centers on emergency calls, and
there may be some situations in which it is currently made available to
domestic law enforcement under other circumstances, though CALEA
restricts such availability without warrents.  Whether and under what
circumstances law enforcement can request a poll be transmitted
(re-registration) to locate a silent but powered phone is less clear.  
It would seem that CALEA forbids this, but what in fact is the practice
by such agencies as the FBI working quietly with cell carriers in places
such as NYC is less clear.

	In the future FCC rules will require that all E-911 calling
wireless phones be located to 125 meters 67% of the time.  There are
proposals to do this with differential time of arrival (DTOA)
or other direction finding techniques (apparently a hard problem
in cities with lots of multipath propagation due to reflections)
that work passively on some or all cell calls and registrations
(thus allowing tracking of everybody), or by cooperation with the
cellphone handset that could be only turned on when the user wished
to be located (an E-911 emergency) and disabled otherwise.   One
version of this would use GPS rather than ranging or other techniques
to determine position relative to the cell sites.    Of course all
the user disaablable  techniques such as GPS and DTOA done in the handset
firmware only will work with future cell firmware and hardware
and not legacy handsets, and because of this may not be acceptable
to the FCC.

	There are some distinctions between CDMA, GSM, analog and TDMA
(non GSM), in respects to exactly how easy it is to implement precision
location meeting the FCC spec passively and on all calls at all times.
Apparently CDMA with its very tight power control to minimize the near-far
problem makes it fairly awkward to reliably triangulate position from
multiple sites since the mobile may be only detectable at one site
at any time...  What this means in practice is that some wireless
technologies are more likely to require some definate active firmware
intervention to do precision location, whilst others may allow it
with no special intervention.   If the FCC allows this intervention
to be enabled by a user, this may provide some opportunity for
location privacy.


> 
> However pagers are not, correct? They just broadcast an entire area to
> page instead of the pager keeping the network informed of their
> location.

	The one way pagers work this way.  The guaranteed delivery two
way pagers do support registration and will know the location of
the pager after a page has been sent to it and any time the system
wants to determine it.   This location will be quite coarse with current
two way (reFlex) pagers with cell sites some distance apart, but 
DF techniques are quite possible and could be implemented by law
enforcement or spooks or other interested groups.  Unlike wireless phones
there is no current FCC requirement for positioning information distribution
or precision positioning infrastructure, so two way pagers aren't
likeyly to be routinely located accurately any time soon.

	Of course most modern wireless phones support paging message
delivery, so more and more people will be using wireless phones with
the FCC mandated tracking accuracy for paging...
> 
> One thing I have long wondered: Why don't they make phones that
> "wake-up" by a paging signal and then accept the call? It might increase
> the connect time significantly, but it would also increase the potential
> stand-by time indefinitely, and the location of the user is only exposed
> when calls are in progress, not while the phone is on stand-by.
> 
	Wireless phones do currently work this way.  They listen to the
forward control channel for a paging message that says they have got a
call coming in and only then do they transmit.  The amount of power used
in transmitting would quickly use up the battery if they continuously
broadcast.  The problem with cellphone location is that they can also be
paged with a registration request that does not cause them to ring
or show any evidence of transmitting, but sends back a brief message
burst (not using much battery).   This can be made to happen every
so often, or only when polled.


> Are there any paging services (particularly alpha paging) that work on a
> global scale? You would think daily pager rental service (esp. at
> airports) would be popular. You could have an email address, even a
> static phone number, that could re-route messages to any pager that you
> happen to have at the time (PSTN-IP-PSTN, or even easier if the pager
> service gives SMTP addresses, which most do these days).
> 
	There are nationwide pager services that broadcast your pages
over very wide areas or depend on registration to locate you down to
a smaller area.  But yes, you can get paged anywhere in the US and
several other countries.  And the new LEO satellite technology will
allow paging over whole continents or potentially anywhere in the world.


> Similarly a PSTN-IP-PSTN interface for voice could give you a static
> phone number that you could dynamically forward anywhere untraceably.

	The LEAs don't like this concept, and one of the provisions of
the CALEA wiretap stuff is providing tracing of calls forwarded so you can't
do this....


-- 
	Dave Emery N1PRE,  die@die.com  DIE Consulting, Weston, Mass. 
PGP fingerprint = 2047/4D7B08D1 DE 6E E1 CC 1F 1D 96 E2  5D 27 BD B0 24 88 C3 18