1. Copyright © 2007, Tim Moors Locating Users of Mobile Phones Tim Moors Senior Lecturer School of Electrical Engineering and Telecommunications University of New South Wales Sydney, NSW, Australia t.moors@unsw.edu.au

2. Copyright © 2007, Tim Moors 2 Outline Generations of mobile phones Phone identifiers Cellular location Cellular communication The communication process Physical cell selection Other locators Summary and Questions

3. Copyright © 2007, Tim Moors 3 Generations of mobile phones Cellular?Digital?Provision for dataRate 0 1 2 2.5 3 3.5 4? No 8kHz YesNo 8kHz Yes No9.6kb/s Yes No114kb/s Yes No384kb/s Yes No14.4Mb/s Yes ? VOIP = Voice Over Internet Protocol Support?VOIP Year 1970s 1981 1993 1990s 2000 today ? GNames MTS AMPS GSM GPRS IMT-2000 HSPA ? http://park.org/Japan/NTT/DM/images/RF004900_s.gif http://luciafreitas.tripod.com/umpoucodetudo/EricssonHotLine.jpghttp://www.mobilebulgaria.com/uploads/mobiles/2004/01/pic_3_484.jpghttp://www.three.com.auwww.belkin.com/skype/howitworks/

4. Copyright © 2007, Tim Moors 4 Handset serial number: International Mobile Equipment Identity (IMEI) principally for locking phone to a service; theoretically also to block stolen handsets press *# 06 # to view SIM card (dual SIM in some phones) 16kB-512kB memory contains: address book, personal settings, etc codes for securing access to phone, network International Mobile Subscriber Identity (IMSI): Identifies phone within mobile phone system Phone number Mobile Station Integrated Services Digital Network (identifier) (MSISDN) translated to IMSI at edge of mobile phone system We usually want to locate people, not phones. Phone identifiers SIM = subscriber identity module #

5. Copyright © 2007, Tim Moors 5 Outline Generations of mobile phones Phone identifiers Cellular location Cellular communication Mobile vs cellular phones Why cellular? Base station snapshots Cellular issues The communication process Physical cell selection Other locators Summary and Questions

6. Copyright © 2007, Tim Moors 6 Mobile vs cellular phones Radio range is limited by: power (limited by mobility and health), antennas, noise/interference level, and signal processing Typical potential range: 10s of km in freespace (e.g. pastoral) Usually dont use full range due to congestive effects Typical suburban effective range: 3km Temporary base stations installed for large events e.g. New Years Eve on Sydney Harbour Real environments arent freespace; have clutter e.g. terrain, buildings, vegetation, mobile vehicles/people may find blackspots in buildings only kms from base station Location of mobile phones is often based on this limited range. Current phones are cellular, despite being called mobile in Aust.

7. Copyright © 2007, Tim Moors 7 Why cellular? Confining signals: allows a frequency to be concurrently used elsewhere, raising capacity reduces power needed, shrink battery/elongate lifetime contains base station faults Hexagonal cells tessellate and approximate circles (distance = main determinant of quality) Usually sectorise cells triplets of directional antennas in a triangular arrangement on tower

8. Copyright © 2007, Tim Moors 8 Base station snapshots

9. Copyright © 2007, Tim Moors 9 Cellular issues Cell density should reflect subscriber density Better localisation in denser (e.g. urban) areas Subscribers need to determine power level to use: 1.Mobiles measures strength and error rate 2.Mobile notifies Base Station 3.Base Station indicates what power level to use Base Station position subject to available real estate Signals dont propagate in free space Real cells arent neat hexagons Complex to determine which tower covers a particular point Phone system needs to locate mobile user in order to establish call to it handover mobile users between towers. Handover also used to shift load during congestion But logs generally record first cell, before any handover

10. Copyright © 2007, Tim Moors 10 Outline Generations of mobile phones Phone identifiers Cellular location Cellular communication The communication process Frequencies Signalling channels Ephemeral location for call setup What gets logged? Physical cell selection Other locators Summary and Questions

11. Copyright © 2007, Tim Moors 11 Frequencies Bands of frequencies are divided into channels, assigned to different telcos, divided amongst calls. Bands: Main GSM bands: (others: 850MHz, 1900MHz) 900MHz (890-915, 935-960MHz) 1800MHz (1710-1785, 1805-1880) Main 3G band: 2100MHz (Telstra on 850MHz) Time-division of channel 8 calls Effect on location: # antennas: Separate antennas for each band more antennas more directivity Logged band : 900MHz propagates better than 1800MHz usually establish calls on 900MHz, then hand over to 1800MHz if quality OK most calls logged as established on a 900MHz cell 125 channels 375 channels

12. Copyright © 2007, Tim Moors 12 Signalling channels Broadcast: Base Station announces identity and frequency parameters Common Control Channels Paging: for Base Station to notify phone of a call Random access: for phone to request access; response comes on an... Access grant channel: Indicates which Dedicated Control Channel to use Dedicated Control Channel: Dedicated to a specific call (e.g. to control handset power) Basic call processes: 1.Phone monitors Broadcast ch. to identify local Base Stations 2.Phone chooses Base Station, by strongest signal 3.Phone requests access using Random Access Channel If (unlikely) cant access best Base Station (due to interference or congestion on Random Access Channel); then try 2 nd best 4.Base station indicates channels (DCCH and voice) to use (Receiving call: Paging rather than request access + Access grant)

13. Copyright © 2007, Tim Moors 13 Ephemeral location for call setup Need to track location of phone in order to call it location areas are non-overlapping groups of cells; larger areas: Reduce frequency of location updates = mobile transmissions Increase area covered when paging = mobile receipts and traffic Location Registers: Phone number home MSC Home LR tracks subscribers location records service profile (e.g. caller ID, SMS, etc) Each location area has a Visitor LR Location update process: 1.Mobile identifies new cell (through Broadcast) 2.Mobile reports to new Visitor LR for that cell 3.New Visitor LR notifies Home LR of location 4.HLR replies to new VLR with users service profile then tells old VLR to delete record Calls to mobile go through HLR to current location; page to determine cell within the location area Location is updated whenever phone is on (not just during call setup) Information is ephemeral

14. Copyright © 2007, Tim Moors 14 What gets logged? Logs are kept for both pre-paid and plan-based phones voice (regular) calls and messages Available (to telco) in various forms: cell dump: All calls through a certain Base Station or cell Call Charge Record: for a particular phone (IMEI or MSISDN) What gets logged: Date & time (when call was established), duration Phone numbers (MSISDN) of both parties Record Type: Numeric code indicating: Voice or message Which party initiated the call IMEI of the mobile handset (served by this telco) Cell IDs First Cell ID: Where the call was established [Cells traversed during call are not logged] Last Cell ID: Where the call was released (A recent addition to logs.)

15. Copyright © 2007, Tim Moors 15 Outline Generations of mobile phones Phone identifiers Cellular location Cellular communication The communication process Physical cell selection Sample antenna Choosing which cell of a tower Choosing which tower Other locators Summary and Questions

16. Copyright © 2007, Tim Moors 16 Sample antenna Argus Antennas JPX310D JPX310DAzimuthElevation Pictures from http://www.argusantennas.com/main/?c=custom/argus&custom/argus_task=view_product&product_code=JPX310D&mode=generic

17. Copyright © 2007, Tim Moors 17 Choosing which cell of a tower Environmental factors equally affect all antennas on a tower since they are effectively co-located (c.f. choosing which tower) Choice of cell affected only by: Radiation patterns typically symmetrical Resolution with which phone can distinguish signal strengths Uncertain: No worse than bar display, but unsure of requisite and signalling accuracy Grey area of +/- 10 degrees around demarcation line

18. Copyright © 2007, Tim Moors 18 Choosing which tower Signal strength diminishes with distance, as energy is dissipated and absorbed Signals can be absorbed by obstructions (terrain, buildings, people) reflected, particularly by metal (rooves, vehicles) generally weaker than direct signal, but may be all that is available in a dense environment. received through multiple paths, which may interfere (constructively or destructively, depending on multiples of wavelength 30cm) Telcos Predict coverage, based on antennas and propagation & terrain models Measure actual coverage, e.g. with cherry picker tower / monitoring & positioning equipment in boots of taxis Produce Cell Coverage Maps indicating the expected dominant cell for each point Note: Devices are ambivalent to distance; only aware of signal strength

19. Copyright © 2007, Tim Moors 19 Outline Generations of mobile phones Phone identifiers Cellular location Cellular communication The communication process Physical cell selection Other locators Who cares where you are? Sources of location info E911 Summary and Questions

20. Copyright © 2007, Tim Moors 20 Who cares where you are? Consumers Where am I? Where is the closest xyz? Where is my daughter? Telco Derived from consumer demand To customise content (e.g. ads for local businesses) Capacity planning New services, e.g. road traffic conditions Obliged to help: Emergency services e.g. for people who are lost, or unable to Law enforcement

21. Copyright © 2007, Tim Moors 21 Sources of location info Image from optus.com.au: Homepage / Personal / Mobile / 3G Mobile / FindA; drawing from http://www.acma.gov.au/webwr/consumer_info/location.pdf Cell identity e.g. Optus FindA service Measurements of phone emanations strength timing direction (in future, using steerable antennas) Direction finding well established for wildlife, military; but needs to be done live traditionally exceptional; only now potentially normal. Positioning systems, e.g. GPS Works best outdoors Handset-based privacy through handset control of disclosure

22. Copyright © 2007, Tim Moors 22 E911 Telco provides address associated with caller to direct emergency services FCC has Enhanced 911 (E911) for mobile & VOIP users Legislation gives carriers choices: LocationPopularity67% within95% within handset60%50m150m network20%100m300m hybrid20% Timing: 1996: Development started (pre 9/11, but never only for emergency services) 1999: Wireless Communication and Public Safety Act 2003: 100% of handsets due to be compatible; few carriers met schedule Similar efforts in Europe: Coordination Group on Access to Location Information for Emergency Services; more concern for privacy Australia: ACMA discussion paper in 2004

23. Copyright © 2007, Tim Moors 23 Summary Most current capacity to locate mobile phones due is to the cellular nature of communication cells are a couple of km wide 120 O sectors around towers, with 20 O grey areas Choice between towers heavily influenced by terrestrial clutter Logs only record first (& recently last) cell for a call System tracks, but doesnt preserve, location area of phones that are on Location services are increasing in importance to customers to telcos to law enforcement...

24. Copyright © 2007, Tim Moors Locating Users of Mobile Phones Tim Moors Senior Lecturer School of Electrical Engineering and Telecommunications University of New South Wales Sydney, NSW, Australia t.moors@unsw.edu.au Questions?