Ted November 2, 2021 8:04 AM


Very interesting rebuttal from benny bryant.

benny included what looks like highlighted screenshots from court case filings. Are these out there and accurate?

benny also tweets:

PSb/ they have not all been discovered solely by telecoms data
they’ve been discovered via Signal chat, GoToMeeting meetings, Facebook messages, bank records, phone records, email records…

Does cell phone metadata still take the lead on discovery? Also what is benny’s angle on disagreeing with Tomi Ahonen?

Alan November 2, 2021 8:26 AM


Having followed the proceedings primarily through @emptywheel at and , I believe @bennybryant17’s screenshots are accurate. You can check them yourself at or, from a more authoritative source but one that you have to pay for, at

I think video evidence has taken the lead in discovery. There are thousands of hours of video taken from security cameras inside and outside the Capitol as well as the intruders’ own smartphones that they used to record their activities to upload or stream to social media. The video evidence is primarily buttressed by financial info such as hotel and flight charges. The cell phone meta data may have been used as a screen to tell investigators who to investigate, or to help identify false leads, and has been used in search warrants. I’m not sure how much of it has been used in the actual indictments however, but it may have been in cases where the tower pings or GPS data strongly indicated a location directly in the interior of the Capitol. Reading the indictments and unsealed search warrants would definitively answer that question tho.

I don’t think @bennybryant17 has an angle on this except to take umbrage to fake news and efforts at self promotion.

Alan November 2, 2021 8:41 AM


PS, as @bennybryant17 also correctly points out, a lot of the investigation has made use of social media posts (facebook, parler and others) in which persons bragged about their activities on January 6, which was then traced back to the suspects using server IP logs, etc. Indictments and plea agreements were also leveraged to expand the investigation by requiring suspects to identify with whom they communicated, traveled, and/or entered the Capitol, and to allow their phones and social media accounts to be searched.

Winter November 2, 2021 9:12 AM

“Very interesting rebuttal from benny bryant.”

I particularly like the fictional account by Tomi Ahonen. He has worked at Nokia from before SMS was invented and through the whole mobile revolution. His job has always been to extract data for marketing from mobile networks. He has a good view on what mobile meta data is available and how it can be used.

Winter November 2, 2021 9:27 AM

“Deep analysis of social media networks can be very revealing!”

Network analysis is the most effective discovery method I know short of telepathy.

echo November 2, 2021 10:24 AM


Network analysis is the most effective discovery method I know short of telepathy.

There’s other people way on the case more than I am (like 1000%) or spotting something ages before I wombled in to things. I’ve seen some of the network analysis (by a person with a job title in this area) and it made my eyes pop.

I have zero idea what intelligence agencies or law enforcement do with this stuff. Cops by and large are utterly dumb and have their own issues as we’ve been hearing about recently but then the cops are what they are so there’sonly so much you can expect. The current UK government is half the problem so not much noise from them. I find their centralisation of power, secrecy, and use of behavorial psychology very suspect on top of everything else.

Two things just dropped in my lap today. The BBC (and Guardian) has some real problems. Mismanagement is one thing then there is the lying by management. There’s a traffic analysis angle here but also how you interpret this. It’s not so much what’s in the media but what they’re keeping out of the media.

Winter November 2, 2021 11:10 AM

“Wha wha what?! Was it fictional?”

Follow the thread from the picture of Motel6. Then you get a picture of Tomi (with hat) in front of the Arby’s in Penna. 😉

However, this story is what they teach in security kindergarten. It is just that the foot pawns and front people are generally really, really “underqualified”

PS: It is no secret that Tomi loves America but does not like Trump et al. (which is an understatement).

Winter November 2, 2021 12:24 PM

“Note also some frightening assumptions such as “Means he was AWARE of his guilt”. ”

That is quite normal. If you argue there was no premeditation, then anything that indicates you took precautions or preparations is relevant.

Ted November 2, 2021 1:14 PM


Then you get a picture of Tomi (with hat) in front of the Arby’s in Penna.

I couldn’t find the picture, darn it. But I still need your help. I’m hoping you can explain to me why Tomi would use misinformation (it is misinformation right?) to inform his 116k twitter followers about the exact nature of the surveillance and particularly the phone surveillance used to ID the conspirators when there is SOO much astounding legitimate information.

@Alan had some awesome info. I couldn’t find the exact documents that benny bryant screenshott’d in his tweets, but I found a related one searching for Case 1:21-cr-00028-APM.

I guess I don’t understand if Tomi is trying to be humorous or be a part of the action? Or is he trying to spread general, even if it’s wrong or incomplete, info?

Reading the case document about the conspirators is horrifying and entertaining at the same time. It gives more details about some of their activity, but due to time constraints on my end I don’t know how it aligns with Tomi’s twitter thread.

These people remind me of my cousins, if my cousins were 8 and bat 5h*t crazy.

Winter November 2, 2021 1:41 PM

“I couldn’t find the picture, darn it.”


“I’m hoping you can explain to me why Tomi would use misinformation (it is misinformation right?) to inform his 116k twitter followers about the exact nature of the surveillance and particularly the phone surveillance used to ID the conspirators when there is SOO much astounding legitimate information.”

What you will see in the news media will be the clear evidence. But that does not tell you how the FBI found/will find the suspects in the first place. Tomi’s account tells us how they could have done it using public information about the technology and the FBI.

Tomi writes:
“I have no intention to give a ‘how to commit a perfect crime’ guide-book on finer details of my industry. I will keep this broad, but everything in this Thread is 100% true. FBI went into FAR more detail than this fictional ‘episode of The Wire'”


Tomi also makes it clear in every tweet that this is fictional: He calls it “The Wire: Trump Special Thread”. As you might know, The Wire was a fictional series.

Clive Robinson November 2, 2021 1:58 PM

@ Stéphane Bortzmeyer,

So, turning off your tracking device (your smartphone) now makes you a suspect.

It is the modern version of “behaving suspiciously”.

