Tuesday, June 10, 2014

Two Bulls Fire - Cell Phone Tracing?

There was a forest fire dangerously near Bend, Oregon recently.  The origin is suspicious and KTVZ television station reported that a reward has been offered.  It started at a remote spot in the woods northwest of the city.

Update:  Two Bulls fire human caused.  News at the Bend Bulletin

The most obvious communication information related to a crime is who called who, when and where, what was said and why?  Total specific perp communication information desired by law enforcement. To get it requires probable cause and target person.

A cell phone tower dump gives information about every single cell phone that was in range of the tower and reporting its presence approximately every 7 seconds even when it is not being used.  That is how the cell phone service provider knows where to send a call or receive a call being made.

Identifying possible suspects by placing them in time and place alone is traditionally a good start in an investigation.  That is what a cell phone dump provides.

Law enforcement certainly would not comment of methods and investigation techniques.  A cell tower data dump could provide investigation information.  There is only hope that it will be done.  The public will probably never know if it was done or not. 

This website link shows the location of cell towers in the Bend, Oregon area:  Only two are located to the far west of the where the fire was located. 

What information does a cell phone dump provide?

Must a call actually be made/received to register with a cell tower?

Does a cell phone "register" with its proximate tower even when a call is not made/received?  Simply to transmit that it is in the vicinity to receive a call?  Is a record maintained of cell phones in the vicinity but not making/receiving a call?

This website link reports how the FBI caught a couple of bank robbers.  While the news story references actual calls it also references cell phones of the bandits "using a cell tower" and does not state that the use was for a call.

Wikipedia describes Mobil Phone Tracking

Mobile phone tracking refers to the attaining of the current position of a mobile phone, stationary or moving. Localization may occur either via multilateration of radio signals between (several) radio towers of the network and the phone, or simply via GPS. To locate the phone using multilateration of radio signals, it must emit at least the roaming signal to contact the next nearby antenna tower, but the process does not require an active call. GSM is based on the signal strength to nearby antenna masts.[1]

Is this tracking that is unrelated to actual use of the cell phone recorded and available in a cell phone dump?

This website link addresses that question:

But cellular networks also keep track of the location of any subscriber phones that are powered on and in range of the network, even those not in the process of making or receiving calls. Cellular phones work by periodically scanning for and "registering" with the nearest base station (generally the one with the strongest radio signal). When a phone moves out of range of one base station, it will search for and register with a base station in its new area. The latest base station with which a phone has registered is maintained in a central telephone company database that is used to route incoming calls to the correct base station. This process is automatic and transparent to the user; it happens as soon as the phone is turned on. That is, the current location of every powered on phone in the network is always known to the cellular carrier. 

However, it does not say that the information is retained in any history record.  The purpose of the ping and cell tower location is to complete real time calls.

This website link asks the question in 2007 about ping history retention:

Q. Can cell-phone providers go back into a person’s “ping history” and find where his cell phone was throughout a specific day, oh, say, about six weeks in the past?
  " A. No, according to Joe Farren, spokesman for CTIA-The Wireless Association, a cell-phone industry group in Washington. “These pings occur all the time, and there are 250 million wireless subscribers in America. There’s no reason to log such an incredible amount of data, so each ping over-writes the last one.”
But CNET News’ chief political correspondent Declan McCullagh, who has covered this issue extensively, is skeptical: “We know that telecommunications providers keep logs of who you call and who calls you,” he said in an e-mail. “Why would they treat cell-phone tower logs any differently?”
And as McCullagh and electronic-privacy advocates point out, data storage is dirt cheap these days and getting cheaper: If providers aren’t now able to re-create a cell phone’s path through the world, they probably will be able to do so in the near future.
Too late for some, perhaps. But way too soon for most of us."


What cell phones were in the area of the Two Bulls fire at about the time the fire started?  If they were registered by ping to either of the two westward cell towers in the area and if that ping info was retained in a data base it would significantly reduce the amount cell tower data dump of information to be searched.

What if the cell phone dump for each of the two westward cell tower (map locations shown at the link)  record of calls revealed calls to another cell phone registered as using the same cell tower.  If ping history showing that a cell phone was merely in the area, even if not used, for these two towers was retained it would show what cell phones were in the area and how long they were there.

If law enforcement actually obtains a cell tower dump to discover who might have been near the scene of the fire at the time it started that is a source and method of discovery that it probably does not wish to make public knowledge.  Bad guys might find out and turn off their cell phones while committing a crime.  It would be better if the public generally believed that cell phones only gave incriminating information when and if actual calls were made or received.  

Here is a conundrum.  Anybody can do some internet research like I did on how cell towers work and learn about cell tower data dumps, what information they contain and how that might be used by law enforcement to catch bad guys.  However if that becomes general public knowledge it defeats itself and its purpose.  Is it better then that the public not generally know law enforcement capabilities and methods?  Let the courts monitor them.  With secret court actions? Just how far does keeping the secrets go?

What if the fire was in the vicinity of Mt. Bachelor, further west.  There is only one cell tower there and its area extends to Elk Lake.  The road is popular but relatively few persons travel it and all their cell phones ping to the that cell tower far less compared to cell towers in the city.  How many cars might travel in the vicinity of that tower on Mt. Bachelor during any given time frame.  Each car that travels the road has a destination and stays at that destination for some time.  All that is probably recorded by the cell phone tower.  Certainly in real time because that is how cell tower communication works.  If it is recorded in real time then that information can be retained in history.  That is in fact done but to what extent all cell tower ping information is recorded in history and retained by each service provider (or anyone intercepting this information) is unknown.

If Federal Government property was involved in the fire the FBI would be involved.  While local law enforcement might ask for a cell tower data dump, the FBI probably makes use of this type of information more often.  This web link reports that warrants are not required for this information.  Analyzing it however could lead to the identification of suspects and probably cause to for further investigation.

Data mining cell calls to monetize the Big Data base is a growing business.  This website link discusses the gold mine opportunity.   It gives the example of using Call Data Records to determine distances traveled from home.  The requirement of course is that a call be made and a CDR be generated at two different locations over time in order to determine starting and ending location.  Some duration between calls made at the same location would be required to call it a home or a work place.

A call is a very selective data point that depends on a call being made.

Why use calls as data points when the phone is constantly pinging cell towers to determine which is closest to relay a call at any given time on a real time basis and cell towers hand off to other cell towers as determined by the ping of a traveling cell phone.

Ping data is where the big data is.  If it is not being recorded in history now, and I think it is because the value is too great not to do it, it will be recorded and stored in the near future.

If cell phone ping data is being recorded in history now for access by law enforcement to determine cell phone location over time then it is an intelligence means and method that could not be publicly revealed nor could it be used to identify suspects without a parallel source track that could reasonably explain how the information was obtained.  Like "during a routine traffic stop" or some other plausible explanation.

This scholarly  analysis can be downloaded at this web link.
"Ill-Suited to the Digital Age:  Problems with emerging Judicial Perspectives on Warrantless Searches of Cell Site Location Information"

It explains the process where cell phones register with cell towers.


"Cell phones are designed to automatically scan for the closest cell tower, to ensure adequate signal strength between the phone and the tower.16 Every seven seconds, the phone sends a “ping” signal to nearby towers, in a process called “registration.”17 Registration identifies the closest tower, and ensures that calls sent to and received by the phone will be routed through that tower, which provides the strongest signal.18 Registration continuously occurs as long as the phone is turned on, and cannot be stopped by any means short of turning the phone off.19
Registration identifies the phone through two unique numbers assigned to each cell phone: its mobile identification number and its electronic serial number.20 The mobile identification number is the series of ten digits dialed to call the phone to which it is assigned.21 The electronic serial number is permanently assigned to each cell phone and allows its cell phone service provider to identify the phone on the service 


provider’s network.22 Cell phone service providers use this information to create and maintain a record of every cell tower with which each phone on their networks has registered, and when each of those registrations happened.23 Cell phone service providers retain this record for between one and two years, depending on the service provider.24
Consequently, a cell phone service provider is able to pinpoint the location of a cell phone by cross-referencing the location of the cell tower with which the phone registered, and the time at which the registration occurred.25 Using this information, a cell phone service provider can determine the location of a cell phone, and by implication its user, at virtually any point in time over the preceding one to two years"

Note: This is footnote 26:  
"location in real time as it registers with cell phone towers on the service provider’s
network, the information is termed “real time CSLI.” Blank, supra note 25, at 13.
Where CSLI is used to determine where the phone registered at earlier points in time,
before the search for its location, the information is termed “historical CSLI.” Id."


Very specific information in  document that appears to be well researched.  It does not have any provision or qualification that a call either be made or received

More analysis of Historic CSLI at this web link.

This is a link to Google search results for Historic CSLI

It looks like this to me:

Browsing the links it appears to me that cell phone registration with cell towers,  Simply sending a signal to the cell tower it is closest to every 7 seconds and not related to making or receiving a call is stored in a history record by the service provider.  That contradicts any statement that only the current cell tower location is known to the cell service provider and it is overwritten with no record of history.

So, what cell phone was out in the area of the Two Bulls fire and broadcasting its presence every 7 seconds.  What cell tower would it connect to? There is an iPhone app to find cell towers.  Perhaps some way to find out what cell tower a cell phone in a particular area would register itself to.  There is a code that can be entered to find out but it is controlled by the service provider.

Surveillance.  We are being watched.  Is this a case that makes the watching something beneficial.  The question is:  Who was somewhere at a certain time.  The general place and time are known.  Is that probable cause to suspect anyone in that area at that time?  Especially when it is a remote area.  

Was that same cell phone pinging a tower near Skyliner where  another fire was reported today?

Cell Tower history data dumps seem to be legal and no warrant required.  This is a recent court finding web link.

This entire blog entry is about cell tower dumps and the nature of their information related to law enforcement. I speculate on a specific local incident where there is some degree of possibility that such information might be useful in identifying possible suspects.  Whether or not law enforcement actually obtains this cell phone dump information, if it is even available and obtainable is totally unknown.  Probably not?  or:  Yes, of course they do it all the time, especially when the towers are remote and the magnitude of data recorded in a time frame is small.

The blog entry deals with matters that have a degree of secrecy so who knows?  If it is done then to what degree does law enforcement use Parallel Construction as described by this Wikipedia link to hide actual means and methods of crime investigation.  If the perps are caught soon what information leads to their capture?

To what extent might any agency involved or related to matters considered in this blog entry want to suppress such information/speculation for the public good?  To the extent that this entry does not appear in a google search?  If so, how is that done, if it is done, and who does it? 

Court Rules Warrantless Cell Tracking Unconstitutional

US appeals the ruling 










No comments: