Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

United States, couple years ago my friend in his mid-thirties was feeling depressed after his mom died. Came over to hang out, and wasn’t responding to his sisters calls.

His sister called in a welfare check on him and suddenly I have three cops knocking at my front door. They ask for him by name, say he isn’t in trouble. I go get him; he asks “how did you know where I was?” and the cops say “we pinged your phone”. What that entails exactly I have no clue.

Later I pulled up the video of them arriving on my cameras, they didn’t approach any of my neighbors houses first. It was just right to my front door like they knew exactly where he was. Kinda spooky.



> the cops say “we pinged your phone”. What that entails exactly I have no clue.

The cell phone infrastructure knows where your phone is. It has to in order for it to operate. The police routinely ask cell phone companies for locations of cell phones. Many (most?) not only won't require a warrant, but provide an official portal the police can use to conduct their queries without having to get a phone company employee to do it.


Note that it is not just police. The core of GPS network, SS7 system, is more than 50 years old in this point. It is often exploited by authoritarian states, sometimes to the end to get human right activists and journalists murdered.

https://attack.mitre.org/techniques/T1430/002/

Our crook friends in Israel sell this as a service

https://privacyinternational.org/examples/3429/nso-group-off...


> Note that it is not just police. The core of GPS network, SS7 system, is more than 50 years old in this point. It is often exploited by authoritarian states, sometimes to the end to get human right activists and journalists murdered.

You must mean the phone network, because GPS doesn't run on SS7.


No, I suspect he meant GSM .. which is also sort of wrong-ish but does make sense…


A typo of GPRS is more likely.


Correct me if I'm wrong, but cell phone companies only know which tower you are currently connected to. So it's pretty inaccurate. The only thing that is "house accurate" is the GPS on your phone. That means they need access to your phone to get that info.

Remark that GPS doesn't need to be turned on. Google mapped all Wifi's and so can locate you without GPS.


You are wrong, although I don’t know the exact mechanism. I once witnessed first-hand a somewhat shady situation where a private investigator was trying to find someone’s whereabouts for the purpose of serving them for a lawsuit. As a last ditch effort, they reached out to a somewhat shady contact who was known to have some kind of internal access to the phone system and gave them the target’s phone number and sent $200 with Paypal. 10 minutes later we get an email back with a specific address and as it turns out that address was the target’s lawyer’s office. One of the process servers goes over there and catches the target on his way out.

I was a bit shaken. I believed what you believe before then too.

Edit: Looks like it’s LBS/LCS: https://www.telecomhall.net/t/what-is-lcs-and-lbs/6374


Modern phones know where you are with centimeter-level precision. Beam Steering obviously requires the cell to know where to steer the beam: https://www.fastcompany.com/90314058/5g-means-youll-have-to-...


No it doesn't. Beam steering is adaptive and will work with signals getting reflected, for example. It's just noting where the return signal from the phone comes on 8 antennas and then narrowing the signal to the phone while increasing bandwidth. It does not use location (because it uses wave interference the "location" these beams is an interference pattern, not a position in cm)

Phone triangulation works by getting signal strength on 3 or more towers, and getting location from that. That's how it works on WiFi as well. Access points see the clients, and each other, and if you have enough data points, you don't even have to configure the locations of the access points. Of course, the location you get back is relative to the access points and the distance between them, so systems provide a quick way to convert to distances based on one or two measurements.

So please don't think 3G is going to protect you from triangulation. It isn't. Now they're decommissioned but even hospital pagers can be triangulated (some of them aren't even 1G, though anything remotely recent is just a cell phone in disguise)

Because of the "emergency services" mandate from governments it works without the sim being registered. Phones MUST be able to immediately call emergency services so sim or no sim, they are registered on the cell phone network using the number of the cellular modem hardware in the phone, the IMEI number. Phones without a SIM or eSIM can be triangulated. Phones that have never had a sim can be triangulated. Phones that had a sim, but now don't (you keep your phone on but have taken the sim out), can be triangulated based on the phone number of the sim (by looking up the IMEI that last used that SIM, then triangulating the IMEI). These systems can track mobile phones as they move, even in places where the signal is so weak phone service doesn't work (though of course, this doesn't exactly help with accuracy)

