Tracking a CellPhone that's switched off

liamo

Extract from the Indo on the tragic Robert Holohan story...

It was felt that, if the signal from the key transmission mast could be significantly boosted, it could trace the handset even if the mobile was switched off.

The only way that this effort would not work was if the handset had been disabled - or if it had been exposed to serious water damage.

Now that's news to me. I was under the impression that off is off! Anybody care to enlighten me?

Regards,

Liam

DemoniK

Sounds suspect...

That said there are some devices that never really do switch off.

XDAs (unless the've been updated recently) for example do not switch off the cellphone bit even when turned off - just puts it into Standby.

My V600 doesn't really turn off when I hit off - but does turn off the transmitter/receiver. Just need to remember to put it into Aircraft mode when travelling so an alarm doesn't turn it back on again...

But in your bottom of the chain phone such as a Nokia 3510i I would expect off really does mean off

-RikD.

Peanut

It sounds like they just let slip some secret standy mode builtin to all phones, where a mobile that's turned off listens on low power for a (really?) strong base station signal, whereupon it replies back with a low power acknowledgement transmission...

Capt'n Midnight

Most electronic devices don't turn on and off , it's either on or standby, but if the battery was flat then woundn't work.

How RFIF works. The tag has no power source but it can receive enough power through the antenna from the scanner to send a signal back. The max range is only about 30m though. So given the right technology and lots of power you wouldn't even need to have a battery on the phone.

irishgeo

Your mobile isnt off unless the battery been disabled and the sim card removed. They really should have kept this quiet because now sick people who wish to harm other people and kids now know how to stop a mobile phone tracking them.

Peanut

So it's more or less just an rfid tag in a mobile. That simplifies it a bit.

IrishGeo, agree it was silly whoever let it out to the press, however it looks like we will be seeing more rfid anyway, so the privacy concerns will eventually come into the mainstream.
http://www.spychips.com/

Sunday Business Post article
http://archives.tcm.ie/businesspost/2004/09/05/story952627130.asp

Capt'n Midnight

irishgeo wrote:

Your mobile isnt off unless the battery been disabled and the sim card removed. They really should have kept this quiet because now sick people who wish to harm other people and kids now know how to stop a mobile phone tracking them.

of course they could just chip us all instead... :rolleyes:

there are privacy issues too , many people don't want big brother to know where they are 24/7

overall the emergency services would be able to save more lives by being able to locate car crashes and hill walkers etc.

Capt'n Midnight

Peanut wrote:

So it's more or less just an rfid tag in a mobile. That simplifies it a bit.

AFAIK phones don't have transponders powered by from the mast's signal , and it's impractical except at very short ranges, I'd reckon that either the papers got confused, journalists and technology don't mix or if such a thing exists it's powered from the battery.

Edit - maybe the phone is lying about the empty battery and there is a few % left for the hereIam signal, that would be sneaky indeed.

Pataman

The Columbian authorities used to track Pablo Escabar this way, he thought by turning it off he was safe. It is also rumoured that the Israeli's also use this feature to track Palistinians

Drag00n79

Pataman wrote:

It is also rumoured that the Israeli's also use this feature to track Palistinians

Yes, if memory serves, I think the Israeli military actually took out some Hamas guy in the late 90's based on this kind of technology.

Rew

Shamrok wrote:

Yes, if memory serves, I think the Israeli military actually took out some Hamas guy in the late 90's based on this kind of technology.

He was on the phone when they hit him.

Its the first iv heard of it all as well. Sounds like its all a bit like chinease wispers and the origanl source is nothing like what we are hearing.

daveirl

This post has been deleted.

monster_fighter

The Gards on RTE news (don't know which one, sorry) "clearly" stated that SOME phones MAY be able to transmit when off.

/me goes off to mod cell phone with a hardware battery switch.

The US phones ALL have GPRS built in since last year (it said on the news).

Scary stuff.

Heil Bertie,

monster

Rew

daveirl wrote:

This post has been deleted.

