With 5g and beamforming and mimo and decent bts software(Ericsson or Hua) you can pinpoint the given phone very accurately (within 20m in urban settings) - without any triangulation, as you know the cell tower sector :) Guess what: you can also measure the azimuth within 0.1 degree, so you could have SOME data at where to look.

FYI: That was available back in 2022 as standard. Now it could be even better. :P

▲

jacquesm 6 hours ago | parent [-]

I've already narrowed it down to four buildings for you, so we can consider that all of those methods worked. What is your next move?

I'm not saying it can't be done, clearly it can be done otherwise this article wouldn't exist. But it is not quite as easy as pointing a magic wand (aka an antenna) at a highrise and saying '14th floor, apartment on the North-West corner', though that would obviously make for good cinema.

▲

pavel_lishin 6 hours ago | parent | next [-]

> I've already narrowed it down to four buildings for you, so we can consider that all of those methods worked. What is your next move?

Subpoena the power, water & gas company, and look at apartments that have unusual power usage, coupled with almost zero water & gas usage. Especially look at apartments that don't have a spike in power usage in the morning & evening that corresponds to people having a regular commute.

I'm not sure how much power this equipment draws at idle - I'm assuming it's more idle at night, no need to send scammy SMS messages at 3am Eastern - but I'd wager you could track that.

Granted, it's not fast, but depending on how quickly the companies bend over backward for such a request & how good your interns are at using Excel, you might be able to get this done before sundown.

	▲	kube-system 2 hours ago \| parent [-]
		Maybe in a city like NYC with old apartments you could do that. It’s common for newer LEED buildings to use heat pumps and collective water/sewer billing. Power maybe but WFH is common these days too. And then you’d have to convince a judge that you’ve got something narrow enough.

▲

2snakes an hour ago | parent | prev [-]

There used to be a thing called Waterwitch in the NSA ANT catalog. Would that help?

	▲	12_throw_away 9 minutes ago \| parent [-]
		This inspired me to find this catalog, thank you for mentioning it! For those who have not seen it before, Waterwitch is on page 43 of the 2013 catalog here [1], and is described as "Hand held finishing tool used for geolocating targeted handsets in the field". It did seem to require, if I'm reading right, that the target be connected to a malicious GSM router called "Typhon" (page 42). [1] https://www.cryptomuseum.com/covert/bugs/nsaant/files/NSA_AN...