Locating Users of Mobile Phones Tim Moors

1. Locating Users of Mobile PhonesTim Moors Senior Lecturer School of Electrical Engineering and Telecommunications University of New South Wales Sydney, NSW, Australia t.moors@unsw.edu.au

2. Outline 2 • Generations of mobile phones • Phone identifiers • Cellular location • Cellular communication • The communication process • Physical cell selection • Other locators • Summary and Questions

3. Generations of mobile phones 3 Year Names G Cellular? Digital? Provision for “data” Rate Support? VOIP 1970s MTS 0 No No No No 8kHz 8kHz 1981 AMPS Yes No No No 1 2 1993 GSM Yes Yes Yes No 9.6kb/s 1990s GPRS Yes Yes Yes No 114kb/s 2.5 2000 IMT-2000 Yes Yes Yes No 384kb/s 3 3.5 today HSPA Yes Yes Yes No 14.4Mb/s ? ? 4? Yes Yes Yes Yes ? VOIP = Voice Over Internet Protocol http://www.mobilebulgaria.com/uploads/mobiles/2004/01/pic_3_484.jpg http://luciafreitas.tripod.com/umpoucodetudo/EricssonHotLine.jpg www.belkin.com/skype/howitworks/ http://www.three.com.au http://park.org/Japan/NTT/DM/images/RF004900_s.gif

4. Phone identifiers 4 Handset serial number:International Mobile Equipment Identity (IMEI) • principally for locking phone to a service; theoretically also to block stolen handsets • press “*# 06 #” to view SIM card (“dual SIM” in some phones) 16kB-512kB memory contains: • address book, personal settings, etc • codes for securing access to phone, network • International Mobile Subscriber Identity (IMSI): Identifies phone within mobile phone system “Phone number”Mobile Station Integrated Services Digital Network (identifier) (MSISDN) translated to IMSI at edge of mobile phone system We usually want to locate people, not phones.  # SIM = subscriber identity module

5. Outline 5 • Generations of mobile phones • Phone identifiers • Cellular location • Cellular communication • Mobile vs cellular phones • Why cellular? • Base station snapshots • Cellular issues • The communication process • Physical cell selection • Other locators • Summary and Questions

6. Mobile vs cellular phones 6 Radio range is limited by: • power (limited by mobility and health), • antennas, • noise/interference level, and • signal processing Typical potential range: 10s of km in freespace (e.g. pastoral) • Usually don’t use full range due to congestive effects • Typical suburban effective range: 3km • Temporary base stations installed for large eventse.g. New Years Eve on Sydney Harbour • Real environments aren’t freespace; have “clutter” e.g. terrain, buildings, vegetation, mobile vehicles/people  may find blackspots in buildings only kms from base station Location of mobile phones is often based on this limited range. Current phones are cellular, despite being called “mobile” in Aust.

7. Why cellular? 7 Confining signals: • allows a frequency to be concurrently used elsewhere, raising capacity • reduces power needed, shrink battery/elongate lifetime • contains base station faults Hexagonal cells tessellateand approximate circles(distance = main determinant of quality) Usually sectorise cells triplets of directional antennas in a triangular arrangement on tower

8. Base station snapshots 8

9. Cellular issues 9 • Cell density should reflect subscriber density Better localisation in denser (e.g. urban) areas Subscribers need to determine power level to use: • Mobiles measures strength and error rate • Mobile notifies Base Station • Base Station indicates what power level to use • Base Station position subject to available real estate • Signals don’t propagate in free space  Real cells aren’t neat hexagons  Complex to determine which tower covers a particular point • Phone system needs to • locate mobile user in order to establish call to it • “handover” mobile users between towers.Handover also used to shift load during congestionBut logs generally record first cell, before any handover

10. Outline 10 • Generations of mobile phones • Phone identifiers • Cellular location • Cellular communication • The communication process • Frequencies • Signalling channels • Ephemeral location for call setup • What gets logged? • Physical cell selection • Other locators • Summary and Questions

11. Frequencies 11 Bands of frequencies are divided into channels, assigned to different telcos, divided amongst calls. Bands: • Main GSM bands: (others: 850MHz, 1900MHz) • 900MHz (890-915, 935-960MHz) • 1800MHz (1710-1785, 1805-1880) • Main 3G band: 2100MHz (Telstra on 850MHz) Time-division of channel  8 calls Effect on location: • # antennas: Separate antennas for each band more antennas  more directivity • Logged band: 900MHz propagates better than 1800MHz usually establish calls on 900MHz, then hand over to 1800MHz if quality OK most calls logged as established on a 900MHz cell 125 channels 375 channels

12. Signalling channels 12 • Broadcast: Base Station announces identity and frequency parameters • Common Control Channels • Paging: for Base Station to notify phone of a call • Random access: for phone to request access; response comes on an... • “Access grant” channel: Indicates which Dedicated Control Channel to use • Dedicated Control Channel: Dedicated to a specific call (e.g. to control handset power) Basic call processes: • Phone monitors Broadcast ch. to identify local Base Stations • Phone chooses Base Station, by strongest signal • Phone requests access using Random Access Channel If (unlikely) can’t access best Base Station (due to interference or congestion on Random Access Channel); then try 2nd best • Base station indicates channels (DCCH and voice) to use (Receiving call: Paging rather than request access + Access grant)

13. Ephemeral location for call setup 13 Need to track location of phone in order to call it “location areas” are non-overlapping groups of cells; larger areas: • Reduce frequency of location updates = mobile transmissions • Increase area covered when paging = mobile receipts and traffic Location Registers: • Phone number  home MSC Home LR  • tracks subscriber’s location • records ‘service profile’ (e.g. caller ID, SMS, etc) • Each location area has a Visitor LR  Location update process: • Mobile identifies new cell (through Broadcast) • Mobile reports to new Visitor LR for that cell • New Visitor LR notifies Home LR of location • HLR replies to new VLR with user’s ‘service profile’ then tells old VLR to delete record Calls to mobile go through HLR to current location;page to determine cell within the location area • Location is updated whenever phone is on(not just during call setup) • Information is ephemeral     

14. What gets logged? 14 Logs are kept for • both pre-paid and plan-based phones • voice (“regular”) calls and messages Available (to telco) in various forms: • “cell dump”: All calls through a certain Base Station or cell • “Call Charge Record”: for a particular phone (IMEI or MSISDN) What gets logged: • Date & time (when call was established), duration • Phone numbers (MSISDN) of both parties • Record Type: Numeric code indicating: • Voice or message • Which party initiated the call • IMEI of the mobile handset (served by this telco) • Cell IDs • First Cell ID: Where the call was established [Cells traversed during call are not logged] • Last Cell ID: Where the call was released (A recent addition to logs.)

15. Outline 15 • Generations of mobile phones • Phone identifiers • Cellular location • Cellular communication • The communication process • Physical cell selection • Sample antenna • Choosing which cell of a tower • Choosing which tower • Other locators • Summary and Questions

16. Sample antenna 16 Argus Antennas JPX310D JPX310D Elevation Azimuth Pictures from http://www.argusantennas.com/main/?c=custom/argus&custom/argus_task=view_product&product_code=JPX310D&mode=generic

17. Choosing which cell of a tower 17 Environmental factors equally affect all antennas on a tower since they are effectively co-located(c.f. choosing which tower)  Choice of cell affected only by: • Radiation patterns typically symmetrical • Resolution with which phonecan distinguish signal strengths • Uncertain: No worse than bar display,but unsure of requisite and signalling accuracy • Grey area of +/- 10 degrees around demarcation line

18. Choosing which tower 18 Signal strength diminishes with distance,as energy is dissipated and absorbed  Signals can be  absorbed by obstructions (terrain, buildings, people)  reflected, particularly by metal (rooves, vehicles) • generally weaker than direct signal, butmay be all that is available in a dense environment.  received through multiple paths, which may interfere(constructively or destructively,depending on multiples of wavelength  30cm) Telcos • Predict coverage, based onantennas and propagation & terrain models • Measure actual coverage, e.g. with cherry picker tower /monitoring & positioning equipment in boots of taxis • Produce “Cell Coverage Maps” indicating the expected“dominant cell” for each point Note: Devices are ambivalent to distance; only aware of signal strength   

19. Outline 19 • Generations of mobile phones • Phone identifiers • Cellular location • Cellular communication • The communication process • Physical cell selection • Other locators • Who cares where you are? • Sources of location info • E911 • Summary and Questions

20. Who cares where you are? 20 Consumers • Where am I? • Where is the closest xyz? • Where is my daughter? Telco • Derived from consumer demand • To customise content (e.g. ads for local businesses) • Capacity planning • New services, e.g. road traffic conditions • Obliged to help: Emergency services e.g. for people who are lost, or unable to Law enforcement

21. Sources of location info 21 Cell identity e.g. Optus FindA service Measurements of phone emanations • strength • timing • direction (in future, using steerable antennas) Direction finding well established for wildlife, military; but needs to be done live  traditionally exceptional;only now potentially normal. Positioning systems, e.g. GPS • Works best outdoors • Handset-based  privacy throughhandset control of disclosure Image from optus.com.au: Homepage / Personal / Mobile / 3G Mobile / FindA; drawing from http://www.acma.gov.au/webwr/consumer_info/location.pdf

22. E911 22 Telco provides address associated with caller to direct emergency services FCC has Enhanced 911 (E911) for mobile & VOIP users Legislation gives carriers choices: Location Popularity 67% within 95% within handset 60% 50m 150m network 20% 100m 300m hybrid 20% Timing: 1996: Development started (pre 9/11, but never only for emergency services) 1999: Wireless Communication and Public Safety Act 2003: 100% of handsets due to be compatible; few carriers met schedule Similar efforts in • Europe: “Coordination Group on Access to Location Information for Emergency Services”; more concern for privacy • Australia: ACMA discussion paper in 2004

23. Summary 23 • Most current capacity to locate mobile phones due is to the cellular nature of communication • cells are a couple of km wide • 120O sectors around towers, with 20O grey areas • Choice between towers heavily influenced by terrestrial “clutter” • Logs only record first (& recently last) cell for a call • System tracks, but doesn’t preserve, location area of phones that are on • Location services are increasing in importance • to customers • to telcos • to law enforcement...

24. Questions? Locating Users of Mobile PhonesTim Moors Senior Lecturer School of Electrical Engineering and Telecommunications University of New South Wales Sydney, NSW, Australia t.moors@unsw.edu.au