Anyone who plans to do something has two problems with regards the planed scene to be,

1, Explaining they were not there.
2, Explaining where they were.

Those with sufficient resources solve both be getting another party to carry out the plan.

They then just behave normally, or make the plan coincide with some public function they attend and have many independent witnesses. Their only problem is ensuring they are noticed and remembered which is not that hard when you think about it.

Others used to “loan” a friend who looks similar to them their credit card, mobile phone, etc so they go out for the night and spend on the cards in various places maybe send a few texts fron there etc (but not take or make voice calls). The friend being wise enough to be careful to avoid CCTV. Obviously this is getting more difficult due to the increase not just of CCTV but the miniaturization and hiding of high resolution cameras that make facial recognition and other ML systems to identify people etc a breeze…

Streetwise kids in London go out in groups and swap not just phones, but travel cards, and as they go along clothes and back packs etc they also “mill” amongst themselves making tracking hard. That is they create so much noise in the CCTV footage that it’s never going to be believable in court, and almost anyone can say they were “in the group”.

So what does someone planing to do something do to not be where they are carrying it out.

Well the first is to “run silent” that is no phone use only cash have clothes etc in a bag they can use to change their appearence several times. Unfortunately CCTV is to numerous and “body build” and “gait” are very very hard to disguise.

A second option is “run under false flag”. Which is to appear as an identifiable individual using their phone, cards, clothes etc. This is a highly risky strategy for a whole variety of reasons, but it can be done.

One variation that is almost in the realms of fantasy is for you to “set someone up” to be the prime suspect. That is in effect you carefully get travel cards, burner phone etc and associate them with the target in various ways prior to the planed action. You then at the planed place ensure that there is “contact” / “trace” of the objects, and likewise contact evidence of the place on the objects. Having carried out the plan you then arange for the objects to be found at a place such as the targets home in a way that looks like there was an effort to destroy them that failed. Whilst it is a near fantasy for people making plans, a variation of it most definately not. That is “fitting up” suspects that certain UK police forces have been caught doing over the years to “get results”.

But that still leaves the problem of being somewhere else and this is actually quite hard to do convincingly. Just leaving your phone at home or turning it off is not going to work.

The reason “humans are creatures of habit”. Unless you plan otherwise for quite some time before hand the change in your behaviour will show up in cell phone records etc, like a shining beacon.

So you have to do two things as a minimum,

1, Change your habits a long time in advance (ie six months or more).
2, Have a believable and verifiable reason to have changed your habits.

The easiest way to do this is not to have a plan and then have to change habits, just change your habits now bit by vit. That is say tommorow you become just a little eratic in how you use your phone, and over time become more erratic or make changes for shopping and going out that gives you “me time” or “windows of opportunity” etc.

That is if you plan to go out for the evening with the girls/guys, turn your phone off the night before when you go to bed, putting it on charge. Then only turn it on when you say get to work in the morning. Over time you make the night before put on charge or turn off earlier and earlier then you have a believable window. Sometimes just turn it off before you leave work. If anyone asks why “saving the battery for night out” helps establish patterns in other peoples heads as well as cell records. Bit by bit you build up space or “windows of opportunity” that you can, if you later need to plan something use to your advantage. Likewise if something unexpected happens the fact that your phone was off when it’s most likely to happen gives you space.

There are several other things you can do, but the point is “habits are a strong signal”. Much worse if you “break habits they are as strong a signal” of “difference” thus circumstantial evidence that can be easily made to look like “guilt”.

If you don’t have “habits” then all you make is “noise” which makes the circumstantial evidence harder but still arguable by a prosecutor. The real trick is to have weak habits that work in your favour that way you have counter argument to assumptions of guilt.

People get taught such techniques as part of basic “field craft” courses so that if they have to meet a handler or visit a drop box etc there is not a visable pattern in what they do that correlates such meetings etc.

Aside from people “flapping their gums” which gets police well over 80% of their suspects, t’s all about “finding,patterns”. Not just in your activities but in other peoples activities that coincide or correlate over time. In communications we talk about “Traffic Analysis” in other activities they talk about “contact networks” and similar. In all cases they are looking for patterns and correlation. These are getting the “trickle down” effect and moving out from intelligence agencies into law enforcment agencies, as well as private contractors / consultants working for large corporates etc.

In all cases the investigators MO is get a list of potential suspects as a starting point, droping those who have credible alibies etc, till there are just a few “likely suspects” then the game changes the investigators stop looking to eliminate suspects, but find indicators of guilt. But at all points of an investigation individuals are automatically assumed guilty untill proven not guilty in one way or another. Circumstantial evidence almost never makes you “not guilty” but it very often does make people “guilty”.

That is in the eyes of investigators, circumstantial evidence is just “random” / “chance” when it might clear you. But “probative” / “probable” when it might make you guilty. This is a cognative bias at work, and nearly all investigators have it. Because they are almost always “results driven” and a “result” is “finding someone guilty” as far as they are concerned “anyone will do” even if the happen to be innocent. Because “results matter, justice is irrelevant”, “case closed move on”.

That’s why the sound advice is “Never ever speak to investigators even if you are innocent” there is absolutly no benifit in it for you, and potentially significant harm. Even telling the truth can make you look guilty. You say you were on a bus, they won’t try at all hard to find witnesses, it’s a lot of pointless work for them because you’re guilty anyway… They are more likely to try and find some one who thinks they saw someone vaguely like you, and warp their memory. That way in court the prosecution claim there was no evidence your story was true, but a witness very definately places you at the scene. That takes a jury just about long enough to have a cup of coffee to find you guilty…

Etienne November 2, 2021 2:37 PM

I’ve read where many of the domestic terrorists were using cheap FRS phones. Most terrorist teams probably wouldn’t stray far from each other, I agree. There is safety in numbers.

I think only rubes would continue to use cell phones in the 21st Century, in order to plan and blow-up the country, thus making the way for the Haitians and Hondurans to empty the Treasury.

Winter November 2, 2021 2:46 PM

“Alt link to read thread”

Nice read. Note how the origal thread of bennybryant17 criticized Toni’s story along the lines that the perpetrators were not able to keep up the opsec they should have.

This coup failed because the insurrection was executed by people who were as hopelessly incompetent as their boss.

Alan November 2, 2021 3:04 PM


Their poor opsec made no difference in the success or failure of the coup attempt. Their poor opsec was only discovered and used against them after the coup failed. Hopefully next time, if there is a next time, they will be discovered and the coup attempt thwarted before it even gets started.

Zaphod November 2, 2021 3:58 PM

@Clive – absolute gem of a comment, contents noted and enacted. Along with a multitude of previous advice you gave freely shared, spanning well over a decade.

Take care and best wishes from me.

Clive Robinson November 2, 2021 5:34 PM

@ Alan,

If you read @bennybryant17, it’s clear his “core competence” is not cellular phones.

Because he missed something quite important.

If you read @tomiahonen thread in tweet /8 you find,

“There is a process called triangulation, by which the network knows roughly where you are, accuracy of about one city block

Is realy not true for a whole host of reasons, not least of which is what counts as a city block anyway?

Very roughly in the US it’s an area 1/16th of a mile by 1/8th of a mile. This is not a shape that fits snugly into either a circle or the more traditional triangulation “cocked hat” triangle.

Yes I know some people informaly use a “block” as a measure of distance by saying “Oh it’s about five blocks from here” but again it has no meaning when talking about radient signals eminating from a point.

But there are other issues, triangulation by cell tower is not done by measuring angles, but by measuring “time delay” in theoryvas with GPS it could be very accurate…

In practice it’s not. If you are in a totaly open space and can see all three cell site masts then yes you get the best accuracy but it’s not that good. However the minute you can not see a cell site mast, there are two big issues that arise,

1, Multipath
2, Reflection increased path length.

Without going into details both can very significantly effect the times used to calculate distance thus position.

Anyone who has worked in the mobile phone industry should be able to tell you why they perform considerable surveys, and it’s not just to check to see if all streets get coverage.

Firstly even in a perfectly open environment the accuracy of the location varies with time delay from the mast. So you end up with a variable degree of accuracy. In effect you have a circle around each of the sites representing time delay. Where the three circles cross is aproximately where the mobile will be in theory… Each circle has a width so you end up with a very funny shape sort of triangle, called for historic reasons a “cocked hat” there four there are four places the mobile “might” be in. The first is inside the triangle, the other three are outside the triangle aproximately bounded by a distance equivalent to the point of the triangle furthest away from the side. In practice it’s quite a lot more uncertain.

If the mobile signal is blocked by a building from the direct path to a cell tower, then the signal will arive via one or more reflections that are of unknown extra time delay. This has the effect of moving that sites time circle to have a larger radius which can be quite significant. Thus the cocked hat will not just enlarge the cocked hat significantly it will have a high degree of uncertainty related to the number of reflections (think RMS).

Another side effect of reflections is as a mobile moves at a constant rate along a straight path, the position reported by the time delays “jumps” and if you just overlaid on a map you might well appear to jump several streets away in just a few seconds. In fact you could end up appearing to junp back and forth like a flea on a hot griddle, at very very unlikely speeds…

So where are you?

Are you at one end of the jump or the other or some point in between. The answer is “Err” that is it is unknown you are in effect in any or all of those places so you are in an elipse or lozenge shaped area with no real way of determining, because it does not matter what method you use to average, the only thing you will have any degree of certainty on is “It’s most likely wrong”.

Even 5G with it’s fancy beam stearing is not going to realy improve on things, in fact it could easily be a whole lot worse…

The point is these PlonkerBoys et al are very probaly not that bright, their alledged leaders certainly are not. They probably don’t have the levels of confidence a well trained infantry squad would have. Theirfore they are likely to either stay in eyesight of the leader or directly adjacent to an easily recognised land mark. Most probably they would stay quite close if not very close to each other. Which would have the net effect as far as cell tower triangulation of putting them in the same place.

Therefor I suspect as there was a lot of CCTV around and the idiots dressed in recognisable ways, the FBI would probably use CCTV footage rather than cell tower triangulation.

Thus I would say that @tomiahonen is putting way to much butter on his bread and hoping to get as much jam. Or if you prefere a more rural expression his story “ain’t worth the price of a pile of horse apples”.

P.S. People should realise that most people who work for cell manufacturers or mobile service providers are not at all technical in fact they tend to be sales / marketing / admin / janitorial etc. The number of people who are actually involved with the design of mobile phones, again only a very small number will have technical expertise on the radio side. If memory serves, from an interview he gave to a podcast in the entirety of Nokia they only had one person doing the RF design work around the antenna…

When I worked in a similar environment the “electronics” engineers were few and only three had RF design capability and most of the time –more than 90%– they did not do RF work but all the other bits including mechanical design. In other organisations I worked in RF design was done by the “device manufacturer” as “App Notes” that just got copied. In fact there is only one company I worked for outside of the “Defence Industry” where true RF design and inovation was done. I was one and worked “contract” not “permi” the other was one of the owners of the company and he and I had gone to school together. Sadly he died accidentally a little over a year ago. The last project we worked on was a light weight low cost UV-C anti-viral personal breathing apparatus for doctors and nurses. We had developed a prototype but due to his death it all stopped.

Alan November 2, 2021 6:07 PM


You are 100% correct and some of the search warrants I read gave way too much credence to the accuracy of the cell phone location data. Some of that location data may have been based on phone’s GPS location data, which is more accurate but still not that accurate. See also this article and the associated FBI document that Bruce blogged about a few days ago:

As I mentioned however, I don’t believe the phone location data was used except as a prescreen when trying to narrow down suspects and identify them based on video and other evidence. An actual review of the search warrants and indictments should show this.

Alan November 2, 2021 7:45 PM


It’s always the low hanging fruit who go to jail… As for attribution we know who they are but they are wealthy so can afford to lobby or wield influence, and are always ten steps removed from the action, and employ “like minded proxies” so no proof of direct control can be obtained or when it is there is “plausible deniability”. Or so it appears.

You nailed that comment. All this debate about cell phone location data, video, etc., has so far only mattered for the grunts who went to the Capitol, not the people clearly orchestrating the effort.

anon November 2, 2021 9:02 PM

That’s the answer. If you make the assumption that a cell phone is a person, and no one goes anywhere without one, the above youtube video link show tracking individuals via cell tower data.

I bet you could identify and track a pickpocket during Mardi Gras if you knew the IMEIs of some of the victims.

This is why I put a phone cradle on my Roomba so that my phone moves randomly around the house all of the time

echo November 2, 2021 9:31 PM

I’ve just read someone reporting the far right material I mentioned up thread contains threats against the current US President. I will leave it to others to join the dots with the insurrection referenced in the topic. People have reported this material to the appropriate authorites including the Secret Service. Direct threats have also been made against some very well loved people with an international public profile. As for whether prosecutions follow is another topic as is prosecutions against whom because the source of this far right material is low hanging fruit and just one data point in a cloud of data points.

Ordinary people can be frustrated and say daft things which is why on one occasion I warned someone to delete a comment along these lines. I know they were joking but the fact is by law the US Security Service is required to investigate all threats. Whether they picked this up or went beyond toggling a key on their keyboard for “idiot mouthing off but not a threat” I have no idea but I also said they would not want to put future legitimate and lawful international travel at risk. But threats can also be very very fluffy and indirect much like the modern far right media friendly types indulge in. They’re not so much making threats but nurturing and inflaming and directing anger. Behind the luxury yachts and gift of the gab the people pulling the trigger retain their empires and wealth and status and are walking free. For now?

Winter November 3, 2021 2:18 AM

“But there are other issues, triangulation by cell tower is not done by measuring angles, but by measuring “time delay” in theoryvas with GPS it could be very accurate…”

Not only signal time, also signal strength. See here for graphics:

Accuracy in urban areas is in the order of a (few) hundred meters. That could count as a city block.

SpaceLifeForm November 3, 2021 2:51 AM

@ anon

This is why I put a phone cradle on my Roomba so that my phone moves randomly around the house all of the time

Your cat called. Says if you don’t stop that nonsense, the phone is going to get the ‘treatment’.

Clive Robinson November 3, 2021 5:09 AM

@ anon, SpaceLifeForm, ALL,

This is why I put a phone cradle on my Roomba so that my phone moves randomly around the house all of the time

Do not forget that Roomba’s are now[1] like ET… “They phone home” to the mothership, thus creating “third party records” of their movments…

Speaking of “movments” tell “Mr Kitty” that no matter what it looks like, the Roomba is not a “litter tray” 😉

[1] I’m not sure when the Roomba manufacturers actually went full on creepy with their “surveillance of the customer” “for fun and profit” but it is a very significant personal security risk, and thus the advice of “Do not give them house room” would appear to apply.

Clive Robinson November 3, 2021 6:17 AM

@ Winter,

Not only signal time, also signal strength.

Yes but “Recieved Signal Strength Indication”(RSSI) is a “relative not absolute” measurment at best, so is not reliable at the best of times.

The original use of RSSI in cellular systems was to decide when to perform a “hand over” from one cell mast to another or to switch sectors within a cell. Whilst that might appear to be a “distance measure” due to the way it is described and shown graphically it is in reality “most definately not”, it’s simply a ratio of the RSSI readings of the cell masts within range of the mobile. The algorithm is aproximately,

1, Is the current cell antenna signal below -70db?
2, Is signal from another cell antenna above curent signal?
3, Has it been above for X time?
4, Are the cells/sectors adjacent?
5, Hand over to new cell antenna.

As you can see,

Test 1 is for adiquate service from the current cell mast antenna if it is then nothing needs to be done.
Test 2 is a “relative” or ratio test between two or more cell mast antennas.
Test 3 is to reduce “flutter effects”.
Test 4 is to reduce “terrain effects” due to the likes of valleys or highly built up areas.

There are in reality other tests, such as if the new cell mast antenna backend system has available channels or not and a few others.

But the important point to note is that, the all important “Test 2” is “relative” not “absolute”.

The fact that this has subsequently been misused as a stand in for an “absolute” measurment is yet more evidence of why it realy should not be used as evidence in a court at all, as it is at best a faux measurment.

That is, that due to nonlinearity of receiver and RSSI circuits being unique to each receiver and in the case of mobiles how it is being held at any one moment it is at best an “anybodies guess” measurment[1].

Any one going into court and stating or implying otherwise should be investigated for perjury…

[1] This “factoid” has been used in a television game show. Steven Fry as quiz-master of the BBC show “QI” made it abundantly clear the bars on the display of your mobile phone –a graphic display of RSSI– have no “real” meaning, none what so ever[2].

[2] It would be in defendents and their representatives interests to dig out a video clip of this, because QI is shown world wide and is quite popular. So having been seen by tens if not hundreds of millions of viewers it eliminates the “not common knowledge” defence a prosecution so called “expert witness” might try to hide behind.

wiredog November 3, 2021 6:30 AM

One thing on “triangulation”. The Capitol building is made of stone and most cell towers can’t connect in there, so there are femtocells scattered throughout the building. If someone’s phone connected inside the building they will be easy to track.

wiredog November 3, 2021 7:03 AM

Also, there are Stingrays all over the DC area, most operated by the US and local governments.

Clive Robinson November 3, 2021 9:49 AM

@ Winter, ALL,

With regards,

It has several “errors” in it, that overal would give rise to a misunderstanding of the issues in reality.

This shows up most in the diagrams of tower fixes. They take a 20,000ft view of a perfect earth for the purposes of easy explanation. The reality is “anything but easy”.

So they diagrams are “simplified and idealised” which whilst making explanation easier on the eye they are misleading to put it politely even as a “first aproximation”.

The first thing to realise is the three sector antennas do not behave in the way indicated even in an idealised form. The antennas often used are “vertical” shallow open “corner reflector antennas”[1] which not only have a main or major forward lobe they also have side or minor lobes. Generally their “front to back ratio” is very high even though their forward gain is low for cellular work.

Take the one tower fix diagram, it shows the area nearly correctly for an idealised case. However in reality it would actually extend about one third of the way into the adjacent sectors as antenna “main lobe” radiation patters are never “straight line”, and that is before you consider “side lobes” effects.

Whilst in the second diagram the lozenge shape is nearly correct –it’s actually mostly slightly banana shaped as you are not equidistant– in an idealized way. However even in the idealised for it is actuall too small and in reality would be nearly twice as long as shown.

However the diagram of three towers shows it incorrect not just in that the area is less than a quater the size it realy is. Worse the shape in reality even as a first aproximation be either a circle or an elipse. It would be more triangluar as the underlying curves clearly show.

If you look carefully you can see the so called “cocked hat” triangle made by the bold brown, blue and green lines. The red circle just covers it which is wrong. To see why imagine the actual error width of those lines you can see from the first diagram, now superimpose them you end up with a much larger triangle.

But the diagram shows the towers more or less equidistant, which they almost never are. Also it shows the mobile being in the middle of each sector, thus they can use idealised circles. As indicated that does not happen in practice, so the shape of the curves is actually more like a clover leaf outline. You thus have to see that in your mind for even the first aproximation.

But it gets worse those near random objects distorting the pattern with reflections and shadowing even when mapped out by survey the are almost always inacurate. For instance imagine what effect a construction crane has when a short distance from the cell antennas? This happens frequently in cities not just at the Center but out into more urban areas, especially as “high rise housing” is spreading quite rapidly.

So in practice if you are just talking signal strength then the patterns would be considerably larger and fairly distorted and likewise the error on the mobile position almost entirely unpredictavle with any acuracy.

And importantlt changing constantly and unpredictably due to shadowing and reflection of objects rising up from the terrain, such as trees and their leaves in the dry and in the wet.

To see how bad this can all be, do you remember those “wave machines” from school lab classes, where an oscillating probe generats circularly radiating waves?

Do you remember the pattern when you put a pencil or finger in?

Now imagine the effects of three oscillating probe and say just four randomly placed pencils. Now imagine it with hundreds if not thousands of pencils or other objects.

Which brings us to,

“Using cell tower triangulation (3 towers), it is possible to determine a phone location to within an area of “about” ¾ square mile.”

That 3/4 square mile, is about 100 hundred US “city blocks” that are 1/16th by 1/8th of a square mile.

But as I’ve shown it is atleast 4 times that, so you are looking at an area of 3squ miles, or something like 3-10 “super blocks” or around ~350 “city blocks”. I’ll let others convert that area into a diameter because that is a not unreasonable indicator of the error…

So if you get out a map how much would that cover of say Pennsylvania Ave and surounding areas?

It’s why the time delay is prefered for aproximate location as on average it produces smaller areas. But on occasions due to multiple reflections can make larger areas of apparently compleatly random shape.

[1] For a more detailed analysis of coner reflector antennas see,

But it is a PhD thesis so may be heavy going for those not happy with playing with Maxwell’s Equations in three dimensional geometry.

[2] A simplified explanation of a deep corner reflector antenna,

Because the corner is 90 degrees or less and the radiating element mounted deep wirhin it, the main beam is quite tight and has quite a degree of gain as can be seen in the radiation patern. For cellular use the corner is opened out to 135 degrees or more and the radiating element is mounted in a much more shallow or open way. This has the effect of reducing the gain considerably but opening the main or major lobe out such that it’s half power points are around 130-150 degrees. But also the side or minor lodes you see in the radiation diagram become not just wider but priportionate to the main lobe considerably larger. This obviously has a significant effect when talking about position finding by signal strength. The result is that on most cell antenna systems a mobile mostly appears in two of the three sectors, and sometimes all three.

Winter November 3, 2021 10:26 AM

“So they diagrams are “simplified and idealised” which whilst making explanation easier on the eye they are misleading to put it politely even as a “first aproximation”.”

You are nitpicking on the details, but are losing the forest from the trees.

Each cell tower is stationary and can estimate the distance to a mobile to a precision of ~500m. If you have data from three or more cell towers, more than three is normal in an urban environments, it is simply drawing circles with the approximate distance around the tower position. The phone is in the area where the circles cross. With more towers, you can do nice statistics to determine the best position.

As the towers are stationary, and the build environment is stationary too, any distortions will be stationary too. It should be fairly easy to correct for that.

As this system is/will be used to direct emergency responders to 911/112 distress calls, this has been well developed into a SS7 standard. 911/112 response data must be delivered by all phone companies by law, so they are required to deliver this functionality.

This is one of the privacy leaks in SS7. The positions of thousands of mobile numbers are determined each day using this SS7 feature by unknown actors. That must be illegal, but no one acts on it.

echo November 3, 2021 11:11 AM

This is one of the privacy leaks in SS7. The positions of thousands of mobile numbers are determined each day using this SS7 feature by unknown actors. That must be illegal, but no one acts on it.

Nobody has ever answered the question why did GCHQ object to policy to force roaming allowed by default to solve signal blackspots. GCHQ muttered about it being difficult or expensive and that is as far as the answer went. So the rest of us suffer degraded services because a random careerist blowhard in GCHQ had a rush of blood to the head. Who was that steel jawed when behind a desk idiot?

They’re quick enough to put the fix in when it suits them (and if people realised how many of these kinds of fixing mechanisms were built into the system and how often they were abused there would be a riot). But they are very slow to sort out the mess they created.

“National security” is like “commercial confidentiality”…

As for “must be illegal but nobody acts on it” there’s a lot of that around. Speaking of which the latest news is Twitter just locked out the whistleblower of the terrorist material I mentioned earlier. The suspectd reason is mass reporting of their account by the far right. The account which published terrorist material on an external website is still live.

Then there’s the “licence to kill” legislation which gives the Home Secretary the power in law to sign off unlawful activity in pursuance of “national security” and the spycops scandal and British army soldiers reported only this week as bragging on Facebook about where to find the body….

Something smells a bit.

Jon November 3, 2021 3:20 PM

@ wiredog, et. al.

No doubt there are various “security” systems in the Capitol Building that are not known to the public.

If authorities had a better way of locating a phone (moreover, a person carrying a phone), but introducing that way into court would be awkward (unlawful, classified, &c), then a bit of “parallel construction” and claiming special efficacy of another system instead might go a long way.

@ echo

Something smells, hm?


SpaceLifeForm November 3, 2021 5:36 PM

@ wiredog

If someone’s phone connected inside the building they will be easy to track.

Which is why certain cells did NOT take their burner phones to the Capitol.

They thought they had good opsec.

Lack of signal, is signal.

John November 3, 2021 5:57 PM

@ Clive, echo, winter

The advice given about security and communication networks is very insightful. It really helps for everyone just starting out in infosec and looking to expand their knowledge.

Keep up the hard work helping all who lack the resources but are willing to learn.

Clive Robinson November 3, 2021 6:13 PM

@ Jon, ALL,

No doubt there are various “security” systems in the Capitol Building that are not known to the public.

Or nearly every one who works there either.

Some security measures are unavoidably obvious such as getting “wanded down” with a hand held metal detector. Others such as hidden IR cameras and back reflection terahertz imaging are partialy obvious in that you are aware you are being scanned but not by what.

Then there are other things that are in effect automated thus can be quite covert. One such is an EM cell[1] looking for electronic emmisions that you build into a coridor just before a card or keypad controled door. Think of it like those shop door “tag detectors” on steroids that will detect most electronics that are turned on. Further with some variation electronics that are turned off can be detected as well (think nonlinear junction detector[2]).

There are also “up draft CAM” (Chemical Agent Monitoring) devices that can pick up very tiny quantities of certain chemical compounds in the air (though we are a long way from beating nature, honey bees, mice, and dogs are more sensitive than high end lab equipment and a lot lot faster).

[1] Essentially there are a three basic ways to make an EM Cell people can walk through. Firstly a “Transverse ElectroMagnetic”(TEM) also called a Crawford cell after it’s inventor. Secondly a “Helmholtz coil”. Thirdly a wave guide that has a broad band antenne at one end and a “100 ohm foam” or equivalent absorbtion load at the other. In effect it is another “transmission line system like the TEM but without a sceptum plate.

The TEM is basically a very large transmission line like a coax cable, you can see the design of a small one in,

As you can see the sceptum plate is going to be a bit of a nuicence unless you do something. Well the something is put a dielectric on one side of the sceptum such that it gets very much close to one wall but it still looks like a transmission line electrically. Like all EM cells it is frequency dependent even though it is a transmission line, and one you can walk through would be good for HF and some VHF, there are tricks to take the upper frequency up but the maths can get hairy.

As for the Helmholtz coil this was originally designed for producing near linear magnetic fields,

However like antennas Helmholtz coils are reciprocal in nature. But they are mainly for low frequency work. One the size of a double door corridor would be good for the MF and LF bands so say 3Mhz down to a few tens of Hertz if capacitively or inductively issolated for safety. Again there are tricks you can do to extend the bandwidth.

You can actually build a combined TEM and Helmholtz coil cell, using three sets of coils in the different axis around the TEM cell so you can make a “magnetic bottle” etc to remove the effects of the Earths magnetic field, or create an artificial field. In the past I’ve built a small version to sit on top of a desk to test certain types of lets call it “Ocean Surveying” equipment that can be very rapidly deployed.

[2] Non linear junction detectors, detect the semiconductor junctions in diodes, transistors, ICs, etc even when they are powered off. In essence the junctions are “square law” devices so that if you hit them with a clean RF signal, they will generate a second harmonic that can be received and is thus a give away that a semiconductor junction is within it’s active region.

JonKnowsNothing November 3, 2021 11:53 PM

@Clive, @All

re: Finding the unfindable

A recent set of reports from AU about a family who went camping and when they woke in the AM a child was missing from the campsite. The incident has been in progress for several weeks and 11 02 2021 a happy ending (or start of) was reported when the little one was found in a suburb house.

Not much real information was released and caveat: many times these AHHHH reports turn out to be anything but, so what really happened is still to be released.

However, IF one were to consider how a person can be traced from a campground to a suburb just using imagination and ignore small things like warrants, which are different in AU than USA. In reality not that many US Magistrates would withhold a warrant in such case even if it was in the USA.


  • APerson traveled to the campground by vehicle. They may have had a smartphone with them or they left it behind. Many modern cars have comms and there are ubiquitous LPR (license plate readers) at nearly every intersection with a stoplight.
  • Using geo-fencing and time-of-last-sighting regression time frames, enumerate all cars traveling on any roads that lead to any entrance of the park.
  • Correlate all cars with cell towers. Eliminate those cars that “passed by” the park entrance when their receivers were picked up by the adjacent tower. Any signal that “stopped or did not connect to any other tower or had a long time-out delay in connection” sorts to the top of the listings.
  • Trace the LPR data and the celldata to all cars and compare with signal/lack of signal
  • Any signal that was found in the park (DrtBx/Stingray overhead flights) goes to the top of the listing.
  • Compare “dark mode phones” with “active phones” and follow their signals for the previous N-hours.

I would hazard a guess that this would have taken only a few hours to do, provided the LEA had access to the proper datasets or used their embedded teams at the Telcos to do the filtering.

The dark mode phone is the dark horse. Negative Space is not empty.

MarkH November 4, 2021 1:10 AM


According to a brief story I read,

• the child was missing for 18 days

• she was found in a house about a mile away from her home

• she disappeared during the night from a tent with an internal divider, with her parents on the other side and her smaller sister with her

I expect that law enforcement would immediately pursue phone tracing in such a case. Whether that process would need more than 2 weeks to come to fruition, I know not.

The circumstances of her disappearance, and the nearness of the place where she was found, perhaps suggest a targeted abduction by someone who had met or at least observed the child previously.

I propose that old-fashioned investigative legwork is at least as likely as mobile phone location to explain how she was found.

Whoever took her to that house seemed to be still at large. Perhaps after apprehension, the police will release more info.

echo November 4, 2021 2:22 AM

I propose that old-fashioned investigative legwork is at least as likely as mobile phone location to explain how she was found.

I tend to agree. This wouldn’t surprise me.

Winter November 4, 2021 2:36 AM

Discovery of missing girl

Wikipedia has the latest:

The discovery was attributed by the police to a key clue of a car spotted driving from the campsite in the early hours of 16 October, with the police having made a public plea for further information on it on 25 October.[26] According to Blanch, police work utilising a large amount of information in the case was essential.[

Legwork, indeed.

Clive Robinson November 4, 2021 8:13 AM

@ Winter, JonKnowsNothing, ALL,

Legwork, indeed.


“Parallel Construction”?


“Somewhere in between”?

We don’t know and don’t have any way to find out from afar, we will just have to wait on more information.

However for the point of discussion and potential “learning new tricks” that this old dog likes to do, lets “Walk it through”,

One of the things about security is it’s nearly all about “intelligence gathering and application”[1].

In the popular conception of the Inteligence Community(IC) they talk of “methods and sources” for intelligence gathering (observation).

The important point that is often missed though is normally,

“They Only work when the target is not aware of them”.

For instance the Chinese Government became aware of spys/agents because the CIA had bad handling techniques. Shortly there after the CIA lost it’s spys/agents.

The more recent Encrochat etc supposadly secure phones that “alleged” criminals were using. Now that “cat is out the bag” those who were not rounded up, are going to change their tactics.

So from a potential “crime prevention” point of view firstly a valuable information “source” has gone dark, but also now that “method” will not work again either (or should not if the alleged criminals have more than a couple of brain cells).

But it works the other way,

Which can be seen with physical defences. If you have a bullet proof electronic lock, then are criminals stymied? Yes, unless they gather intelligence and find out about it. If they do then that enables them to work out a way to bypass it or pursuade or trick someone into divulging the entry code.

So even physical defences rely in part on keeping them unknown to an adversary. But where that is not possible they can still work as a deterant or delaying tactic. That is a massive wall with barbed wire, CCTV, bright lights, etc tells a criminal two things,

1, Some one has spent a lot of money on defences.
2, They can not easily get past the defences “they can see”.

So they might well “assume” a lot of money has also been spent on defences they can not see… Which might well not be true but deters any way. Lesser criminals might consider what they can see is “too much trouble” so are detered. Whilst criminals who can get past also know it is going to take time, a lot of it, thus question if the delaying tactic is there because there are hidden alarms, that will bring a response before they can get not just in and out, but clear away.

Which brings us into “tactics” if you know an advarsary is going to take a certain route, Do you put up a show of force so they might “surrender” or do you put things out of sight create a “Take down area” / “kill zone” and ambush them?

The down sides of a show of force, is that the adversary might take hostages or worse “go down or run with guns blazing” either way creating casualties to your forces or uninvolved others (collateral damage).

That is “supprise” is achieved where your intelligence enables you to plan but the adverasaries intelligence fails to give them time to plan counter measures thus they have to “react” effectively instinctively.

Sometimes the best way to react is counter intuative to the monkey brain instinct that sends you scurrying up a tree. So the way to stop that instinct is by training and the “learned pattern” takes control.

It’s why there is the saying,

“Fail to learn, is plan to fail”

Which also gives rise to,

“Fail to plan, is learn to fail”

As an outcome…

Something the IT industry appears not to have heard…

[1] Yes even what we call “physical defences” such as fences, gates, locks, walls, barbed wire came about due to, the first three steps of the basic scientific method,

1, Observation.
2, Hypothesize.
3, Test.

Which actuall is the same as “inteligence gathering and application”.

MarkH November 4, 2021 9:53 AM

Re: Australia case

If (a) the abductor routinely carries a powered-up mobile, and (b) an effective mobile location system is available to local enforcement, I would expect that the phone could have been tracked in a time frame of hours to a couple of days.

If this assessment is correct, an interesting question is why was mobile location not used successfully in this instance?

JonKnowsNothing November 4, 2021 10:06 AM

@Clive, @MarkH, @All

re: why was mobile location not used successfully in this instance?

IF the scenario rolled out as in the several posts, I would guess it did work.

What took longer was the logistics and perhaps administrative details to do the physical assault on the property.

Takes time to get those nice Photo Op Shots.

Although in one report, a Backup officer JUMPED in front of the camera to get the FIRST Photo OP, instead of the Lead detective. Such actions have been seen in numerous tactical raids, often by US Navy Seals who don’t seem to understand how to follow their orders.

I would also hazard a guess that the property and person(s) were under heavy surveillance of the type that Clive often alludes to. Some of that might never get revealed. The AUKUS deal shows the Aussies know keep a secret.

Legwork is Keyboard Work. Let your fingers do the walking…

Clive Robinson November 4, 2021 10:49 AM

@ MarkH,

If this assessment is correct, an interesting question is why was mobile location not used successfully in this instance?

The important part of your post is not the question but,

“could have been”

For the “could” to become “would” requires,

1, Knowledge.
2, Access.
3, Resources.
4, Ability.
5, Time.

On this blog we routinely have “knowledge”(1) years if not decades before those at the coal face of everyday investigations.

But, we also often assume because of it, “access”(2) is effecticely a given, when often it is not for various reasons. Likewise we also tend to asume that the “resources”(3) and “ability”(4) to process the information in what is likely to normally be a very fast “time”(5) frame are to hand, when normally they would not be currently.

Whilst these “lacks” are being turned to “haves” in some places, even in the most affluent of nations with apparently draconian legislation, regulation, or covert activity alow, things are moving at what looks like a glacial pace (and yes I’m aware that many glaciers are in effect moving backwards due to neo-con policies which are bad for everyone).

lurker November 4, 2021 11:27 AM

In this corner of the planet MSM have noted the missing Carnarvon girl was found by a combination of diligent trawling through camera footage, and old-fashioned nosey neighbours wondering why that old bloke was buying nappies [diapers] in the supermarket.

Conspiracy theorists might consider this a construct by LEA to conceal their real method…

Alan November 4, 2021 12:56 PM

From this article:

How Are the Cases Being Made?

In reviewing the key charging documents and statements of fact for the 115 defendants who have pleaded guilty—which include 16 who have pleaded to felonies—one gets a feel for how the cases are being put together. (This post uses Oct. 27 as its cutoff date for statistical calculations; the numbers change daily.)

For most of the cases, there’s little mystery to it. As New York Times reporter Alan Feuer put it Oct. 12, “Never in the history of humanity has there been a crime documented as well as this one as it was happening … including … by the defendants themselves.” (Feuer made the remarks in a YouTube interview conducted by the Program on Extremism’s deputy director, Seamus Hughes, with four daily reporters covering the January prosecutions.)

According to the Program on Extremism’s research, at least 85 percent of all the prosecutions employ, at least in part, evidence from social media posts made by or about the defendants either before, during or after the riot—often all three. The most popular forums were Facebook and Instagram, which dwarf specialized, reputedly right-wing apps like Parler or Gab in the frequency with which posts from their sites show up as evidence in the cases. A remarkable number of defendants—even those facing serious felonies—posted or shared incriminating live videos or photos, or at least filled their phones with them (where they could later be mined by investigators via search warrant).

Defendant Edward Jacob Lang, for instance, who is alleged to have engaged in pitched battles with police officers for nearly two and a half hours—kicking them, jabbing them with a bat and throwing a fire extinguisher at them—took periodic time-outs to post live videos or selfies on Facebook or Instagram, according to government filings in his case. In one instance, he superimposed a pointing-hand icon with the legend: “THIS IS ME.”

At least one defendant’s phone was running Life360—an app designed to let family members keep track of each other’s whereabouts—throughout the riot, recording his incriminating locations. Two other defendants were turned in to the FBI by unimpressed matches on the dating app Bumble, to whom they had boasted of their exploits after the fact.

On top of that, there was an ocean of news media footage. And within the Capitol building itself and its restricted perimeter, 515 security cameras were filming, too. The latter captured about 4,800 hours of video—four terabytes worth—according to a recent government filing. Body-worn cameras on 900 police officers contributed another 1,600 hours of footage. (At least one defendant wore his own body camera.)

The FBI was also deluged with tips from the defendants’ current and former colleagues, acquaintances, and relatives. Online citizen sleuths, operating under rubrics like #SeditionHunters, also pored over the available footage, providing tips to investigators.

To make out probable cause, the FBI sometimes served search warrants on the likes of Facebook, Snapchat, Google, AT&T and Verizon. Search warrants to Google and the phone companies sought geolocation information drawn from GPS data, nearby Wi-Fi access points, and Bluetooth beacons. In response, Google provided maps showing the suspect’s path within the Capitol building, with circles reflecting a 10-meter radius of accuracy, which the company maintains is reliable “68 percent of the time,” according to the criminal complaints.

Ted November 4, 2021 2:30 PM


Defendant … [after physically assaulting law enforcement and posting videos of it, posting on one] … “THIS IS ME.”


echo November 4, 2021 3:12 PM

Serial criminals often start their crime close to where they lie or a place they are familiar with. They may later develop distraction patterns often beginning with somewhere away from their location. Routes may be selected to evade cameras and vehicles or appearance may be disguised. Looking like you belong is one disguise. The old hi-vis vest and a clipboard is another. Hats obscure faces from camera as do sun visors on vehicles. Distraction or deep slumber may be taken advantage of. Of the criminal has prior access to a location they may know the location by feel or the number of steps to move from one place to another. Certain types of locks maybe gutted of their internals or copies of keys made. Window catches can be discretely broken or generic “security” keys bought. Security can be evaded simply by knocking on a door or entering through an open door or window, or hiding on the premises.

Past experience will create shortcuts so the police will be able to rapidly sieve for the most likely suspects and locations.

Where there is a risk the trail may run could or there is a threat to life the police may employ parallelism which explains the large amount of manpower.

Criminals may “hurricane or tornado” i.e. go to ground in one place or raidly flee. They may hide under natural cover or some old planking or a stray plastic sheet within feet of a police presence.

Screeching wheels of a potential escape vehicle may be a clue. Where they disturbed or were they impatient? It may even help date the vehicle. Intelligence agency or forensic databases may have everything from tyre to paint samples including date and location and manufacturer to narrow the search even more.

I suspect police methods may be informed in part by advice from special forces. Special forces won’t give the ranch away but they will know more about some things than the police. Ditto other specialities and academic sources and criminal chatter from previous cases.

I’m sure electronic surveillance plays a role today but how much I don’t know. It’s not a magic wand.

Cops can be dumb but basic police work hasn’t changed much over the years. Cops are also addicts for excitement and can suffer from “Manchester haircut” syndrome. They want to look like “dah man” and can be tribalistic as well as spilling operational methods which junior editorial staff often don’t catch for early broadcasts but this steadily wiped as phone calls are made and the day goes on in time for the more highly sanitised early evening news.

I really hate cops for their stupidity but everyone involved including the public got a result which is something. I’m sure the family and everyone involved is really happy.

Leave a comment


Allowed HTML <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre> Markdown Extra syntax via

Sidebar photo of Bruce Schneier by Joe MacInnis.