Locating and tracking individuals is often a vital component of law enforcement operations. Throughout its history, American law enforcement has continually adopted new methods and technologies to track suspects with greater efficiency. Nineteenth-century state governments employed bounty hunters to track suspects across state lines,1 while some twentieth-century agencies used Global Positioning System (GPS) devices to track suspects’ vehicles.2 In recent decades, technological advances in cell phones have enabled law enforcement to track the vast majority of Americans without direct interaction, causing many federal courts to disagree about the proper use of such technology.3
With the widespread adoption of cell phones, much of the American population is now carrying a tracking device by default, endowing law enforcement with ample opportunities to locate a suspect.4 This article will explain the technology behind cell phone tracking methods, including the three primary means through which a cell phone’s location can be tracked. These three methods include: (1) analyzing historic cell site data, (2) real-time tracking using prospective cell site data and GPS, and (3) real-time tracking using cell site simulators. This article will focus on the technology behind each of these methods, and how the technologies’ capabilities and limitations impact the legal requirements of their use by law enforcement.
TRACKING THE LOCATION OF A CELL PHONE
When determining the appropriate method to track a cell phone, a law enforcement agency’s level of legal authority is based on the evidence already obtained. Some necessary questions might include: whether the agency has established proper probable cause to conduct the type of search contemplated; whether it has obtained a necessary search warrant; and whether more evidence of criminal activity is required. Although appellate courts are divided on whether these methods require a search warrant under the Fourth Amendment, several U.S. appellate courts have held that obtaining historic cell site data5 does not require a warrant—an issue the Supreme Court will address when it hears Carpenter v. United States.6 Additionally, as a matter of policy, the U.S. Department of Justice (DOJ) requires a search warrant for the use of cell site simulators.7
Analyzing Historic Cell Site Data
Cell service providers (e.g., AT&T, Verizon, T-Mobile, etc.) maintain records of a mobile phone’s activity as it connects to cell sites. In the industry parlance, the term “cell sites” refers to the towers and electronic communications equipment that are placed throughout the country (comprising a service provider’s network) that make cellular communications possible. The coverage area of an individual cell site varies based on several factors, but urban areas generally have a cell site every one-half to one mile—the typical coverage area is between three and five miles in more rural areas.8 As a cell phone moves throughout a coverage area, its connection transfers from cell site to cell site, maintaining a continuous connection with the strongest available signal, and this phenomenon effectively creates a broad record of movements by the holder of the phone.9 These records are stored by service providers every time a phone call or text message is sent or received, and collectively are known as Historic Cell Site Location Information (CSLI) .10
CSLI comes in the form of a directional radial wedge, a slice of the coverage area circle surrounding a cell site. When a cell device connects to a cell site, CSLI can determine within which radial wedge the device is located. This information, while useful, does not provide a precise location in the same way a GPS tracker would. Instead, CSLI can locate a phone within a 60- or 120-degree radial wedge extending between one-half mile and two miles in length.11 This precision is also dependent on the number of cell sites in an area, so the radii may be even wider in suburban or rural areas where cell sites are sparser.12 Broad locational information like this can help establish a pattern, but because the data is not precise and is maintained as a business record by cell service providers, the U.S. Court of Appeals for the Sixth Circuit held that obtaining it is not a search under the Fourth Amendment that would require a warrant—again, a decision that the Supreme Court will review this term.13
Under the Stored Communications Act, Congress also expressly permitted a governmental entity to obtain a customer’s name, address, connection records, and telephone number, or other subscriber number or identity from a service provider, with a valid subpoena, rather than a search warrant.14
Real-time Tracking with Prospective Cell Site Information and GPS
In contrast to historic CSLI, prospective CSLI is obtained by actively sending a signal to a targeted cellular device, triggering the device to respond to the cell site with information and creating a real-time set of locational records with the same general radii as historic CSLI.15 Although this information may not be precise, because the locational data is received in real-time, officers can determine the cell phone’s current general location (rather than its previous general location), significantly narrowing the search. Law enforcement can use this information also in deploying cell site simulators (another cell phone tracking innovation described below) to determine the phone’s location more precisely. The precision of prospective CSLI varies, however, based upon the number of cell sites in the area; if the targeted cell phone is within range of three cell sites, the location discerned from this data is nearly as precise as GPS.16
A cell service provider can also activate a cell phone’s internal GPS locator (if it was manufactured with one) in order to provide a precise, real-time location of the device without using CSLI and without its user knowing.17 While there is a potential disparity in precision between prospective CSLI and GPS data, these two methods differ from historic CSLI and cell site simulators (explained below) in that they provide law enforcement with the current location of a suspect anywhere in the country based solely on their cell phone number.
Locating Cell Phones Using Cell Site Simulators
Cell site simulators operate by falsely posing as a service provider’s closest cell site, tricking a cell phone into sending and receiving signals to and from the simulator. This allows the simulator to intercept the data as it is sent from a cell phone to the service provider’s network—a scheme commonly known as a man-in-the-middle attack.18 These simulators are also known as “IMSI catchers”, a moniker referring to a cell phone’s International Mobile Subscriber Identity number. The IMSI is unique to each device and is assigned by the service provider.19 This number is similar to a credit card number; the ISMI includes a numeric string that identifies the device and its associated service provider. Although a device can be assigned a new IMSI number, no two devices will have the same IMSI number at any given time.
When a cellular device wants to connect to a network, it will attempt to get the best connection by connecting to whichever cell site is emitting the strongest signal.20 IMSI catchers take advantage of this behavior and, by emitting an artificially strong signal, will force all cellular devices within a small area to connect to the device instead of the normal cell site.21 Per DOJ policy, cell site simulators used by law enforcement are configured to intercept only metadata, akin to a traditional pen register.22 The simulators are capable of intercepting a much broader variety of data, however (ranging from collecting IMSI numbers, to reading the content of text messages and phone calls, or even intercepting files from the phone), depending on the sophistication of the cell site simulator being used and the network to which it is connected.23
Although cell site simulators can intercept a variety of data, when they are configured as a pen register, law enforcement focuses on only the strength and direction of the signal from the targeted IMSI number. Law enforcement can also place cell site simulators in roving vehicles. Roving simulators allow agents to take the initiative in locating stationary suspects, monitoring changes in the strength and direction of a cellular device’s stationary signal. Police officers have employed similar tactics by placing radio transmitters (colloquially referred to as beepers) in contraband, allowing officers to track a contraband item’s location through a directional-receiver able to detect the strength of the emitted radio signal.24 According to the Supreme Court, law enforcement requires a search warrant when transmitting devices are tracked as the target takes them beyond the view of the general public.25 Applying that principle, a warrant would presumably be required for the use of a cell site simulator if, and when, the phone is not within public view.26
As cell phone technology advances and networks become more sophisticated, the ability of law enforcement to track a cellular device will almost certainly become more precise.27 These advances will likely deepen the divide between law enforcement’s capabilities and the average user’s understanding of the information collected by carriers—furthering the consumer’s already-meek expectation of privacy in their data under the third-party doctrine.28
As courts have been slow to apply Fourth Amendment protections to CSLI and cell site simulators, Congress and federal agencies might be better equipped to hold law enforcement more accountable. The DOJ has already taken steps in this direction, requiring law enforcement agencies under its authority to obtain a warrant before using a cell site simulator. Similarly, pertinent legislation, such as the Electronic Communications Privacy Act and the Stored Communications Act, can be updated to more appropriately protect consumer privacy given the current state of electronic communication technologies—covering many of the gray areas in which courts have struggled to apply Fourth Amendment protections.