re OJ and Cellular tracking from Willis Ware

[David Farber <farber@central.cis.upenn.edu>]

From: Willis H. Ware <Willis_Ware@rand.org>
Reply-To: willis@rand.org
Subject: Re: CELLFONE TRACKING
Date: Thu, 30 Jun 94 10:32:44 PDT




PAT: As requested ...


The recent "Freeway Chase" of O.J.Simpson's white Ford Bronco has
brought into public consciousness the issue of whether a cellular
telephone network is technically able to track a subscriber's handset
and report its physical location.


The {Los Angeles Times} published an article stating that the
cellphone system had been used to track the vehicle.  On the other
hand, local TV stations also interviewed the young couple who, on
their way to the beach, had visually sighted the car and used a
roadside emergency phone to report it to authorities.  The role of the
cellular provider or its technical ability to track is not wholly
clear; but on the basis of all the facts that appeared in local media,
it does seem clear that the vehicle tracking was largely visual, not
electronic.  In fact later in the chase, the driver reported where he
was and when he intended to make turns off/on the freeway network.


The first technical observation would appear to be that a handset is
either handling a call, is on standby, or is switched off.  If the
last, it must be invisible to the network.  In standby, there must be
some periodic communication between handset and the network -- perhaps
polling, perhaps challenge and response -- that allows the cellphone
net to know in which cell an active or standby handset is presently
located.  Otherwise the network could not know to which cell to direct
an incoming call, or to hand off an outgoing call from one cell to the
next as the handset moves from cell to cell.


Therefore, one readily concludes that the cellphone network can track a
unit to its current cell location and from cell to cell.  Presumably,
such location information could be available to the system operators
as a matter of routine oversight of the system, to the creation of
operational records and audit trails, and to billing records.  So the
cellular operator, AirTouch in this case, could probably report to
authorities which cell the Bronco currently occupied.


Probably, the present-cell-location information is available within
the network whether the handset is active or in standby.


As a matter of legalities, the {Los Angeles Times} article did say
that the provider -- AirTouch -- had been "subpoenaed to cooperate"
and it did also say that a wiretap court order had been obtained.  The
subpoena was probably to cover what is known as "transaction records"
which in a cellular system might include location information but
certainly caller and callee numbers and billing information.  The
wiretap order would be required to monitor and record the content of
the calls.


Next, however, there is a point of technical uncertainty.  At
cell-phone frequencies, the antennas are usually made up of multiple
elements in order to get the desired azimuthal coverage and to avoid
wasting energy by confining the transmitted energy to the desired
service area, which for cellphones transmitters probably is a roughly
round flat saucer of radiation.  There would be no point in wasting
energy by squirting it straight overhead or to unusually high angles.
It is well known that broadcast transmitters -- AM/FM/TV -- control the
radiation pattern of their antennas to maximize the transmitted energy
into the service area.


But, does a cellular transmitter control and manipulate the individual
antenna elements for each transmission in order to maximize the energy
directed toward the handset of interest?  Is the phasing among the
many elements adjusted dynamically to point a given transmission
toward a handset and to track its motion?  Are there even multiple
transmitters so that individual calls can be assigned to particular
antenna beams?  Or is there a single transmitter that is used for all
calls concurrently in progress and that deals with the multiple
elements of the antenna as a single composite entity that has a fixed
radiation pattern adapted to its particular location?


In the present state of electronics, multiple transmitters and dynamic
electronic beam pointing would be easily achieved.  But how has the
system been designed?


If angular adjustment is indeed utilized for each transmission, then
two cell sites that can hear the transmission could, in principle,
function as a form of triangulation, and tracking could be more
precise than just "the handset is in cell xx".  IF angular positioning
of the transmitted beam for a given call-in-progress is indeed used,
then it's a collateral question of whether such information can be
extracted from the system by its operational personnel.


The Times article quoted a security consultant from Houston TX as
saying that triangulation had been used by the authorities and that it
had also been used to track down a drug figure in Columbia.  In the
latter case, I can imagine the DEA and other authorities having high
quality triangulation equipment, but it would seem unlikely that local
law authorities would.  So if the triangulation story is correct, then
it must follow that the cell transmitters themselves are able to
provide some level of triangulation.


What are the technical facts about the cellphone network, its ability
to track, and its ability to report location?




Willis Ware    Santa Monica, CA