10/19/2017

Cell Phone Location Evidence for Legal Professionals

Larry Daniel
DFCP, EnCE, ACE, AME, BCE, CTNS, CTA, CWA

Locating Cell Phones

• Least Precise to Most
• Call Detail Records
• (Drive Testing)
• Google Location Services
• E‐911 Records
• Phone Based Location
• Find my iPhone

2 of 68

Call Detail Records

“The Evidence”

3 of 68

1
 10/19/2017

Call Detail Records (CDRs)

• What are they?
• Legal proof of a service provided
• A technical road map of a call
• A financial transaction record

4 of 68

Call Detail Records (CDRs)

• How to get them
• Account holder can request with notarized letter
• Via subpoena
• Via discovery
• Always get copies of the original files
• Contact us for specific subpoena language…It is free.

5 of 68

Call Detail Records (CDRs)

• How are they used?
• Associate a phone call with a cell tower
• Show connections between phone numbers
• Show frequency of connections
• Show “user” activity

6 of 68

2
 10/19/2017

Call Detail Records (CDRs)

• What can they contain?
• Voice call activity
• Call forwarding information
• Text message transaction
• Data transactions

7 of 68

Call Detail Records (CDRs)

• How are they used?
• Most common type of evidence in “Cell Phone Location Maps”
• IMPORTANT
• You have the location of the cell tower, NOT the phone
• A tenuous relationship to the phone’s location
• NOT triangulation @#&^(@!!!

8 of 68

Call Detail Records (Retention)

Carrier Subscriber Call History Only Call History with Towers SMS Content "Precision Location"

Verizon 7‐10 Years 7 Years Rolling 12 months 3 to 10 days 8 Days

AT&T/Cricket 7 Years 7 Years 7 Years N/A 8 Days

Sprint 10 Years 18 Months 18 Months N/A 180 Days

T‐Mobile/ 
Metro PCS 3 to 5 years 23 Months 23 Months N/A  23 Months

US Cellular 7 Years Rolling 12 Months Rolling 12 months 3 to 5 Days N/A

9 of 68

3
 10/19/2017

Call Detail Records (AT&T)

10 of 68

Call Detail Records (Sprint)

11 of 68

Call Detail Records (Sprint Towers)

Cell# NEID Repoll# Address1 City County State Zip Latitude Longitude BTS Manufacturer Sector Azimuth

1 90 432 2960  Metzerott  Road College Park Prince George S MD 20783 39.00546 ‐76.95705 LUCENT 1 110

1 90 432 2960  Metzerott  Road College Park Prince George S MD 20783 39.00546 ‐76.95705 LUCENT 2 210

1 90 432 2960  Metzerott  Road College Park Prince George S MD 20783 39.00546 ‐76.95705 LUCENT 3 310

2 90 432 13801 Georgia Ave. Silver Spring Montgomery MD 20906 39.0877797 ‐77.0708293 LUCENT 1 15

2 90 432 13801 Georgia Ave. Silver Spring Montgomery MD 20906 39.0877797 ‐77.0708293 LUCENT 2 135

2 90 432 13801 Georgia Ave. Silver Spring Montgomery MD 20906 39.0877797 ‐77.0708293 LUCENT 3 255

3 90 432 11235 Oak Leaf Dr. Silver Spring Montgomery MD 20901 39.0411097 ‐76.9938997 LUCENT 1 15

3 90 432 11235 Oak Leaf Dr. Silver Spring Montgomery MD 20901 39.0411097 ‐76.9938997 LUCENT 2 135

3 90 432 11235 Oak Leaf Dr. Silver Spring Montgomery MD 20901 39.0411097 ‐76.9938997 LUCENT 3 255

4 90 432 49 Randolph Rd. Silver Spring Montgomery MD 20904 39.0761093 ‐77.00333 LUCENT 1 15

4 90 432 49 Randolph Rd. Silver Spring Montgomery MD 20904 39.0761093 ‐77.00333 LUCENT 2 135

4 90 432 49 Randolph Rd. Silver Spring Montgomery MD 20904 39.0761093 ‐77.00333 LUCENT 3 255

5 90 432 15430 Old Columbia Pike Burtonsville Montgomery MD 20866 39.10889 ‐76.9366697 LUCENT 1 15

5 90 432 15430 Old Columbia Pike Burtonsville Montgomery MD 20866 39.10889 ‐76.9366697 LUCENT 2 135

5 90 432 15430 Old Columbia Pike Burtonsville Montgomery MD 20866 39.10889 ‐76.9366697 LUCENT 3 255

12 of 68

4
 10/19/2017

What About Burner Phones?

13 of 68

Burner Phone F.A.Qs

• What are they?
• Pre‐Paid Phones
• No verification of identity needed
• No valid “Subscriber” information
• How to you get the records?
• Seller may reveal the phone company

14 of 68

Burner Phone F.A.Qs

• Getting the records
• Finding the carrier for the phone number
• www.fonefinder.net
• Who owns the number
• No Porting Information
• All burner phones have a phone company
• T‐Mobile
• Metro PCS
• Verizon
• Etc.

15 of 68

5
 10/19/2017

Burner Phone F.A.Qs

• Getting the records
• Subpoena the carrier
• Pre‐paid phone records may be a shorter
retention period than a post‐paid phone.
• 90 to 180 days in many cases

16 of 68

Cell Phones

17 of 68

The Flip Phone

(Invented by Star Trek writers)
• Simplest form –
• Just a 2 way radio

• Newer form
• Calls
• Texts
• Some small apps

18 of 68

6
 10/19/2017

The Smart Phone

Powerful handheld computer
• Still a 2 way radio
• Plus
• Camera
• Texts
• Millions of Apps

19 of 68

How does a cell phone work?

20 of 68

Communications
• Walkie‐Talkie
What’s the story, 
Roger!

What’s the story, 
Roger!

21 of 68

7
 10/19/2017

Registration
• On Power up
• Phone tunes to a known frequency and
begins to listen.

22 of 68

The Hook Up: Choosing a Tower

• How does the Pick me!

phone choose
a tower? No pick me!

23 of 68

The Hook Up: Choosing a Tower

• when equidistant, no way to know.

3 miles 3 miles

24 of 68

8
 10/19/2017

The Hook Up: Choosing a Tower

• Occlusions

25 of 68

The Hook Up: Choosing a Tower

• Channels must be available
• Let it Snow!

3 miles 3 miles

26 of 68

Choosing a Tower: Moving Around

• Hand offs
• No record of intermediate hand offs
• May get starting and ending cell towers

27 of 68

9
 10/19/2017

How the Cellular System

Works

28 of 68

www.guardiandf.com / 919‐868‐6291 /  
<#> of 51

The Cellular System: Cell Site

• A Cell Site
• Antennas
• Send and receive signals to and
from cell phones
• Base Station Transceiver
• Manages the tower and calls on
the tower
• Talks to the phone via network
cables

30 of 68

10
 10/19/2017

Cell Tower Sectors

• Sector Layout and Azimuth
• Cell towers can have from 0 to 6 sectors
• Most common is three sectors
• Azimuth is the direction the antenna points

31 of 68

Cell Tower Sectors

• Sector Layout and Azimuth

32 of 68

Cell Tower Sectors

33 of 68

11
 10/19/2017

Cell Tower Coverage

34 of 68

Cell Coverage
• Area size is determined by customer
needs
• More people, more towers
• More cows, less towers

35 of 68

Subscriber Density
• As subscribers increase:
• Coverage size per tower
gets smaller
• Each cell site may have 200
channels (100 calls)
• Need more towers with
smaller radius versus one
large tower.

36 of 68

12
 10/19/2017

How Far?
• How far can a cell phone be from a tower and still
make or receive a call?
• Assuming a perfectly flat earth, extremely tall cell
tower, maximum legal power output, and no other
cell towers in the area…
• GSM (AT&T or T‐Mobile) = 22 miles
• CDMA (Sprint, Verizon, etc.) = 35 Miles
• Limiting factors
• Terrain, ground clutter, proximity of other towers,
signal strength, cell phone being used, tower
height, radio frequency…and the list goes on…

38 of 68

Real World Issues

39 of 68

13
 10/19/2017

ATT Radio Frequency Engineering Map of Air Coverage – Example 

40 of 68

Example (Sprint Towers Dallas 1)

41 of 68

Example (Sprint Towers Dallas 2)

42 of 68

14
 10/19/2017

Example (Sprint Towers Ft Worth)

43 of 68

Example (Sprint Towers All )

44 of 68

Example (Sprint Towers All )

45 of 68

15
 10/19/2017

Example (Sprint Towers Atlanta)

46 of 68

Examples

www.guardiandf.com / 919‐868‐6291 47 of 68

Viewing KML / KMZ files

• What are they?
• Work product output from some police
and private experts
• Google Earth File format
• Can be opened using Google Earth
Professional
• Now a free program

48 of 68

16
 10/19/2017

Google Earth Professional

49 of 68

The Pie‐Slice!

50 of 68

The Pie‐Slice!

51 of 68

17
 10/19/2017

The Pie‐Slice! (1)

52 of 68

The Pie‐Slice! (2)

53 of 68

This is “expert” training?

54 of 68

18
 10/19/2017

Expert Analysis or Fantasy?

55 of 68

Call Detail Records: Insurance Case

56 of 68

Call Detail Records: Carjacking

57 of 68

19
 10/19/2017

Call Detail Records: Robbery

58 of 68

Call Detail Records: Murder

59 of 68

Case Example: CDR and Phone Location

60 of 68

20
 10/19/2017

Case Example: CDR and Phone Location

61 of 68

Drive testing

62 of 68

E‐911 Location

63 of 68

21
 10/19/2017

Google Location Services

64 of 68

Capabilities: Examples

• Google is watching
• Location activity
• Full route

65 of 68

Capabilities: Examples

• Google is listening
• Location activity
• Full route

66 of 68

22
 10/19/2017

Find my iPhone – Device Based

67 of 68

• www.guardiandf.com
• 919‐868‐6291 Highly qualified experts in computer, cell phone,
• larry@guardiandf.com cellular location, GPS, and cyber risk forensics.

68 of 68

23