Cellphone network upgrades make location tracking almost as precise as GPS
Advances in cellphone networks make a legal distinction between cellular location tracking through the network and through GPS increasingly obsolete, said cybersecurity researcher Matt Blaze during an April 25 congressional hearing.
Blaze, an associate professor of computer science at the University of Pennsylvania, testified before a House Judiciary subcommittee chaired by Rep. Jim Sensenbrenner (R-Wisc.) in the second in a series of hearings on the Electronic Communications Privacy Act of 1986.
"Network-based geolocation can often be more revealing than GPS tracking," Blaze said in his written testimony (.pdf), noting the bandwidth demand-driven phenomenon of increasingly smaller cellphone tower service areas in highly populated places and the limited indoor reception of GPS signals.
Smaller cellphone tower service areas translate into a smaller geographic area within which a user is known to be--and the development of ultra-small base stations known variously as picocells, femtocells or microcells makes network activity-derived location even more precise.
More towers also makes possible the triangulation of cellphone signals--correlating the precise time and angle at which a device signal hits multiple towers in order to pinpoint a cellphone's location "at a level of accuracy that can approach that of GPS," Blaze said.
"It is no longer valid to assume that the cell sector recorded by the network will give only an approximate indication of a user's location," he added.
Mark Eckenwiler, until recently a Justice Department lawyer specializing in surveillance issues and now with law firm Perkins Coie, noted that Federal Communications Commission regulations from 1997 requiring 9-1-1 call centers to have the ability to identify wireless callers has led cellular carriers to develop a triangulation technique using test signals that is accurate to within 50 to 300 meters.
But, he said in his prepared statement (.pdf), wireless carriers don't ordinarily store that 9-1-1 precision location data, meaning that it isn't available to law enforcement conducting an investigation of past events.
Law enforcement can seek that data prospectively, however, although ECPA doesn't provide a clear mechanism for obtaining that data, leading prosecutors to often obtain "a search warrant under Federal Rule 41 or state equivalent," he wrote.
ECPA also creates ambiguity for law enforcement seeking real-time cell site location information not based on ordinary cell signal triangulation, Eckenwiler said.
Under the pen register statue, government can obtain a court order to see what phone numbers an individual dials or receives, but the Communications Assistance for Law Enforcement Act of 1994 (which amended ECPA) puts physical location out of bounds, except for the extent to which location can be gleaned from telephone numbers themselves.
"This restriction creates a gap in the statutory framework: although it declares which type of process may not be used (i.e., a bare pen register order), it does not prescribe the types of court orders that may be used," Eckenwiler said in his written testimony.
Prosecutors as a result have applied for hybrid court orders to access that data, so-called because they cite the pen register statues and section 2703(d) of ECPA, which lets law enforcement obtain stored non-content data through a court order that requires the government to demonstrate "specific and articulable facts showing that there are reasonable grounds to believe" that the records are relevant and material to an ongoing criminal investigation.
But starting in 2005, some lower courts began rejecting applications for hybrid orders, Eckenwiler said, on the grounds that ECPA doesn't address duration of surveillance and other aspects of law enforcement interception of communications. "These courts concluded that the government needs to use a search warrant, not because the Fourth Amendment requires it, but rather because a search warrant is the only available mechanism," he wrote.
- go to the hearing webpage (prepared testimonies and webcast available)