Re: Apple changed their documentation at my request but it proves they don't care about privacy

On 2026-09-07 13:34, Carlos E.R. wrote:
> On 2026-09-07 11:47, Nuno Silva wrote:
>> (Snipping for brevity for inline replies, sorry that this removes the
>> context, but in this case it probably is preferrable, please refer to
>> the parent post for the full context:)
>>
>> (And thanks for the post, Jon, it does indeed make things clearer to
>> understand at least for me.)
>>
>> On 2026-09-06, Jon Ribbens wrote:
>>
>>> The purpose of these databases of BSSID locations is to assist devices
>>> such as mobile phones in locating themselves. Maybe the device is
>>> indoors and cannot get a GPS signal, but also my understanding is that
>>> GPS can fix an accurate location much faster if it starts already
>>> knowing vaguely where on the planet it is.
>>
>> There was already a mechanism to do this at least since "3G" using
>> mobile data connections, right?
> 
> Yes. It was possible since GSM was invented, but somebody had to figure 
> out that, and design a methodology. Initially, it involved a written 
> request to the mobile network provider to do calculations using dumps of 
> logs from each tower that could be involved.
> 
> And at some time it was automated, and phones could find their rough 
> location instantly.

I asked ChatGPT for more info. Take with a pinch of salt.

Q: How was it found that the location of a mobile phone (GSM) could be 
calculated from the data logged by nearby towers? I think it was a 
doctorate paper?

A: Yes — and I think I know what phenomenon you’re remembering. It 
wasn’t a single discovery in one doctoral thesis, but there were 
important early academic/industry papers and theses showing that GSM 
network measurements could be turned into a geographical position.

The key insight is surprisingly simple: a GSM phone is constantly 
measuring the surrounding base stations, not just the tower it is 
currently connected to.
What information is available?

A GSM handset/network can provide things such as:

     Cell ID — which base station/cell the phone is using.
     RSSI / received signal strength — how strongly it receives 
neighbouring cells.
     Timing Advance (TA) — effectively an estimate of how far the phone 
is from its serving base station, in discrete distance steps.
     Measurements from several neighbouring base stations.

If you know where the base stations are, these measurements constrain 
where the phone can be.

For example, if tower A gives a Timing Advance corresponding roughly to 
2 km:

                          Phone
                            *
                           / \
                          /   \
                         /     \
                        /       \
                       /  ~2 km  \
                      /           \
                     O             \
                 Tower A            \

The phone should lie somewhere around a circle of roughly 2 km radius.

With another tower:

                    O Tower B
                   / \
                  /   \
                 /     \
                /       \
               /    *    \       ← possible position
              /           \
             /             \
            O---------------

          Tower A

And with three or more measurements, you can narrow it down considerably.
But there's an even more interesting version

You don't necessarily need an explicit distance measurement.

The phone reports the signal strengths of surrounding cells. Because 
radio signals generally get weaker with distance, you can construct an 
approximate relationship like:

     signal strength → estimated distance → geographical position

This is called RSS-based positioning, and with three or more stations it 
can resemble trilateration.

However, radio propagation is messy — buildings, reflections, terrain, 
antenna patterns, etc. mean that RSS isn't a reliable direct distance 
measurement. That's why another approach became very important: 
fingerprinting.

You can drive around an area recording:

Location       Cell A   Cell B   Cell C   Cell D
--------------------------------------------------
40.123, -3.21   -55      -72      -81      -90
40.124, -3.21   -58      -69      -79      -88
40.125, -3.21   -63      -65      -76      -91
...

Then, when an unknown phone produces:

Cell A = -60
Cell B = -67
Cell C = -77
Cell D = -89

you look for the place in the database whose "radio signature" most 
closely matches it.

That's GSM fingerprinting, and it's actually a very powerful idea.
And your memory of a doctorate/thesis is plausible

There are quite a few doctoral works in this area.

One particularly relevant early work is Christopher Drane, Malcolm 
Macnaughtan and Craig Scott, “Positioning GSM Telephones,” published in 
IEEE Communications Magazine in 1998. Interestingly, the authors say 
they had achieved accurate position measurements using GSM as early as 
May 1996.

There is also Jian Zhu's 2006 Georgia Tech PhD dissertation, 
Indoor/Outdoor Location of Cellular Handsets Based on Received Signal 
Strength, specifically investigating handset positioning from the 
received signal strengths of surrounding base stations.

And a later PhD dissertation, Zaenab Shakir (Florida Institute of 
Technology, 2020), deals explicitly with geolocation from signal level 
measurements and Timing Advance inside the cellular network.

There is also a particularly interesting doctoral thesis by Lauri Wirola 
on the evolution of cellular positioning standards, covering methods 
based on cell coverage combined with time delay, time difference and 
received signal strength.
One subtle point

If what you remember is specifically "someone discovered that you could 
reconstruct the location of a phone from the logs of the towers, without 
GPS", then I suspect you're remembering something slightly different 
from ordinary GSM triangulation.

There are techniques where the network's existing logs/measurements — 
serving cell, neighbouring-cell measurements, Timing Advance, handovers, 
etc. — can be accumulated over time and used to infer a person's 
route/location.

That gets particularly interesting because you don't need to know the 
phone's GPS position at all. The cellular network itself becomes a kind 
of enormous, distributed positioning system.

If you tell me roughly when you encountered the paper (1990s / 2000s / 
2010s) or whether it was about GSM specifically, mobile-phone 
surveillance, or anonymised phone records, I can try to track down the 
exact PhD paper you're remembering.


Sources:

     PPubMed Central (PMC)
     A Modular Localization System as a Positioning Service for Road 
Transport - PMC
     CCiteSeerX
     Positioning GSM Telephones
     GGeorgia Tech Repository
     Indoor/Outdoor Location of Cellular Handsets Based on Received 
Signal Strength
     SScholarship Repository
     "Geolocation Based on Signal Level Measurement and Time Advance 
Inside " by Zaenab Shakir
     TTampere University Research Portal
     Studies on location technology standards evolution in wireless 
networks - Tampere University Research Portal

-- 
Cheers, Carlos.
ES🇪🇸, EU🇪🇺;