For the Defense - Vol. 5, Issue 2 - 33

straightforward of which is through the "Global
Positioning System (GPS)." GPS uses physical
satellites in low earth orbit to triangulate and
pinpoint a device location anywhere on the
planet with accuracy down to about one meter
(~3ft). While GPS is the most well-known, there
also are similar competing positioning systems.
GLONASS, or "Global Navigation Satellite
System," offers similar speed, accuracy, and
coverage to GPS. Most modern smartphones are
equipped with hardware that can utilize both
satellite systems, as well as mix and match data
from the two, to speed up location resolution.
If you can't look up and see the satellites, GPS
satellites can't look down and see you. This is
why GPS typically does not work well indoors,
in valleys surrounded by mountains, city streets
where the skies are blocked by skyscrapers, or
in the forest under heavy tree cover. When GPS
resolution is unavailable or simply taking too
long, other tricks come into play.
Among the most common are passive Wi-Fi
and Bluetooth scanning. For about two decades,
Google, Apple, and other third-party companies
have been mapping the globe with their various
Navigation apps and "Street View" cars. These
cars are driven around the planet, collecting
photos and detailed GPS and radio signal logs
of everything. The cars not only are collecting
photos of your street, house, and vehicles in your
driveway, they are also scanning, or "sniffing,"
the unique ID of your Wi-Fi router, Bluetoothequipped printer, and garage door opener. Every
device that utilizes Wi-Fi or Bluetooth has what
is known as a unique Media Access Control, or
MAC address, and they are constantly projecting
this value for other devices. This is primarily used
for pairing two devices together, such as your
phone and earbuds, or allowing your laptop to
connect to your in-home Wi-Fi and print from the
backyard deck to the printer in the front office.
When a Google Street View car passes a
location, these unique MAC values are added to
a database and tagged with the physical location
of the Street View car at the time it registered
the signal. Now Google knows the wireless
network named "One Shot Coffee Free Wi-Fi"
with the unique MAC address "FF:FF:FF:00:00:00"
is located at the GPS coordinates "39.9677073,
-75.1406538". The next time someone is standing
on the corner of second and Bodine Street in

Philadelphia and their phone is having issues
communicating with a GPS satellite, it can simply
ask Google, "Hey, this is a list of all the wireless
networks I can currently see. Do you know where
I am?" Google will respond, "not exactly, but we
know that specific Wi-Fi is 300ft to your right."
Combine this with hundreds or thousands of
other Wi-Fi and Bluetooth signals on an average
city block, and an accurate representation of a
user's location is generated simply from passive
Wi-Fi and Bluetooth scanning in that location.
Yet, just as GPS requires line-of-sight, this method
has its downfalls. Its location services in rural
environments with few wireless devices separated
by several miles will not be anywhere near as
useful as they are in urban environments.
The third common method of gathering
location data is cell tower triangulation. This
is where cell providers and Call Detail Records
(CDRs) come into play. Much the same way
Google and Apple maintain a list of known
Wi-Fi and Bluetooth device locations they have
curated, cell phone companies can take this a
step further and not only identify towers you are
near, but exactly what side of a tower ("sector")
your phone is connected to. Cell providers have
full access to the data your phone sends to the
towers they operate, including how far you
are from the tower, the signal strength you are
receiving and sending, the other towers are in
the "neighborhood" and the specific "cell site"
on the tower you are connected to. All this data
is constantly recorded and audited for quality
control and network analysis, and ultimately the
data is used to improve coverage, speed, and
functionality of the cell phone providers' network
to one-up their competitors. This data is recorded
and logged in AT&T, Verizon, Sprint, or T-Mobile's
servers, waiting for analysis by a trained expert in
CDRs. It is kept by all the major cell providers for
at least one rolling calendar year.
So how do you actually get this CDR data? A
subpoena to the legal department of the cell
phone provider is typically all that is required
to get the data. It must be noted that when
authoring the subpoena/legal request that very
specific and technical terminology must be used
in order to receive full CDRs from a subpoena
response. The legal departments of these
companies will often produce only exactly what
is asked for, so if you are not specific enough you
may only get call or billing records, and not full
Vol. 5, Issue 2 l For The Defense

For the Defense - Vol. 5, Issue 2

Table of Contents for the Digital Edition of For the Defense - Vol. 5, Issue 2