Cell Tower Tracking - How accurate is it?

http://exforensis.blogspot.com/2012/08/cell-tower-tracking-how-accurate-is-it.html

Cell Tower Tracking - How accurate is it?

Every so often I take a look at the search engine keywords and phrases that people are searching for when they visit my web site. Some of the more common search terms I am seeing these days are, "How accurate is cell tower locations?" and "Cell Tower Tracking" and so on.

The accuracy of locating a cell phone using historical call detail records is one of the more common search terms I see.

First of all, and this is important, you cannot precisely locate a phone using a historical call detail record. Even if you get down to the level of a pico cell, which is a very small cell site, that would still only give you an area in which the phone might be.

The area of cellular analysis of call detail records is so new, there is not even a good term to use to define it as an area of expertise. I have qualified and testified as an expert in the field of "cellular tower technology forensics" or "cell tower forensics" four times now. I guess I prefer the term, "cellular system technology forensics"
 
 The quandary is that analysts are taking call detail records and using them to plot the location of cell towers on maps and then, in come cases, drawing approximate coverage circles on the map to show how the cell towers cover a particular area. This is fine if you know what you are doing, but can be a disaster if you do not have some background in the technology through training or study of radio frequency planning.

All of this is being done from a combination of historical call detail records and tower locations provided by the cellular carrier.

What I am finding in doing these types of analysis is that it is a lot more difficult to do correctly than many may think.

In fact, in the cases I have analysed as the opposing expert in about 40 cases now, I find serious errors in over 75% of the cases.

Why is the error rate so high? Analysing call detail records and tower locations is a minefield of potential errors that can be made if the analyst does not understand how the technology works, does not catch all the little details from one carrier to another in their records or makes unsupportable claims about the evidence.

What are some of the errors that are made when doing this type of analysis?

Getting the tower radius wrong:

The analyst does not have access to any engineering data, or any technical data about the towers. This means that the tower radius plotted by the analyst is based on his or her opinion, or some default radius they were taught in training.
Not having an understanding of radio frequency reuse planning, which is the only basis for placing cell towers and determining their coverage area when all you have is the location of the cell towers.
Ignoring the presence of other towers in the area.
I see reports from analysts that only plot cell towers that were used for cell calls and completely ignore other cell towers in the area. This can lead to them plotting tower coverage areas that are completely out of whack.

Making unsupportable statements:

Claiming that if two cell phones use the same tower near a location that the persons must be together.
Claiming that if two cell phones use towers along the same highway that the cell phones must be together.
Claiming that a cell phone using a tower places the phone in a location.
Claiming that the azimuth of the cell sector points to the location of the phone in the sector.
Making technical errors:

Failing to catch the type of cell site equipment used for a call detail record. This can make all of the sectors plotted by the analyst be off by a large margin in the direction of the cell sector because the numbering for the call detail record must be translated to match the sector numbers in the tower records.
Drawing sectors on a map when the call detail records do not support sectors.
Drawing the sector map for towers upside down.
Failing to notice that the cell tower is on a different switch from the one plotted.

A call detail record is a technical and financial record of a call, not a location record for a call. What this means is that the call detail record will contain the calling phone number, the dial digits in some cases, the dialed number, the date and time the call starts, the duration of the call and the date and time the call ends. It will also contain the initial cell tower used to make the call, and sometimes, it will contain the last cell tower in use when the call is completed as well as the switch ID for the cell tower. It may or may not contain any information regarding the sector used by the phone for a tower.

 Cells and Sectors: Cell towers typically have a circular coverage area. Cell towers may be further segmented into sectors. Think of it like this: Imagine you have a pole lamp. When you remove the shade, the light shines evenly in all directions. This would be a cell tower without any sectors or an omnidirectional tower.

Now imagine you had a pole lamp with three floodlights attached equally distant from each other around the top of the pole. Each of the lamps would shine in a direction with a beam that expands as the light gets further from the lamp. For our purposes, we will assume that the beam has a width of 120 degrees or one third of a circle. This would be a sectorized cell tower. Cell towers can have 0 to 6 sectors.

The direction that you point each of the lamps would be called the azimuth. If you pointed one of the lamps due north, it would be at zero degrees on a circle. The figure below shows a zero degree azimuth in sector 1 (Alpha) in the circle on the left.
 To take our example a little further, lets say that the scene of a crime is located in sector 1 of the circle on the left. Our person of interest has a phone call that uses sector 1 of that tower right around the time of the crime.

Does that put the person at the scene of the crime?
 
 The first question you have to ask is, just how big an area does that sector cover? For instance, a cell tower with a radius of one mile is 3.14 square miles in area. This means that sector one of our tower example is 1/3 of a square mile or 670 acres in area.

The best you could say as an analyst is that the phone is somewhere in an area of 670 acres. To put that in perspective, a Super WalMart is about 5 to 8 acres in size. If you and I were both in a Super WalMart and my phone was using a tower sector that only covered that Super WalMart, could you locate me in the sporting goods section of the Super Walmart? Of course not, because I could be anywhere inside or outside the store. In fact you would have no idea of my actual location.

Triangulation

Sometimes people mistakenly say that a cell phone was triangulated using call detail records. This is an impossibility. A call detail record only gives the location of a single cell tower that was used to connect a cell phone to the phone system for a call.

To triangulate a phone you need to have a minimum of three known locations at a known distance from the phone. Triangulation of a phone is only possible when using the 911 system to locate the phone. This would have to be done in real time and is not possible to do after the fact.

This blog post does not begin to scratch the surface of the information regarding cellular system or cell tower location analysis. But I do hope it provides an inkling of understanding as a general overview.

There is a lot more to doing cellular analysis than many might think. The sad fact is that testimony is being given in courts before juries where the analysis is completely wrong in many cases.

__._,_.___