Cell Tower Triangulation – How it Works

Cell TowerFirst, I refer you to Martin Yant’s earlier post on this subject:  https://wrongfulconvictionsblog.org/2012/05/10/cell-phone-evidence-doesnt-always-ring-true/

The post makes the point that data from a single cell tower is essentially worthless in trying to place someone in a particular location.  The best you can expect is a band within a 120° “pie wedge” from the cell tower.

If two cell towers are used, it gets much better, and if three towers are used it gets even better yet.  But to make sure this kind of evidence doesn’t get misused, and to know what it’s limitations are, it’s important to know how it works.

You may have noticed that the antennas on a cell tower are always arranged in a triangle.  There are some sound technical and economic reasons for this, but we won’t go into that here.  But it does mean that a cell tower can tell from which of the three antenna arrays it is receiving a signal.  Each of the three antenna arrays covers a 120° sector with the tower at it’s focus, and these sectors, by convention, are referred to as alpha, beta, and gamma – αβγ.

Within each sector, the tower can make a measurement of how far away the transmitting cell phone is.  This is done by measuring signal strength and the round-trip signal time.  For a lot of technical reasons, this is not a very accurate measurement, and the determined distance will have a reasonably significant error band.

Here is a diagram of a single cell tower showing concentric bands of distance from the tower, and the three “sectors”.  The distance bands don’t stop at “6”, but this is just to give you the idea.  Note that at six miles out, the arc of a sector is 12.6 miles long.

Here is how a single-tower location would work.  The cell tower has determined that the signal is coming from the γ sector, and that the origin of the signal is approximately 4 miles from the tower.  This would place the caller within the yellow band, which you can see is 8.4 miles long and “about” ½ mile wide – an area of 4.2 sq. miles.

If the cell phone in question is also negotiating with a second cell tower at the same time (and this must be the case), the ability to locate the phone gets much better.  Here is a diagram of the situation when the phone is 4 miles from the “orange” tower in the γ sector, and 5 miles from the “blue” tower in the α sector.  This will place the phone in an oval (shown in red) whose center is the intersection of the swept areas of the two towers’ approximate distance bands.

If a third tower is brought into play, and the phone in question is determined to be 5 miles from the (third) “green” tower, this diagram shows that the area of location can be estimated even more closely.  Keep in mind that the phone must be negotiating with all three towers at the same time.

In densely populated urban areas, the cell towers are close together, and a much closer estimation of phone location can be made than in a rural area, where the towers are far apart.

Some of the newest cell phones can actually report a GPS location, and this is quite accurate, and doesn’t rely on the cell towers at all.

Using cell tower triangulation (3 towers), it is possible to determine a phone location to within an area of “about” ¾ square mile.

Cell tower locating evidence often goes unchallenged by the defense.  Now that you have the basics, you should be in a position to challenge that kind of evidence when it’s called for.

34 responses to “Cell Tower Triangulation – How it Works

  1. Pingback: Droidtales #7 :: Protecting your phone « Bill's Blog

  2. can a mobile application determine the location using such technique?

  3. Pingback: Anyones knows how Android's Network Location Provider works? : Android Community - For Application Development

  4. Pingback: Android App keeps logged out : Android Community - For Application Development

  5. i have a question about circles why we draw a equal circles for each cell

  6. Pingback: Big Brother is Listening In | Undustrialism

  7. Pingback: Mobile Device Security : Paracentric Security

  8. Pingback: COMSEC Part I: An Introduction : Paracentric Security

  9. Pingback: Yes, your phone really is tracking every move you make (and some that you don’t) | Deb Shinder's Technology InSights

  10. Pingback: 4 Technologies That Criminal Defense Attorneys Use to Help Clients. | PcDrome

  11. Saw Ben Levitan explain this in Tennessee trial. Says accuracy is about good to 400 football fields. He said only 911 is accurate and not 100% of the time.

    • 911 can only trianglate if you have a phone that is connected (still on the call)and/or able to be called back. A phone that is pay per month can call 911, but no one will find you if you do not stay on the line. If someone paying by the month wishes to be found but can’t stay on the line, tell the dispatcher where you are.

  12. Pingback: “Automatic” Justice? | Wrongful Convictions Blog

  13. Pingback: How does cell tower triangulation works? - Quora

  14. Pingback: Idea -> Prototype -> Production | bhargavelectronics

  15. What about Remote Neural Monitoring using the above technique? Is it real? If it is, can we prove it in a court of law?

  16. One thing to remember when using triangulation or trilateration that the calculations are based premise that cell tower lat/longs and antenna azimuths are accurately recorded in database, this is not always the case. Please see E911 white papers at http://www.sunsight.com

  17. Hello Sir!

    Is there a way to track triangulated position on Google Map? If yes, please explain.

  18. Nice helpful

  19. Pingback: Triangulation Accuracy Cell Phone | Securitynews5

  20. If you know mobile towers IDs (MCC, MNC, LAC, CELLID) you can use the service https://www.mylnikov.org/archives/1059 and get the final triangulation position coordinates.

  21. Is it possible to determine all of the cell phone devices in one specific area if given a single target? Example, could triangulation help someone (with authority to access towers) determine my location and then every other cell phone within 100 feet of me?

  22. Reblogged this on Welcome To the World of Dreamers and commented:
    very useful blog

  23. Pingback: Seguridad en las comunicaciones móviles (Parte IV) | Digimodes

  24. Pingback: Why signal boosters are necessary

  25. So this data is also what is preserved by the carrier records yeah?
    I have a case to where I’m gonna need to have proof of being in a totally different town..roughly 35 miles away.
    For an alleged incident that occured about 2 weeks ago.
    The window of even 2-3 miles isn’t a big deal.
    I don’t know if you can comment under mine.. But if you can i have a few more questions.

    Can the carrier triangulate based on their own towers? Or does it have to be done by a forensic specialist?? (To be used in court)

    This can be a GREAT TOOL. Especially for innocent people.
    I could see how it could also be incriminating too.. Especially if you were within 1-2 miles of where something happened.

    Thanks for the post. 🙂 email me if you can see it. I would appreciate it.

  26. Pingback: SOLVED: Quick Answers to Frequently Asked Questions about SIM Cards - Up & Running Technologies, Tech How To's

  27. Pingback: Aaron Hernandez Caught by Cell Phone Tehnology | Nashville Criminal Law Report

  28. Pingback: A Swiss Bank Account in Your Pocket – ETP

  29. Pingback: Tecnologias de Localização na Pandemia do COVID-19 – CITi Blog

  30. Pingback: Learn about the method of triangulation - Homework Educator

  31. Pingback: When it is possible to locate/trace SMS sender?

  32. Pingback: How To Use Google’s Find My Device Tool To Locate Your Android Device – AppTuse

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s