Well you know what they say:

Those that cannt do it write about it



Carolin Lillington with the Irish Times is a bit like that. She writes purely about technology but cannt post to her blog half the time coz she cannt get her mac up on a DSL line. Her articles go from being incitefull to dreadfull.

Jerry Ryan had a big discussion about it all this morning. Had a few experts on who were as secptical about it all as we are.

For a boosted signal to power the phone im pretty sure it would have to be built with that in mind (induction loop of some description) and TBH the cost of RFID gear that reads tags at more the 30cm is astronomical.

To triangualte the pos of the phone it would have to login to at least 3 cells. All the press conferences about that poor kid and this case have seemed like there is alot more know then what they are telling us (obvously for good reason) and that seems to go for the phone as well. Maybe they jsut put alot of work in to processing the logs for the phone before it died was turned off.

Peanut

monster_fighter wrote:

The Gards on RTE news (don't know which one, sorry) "clearly" stated that SOME phones MAY be able to transmit when off.

..riiiiight... so that more or less means all newish mobiles

Given what Rew is saying about rfid range, perhaps it's then a combination of a low power standby listening mode, coupled with a specialised high power base station. The mobile could send acknowledgment back at full power if it received the appropriate broadcast code from the base station I imagine.. maybe...

Rew

monster_fighter wrote:

The US phones ALL have GPRS built in since last year (it said on the news).

LOL, no they dont. In 2001 or so the Americans brought in a law called E911 (google will give you loads of info). E911 stated that all phones (mobile and fixed) had to be locateable by a 911 operator at their terminal without having to go to the operator for the info. For mobile phoines they had to be located to within 100m2. SOME mobile operators included GPS chips in to their phones to cover this requirement but not all. Others use the same cell triangualtion we are talking about here. E911 dosn say how the handsets have to be located jsut that they have to be located.

Dont belive everything you see on TV

Capt'n Midnight

Rew wrote:

To triangualte the pos of the phone it would have to login to at least 3 cells.

I think you can use signal strength and/or time to work out distance from a mast so only two would be needed, coverage patterns could also be used to work out likely positions even if one one mast could be seen in come cases ,
ie. you could tell if someone was X far away from the mast AND not able to see other masts so they are probably in that area.
Antennas on masts are sectorised (triangular masts with antennas at corners) so will get some directinality, maybe masts use diversity antennas so could get a better direction that way.

IIRC the Israelis used a radar/rdiation homing missile (or maybe it was just GPS) how nice for the American tax payers who paid for it all to know that the E911 system works.

gline

The first comment seems a case of dont believe everything you hear.

Rew

Cell Phone positioning is around longer then E911 and was probabaly military long before it was civial.

Iv see accuarte positioning off 2 cells but they combined Time Diferance of Arival (TDoA) and Angle of Arival (AoA) to do it and it wasn't GSM based. The sectorised antennas dont give a huge amount of direction. If your a few miles from a sector antenna the wedge of possible area that that creates is huge. AoA systes used phased antenna arrays to judge the angle of the signle but for every degree there out the error is exponentialy increased over distance. Time measuremenst are dificult as the radio signals are travling at the speed of light so you need higly accurte and syncronised time sources.

The coverage pattern stuff was used in the Soem(sp?) murder trial. Somthing about Huntlys house being in a small area with unique properties.

MadKevo

It's always amazing that when you know more than a journalist about a certain subject they appear to be extremely idiotic, lazy and inaccurate, yet we trust them to form our opinions of subjects for which we know little. Personally I blame editors and deadlines for this, not necessarily the hacks' fault. Makes you think eh?
My 2c for tonight, thank you world.
/MK

Tom Dunne

Lads - listen to what the Gardai are saying. They did say mobile phone technology played a part, they did not for a minute say that they were talking about the child's mobile phone.

My own theory on what happened was that they were monitoring several phones (friends, family members, etc.). They may have looked at location logs (the tri-angulation mentioned above) and noticed one particular phone going to a particular location (notice how they only sent a small sub-section of the search team to the area the body was found).

This whole tracking of powered off or dead mobile phones seems to be the work of some silly conspiracy theorist.

Peanut

tom dunne wrote:

Lads - listen to what the Gardai are saying. They did say mobile phone technology played a part, they did not for a minute say that they were talking about the child's mobile phone.
...
This whole tracking of powered off or dead mobile phones seems to be the work of some silly conspiracy theorist.

It was widely reported that they were talking about "boosting the signal" specifically in order to find the child's mobile.

e.g. from IOL - "Officers had worked with the mobile phone company O2 to boost the signal from Robert’s Nokia mobile phone, which went dead shortly after he disappeared. This allowed them to narrow down the search to the area around Inch Strand. An enormous mobile phone mast overlooked the site where Robert’s body was eventually discovered."
http://212.2.162.45/news/story.asp?j=130525280&p=y3x5z5986&n=130526040

I don't think it's far fetched at all that the mobile's radio could be listening in standby, the radio circuitry is there already, it's not as if they would need to make a major change to do it. It has already been mentioned here that a mobile is not completely offline unless the battery is removed.

moshpit77

when you set the alarm on your phone, then turn the phone 'off', the alarm will still switch the phone on and go off at the specified time. Therefore your phone is never really 'off' just on standby, unless the battery is removed

Kevin_rc_ie

It's always amazing that when you know more than a journalist about a certain subject they appear to be extremely idiotic, lazy and inaccurate, yet we trust them to form our opinions of subjects for which we know little.

I notice that a lot too.

This is kinda stupid and I probably shouldn't bring it up here but I misplaced my turned off phone in my house and unfortuently I can't ring it to hear the tone/vibration to find out where it is. The title of this thread gave me some hope. But I think I'll have to find it the old fashioned way (sniffer dogs) or is there anything technological i can do to find it.

Rew

Kevin_rc_ie wrote:

I notice that a lot too.

This is kinda stupid and I probably shouldn't bring it up here but I misplaced my turned off phone in my house and unfortuently I can't ring it to hear the tone/vibration to find out where it is. The title of this thread gave me some hope. But I think I'll have to find it the old fashioned way (sniffer dogs) or is there anything technological i can do to find it.

Na, break out the Pedigree Chum

gline

Kevin_rc_ie wrote:

I notice that a lot too.

This is kinda stupid and I probably shouldn't bring it up here but I misplaced my turned off phone in my house and unfortuently I can't ring it to hear the tone/vibration to find out where it is. The title of this thread gave me some hope. But I think I'll have to find it the old fashioned way (sniffer dogs) or is there anything technological i can do to find it.

Time to play fetch, LOL

Capt'n Midnight

MadKevo wrote:

It's always amazing that when you know more than a journalist about a certain subject they appear to be extremely idiotic, lazy and inaccurate, yet we trust them to form our opinions of subjects for which we know little. Personally I blame editors and deadlines for this, not necessarily the hacks' fault. Makes you think eh?
My 2c for tonight, thank you world./MK

The rule seems to be that for most things they have specialists, scientists do writeups for scientific journals, meterologists do the weather, but for things that journalists use on a day to day basis , cars and computers and phones etc. they try to do it themselves. Reading the technical section of many mainstream computer mags has a high cringe factor. A lot of factual errors.

gline

Capt'n Midnight wrote:

The rule seems to be that for most things they have specialists, scientists do writeups for scientific journals, meterologists do the weather, but for things that journalists use on a day to day basis , cars and computers and phones etc. they try to do it themselves. Reading the technical section of many mainstream computer mags has a high cringe factor. A lot of factual errors.

true, they dont bother reading up on things, or they read the wrong things and quote hear-say

seamus

Peanut wrote:

I don't think it's far fetched at all that the mobile's radio could be listening in standby, the radio circuitry is there already, it's not as if they would need to make a major change to do it. It has already been mentioned here that a mobile is not completely offline unless the battery is removed.

That's really the key here. As I said in another thread, even when the phone is dead, there's enough power to remember the time & date (probably indentical to the chip that keeps time & date in your PC), so it's reasonable to assume that there's also enough power for minimum radio usage.

I'd say it's probably a unintentional feature, just something that you get naturally with complex electronics. Remember that your power button is electronics-controlled (as opposed to say a light switch, which is a mechanical switch), so there must be some circuits in your phone that are always on except when the battery is removed.

kaimera

regarding the incident in cork :: was mentioned to me today that the boys phone wasn't turned off, just out of coverage. Thats how a boosted signal 'found' the mobile.

Rew

kaimera wrote:

regarding the incident in cork :: was mentioned to me today that the boys phone wasn't turned off, just out of coverage. Thats how a boosted signal 'found' the mobile.

Makes sense, pitty ity took em so long to do it...

daymobrew

Capt'n Midnight wrote:

overall the emergency services would be able to save more lives by being able to locate car crashes and hill walkers etc.

An RTE News story described how all US mobiles have a built in GPS chip for this very reason.

Rew

daymobrew wrote:

An RTE News story described how all US mobiles have a built in GPS chip for this very reason.

Not all of them, read back through this thread for E911 stuff and for the coments on poorly reseached journalism.

sceptre

kaimera wrote:

regarding the incident in cork :: was mentioned to me today that the boys phone wasn't turned off, just out of coverage. Thats how a boosted signal 'found' the mobile.

I'd run with that one too (Occam's Razor and so on). Thing is though, he was out there for a week, yeah? Do phone batteries last that long these days when they're searching for a signal? (my phone is crap and needs charging every few days even 200 hundred yards from the nearest phone mast)

John R

sceptre wrote:

I'd run with that one too (Occam's Razor and so on). Thing is though, he was out there for a week, yeah? Do phone batteries last that long these days when they're searching for a signal? (my phone is crap and needs charging every few days even 200 hundred yards from the nearest phone mast)

My most recent phone has been lasting over 6 days between charges including text messages and phonecalls so yes it is possible.


I do however think the theory of boostng a signal so a phone on standby can pick it up is crap, with the exception of devices that are/would be designed for that explicit purpose.
It is likely and probably inevitable that tracking technologies will be embedded in future cellphone products but not with current ones.

The power needed by the reciever is a great deal more than to run the clock, if the transmitters were on it would be noticeable in the battery drain of phones switched off.

Rew

Recivers are relitivly cheap to run power wise but trnasmitting drains the crap out of the battery. They couldn't position a phone that was just reciving it would have to transmit a response.

100gSoma

hi everyone,
The journalists in Ireland got it wrong. They got 2+2 and got 10 as usual.
The gardai said that mobile telephony played a part. What part it played is they tracked the last cell that roberts phone was in before it was turned off.
The cells are about 1km wide each depending on urban or rural area and usually overlap. The cell that your phone is registered in depends on which cell mast can pick up the phone signal strongest.
So most likley all they did was work out which cell the phone was in when it 'logged off'. This owuld have given them about 2km square to be 'extra vigilant' when searching. This is exactly what happened, as the gardai told the group to be "extra vigilant" in this particular area. They hoped to find the phone etc.

I did Digital Comms as part of my degree and I have never heard of a phone being traced when swiched off. This is crap. The news report said that small levels of radiation are still emitted even if its off or has no battery etc. Thats lies. Is it a nuclear phone? They then said the only way to stop it transmitting was water damage. jeezus. these people are unreal.
when your phone is off, it is OFF. no signal. All eircom or 02 etc can tell the gardai is where the last signal from your phone was recieved. And even this info can only be approximated to 400m sqaure to 2km square.

In the USA all phones sold after 2001 have a 911' chip. If 911 is dialed the phone sends a GPS signal to a secure site. Its location can be found within 5 metres. so if a kidnapped person dials 911 and leaves ther ephone in a pocket or at a site etc, the cops will be there asap.

Will come in here sooner or later when 3g is here.

Rew

100gSoma wrote:

I did Digital Comms as part of my degree and I have never heard of a phone being traced when swiched off. This is crap. The news report said that small levels of radiation are still emitted even if its off or has no battery etc. Thats lies. Is it a nuclear phone? They then said the only way to stop it transmitting was water damage. jeezus. these people are unreal.
when your phone is off, it is OFF. no signal. All eircom or 02 etc can tell the gardai is where the last signal from your phone was recieved. And even this info can only be approximated to 400m sqaure to 2km square.

In the USA all phones sold after 2001 have a 911' chip. If 911 is dialed the phone sends a GPS signal to a secure site. Its location can be found within 5 metres. so if a kidnapped person dials 911 and leaves ther ephone in a pocket or at a site etc, the cops will be there asap.

Where did you do your degree and did you data comms lecturer actaully tell you all that?

Superman

100gSoma wrote:

I did Digital Comms as part of my degree and I have never heard of a phone being traced when swiched off. This is crap. The news report said that small levels of radiation are still emitted even if its off or has no battery etc. Thats lies. Is it a nuclear phone? They then said the only way to stop it transmitting was water damage. jeezus. these people are unreal.
when your phone is off, it is OFF. no signal. All eircom or 02 etc can tell the gardai is where the last signal from your phone was recieved. And even this info can only be approximated to 400m sqaure to 2km square.

In the USA all phones sold after 2001 have a 911' chip. If 911 is dialed the phone sends a GPS signal to a secure site. Its location can be found within 5 metres. so if a kidnapped person dials 911 and leaves ther ephone in a pocket or at a site etc, the cops will be there asap.

Will come in here sooner or later when 3g is here.

well sounds pretty believable, better than www.spychips.com (he thinks his gillete is spying on him) also i watched a prog about a chechen guy the russians wanted to kill and they had to wait till he turned on his phone and then send the planes to get him and it worked, now i'm sure phone's still have power in them when they aren't fully on.

100gSoma

Rew wrote:

Where did you do your degree and did you data comms lecturer actaully tell you all that?

I did an Honours(2nd) B.Sc Degree IT with The Open university. I chose the Digital Comms module for one year of this.
Heres a link. http://www3.open.ac.uk/courses/bin/p12.dll?C02T305

The course was highly techincal and covered every aspect of Digital Comms including mobile telephony (which I did a project on). Soft Power on a phone only keeps the time/date intact etc. It doe snot emit any signals to the cells, of this Im quite sure. Someone please correct if Im wrong, in which case I'll be mailing OU to update their Mobile telephony information in the course.

Im sure he was traced by monitoring the area where his phone 'logged off' the cell. ie: was turned off, last 'goodbye' signal recieved by network.

Rew

I was just wondering coz some of you facts are bit off.

Cell coverage in GSM is up 30 miles (which is extreme).

There is no 911 chip as such but mobile operators do have to comply with the E911 directive which says they have to position phones to within 100m2. SOME phones use GPS others use the network its self. It doesn’t just transmit location when 911 is called they are using the positioning info for other value added features/services. GPS isn't that reliable in built up areas.

Operators can position a handset in Ireland using means other then what cell you are or were last logged on to. There are a few different methods they use which can be very accurate.

The point ahs been made in this thread that the phone was not off just out of coverage and that they boosted the local cells to try pick it up. Which makes sense and explains why the story came out that it was off and that they were boosting the signal to “activate it”.

As for the phone being on or off I tend to agree with you but then again iv never put a phone that’s off up to a spectrum analyser. Some organisations recommend you remove the battery when in dodgy areas/countries that you don’t want to be found in....

Peanut

Rew wrote:

Recivers are relitivly cheap to run power wise but trnasmitting drains the crap out of the battery. They couldn't position a phone that was just reciving it would have to transmit a response.

The point should be made however that it may only need to transmit in acknowledgement to a certain request from a base station, it could be in "passive receive" mode at all other times (*ie. not calling back every n minutes, which presumably means the battery could last a lot longer).

* = may not be true

Superman

Rew wrote:

Operators can position a handset in Ireland using means other then what cell you are or were last logged on to.

Yeah aint that how they caught the omagh bombers cause the phones went up and down the country in one day

Rew wrote:

then again iv never put a phone that’s off up to a spectrum analyser.

I do, every night, I leave it beside my stereo when its off and my stereo never makes that bogie noise it usually makes with phone so it is defo not gettin a signal

Rew

Superman wrote:

Yeah aint that how they caught the omagh bombers cause the phones went up and down the country in one day

Phone records were used in that case and they put phones owned by a particular guy around Omagh on the day. It was part of the case againt him. Dont think they ever caught the actual bombers.

I do, every night, I leave it beside my stereo when its off and my stereo never makes that bogie noise it usually makes with phone so it is defo not gettin a signal

Dosnt work like that im afraid but im sure if phones were transmiting when off sombody would have the spectrum logs to prove it. But try this turn you phone on put it write up to your stereo. Leave it there for a while. Does it interfere? Generally no (though you should here an ocasional blip). This dosnt mean your phone isn't talking to the cell.

Superman

Rew wrote:

But try this turn you phone on put it write up to your stereo. Leave it there for a while. Does it interfere? Generally no (though you should here an ocasional blip). This dosnt mean your phone isn't talking to the cell.

Yeah i conducted this little experiment last night i turned the phone on and put it in the hollow of my speaker and it was tick and interfering every couple of min, then i turned it off and nothing, so if it is putting out a signal its obviously different than the one it needs to communicate with the cell as that registers on my speakers.

BrianD

With the introduction of the E911 law it is incredible how closely the USA resembles the communist countries of eastern Europe up to their collapse.

Land of the free? I think not! Police State? Yes!

Rew

BrianD wrote:

With the introduction of the E911 law it is incredible how closely the USA resembles the communist countries of eastern Europe up to their collapse.

Land of the free? I think not! Police State? Yes!

As with any technology it has good and bad uses but is that a good reason bot to use them? E911 has probably saves lives daily and in other countries that dont have E911 equivlent laws the technology is abused by the state to find people or catch criminals. The operators in Ireland retain logs for up to 10 years. Thats a very detailed recored of movements.

German police wanted to find a phone but they need trafic generated to/from the phone (a requirement of German law as I understand it) to locate it so they made the operator send service messages that wouldn't cause any visual effect on the handset but was calssed as trafic...

Superman

BrianD wrote:

With the introduction of the E911 law it is incredible how closely the USA resembles the communist countries of eastern Europe up to their collapse.

Land of the free? I think not! Police State? Yes!

Oh good ol' politics creeps into the conversation somewhere, America ain't great for the ol' civil liberties but i think its got alot more going for it the Kiev or Bratislava in the 1970's.
anyway enought about politics , back to phones! there deadly!

irishgeo

They know hwo done the Omagh Bombings becuase the Americans were listening into the phone calls via spy satelite. The only problem is that these records could not be used in court for virous legal reasons. Its the same with any recorded stuff. Unless you are notified by what ever means, a sign , a recorded message etc , any recording can not be used in court.

seamus

irishgeo wrote:

They know hwo done the Omagh Bombings becuase the Americans were listening into the phone calls via spy satelite. The only problem is that these records could not be used in court for virous legal reasons. Its the same with any recorded stuff. Unless you are notified by what ever means, a sign , a recorded message etc , any recording can not be used in court.

Depends on the country obviously. I'm not sure what the story is in the states, but that's the story here. Of course, it can't be tried in the States under their law.
Catch-22 sometimes, but that's the law.

monster_fighter

irishgeo wrote:

They know hwo done the Omagh Bombings becuase the Americans were listening into the phone calls via spy satelite. The only problem is that these records could not be used in court for virous legal reasons. Its the same with any recorded stuff. Unless you are notified by what ever means, a sign , a recorded message etc , any recording can not be used in court.

????

Do you know how much GSM traffic you have record to get enought to crack
the encryption? Lots, terabytes - without that amount the key rotation makes near impossible.
So I doubt the used sat's to record GSM - now landlines are another story as they are routed unencrypted all over the place.