Cell Tower Triangulation – How it Works

Cell TowerFirst, I refer you to Martin Yant’s earlier post on this subject:  http://wrongfulconvictionsblog.org/2012/05/10/cell-phone-evidence-doesnt-always-ring-true/

The post makes the point that data from a single cell tower is essentially worthless in trying to place someone in a particular location.  The best you can expect is a band within a 120° “pie wedge” from the cell tower.

If two cell towers are used, it gets much better, and if three towers are used it gets even better yet.  But to make sure this kind of evidence doesn’t get misused, and to know what it’s limitations are, it’s important to know how it works.

You may have noticed that the antennas on a cell tower are always arranged in a triangle.  There are some sound technical and economic reasons for this, but we won’t go into that here.  But it does mean that a cell tower can tell from which of the three antenna arrays it is receiving a signal.  Each of the three antenna arrays covers a 120° sector with the tower at it’s focus, and these sectors, by convention, are referred to as alpha, beta, and gamma – αβγ.

Within each sector, the tower can make a measurement of how far away the transmitting cell phone is.  This is done by measuring signal strength and the round-trip signal time.  For a lot of technical reasons, this is not a very accurate measurement, and the determined distance will have a reasonably significant error band.

Here is a diagram of a single cell tower showing concentric bands of distance from the tower, and the three “sectors”.  The distance bands don’t stop at “6”, but this is just to give you the idea.  Note that at six miles out, the arc of a sector is 12.6 miles long.

Here is how a single-tower location would work.  The cell tower has determined that the signal is coming from the γ sector, and that the origin of the signal is approximately 4 miles from the tower.  This would place the caller within the yellow band, which you can see is 8.4 miles long and “about” ½ mile wide – an area of 4.2 sq. miles.

If the cell phone in question is also negotiating with a second cell tower at the same time (and this must be the case), the ability to locate the phone gets much better.  Here is a diagram of the situation when the phone is 4 miles from the “orange” tower in the γ sector, and 5 miles from the “blue” tower in the α sector.  This will place the phone in an oval (shown in red) whose center is the intersection of the swept areas of the two towers’ approximate distance bands.

If a third tower is brought into play, and the phone in question is determined to be 5 miles from the (third) “green” tower, this diagram shows that the area of location can be estimated even more closely.  Keep in mind that the phone must be negotiating with all three towers at the same time.

In densely populated urban areas, the cell towers are close together, and a much closer estimation of phone location can be made than in a rural area, where the towers are far apart.

Some of the newest cell phones can actually report a GPS location, and this is quite accurate, and doesn’t rely on the cell towers at all.

Using cell tower triangulation (3 towers), it is possible to determine a phone location to within an area of “about” ¾ square mile.

Cell tower locating evidence often goes unchallenged by the defense.  Now that you have the basics, you should be in a position to challenge that kind of evidence when it’s called for.

10 responses to “Cell Tower Triangulation – How it Works

  1. Pingback: Droidtales #7 :: Protecting your phone « Bill's Blog

  2. can a mobile application determine the location using such technique?

  3. Pingback: Anyones knows how Android's Network Location Provider works? : Android Community - For Application Development

  4. Pingback: Android App keeps logged out : Android Community - For Application Development

  5. i have a question about circles why we draw a equal circles for each cell

  6. Pingback: Big Brother is Listening In | Undustrialism

  7. Pingback: Mobile Device Security : Paracentric Security

  8. Pingback: COMSEC Part I: An Introduction : Paracentric Security

  9. Pingback: Yes, your phone really is tracking every move you make (and some that you don’t) | Deb Shinder's Technology InSights

  10. Pingback: 4 Technologies That Criminal Defense Attorneys Use to Help Clients. | PcDrome

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s