Tracking a CellPhone that's switched off

daymobrew

Capt'n Midnight wrote:

overall the emergency services would be able to save more lives by being able to locate car crashes and hill walkers etc.

An RTE News story described how all US mobiles have a built in GPS chip for this very reason.

Rew

daymobrew wrote:

An RTE News story described how all US mobiles have a built in GPS chip for this very reason.

Not all of them, read back through this thread for E911 stuff and for the coments on poorly reseached journalism.

sceptre

kaimera wrote:

regarding the incident in cork :: was mentioned to me today that the boys phone wasn't turned off, just out of coverage. Thats how a boosted signal 'found' the mobile.

I'd run with that one too (Occam's Razor and so on). Thing is though, he was out there for a week, yeah? Do phone batteries last that long these days when they're searching for a signal? (my phone is crap and needs charging every few days even 200 hundred yards from the nearest phone mast)

John R

sceptre wrote:

I'd run with that one too (Occam's Razor and so on). Thing is though, he was out there for a week, yeah? Do phone batteries last that long these days when they're searching for a signal? (my phone is crap and needs charging every few days even 200 hundred yards from the nearest phone mast)

My most recent phone has been lasting over 6 days between charges including text messages and phonecalls so yes it is possible.


I do however think the theory of boostng a signal so a phone on standby can pick it up is crap, with the exception of devices that are/would be designed for that explicit purpose.
It is likely and probably inevitable that tracking technologies will be embedded in future cellphone products but not with current ones.

The power needed by the reciever is a great deal more than to run the clock, if the transmitters were on it would be noticeable in the battery drain of phones switched off.

Rew

Recivers are relitivly cheap to run power wise but trnasmitting drains the crap out of the battery. They couldn't position a phone that was just reciving it would have to transmit a response.

100gSoma

hi everyone,
The journalists in Ireland got it wrong. They got 2+2 and got 10 as usual.
The gardai said that mobile telephony played a part. What part it played is they tracked the last cell that roberts phone was in before it was turned off.
The cells are about 1km wide each depending on urban or rural area and usually overlap. The cell that your phone is registered in depends on which cell mast can pick up the phone signal strongest.
So most likley all they did was work out which cell the phone was in when it 'logged off'. This owuld have given them about 2km square to be 'extra vigilant' when searching. This is exactly what happened, as the gardai told the group to be "extra vigilant" in this particular area. They hoped to find the phone etc.

I did Digital Comms as part of my degree and I have never heard of a phone being traced when swiched off. This is crap. The news report said that small levels of radiation are still emitted even if its off or has no battery etc. Thats lies. Is it a nuclear phone? They then said the only way to stop it transmitting was water damage. jeezus. these people are unreal.
when your phone is off, it is OFF. no signal. All eircom or 02 etc can tell the gardai is where the last signal from your phone was recieved. And even this info can only be approximated to 400m sqaure to 2km square.

In the USA all phones sold after 2001 have a 911' chip. If 911 is dialed the phone sends a GPS signal to a secure site. Its location can be found within 5 metres. so if a kidnapped person dials 911 and leaves ther ephone in a pocket or at a site etc, the cops will be there asap.

Will come in here sooner or later when 3g is here.

Rew

100gSoma wrote:

I did Digital Comms as part of my degree and I have never heard of a phone being traced when swiched off. This is crap. The news report said that small levels of radiation are still emitted even if its off or has no battery etc. Thats lies. Is it a nuclear phone? They then said the only way to stop it transmitting was water damage. jeezus. these people are unreal.
when your phone is off, it is OFF. no signal. All eircom or 02 etc can tell the gardai is where the last signal from your phone was recieved. And even this info can only be approximated to 400m sqaure to 2km square.

In the USA all phones sold after 2001 have a 911' chip. If 911 is dialed the phone sends a GPS signal to a secure site. Its location can be found within 5 metres. so if a kidnapped person dials 911 and leaves ther ephone in a pocket or at a site etc, the cops will be there asap.

Where did you do your degree and did you data comms lecturer actaully tell you all that?

Superman

100gSoma wrote:

I did Digital Comms as part of my degree and I have never heard of a phone being traced when swiched off. This is crap. The news report said that small levels of radiation are still emitted even if its off or has no battery etc. Thats lies. Is it a nuclear phone? They then said the only way to stop it transmitting was water damage. jeezus. these people are unreal.
when your phone is off, it is OFF. no signal. All eircom or 02 etc can tell the gardai is where the last signal from your phone was recieved. And even this info can only be approximated to 400m sqaure to 2km square.

In the USA all phones sold after 2001 have a 911' chip. If 911 is dialed the phone sends a GPS signal to a secure site. Its location can be found within 5 metres. so if a kidnapped person dials 911 and leaves ther ephone in a pocket or at a site etc, the cops will be there asap.

Will come in here sooner or later when 3g is here.

well sounds pretty believable, better than www.spychips.com (he thinks his gillete is spying on him) also i watched a prog about a chechen guy the russians wanted to kill and they had to wait till he turned on his phone and then send the planes to get him and it worked, now i'm sure phone's still have power in them when they aren't fully on.

100gSoma

Rew wrote:

Where did you do your degree and did you data comms lecturer actaully tell you all that?

I did an Honours(2nd) B.Sc Degree IT with The Open university. I chose the Digital Comms module for one year of this.
Heres a link. http://www3.open.ac.uk/courses/bin/p12.dll?C02T305

The course was highly techincal and covered every aspect of Digital Comms including mobile telephony (which I did a project on). Soft Power on a phone only keeps the time/date intact etc. It doe snot emit any signals to the cells, of this Im quite sure. Someone please correct if Im wrong, in which case I'll be mailing OU to update their Mobile telephony information in the course.

Im sure he was traced by monitoring the area where his phone 'logged off' the cell. ie: was turned off, last 'goodbye' signal recieved by network.

Rew

I was just wondering coz some of you facts are bit off.

Cell coverage in GSM is up 30 miles (which is extreme).

There is no 911 chip as such but mobile operators do have to comply with the E911 directive which says they have to position phones to within 100m2. SOME phones use GPS others use the network its self. It doesn’t just transmit location when 911 is called they are using the positioning info for other value added features/services. GPS isn't that reliable in built up areas.

Operators can position a handset in Ireland using means other then what cell you are or were last logged on to. There are a few different methods they use which can be very accurate.

The point ahs been made in this thread that the phone was not off just out of coverage and that they boosted the local cells to try pick it up. Which makes sense and explains why the story came out that it was off and that they were boosting the signal to “activate it”.

As for the phone being on or off I tend to agree with you but then again iv never put a phone that’s off up to a spectrum analyser. Some organisations recommend you remove the battery when in dodgy areas/countries that you don’t want to be found in....

Peanut

Rew wrote:

Recivers are relitivly cheap to run power wise but trnasmitting drains the crap out of the battery. They couldn't position a phone that was just reciving it would have to transmit a response.

The point should be made however that it may only need to transmit in acknowledgement to a certain request from a base station, it could be in "passive receive" mode at all other times (*ie. not calling back every n minutes, which presumably means the battery could last a lot longer).

* = may not be true

Superman

Rew wrote:

Operators can position a handset in Ireland using means other then what cell you are or were last logged on to.

Yeah aint that how they caught the omagh bombers cause the phones went up and down the country in one day

Rew wrote:

then again iv never put a phone that’s off up to a spectrum analyser.

I do, every night, I leave it beside my stereo when its off and my stereo never makes that bogie noise it usually makes with phone so it is defo not gettin a signal

Rew

Superman wrote:

Yeah aint that how they caught the omagh bombers cause the phones went up and down the country in one day

Phone records were used in that case and they put phones owned by a particular guy around Omagh on the day. It was part of the case againt him. Dont think they ever caught the actual bombers.

I do, every night, I leave it beside my stereo when its off and my stereo never makes that bogie noise it usually makes with phone so it is defo not gettin a signal

Dosnt work like that im afraid but im sure if phones were transmiting when off sombody would have the spectrum logs to prove it. But try this turn you phone on put it write up to your stereo. Leave it there for a while. Does it interfere? Generally no (though you should here an ocasional blip). This dosnt mean your phone isn't talking to the cell.

Superman

Rew wrote:

But try this turn you phone on put it write up to your stereo. Leave it there for a while. Does it interfere? Generally no (though you should here an ocasional blip). This dosnt mean your phone isn't talking to the cell.

Yeah i conducted this little experiment last night i turned the phone on and put it in the hollow of my speaker and it was tick and interfering every couple of min, then i turned it off and nothing, so if it is putting out a signal its obviously different than the one it needs to communicate with the cell as that registers on my speakers.

BrianD

With the introduction of the E911 law it is incredible how closely the USA resembles the communist countries of eastern Europe up to their collapse.

Land of the free? I think not! Police State? Yes!

Rew

BrianD wrote:

With the introduction of the E911 law it is incredible how closely the USA resembles the communist countries of eastern Europe up to their collapse.

Land of the free? I think not! Police State? Yes!

As with any technology it has good and bad uses but is that a good reason bot to use them? E911 has probably saves lives daily and in other countries that dont have E911 equivlent laws the technology is abused by the state to find people or catch criminals. The operators in Ireland retain logs for up to 10 years. Thats a very detailed recored of movements.

German police wanted to find a phone but they need trafic generated to/from the phone (a requirement of German law as I understand it) to locate it so they made the operator send service messages that wouldn't cause any visual effect on the handset but was calssed as trafic...

Superman

BrianD wrote:

With the introduction of the E911 law it is incredible how closely the USA resembles the communist countries of eastern Europe up to their collapse.

Land of the free? I think not! Police State? Yes!

Oh good ol' politics creeps into the conversation somewhere, America ain't great for the ol' civil liberties but i think its got alot more going for it the Kiev or Bratislava in the 1970's.
anyway enought about politics , back to phones! there deadly!

irishgeo

They know hwo done the Omagh Bombings becuase the Americans were listening into the phone calls via spy satelite. The only problem is that these records could not be used in court for virous legal reasons. Its the same with any recorded stuff. Unless you are notified by what ever means, a sign , a recorded message etc , any recording can not be used in court.

seamus

irishgeo wrote:

They know hwo done the Omagh Bombings becuase the Americans were listening into the phone calls via spy satelite. The only problem is that these records could not be used in court for virous legal reasons. Its the same with any recorded stuff. Unless you are notified by what ever means, a sign , a recorded message etc , any recording can not be used in court.

Depends on the country obviously. I'm not sure what the story is in the states, but that's the story here. Of course, it can't be tried in the States under their law.
Catch-22 sometimes, but that's the law.

monster_fighter

irishgeo wrote:

They know hwo done the Omagh Bombings becuase the Americans were listening into the phone calls via spy satelite. The only problem is that these records could not be used in court for virous legal reasons. Its the same with any recorded stuff. Unless you are notified by what ever means, a sign , a recorded message etc , any recording can not be used in court.

????

Do you know how much GSM traffic you have record to get enought to crack
the encryption? Lots, terabytes - without that amount the key rotation makes near impossible.
So I doubt the used sat's to record GSM - now landlines are another story as they are routed unencrypted all over the place.

irishgeo

Come on you dont think the Americans dont have the key to unencrypt any GSM call in the World. Think again man.

darraghrogan

I can't believe GSM is secure. Wasn't there a means by which you could set up a base station near an existing base station but operate at a higher power output so that the mobile chose your base station?

Or if you interfere with the signal strength received by the mobile, it will drop its encryption?

Darragh

MrPinK

monster_fighter wrote:

Do you know how much GSM traffic you have record to get enought to crack the encryption? Lots, terabytes - without that amount the key rotation makes near impossible

As far as I remember, the CAVE algorithm that GSM uses generates a random 260 bit mask for each direction of a call, which is repeatedly XOR'ed against the compressed speech data. You certainly wouldn't need terabytes in that case. It's what a lecturer of mine referred to as "joke cryptography".

oscarBravo

100gSoma wrote:

The cells are about 1km wide each depending on urban or rural area and usually overlap.

In urban areas maybe, but you may be sure that in rural areas they are a hell of a lot bigger. My nearest cell sites are approximately 6-8km away.

Rew wrote:

Cell coverage in GSM is up 30 miles (which is extreme).

AFAIK the hard distance limit is 35km.

MrPink wrote:

As far as I remember, the CAVE algorithm that GSM uses generates a random 260 bit mask for each direction of a call, which is repeatedly XOR'ed against the compressed speech data. You certainly wouldn't need terabytes in that case. It's what a lecturer of mine referred to as "joke cryptography".

In theory it's not all that bad, but in practice the keys used are apparently rather weak (lots of zeros in predictable places). You can decide on your own favourite conspiracy theory as to why this might be...

Tom Dunne

Back on the topic of journalists writing about stuff they simply do not understand, here is a classic quote from today's Sunday Business Post. This is an article supposedly about the Big Brother implications of mobile phones and how they can be used to pinpoint people's location:

Link here

"Even when the mobile was simply switched on, the phone maintained a fresh trail, courtesy of the infrared device keeping the signal alive for incoming calls."

WTF? What kind of nonsense journalism is that? Anyone have any idea what he is talking about?

MrPinK

oscarBravo wrote:

In theory it's not all that bad

It's essentially reusing a one-time pad. A very bad practise which is very vunerable to attack. If they know enough about cryptography to come up with an encryption algorithm, they know enough to realise that this is pertty weak security. The only possible reason for using weak encryption is so that the right people can break it.

lucernarian

On the point of distance limits with gsm masts, how come a friend of mine, on vodafone, who lives 150 m from 2 masts (almost side-by-side) has problems with reception? That's assuming that one of the masts are vodafone but its a rural area. I live 3 miles away but i also have problems.

Would your location as a citizen of the Republic of Ireland be covered under the data protection act? I suppose one could say that your geographical position could be termed as data. If that's so then any attempts in Ireland to introduce E911 type laws would involve the service provider explicitly asking the user for consent to use the tracking service.

Did the Americans even record the phone calls in the first place?

jmcc

Rew wrote:

To triangualte the pos of the phone it would have to login to at least 3 cells.

Which is why the story about upping the power at the base stations is interesting. Just a rough phase of the moon idea but boosting the power of base stations in sequence and factoring in the power/reception levels could produce a rough idea of the position of the phone in a cell but you would probably need more than three cells. It could be simpler to use some kind of ELINT detection method.

Maybe they jsut put alot of work in to processing the logs for the phone before it died was turned off.

The last cell id that the phone was in prior to being switched off is recorded in the phone. The logs are perhaps the simplest way of doing things. The problem with large rural areas is the size of the cells - they are not micro-cells where phones can be tracked in cells that are approximately 100 m or so.

Regards...jmcc

jmcc

Rew wrote:

He was on the phone when they hit him.

Its the first iv heard of it all as well. Sounds like its all a bit like chinease wispers and the origanl source is nothing like what we are hearing.

The story was that Mossad had managed to get someone in the environment of a Palestinian known as "The Engineer" to provide a rigged mobile phone with an embedded explosive device to the target. The head of Mossad was reputed to have called the target and said something like "listen closely". It has the kind of black humour associated with spookdom and "The Engineer" was assassinated in this manner.

Regards...jmcc

jmcc

monster_fighter wrote:

Do you know how much GSM traffic you have record to get enought to crack the encryption? Lots, terabytes - without that amount the key rotation makes near impossible.

Wow such a cryptographical insight. Are you a "technology journalist"? GSM encryption is not that difficult to crack. Indeed in 1999, it was possible to crack an encrypted GSM conversation (derive the key) with a PC with 128MB and about 70G of hard drive space in under 60 seconds [1]. That was roughly a desktop spec in 1999. The intelligence agencies measure their crypto computers in acres. The GSM algorithms were also weakened so that the intelligence agencies could monitor them without any difficulty. You probably weren't around when the first of them were posted on the Usenet group sci.crypt.

So I doubt the used sat's to record GSM - now landlines are another story as they are routed unencrypted all over the place.

Expert on electronic surveillance via satellite as well? Ever heard of Echelon and the UKUSA agreement? To put it bluntly - if you rely on what the "technology journalists" publish, you will probably draw the wrong conclusions about technology, cryptography, electronic intelligence gathering and the security of communications. These people rarely have much of a clue about technology in general let alone this very complicated set of aspects of it.

Regards...jmcc
[1]The Shamir Biham paper indicated that the key could be derived in approximately 1 second using the PC spec above.