141

In movies and television shows, you often see law enforcement (or hacker types) attempting to trace a phone call that they have received. The typical scene plays out with one party trying to keep the other party on the phone long enough for them to get a trace on the location. Veteran bad guys know this and usually hang up just before the other side get a lock on the location.

I realize that some of this may have changed over time, as phone systems have evolved. It may also be different with landlines and cell phones. I'm curious if this is accurate now and if it was ever accurate.

Can you trace a phone call like this at all? Is there a specific time that the call has to last? If so, why?

  • 1
    For law enforcement agencies with the proper technology and permissions (see for example CALEA in the US) the data is accessible no matter how long the call took. – Ophir Yoktan Mar 30 '11 at 13:53
  • 12
    The movie stuff is just for the drama. You can trace the call when the caller dials the last number / when the phone rings the first time. Then all information the phone company needs is there. I will post an answer after I found a linkable source. – Martin Scharrer Mar 30 '11 at 13:53
  • 56
    Number 2 on my list of law enforcement movie inaccuracies, behind the oh-so-ridiculous "zoom in and enhance" on the grainy CCTV image. – Nellius Mar 30 '11 at 13:57
  • 16
    @Nellius: Let's enhance! – Borror0 Mar 30 '11 at 17:06
  • 1
    @Nellius Ha! Yeah that enhancing grainy images is ridiculous. – morganpdx Mar 30 '11 at 22:39
122
+50

"I'm curious if . . . it was ever accurate."

The short answer is "yes." Today, of course, it's ridiculous as others have pointed out.

The original electro-mechanical switches were called "step-by-step" switches in the US, or "Strowger" switches in the UK. Later, electro-mechanical switches were called "crossbar" switches.

Both set up a continuous metallic path through the switch which lasts the duration of the call.

In fact, many of the dialing and numbering conventions - dialing "0" for the Operator, dialing "1" for Long Distance, dialing "011" for international, and no area codes or telephone numbers starting with "0" or "1" - directly resulted from the way these switches were designed and wired.

The telephone network was a hierarchical (5-level) network.

Only "Class 5" switches connected to telephone lines - all other levels were "tandem switches" designed to connect two switches together with "trunks". The equipment required to automatically bill calls ("Automatic Message Accounting") was very expensive, so it was usually concentrated in Class 4 or Class 3 "Toll Centers" where it could serve multiple Class 5 offices (and that's why we got free local calling in the US). Row 1 of the SXS "Selector" or crossbar (corresponding to the dialed digit "1") was wired directly to a "CAMA trunk" (Centralized AMA) to a tandem switch where the details were recorded before the call was set up. (Similarly, row 10, corresponding to dialed digit "0", was directly connected to trunks to the operator center).

So tracing a call in an all electro-mechanical network would literally require working backward from the receiving telephone line, to either the originating line (if the call originated in the same Class 5 office) or to the incoming trunk line, etc., etc. But it wasn't "digit by digit." It would be analagous to following a piece of string to its point of origin, then making a note of the telephone number associated with the tin can the string is tied to.

The 1ESS switch was introduced in the 1960s. It was a computer-controlled mechanical switch. True digital switches like the 5ESS and the DMS100 came along in the 1970s.

Digital switching made billing and services like Caller ID a function of software, not hardware, so tracing a call in an ESS network is much simpler. But steppers and crossbars remained in service well into the 1980s, and many were only replaced because the state Public Service Commission required it.

As to any differences between wireline and wireless: let's ignore the radio-based IMTS and talk about AMPS and digital (GSM, TDMA, CDMA). All of these systems were based on digital switching fabric, and all calls were billed (so calling party number was automatically captured), so tracing a call would have been relatively simple.

One additional distinction: there's a difference between information available in the modern network (billing information, tower ID, GPS coordinates), and information shared with the user (Caller ID).

  • 4
    Let me chip in, great post from a new user! – Sklivvz Apr 5 '11 at 22:32
  • 1
    +1 For the great research and detail. This is the kind of phone network intelligence (with credible links) I was looking for! – Luke Apr 6 '11 at 1:03
  • 1
    Thanks. Borror0 - I put the links back in. Luke, one other thing - there were devices (essentially small, portable AMA systems) called "traps" which could be connected to a line to record details about incoming calls. These were mainly used to catch nuisance callers, and could be installed after a subscriber filed a complaint. Then there are wiretaps, which actually record the call itself. – John Craft Apr 6 '11 at 12:30
  • 1
    Ok, so that answers the question whether tracing a call took time, but still there is issue of hanging up just before... could time required to trace be predicted? – vartec Apr 19 '12 at 12:26
55

There is an interesting Slate article, How Hard Would It Be To Trace the Sniper's Phone Calls?, that discusses the advances from old switching technology to digital switches and it somewhat implies that the cinematic drama may have been based partially on fact at one point. It goes on to say that modern digital switches can trace a call's number instantly and then correlate that with location information to find the address. It also says that dialing *67 only blocks caller ID data from civilians and doesn't keep you from being traced.

Digital switches have sped up the process. Beginning in the mid-1980s, phone companies began using electronic switching systems, which can automatically identify any caller's number within a fraction of a second. Those numbers can then be correlated with information from an automatic location indicator to find the phone's address. There is no foolproof way to avoid tracing on an ESS network when making a direct-dial call. (And don't think for a second that hitting *67, which masks your number to Caller ID boxes, can foil a police trace; it only works against civilians.)

It goes further to talk about cell phones too, indicating that by 2006, cell providers were required to triangulate the location of the phones on its network. The most obvious usage of this is for 911 (U.S. Emergency calls).

Mobile phones have proven harder to trace over recent years, but that is changing, too. The Federal Communications Commission has ordered that, by 2006, all cell-phone networks must feature location-tracking technology, ostensibly to assist 911 operators. As a result, many new mobiles now come equipped with chips that link them into the Global Positioning Satellite system. Triangulation using coordinates from adjacent cell-phone towers is another effective tracing technique.

This link talks a bit more about the *57 option to trace calls. It appears that by using *57 immediately after a call, you can tell the phone company to trace the call and they will hand the information over to law enforcement.

Call Trace. The phone company's Call Trace service allows you to identify the phone number of the harassing caller, regardless of whether the caller blocks the number. When you activate the Call Trace code (*57) immediately following the harassing call, the caller's phone number is recorded by the phone company. The phone number is not given to you, however. You will be asked by the phone company to sign an authorization form before the harasser's phone number is turned over to law enforcement for further investigation.

To order the Call Trace service, you must pay a start-up fee. Some phone companies then charge you each time you use Call Trace; others require a monthly charge for an unlimited number of traces.

  • Keep in mind, that adjacent cell-phone towers always operate (listen and transmit) on different frequencies to reduce interference (en.wikipedia.org/wiki/Cellular_network#Frequency_reuse). So, even though there are plenty of methods for detemining a location of the phone (most of them real-time, some of them based on historical data), none of them actually use triangulation from cell towers. – ADEpt Jul 29 '11 at 22:17
  • 4
    @ADEpt I'm not sure what you mean. Just because the towers are on different frequencies, that doesn't mean that you couldn't triangulate position based on that data. Triangulation isn't dependent upon frequency, it's dependent upon signal strength (implied distance) from 3 (or more) towers. – Luke Aug 9 '11 at 12:19
  • Technical quibble: triangulation is based on measuring the angles to known points, not the distance. What we're talking about is closer to multilateration, although strictly speaking that's based on using propagation delays to measure the distances, rather than signal strength. – Gordon Davisson Jan 23 '13 at 6:28
  • On a related note, I've been told by the police (in Victoria, Australia) that they only trace phones when it's a life-or-death matter because it involves actually disabling whole towers and costing phone companies/police thousands of dollars. Presumably towers can only 'see' handsets (and therefore measure propagation delays) when said handsets are actually using their frequency (and hence police have to disable certain towers to nudge the handset into logging into a different tower). – Matt Lyons Mar 24 '14 at 6:08
  • +1 for the *67 (although in the UK it is 141), it's nice to know that that is just civilian blocking. – Tim Mar 24 '15 at 21:39
15

There's a description of the state of telephone tracing in the mid 1980's, in Clifford Stoll's "The Cuckoo's Egg" [1]. At that time a trace could generally be completed in a few seconds (with some coordination between technicians at the different exchanges), unless the call got routed through one of the few remaining 1950's era electromechanical exchanges, in which case a technician would have to run from rack to rack within the exchange, which would obviously take a lot longer. He does state that if the call ends then the trace cannot be completed.

  1. The Cuckoo's Egg: Tracking a Spy Through the Maze of Computer Espionage by Clifford Stoll. Doubleday (1989) ISBN: 0-385-24946-2
8

Surprisingly enough, this field isn't as secret as you'd perhaps think. For instance, the GSM standard includes a part documenting standard interfaces for this (GSM 03.33).

I've implemented this for a major phone switch manufacturer that sold to ~90 countries. There's no restriction whatsoever. In fact, there's no trace at all. Once a phone number is selected for monitoring, any incoming or outgoing call is automatically picked up. There's no need for manual action.

So, when a call to a monitored phone number is made, the entire Call Detail Record is available. Nowadays, that includes all SS7 data. SS7 uses ISUP messages, including the Initial Address Message (IAM). Without that, there's no call, and afterwards the caller is known (to the phone switch receiving the call).

Features like "Caller ID" work by including the data from the ISUP IAM to the subscriber line, whereas "Caller ID Block" works by not copying the data from the IAM. This also explains why the police isn't affected by Called ID Block: their subscriber lines have another feature, "Caller ID Override" which copies the caller's phone number regardsless of his "Caller ID Block" flag.

One of the further nails in this myth's coffin is the fact that for low-priority cases, the phone switch will only put a marker in the Call Detail Record (CDR), and sent the final CDR to the police. In that case, the call is effectively traced only after it's hung up.

  • This needs more referencing – Sklivvz Apr 7 '11 at 6:55
  • Sklivvz, that information is in proprietary documents which aren't open to the public. I've worked in GMS telco myself and seen some of it. Though we worked on the tariffing/billing side, where information could be traced after the fact, all the information about who calls who from where to where for how long was available to us and recorded in a relational database, where it was retained for several years (for tax purposes, but also available to law enforcement given a court order). – jwenting Apr 8 '11 at 20:40
  • Well, the ISUP and GSM specs aren't really proprietary (internal no a limited set of companies), but they're not free either. – MSalters Apr 11 '11 at 7:43
  • They are free nowadays: 3gpp.org/specification-numbering – ADEpt Jul 29 '11 at 22:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .