Can you only trace a phone call if they don't hang up?

Question

In movies and television shows, you often see law enforcement (or hacker types) attempting to trace a phone call that they have received. The typical scene plays out with one party trying to keep the other party on the phone long enough for them to get a trace on the location. Veteran bad guys know this and usually hang up just before the other side get a lock on the location.

I realize that some of this may have changed over time, as phone systems have evolved. It may also be different with landlines and cell phones. I'm curious if this is accurate now and if it was ever accurate.

Can you trace a phone call like this at all? Is there a specific time that the call has to last? If so, why?

Answer 1

"I'm curious if . . . it was ever accurate."

The short answer is "yes." Today, of course, it's ridiculous as others have pointed out.

The original electro-mechanical switches were called "step-by-step" switches in the US, or "Strowger" switches in the UK. Later, electro-mechanical switches were called "crossbar" switches.

Both set up a continuous metallic path through the switch which lasts the duration of the call.

In fact, many of the dialing and numbering conventions - dialing "0" for the Operator, dialing "1" for Long Distance, dialing "011" for international, and no area codes or telephone numbers starting with "0" or "1" - directly resulted from the way these switches were designed and wired.

The telephone network was a hierarchical (5-level) network.

Only "Class 5" switches connected to telephone lines - all other levels were "tandem switches" designed to connect two switches together with "trunks". The equipment required to automatically bill calls ("Automatic Message Accounting") was very expensive, so it was usually concentrated in Class 4 or Class 3 "Toll Centers" where it could serve multiple Class 5 offices (and that's why we got free local calling in the US). Row 1 of the SXS "Selector" or crossbar (corresponding to the dialed digit "1") was wired directly to a "CAMA trunk" (Centralized AMA) to a tandem switch where the details were recorded before the call was set up. (Similarly, row 10, corresponding to dialed digit "0", was directly connected to trunks to the operator center).

So tracing a call in an all electro-mechanical network would literally require working backward from the receiving telephone line, to either the originating line (if the call originated in the same Class 5 office) or to the incoming trunk line, etc., etc. But it wasn't "digit by digit." It would be analagous to following a piece of string to its point of origin, then making a note of the telephone number associated with the tin can the string is tied to.

The 1ESS switch was introduced in the 1960s. It was a computer-controlled mechanical switch. True digital switches like the 5ESS and the DMS100 came along in the 1970s.

Digital switching made billing and services like Caller ID a function of software, not hardware, so tracing a call in an ESS network is much simpler. But steppers and crossbars remained in service well into the 1980s, and many were only replaced because the state Public Service Commission required it.

As to any differences between wireline and wireless: let's ignore the radio-based IMTS and talk about AMPS and digital (GSM, TDMA, CDMA). All of these systems were based on digital switching fabric, and all calls were billed (so calling party number was automatically captured), so tracing a call would have been relatively simple.

One additional distinction: there's a difference between information available in the modern network (billing information, tower ID, GPS coordinates), and information shared with the user (Caller ID).

Answer 2

There is an interesting Slate article, How Hard Would It Be To Trace the Sniper's Phone Calls?, that discusses the advances from old switching technology to digital switches and it somewhat implies that the cinematic drama may have been based partially on fact at one point. It goes on to say that modern digital switches can trace a call's number instantly and then correlate that with location information to find the address. It also says that dialing *67 only blocks caller ID data from civilians and doesn't keep you from being traced.

Digital switches have sped up the process. Beginning in the mid-1980s, phone companies began using electronic switching systems, which can automatically identify any caller's number within a fraction of a second. Those numbers can then be correlated with information from an automatic location indicator to find the phone's address. There is no foolproof way to avoid tracing on an ESS network when making a direct-dial call. (And don't think for a second that hitting *67, which masks your number to Caller ID boxes, can foil a police trace; it only works against civilians.)

It goes further to talk about cell phones too, indicating that by 2006, cell providers were required to triangulate the location of the phones on its network. The most obvious usage of this is for 911 (U.S. Emergency calls).

Mobile phones have proven harder to trace over recent years, but that is changing, too. The Federal Communications Commission has ordered that, by 2006, all cell-phone networks must feature location-tracking technology, ostensibly to assist 911 operators. As a result, many new mobiles now come equipped with chips that link them into the Global Positioning Satellite system. Triangulation using coordinates from adjacent cell-phone towers is another effective tracing technique.

This link talks a bit more about the *57 option to trace calls. It appears that by using *57 immediately after a call, you can tell the phone company to trace the call and they will hand the information over to law enforcement.

Call Trace. The phone company's Call Trace service allows you to identify the phone number of the harassing caller, regardless of whether the caller blocks the number. When you activate the Call Trace code (*57) immediately following the harassing call, the caller's phone number is recorded by the phone company. The phone number is not given to you, however. You will be asked by the phone company to sign an authorization form before the harasser's phone number is turned over to law enforcement for further investigation.

To order the Call Trace service, you must pay a start-up fee. Some phone companies then charge you each time you use Call Trace; others require a monthly charge for an unlimited number of traces.

Answer 3

There's a description of the state of telephone tracing in the mid 1980's, in Clifford Stoll's "The Cuckoo's Egg" [1]. At that time a trace could generally be completed in a few seconds (with some coordination between technicians at the different exchanges), unless the call got routed through one of the few remaining 1950's era electromechanical exchanges, in which case a technician would have to run from rack to rack within the exchange, which would obviously take a lot longer. He does state that if the call ends then the trace cannot be completed.

1. The Cuckoo's Egg: Tracking a Spy Through the Maze of Computer Espionage by Clifford Stoll. Doubleday (1989) ISBN: 0-385-24946-2

Answer 4

Surprisingly enough, this field isn't as secret as you'd perhaps think. For instance, the GSM standard includes a part documenting standard interfaces for this (GSM 03.33).

I've implemented this for a major phone switch manufacturer that sold to ~90 countries. There's no restriction whatsoever. In fact, there's no trace at all. Once a phone number is selected for monitoring, any incoming or outgoing call is automatically picked up. There's no need for manual action.

So, when a call to a monitored phone number is made, the entire Call Detail Record is available. Nowadays, that includes all SS7 data. SS7 uses ISUP messages, including the Initial Address Message (IAM). Without that, there's no call, and afterwards the caller is known (to the phone switch receiving the call).

Features like "Caller ID" work by including the data from the ISUP IAM to the subscriber line, whereas "Caller ID Block" works by not copying the data from the IAM. This also explains why the police isn't affected by Called ID Block: their subscriber lines have another feature, "Caller ID Override" which copies the caller's phone number regardsless of his "Caller ID Block" flag.

One of the further nails in this myth's coffin is the fact that for low-priority cases, the phone switch will only put a marker in the Call Detail Record (CDR), and sent the final CDR to the police. In that case, the call is effectively traced only after it's hung up.