Of course whether all this works depends on the competence of the large telcos and the police in a specific country. What I said above is what's possible, not what is actually done. What another poster said is true: telcos have internet portals, accessible to the police (and ...) where you enter some information and get location back. This is generally demanded by governments, as the telco is not allowed to know WHO gets tracked by the police in most countries. Yes, in the US telcos are allowed to know, and they can even legally refuse to track someone, but in most of the EU this is not true.

Whether airplane mode prevents your location from being monitored depends on the phone.


iirc, Your phone sends signal to all nearby towers and then pick the closest one to connect with, which means the signal towers can also triangulate your location based from your distance to the nearby towers


> Correct me if I'm wrong, but cell phone companies only know which tower you are currently connected to. So it's pretty inaccurate. The only thing that is "house accurate" is the GPS on your phone.

That was the case before 5G. They'd only have your location to within a mile or so. 5G gives them your location to within feet. It's because they need to so many more towers.


The question is how accurate is cell tower triangulation?


It depends on the area. In very dense areas, it can be more accurate than you expect. It's also possible that they triggered a GPS response that told them rather precisely where the phone is.

I'm only speculating, of course.


A few years ago, when I was studying, my friend and I did a project on that in Xamarin. It took us two evenings, and the accuracy was 300 meters at worst, and 30 meters at best. It's worth noting that this was in a larger city.

So, if two students can achieve even 30 meters accuracy in two days, big telecom corporations will certainly do better in a few decades.

EDIT: By the way, it wasn't only triangulation but also signal strength change analysis. It wasn't as serious as it sounds, there are formulas already made for calculating that.


In the past, ~1 mile. One of the complaints people had about 5G was that it could make it much more accurate. Accurate enough to find a house or someone's location with it. It works because 5G needs towers all over the place to function.


Did the friend park the car out the front of his house, with a license plate that would have been shared by the sister? In the suburbs you don’t need to be overly precise, do a drive by and stop at the house with the car?


E911 says the PSAP has to be able to get within 100m iirc


Phones don’t just use triangulation. Modern smartphones will also use GPS (A-GPS).


This is about asking the cell network where the phone is. This is not about asking the phone where the phone is.


I think the question was "how did the phone company know the location", and GPS may be part of the answer.

In the US, E911 requires all phones to be able to report their physical location. Phone companies may use this ability to respond to police location requests. I don't know one way or another, but it seems likely.


Do phone companies have access to that when the phone isn't actively placing a 911 call?


Even if they don’t, they can use trilateration/triangulation (for which I assume they always have the necessary information: signal strength and approximate distance) to pinpoint the exact location.


Good question. Big picture, the phone companies have access to that information any time they want.

The E911 laws, though, only require that the location information be obtained and forwarded when the call is placed.

So, I don't know. I don't know anything beyond that.


They won't use that if the GPS / "Location" service is turned off. But the cell network still knows where you are anyway, within ten meters or better. The FCC asks for z-axis accuracy within 3 meters; good enough to determine what floor of a building you're on (for E911 purposes.) 5G Rel 17 can supposedly locate people within a meter.


Despite all the technology in the world the majority of police work is still plain old-fashioned knocking on doors and making phone calls. People will always voluntarily give up all the information in the world to be seen as good citizens. In your friend's case I'm willing to bet that they asked the sister for the names of his close friends and acquaintances and yours matched up.


No. They can locate anyone's phone on demand. The services that do this can generate a likely street address from GPS or tower triangulated location.

This is how many criminals now get caught while on the run. It isn't magic police work but rather the personal tracking device everyone carries. Likewise some spree killers have been tracked down by geofencing phones known to be around all crime scenes and zeroing in on the one that shows up at all/most of them.


Cell phones are only connected to 1 tower afaik. So no triangulation is possible, only the tower they are connected to, which is very broad.


That's not accurate; they get angle and time (distance) from the tower. It's a hell of a lot more precise than a circle somewhere around the tower.

https://www.ericsson.com/en/blog/2020/12/5g-positioning--wha...


Other towers can still passively track your signal. You also have to communicate with more than one tower during handoff between cells. This is a capability mandated by E911.

From https://en.wikipedia.org/wiki/Enhanced_9-1-1:

  To locate a mobile telephone geographically, there are two general approaches. One is to use some form of radiolocation from the cellular network; the other is to use a Global Positioning System receiver built into the phone itself. Both approaches are described by the Radio resource location services protocol (LCS protocol).


Look at the tower. It would have at least 3 antennas giving at least a 120 degree segment. As soon as a phone connects to another one you would have a line (or more like an ellipsoid) between the two towers. Even if the phone just lies on the desk it could switch towers, eg if the current one has too many clients, or the signal quality is pretty equal between them.

NB I worked in a such place, my phone would be in low 40-50% at the end of the work day, despite being able to endure two days easily if I would be at some other place.


Carrier aggregation is a thing since LTE-Advanced


Source?



Your "on demand" makes it read like they don't need to get a warrant whereas your link describes a missing-children investigation that had already made the national news, i.e., a situation in which getting a warrant would be very easy.


I've had it used on me personally without a warrant. There are no deep controls on this tech. You just have to know someone who can do a favor.


Well, sure, but more often than not, when someone on HN gives a URL to support some point, the URL ends up not actually supporting the point. I'm curious why people do that. Why did you do it?


A warrant can be "on demand" within minutes if you can get a judge to pick up his phone.


https://en.wikipedia.org/wiki/Sensorvault is for Google, with the 3 linked sources being very fun reads.


> Despite all the technology in the world the majority of police work is still plain old-fashioned knocking on doors and making phone calls. People will always voluntarily give up all the information in the world to be seen as good citizens. In your friend's case I'm willing to bet that they asked the sister for the names of his close friends and acquaintances and yours matched up.

Sure, but that doesn't pass the smell test in this situation:

1. That's a lot of work, which would take a lot of time to do. For instance, does the sister know the OP's number. His full name? His first name? Are they going do all the work to piece together fragmentary information for a wellness check?

2. The technology exists and is widely deployed for the police to straightforwardly take a quick shortcut around all that work.

And most importantly:

3. The police said they took that shortcut.


or they just triangulated using his cell phone, it can be very accurate in urban settings


You experienced a type 0 SMS. It can wake the GPS on a modern phone and return a GPS location.

Last time I checked cell tower triangulation is accurate to between a few hundred and a few thousand feet. Cellular A-GPS can be good to within a few feet inside houses usually but often its within a few tens of feet in accuracy.


> Last time I checked cell tower triangulation is accurate to between a few hundred and a few thousand feet

That was about what LTE could do. With 4G, they got it down to 20-50 meters. Now they can do much better.


Police need a warrant to get location data from your cell phone provider. No department is bothering with that for a welfare check unless the situation is really dire, and the process still takes a while to carry out. "Where do you think your brother is?" "Oh probably at XYZ's place" is a much more straightforward and common process.


I have some family who are dispatchers (not in the US), and they have the ability to immediately get location data directly from providers if they think somebody is in imminent danger. They can’t do it to track a suspect (not without a warrant), but they would regularly do it for suspected suicides, or when a caller communicated they were in danger but failed to give their location for what ever reason.

I wouldn’t be surprised if many jurisdictions around the world had similar systems.


That’s for the person who is actively calling 911 though, not a random persons phone.


In the cases I’m familiar with it was often used for other people calling in suspected suicide attempts (or other types of self harm, or drug overdoses, ect…)


I am a reporter who covers crime. Your account is 100% accurate. Federal law allows for the disclosure of customer records “to a governmental entity, if the provider, in good faith, believes that an emergency involving danger of death or serious physical injury to any person requires disclosure without delay of information relating to the emergency.” 5 U.S.C § 2703(c).


I don't know the processes in US, but in Europe I saw this in action first hand done in minutes, so I don't know.

edit: Over a stolen phone, no less, not even a person being in danger.


In the US the process is you go to the police to report a stolen phone and they say "tough luck, hope you had insurance".


Police need a warrant to demand that data. Nothing stops the provider from handing it over willingly.


Hopefully this new 'the Government can't compel companies' trial shuts this down as well

https://news.ycombinator.com/item?id=36614678

Either corporations are allowed to be 'pressured' by the government or they aren't. But of course the legal system will make themselves a nice carveout for their uses like always.


It won't shut it down. The cops aren't compelling or pressuring the providers to give the info. They're just doing it.


> Police need a warrant

if the information they gather is to be admissible in court as evidence against a person. Police do not need a warrant to save the life of a person.


But they said themselves that they pinged his phone.


They may have done both. Or they may be lying. In most cases it's best to assume that the police won't give you any info unless they are compelled to do so (and sometimes not even then).


Seems much more likely that his sister knew the friend, and suggested he might be there? Or there was some relation to the friend to know the exact address. Unless he lived at a single-family house, it's unlikely a phone's GPS would be exact enough.


Seems like much more work. Based on the stories I've seen about these operations to track down phones over the years, it's a little more complicated


They just call the phone and the system will typically triangulate it if it rings. It's used all the time in search and rescue.


I like this idea, very human. Social engineering basically. And at the end, they are not required to tell you their method.


But they can't find a stolen bicycle with a gps tracker as the gps information 'may not be accurate'. Similar for phones. /(am in europe)


That's just it, they are doing their own thing. This is why I liked the explanation, it reflects that the police is not an organization that's somehow representing and enforcing a higher moral standard, but rather a distinct thing that has its own life and culture. And that social engineering and parallel construction are part of daily life.


That is plainly allowed under federal law.

Pursuant to 5 U.S.C § 2703(c), a provider “may divulge a record or other information pertaining to a subscriber to or customer of such service (not including the contents of communications covered by subsection (a)(1) or (a)(2)”…“to a governmental entity, if the provider, in good faith, believes that an emergency involving danger of death or serious physical injury to any person requires disclosure without delay of information relating to the emergency.”


No one is arguing that it's illegal, OP only said its 'spooky', therefore bad. Sometimes bad things are plainly allowed by federal law.


The police can access all call logs; if they found your number among his last calls, starting from your house would have been among the first things to do in normal investigation.


kinda spooky you see your neighbours doors on your cameras :O


Triangulation by cell tower is really, really accurate.


Doesn't such tracking require a warrant?

Looking at call logs may require less.


Cops can freely buy anything from one of Peter Thiel's panopticon products. He can buy all the data from brokers and companies for a pretty high price, and sell it to cops for an equally stupid price, and your tax dollars get used to bypass the entire concept of a warrant.


No, no need for a warrant. If the cops ask nicely (as opposed to making a demand), and the provider provides the info, there was no need for a warrant. That is the common process today.


Not really, best in class network probes will regularly give you positions that are wrong by a few km, you need quite a bit of cleaning to reconstruct accurate paths.

That's why something like MDT was added to 3GPP standards and emergency calls trigger a hard GPS fix.


Sure, that seems like something that could happen. However, meanwhile, in practice, my friend was having a mental break and the cops narrowed my friend's location down to 3 possible houses in a neighborhood.


See this comment: https://news.ycombinator.com/item?id=36617330

Abusing emergency location services is a much better explanation here. They can ping the device for a short time and it'll do its best (using A-GPS and WiFi) to provide an accurate position, without involving anyone since it's fully automated. Collecting positions from a carrier's network infrastructure is a more complex and slow task in comparison.


How can you triangulate if you're only connected to 1 tower?


Towers use sector antennas that can cover typically 15 degrees down to 5 degrees, so the angle from the tower is somewhat known. There are some ways to get an idea how far a device is from the tower with sufficient access, but its usually a moot point because rarely does a device get into a place where it is only being seen on one tower.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: