Cell Tower / Cell ID: Data Point Intelligence Guide

A cell identifier is not a location. It is a piece of network infrastructure with a coverage footprint, and confusing the two is how cases fall apart in court.

Understanding the Cell Tower / Cell ID as an intelligence artifact

A cell identifier is the network's address for a specific radio sector. In GSM and UMTS it combines the mobile country code, mobile network code, location area code and cell identity. LTE and 5G use tracking area codes with an enhanced cell identifier embedding a base station identifier plus a sector number. Together these identify one antenna sector, on one operator's network, in one country, each with its own azimuth, beamwidth, tilt, transmit power and resulting coverage footprint.

One physical mast typically carries several sectors and often several operators, so a single site maps to many identifiers. Coverage is a directional lobe rather than a circle, varying with terrain, clutter, antenna tilt, power and network load, from a few hundred metres in dense urban cores to tens of kilometres in rural areas. Small cells, femtocells and distributed antenna systems produce identifiers with footprints measured in tens of metres inside buildings.

Why it matters

Cell identifiers link a device's network activity to a geographic footprint at a point in time. In lawful investigation they contextualise call detail records and provide coarse geolocation where no satellite fix exists. They also characterise networks in their own right: which operators serve an area, where coverage was recently extended, and where no coverage exists at all. War-driving datasets let analysts map identifiers to observed positions without any carrier involvement whatsoever.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

• Country and network codes identify the operating country and carrier, revealing which network a device was attached to.
• Sector azimuth and antenna characteristics define a directional coverage lobe rather than a circle around the mast.
• New identifiers appearing in crowd-sourced datasets mark recent network build-out or temporary deployable masts.
• Dense small-cell identifiers indicate indoor or venue coverage with footprints of only tens of metres.
• Identifier sequences and base station numbering reveal how an operator organises its network geographically.
• Absence of any operator coverage in an area constrains claims that a device was communicating from there.
• Cross-border identifiers near frontiers explain roaming events that would otherwise look like international travel.
• Temporary cell deployments correlate with events, disasters or crowd operations on specific known dates.

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

• OpenCelliD — Open crowd-sourced database mapping cell identifiers to estimated positions with sample counts.
• WiGLE — Community war-driving data covering cellular and wireless observations with timestamps and positions.
• CellMapper — Crowd-sourced network mapping including sector layout, frequency band and operator detail.
• ITU E.212 code assignments — Authoritative mapping of mobile country and network codes to named operators.
• FCC Antenna Structure Registry — US registered antenna structures with coordinates, heights and registered owners.
• National regulator licence registers — Spectrum and site licences identifying operators and their authorised transmitter locations.
• Unwired Labs or Combain (commercial) — Commercial geolocation APIs with broader cell coverage than open datasets provide.
• Carrier records via legal process — Authoritative cell site and sector data obtainable only under lawful production orders.

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

1. Parse the identifier fully — Separate country code, network code, area code and cell identity, and note which radio technology is involved.
2. Identify the operator — Resolve country and network codes to a named carrier and confirm the generation of network in use.
3. Estimate the site position — Look up crowd-sourced observations, retaining reported accuracy and sample count rather than a bare point.
4. Model the coverage lobe — Apply azimuth, terrain and environment to produce a sector footprint with an explicitly stated uncertainty.
5. Corroborate the mast — Check antenna registries, overhead imagery and street-level views for a physical structure at the estimated position.
6. Combine with authoritative data — Where the case supports it, obtain carrier cell site data through lawful process and reconcile against your estimate.
7. Report with error bounds — Present conclusions as an area with confidence, never as a point, and document every assumption you relied on.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Collected by these disciplines

• Radio Frequency Intelligence — The Electromagnetic Spectrum as an Intelligence Source
• Signals Intelligence — Intelligence from Intercepted Communications and Emissions
• Measurement & Signature Intel — Signatures, Measurements, and Physical Phenomena
• Technical Intelligence — Technology Capability, Design, and Exploitation
• Space Intelligence — Orbital Activity, Space Assets, and Counterspace
• Aviation Intelligence — Aircraft, Flights, and the Aviation Domain

Investigated in these domains

• RF & Signals Intel

Pivots to these data points

• IMEI / Device Identifier — A unique mobile-equipment identifier; the TAC prefix identifies make and model.

Inside the platform: where Cell Tower / Cell ID lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

• datapoint.php?dp=dp_celltower — Data point hub
• domain.php?d=rf — RF & Signals Intel dashboard
• search.php — Advanced search, filter and pivot
• correlate.php — Correlation graph
• cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

• Enrichment Runner
• Enrichment → Local
• Correlate Infrastructure
• Summarise (Copilot)
• Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

1. Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Parse the identifier fully is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
2. Building the picture. A single indicator is rarely the story. Estimate the site position turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
3. Producing something actionable. Analysis that ends in a document nobody can use is wasted. Report with error bounds feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Cell Tower / Cell ID

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Cell identifiers support communications environment characterisation and force protection: which operators serve an area, where coverage exists and where it does not, and where deployable or newly built infrastructure has appeared. That informs planning for connectivity, for civil considerations in intelligence preparation of the environment, and for understanding the information environment a population actually uses. Constraints are firm. Open infrastructure datasets describe networks, not people, and using them to locate individuals is a different activity requiring different authority. Coverage modelling should always be expressed as a footprint with uncertainty, because a coverage lobe presented as a point misleads every consumer downstream.

🕵 National intelligence

Cell identifiers characterise networks and, where lawfully obtained, contextualise communications records. The open value is infrastructure mapping: operator presence, build-out, deployable masts appearing around events, and the absence of coverage constraining claims that a device was communicating from a location. Where identifiers appear in lawfully obtained records, they place a device within a sector footprint rather than at a point, and the analytic product must carry that uncertainty into the assessment. Handling should recognise that the combination of an identifier with a subscriber or device is personal data of the most sensitive kind, requiring authorisation, logging and short retention regardless of the collection route.

👮 Law enforcement

Cell site analysis is a mature but hazardous evidential discipline. Call detail records showing which sector served a device are obtained from carriers under warrant or production order in most jurisdictions, and courts in several countries have held that historical location information requires judicial authorisation. The evidential standard is that the analyst must present a coverage area with stated assumptions and error, never a point, and must be able to explain sector azimuth, terrain, load and the difference between the serving cell and the nearest mast. Presenting cell site material with false precision has produced documented miscarriages of justice, and defence experts now routinely attack exactly that.

🔍 Private investigation and corporate security

Private investigators may lawfully use open infrastructure datasets to understand coverage in an area, to check whether a claimed communication was even possible, and to identify operators serving a site. They may not obtain call detail records or cell site information from a carrier, and any broker offering location data on a mobile number is trading in unlawfully obtained or unlawfully repurposed data, with criminal exposure attaching to the buyer in several jurisdictions. Using open cell datasets to track a named individual is unlawful in many countries. The lawful escalation route is a referral to law enforcement or an application through counsel.

📰 Journalism and OSINT media

Cell identifiers occasionally surface in leaked records, court exhibits and device extractions supplied to journalists. The essential reporting discipline is to refuse false precision: a cell identifier locates a device within a sector footprint that may span hundreds of metres or tens of kilometres, and reporting it as a location is wrong. Where cell site evidence features in a case you are covering, the story is often precisely that overstated precision. Protect the subjects, since publishing sector-level location can still identify a home or a source, and seek expert review before publishing any technical claim about coverage.

🌍 NGO, humanitarian and human rights

Human-rights organisations encounter cell data in two ways: as evidence of surveillance and network shutdowns, and as material in the case files of people prosecuted on location evidence. Open infrastructure data supports documentation of shutdowns, throttling and the deployment of temporary masts around protests, which is legitimate and important accountability work. When supporting individuals prosecuted on cell site evidence, the priority is technical review, because overstated precision disproportionately affects defendants without resources. Never attempt to locate an individual, including a missing person, through cell data outside the lawful process, and be careful that staff devices do not generate their own exposure.

🎓 University and research

Researchers use open cell datasets for coverage mapping, digital divide studies, shutdown documentation and mobility modelling. Crowd-sourced datasets carry systematic bias toward routes and areas where contributors drive, and estimated mast positions are derived from observation clusters rather than surveyed. Report position uncertainty and sample counts rather than treating entries as ground truth. Research using individual-level mobility derived from network data is human subjects research requiring ethics approval and typically a data-sharing agreement with an operator, and publication of individual traces is not acceptable practice. Share code and aggregation methods, and cite the datasets under their open licence terms.

Playbook: working Cell Tower / Cell ID end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Parse the identifier completely

Separate mobile country code, mobile network code, location or tracking area code and cell identity, and note the radio technology involved, since the identifier structure differs across GSM, UMTS, LTE and 5G. Record the raw string as received. A good output is a parsed identifier with technology named. Stop when every component is labelled and no digits remain unaccounted for.

Phase 2 — Identify the operator and network

Resolve the country and network codes to a named carrier using the authoritative assignment tables, and confirm which generation of network the identifier belongs to. Note network sharing arrangements, since one physical site may serve several operators. A good output names the operator, country and technology. Stop when you know whose network the device was attached to. Check whether the operator has since merged or renumbered, because assignment tables change and records are historical.

Phase 3 — Estimate the site position

Look up crowd-sourced observations, retaining the reported accuracy, sample count and observation dates rather than taking a bare point. Estimates derived from few samples can sit hundreds of metres from the real mast. A good output is an estimated position with an uncertainty figure and its supporting sample count. Stop when the estimate carries its own quality metadata. Record the dates of the underlying observations, since a cell observed years ago may since have moved or been decommissioned.

Phase 4 — Corroborate the physical mast

Check antenna structure registries, spectrum licence records, overhead imagery and street-level views for a physical structure at or near the estimated position. Confirming the mast exists is a different question from knowing which sector served the device. A good output pairs the estimate with a confirmed or unconfirmed structure. Stop when the site is located physically or the estimate is flagged as uncorroborated.

Phase 5 — Model the coverage lobe

Apply sector azimuth, beamwidth, antenna height and tilt, transmit power, terrain and clutter to produce a directional footprint rather than a circle. Urban cores produce footprints of a few hundred metres; rural macro cells reach tens of kilometres. A good output is a modelled sector polygon with the parameters and assumptions recorded. Stop when the footprint is defensible parameter by parameter.

Phase 6 — Classify the cell type

Distinguish macro cells from small cells, femtocells, distributed antenna systems and deployable masts, because footprints differ by orders of magnitude and analysts routinely apply macro-cell reasoning to indoor cells. Note temporary deployments correlating with events. A good output states the cell class and its implication for footprint size. Stop when the type is established or explicitly unknown. Where the type cannot be determined, report the widest plausible footprint rather than assuming the convenient one.

Phase 7 — Obtain authoritative data lawfully

Where the case supports it, obtain carrier cell site data, sector configuration and call detail records through warrant, production order or equivalent judicial authorisation, and reconcile against your open estimate. Carrier data is the only authoritative source for sector configuration. A good output is a lawful request and the reconciliation against the estimate. Stop when the authoritative data is requested through the proper channel.

Phase 8 — Reconstruct the record carefully

Where call detail records are available, remember that the serving cell is not reliably the nearest one: network load, capacity management, handover behaviour and propagation all mean a device may attach to a more distant sector. A good output presents each record as an area of possible presence rather than a location. Stop when the analysis is expressed in areas throughout.

Phase 9 — Test alternative explanations

Consider whether the identifier was reassigned or renumbered between the record date and your reference data, whether a cross-border cell explains an apparent international event, whether the device was stationary or moving, and whether coverage varies with load or weather. A good output names each alternative and its disposition. Stop when the obvious defence challenges have been addressed. Document each alternative and its disposition in the report itself, not only in your working notes.

Phase 10 — Quantify and state the error

Express the conclusion as an area with a confidence level, list every assumption relied on, and state explicitly what the evidence cannot show. This is not a stylistic preference: courts have rejected cell site evidence presented with false precision, and overstatement is the principal risk in this discipline. A good output would satisfy an opposing expert as to method. Stop when no sentence in the product implies a point.

Phase 11 — Combine with independent evidence

Corroborate location claims with evidence from a different discipline: imagery, witnesses, vehicle records, transaction data or device forensics. Cell site material is corroborative rather than determinative, and cases built on it alone are fragile. A good output shows how the cell evidence narrows an area that other evidence independently supports. Stop when the conclusion does not rest on cell data alone.

Phase 12 — Restrict, log and expire

Treat any dataset linking identifiers to devices or subscribers as highly sensitive: restrict access, log every use, retain only for the case lifetime and delete on schedule. Open infrastructure data can be held more freely, but the joined dataset cannot. A good output is a holding whose access record could be audited. Stop when the controls are applied to the joined data, not just the raw.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
OpenCelliD	Open	Open crowd-sourced database mapping cell identifiers to estimated positions with sample counts, ranges and observation dates.	The main open route from an identifier to an estimated site position, with the quality metadata needed to state uncertainty.
WiGLE	Registration	Community war-driving database of cellular and wireless observations with timestamps, positions and signal information.	Alternative observation set for corroborating estimated positions and for dating when a cell was first observed.
CellMapper	Registration	Crowd-sourced network mapping showing sector layout, frequency bands, base station numbering and operator detail.	Provides sector-level structure and band information that supports coverage modelling rather than just a site point.
ITU E.212 mobile network code assignments	Open	Authoritative international assignment of mobile country codes and mobile network codes to named operators.	Resolves the country and network portions of an identifier to the correct operator, including after network consolidation.
FCC Antenna Structure Registry	Open	United States register of antenna structures with coordinates, heights, lighting requirements and registered owners.	Corroborates the existence and exact position of a physical mast at an estimated site in the United States.
Ofcom and national spectrum registers	Open	National regulator records of spectrum licences and, in some countries, authorised transmitter sites and technical parameters.	Identifies which operator is licensed to transmit where, and sometimes the authorised power and antenna characteristics.
Mobile network coverage checkers	Open	Operator-published coverage maps showing predicted indoor and outdoor service by technology across a country.	Tests whether any coverage exists at a claimed location, which can directly contradict a claim about a communication.
3GPP specifications	Open	Technical specifications defining cell identity structures, tracking and location areas, handover behaviour and network procedures.	The authority for what an identifier actually means and how a device selects and reselects a serving cell.
Unwired Labs and Combain	Licensed	Commercial geolocation services with cell databases broader than open sources, offering position estimates with accuracy figures.	Fills gaps where open datasets have no observations, while still returning estimates rather than authoritative positions.
Carrier records via legal process	Licensed	Authoritative cell site lists, sector azimuths, antenna parameters and call detail records held by the network operator.	The only authoritative source for sector configuration and service records, obtainable only under judicial authorisation.
Forensic Science Regulator codes of practice	Open	United Kingdom quality standards for forensic disciplines, including expectations for cell site analysis method and reporting.	Defines the professional standard an expert report on cell site evidence is expected to meet in court.
GSMA network and roaming documentation	Open	Industry documentation on network identifiers, roaming arrangements and operator groupings across markets.	Explains cross-border attachment, roaming events and operator relationships that can otherwise look like international travel.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Cell Tower / Cell ID. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

• OpenCelliD API and bulk data — Retrieves estimated cell positions with sample counts and ranges; estimates derive from observation clusters and can be hundreds of metres out.
• Radio propagation modelling software — Models coverage from antenna parameters and terrain to produce realistic footprints; results are only as good as the antenna data, which is usually estimated.
• QGIS with terrain data — Builds sector polygons and viewsheds against elevation models; sector geometry drawn without terrain will overstate coverage in broken ground.
• Call detail record analysis tools — Parse and visualise carrier records for authorised users; visualisations that plot a mast as a pin are the origin of most false-precision testimony.
• Antenna registry lookups — Confirm physical structures at estimated positions; registries cover structures rather than the sectors on them and are national in scope.
• Drive test and survey equipment — Measures actual coverage from ground observation, which is the strongest way to validate a modelled footprint; requires lawful access and equipment.
• Case management with access logging — Controls and audits access to joined identifier and subscriber datasets; essential because the joined data is far more sensitive than either part.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

• Enrichment Runner — Walks the indicator set through a chosen provider in time-boxed, cursor-based batches that resume rather than restart.
• Enrichment → Local — Materialises enrichment into the local store so dashboards render from your own database instead of a live third-party call.
• Correlate Infrastructure — Builds the cross-entity link graph: shared hosting, reused certificates, overlapping registrants, repeated selectors.
• Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
• Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

• The mast is not the device. A serving cell establishes that the device was somewhere within a sector footprint, and that footprint is a directional lobe shaped by azimuth, terrain, clutter and power, not a circle and never a point.
• The serving cell is not reliably the nearest cell. Load balancing, capacity management, handover hysteresis and propagation mean a device regularly attaches to a more distant sector, which is the fact most often omitted from cell site testimony.
• Presenting cell site material as precise location has produced documented miscarriages of justice in several jurisdictions. The professional obligation is to state the area and the assumptions, and to say explicitly what the evidence cannot show.
• Cell type changes the answer by orders of magnitude. Indoor small cells, femtocells and distributed antenna systems produce footprints of tens of metres, and applying macro-cell reasoning to them either understates or wildly overstates the area.
• Crowd-sourced positions are estimates from where contributors drove, not surveys. Retain the sample count and reported range, and treat a single-sample entry as an indication that a cell exists rather than as a position.
• Identifiers are reassigned and networks are renumbered, so reference data must be contemporaneous with the record. Matching a 2019 record against today's OpenCelliD extract will silently produce the wrong site.
• Absence of coverage is a powerful and underused finding. Establishing that no operator served a location constrains a claim that a device communicated from there, and it relies only on open data.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Cell Tower / Cell ID is producing anything, and they are worth baselining before you change process or tooling.

• Proportion of cell site conclusions expressed as areas with stated assumptions and error rather than as points.
• Rate at which open position estimates were corroborated against antenna registries or imagery before use.
• Share of analyses where the reference cell dataset was contemporaneous with the records being examined.
• Number of cases where an independent technical review changed or qualified a cell site conclusion.
• Proportion of carrier data obtained through documented judicial authorisation with the authority recorded on the case file.
• Rate at which joined identifier and subscriber datasets are deleted on schedule and their access logs audited.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

• Crowd-sourced positions are estimates derived from observation clusters and can sit hundreds of metres from the real mast.
• The mast position is not the device position, since the device may be anywhere within the sector footprint.
• Operators reassign identifiers and renumber networks, so historical records may not match current published mappings.
• Coverage varies with load and weather, so the serving cell is not reliably the geographically nearest one.
• Indoor and small cells produce tiny footprints that analysts wrongly treat with the same confidence as macro cells.
• Presenting cell site data as precise location has produced documented miscarriages of justice in several jurisdictions.

Legal and ethical considerations

Cell site location information is treated as sensitive in most jurisdictions, and obtaining it from carriers generally requires a warrant or equivalent judicial authorisation. Open datasets describe infrastructure rather than people, and using them to track an individual without authority is unlawful in many countries. Where lawfully obtained, restrict access, log every use and retain only for the case lifetime. State coverage assumptions and error bounds explicitly, because courts have rejected cell site evidence presented with false precision.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Cell Tower / Cell ID, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 6 intelligence disciplines, 1 mission domains, 1 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

Can I convert a cell identifier into a location?

You can convert it into an area, and only with stated uncertainty. Open databases give an estimated mast position derived from clustered observations, which may be hundreds of metres from the actual site, and the mast is not the device. What the identifier establishes is that a device was within the coverage footprint of one sector, which is a directional lobe shaped by azimuth, antenna height, tilt, power, terrain and clutter. In dense urban areas that may be a few hundred metres; in rural areas it may be tens of kilometres. Any output that renders this as a pin on a map is misleading, however convenient it looks.

Why is false precision such a serious problem in cell site evidence?

Because it has convicted people. Cell site material is often the only apparently objective evidence placing a defendant near a scene, and juries treat a map pin as authoritative. In several jurisdictions convictions have been overturned after review established that the analysis overstated precision, ignored that the serving cell need not be the nearest, or presented modelled coverage as measured fact. Regulators and courts now expect method statements, stated assumptions and error, and independent review. The professional obligation is to report the area the evidence supports and to state plainly what it cannot show, even when that weakens the case.

What is the lawful route to carrier cell site data?

Judicial authorisation in most jurisdictions. In the United States, historical cell site location information generally requires a warrant supported by probable cause following the Supreme Court's decision in Carpenter. In the United Kingdom and much of Europe, access to communications data requires authorisation under the applicable investigatory powers framework, with independent approval for location data. Cross-border requests go through mutual legal assistance or designated cooperation channels. Private actors have no route at all, and services claiming to locate a phone number commercially are either fraudulent or trading in unlawfully obtained data.

The record shows a cell forty kilometres from the alleged scene. Does that exclude the defendant?

Not on its own, and this cuts both ways. Devices attach to distant sectors when nearer ones are loaded, when propagation favours a distant mast across water or flat terrain, or during handover. Conversely a nearby cell does not place a device at a scene. The correct approach is to model the plausible footprint of the recorded sector using antenna parameters obtained from the carrier, consider terrain and load, and express the result as an area of possible presence. Then look for independent evidence. Cell records are corroborative; treating them as inclusive or exclusive proof is the error in both directions.

Are open cell datasets a lawful way to find someone?

No. Open datasets describe infrastructure, which is lawful to hold and analyse. Using them in combination with a device or subscriber identifier to determine where a person is or was is location tracking of an identifiable individual, and in most jurisdictions that requires legal authority regardless of how open the underlying map is. For private actors it is unlawful in many countries and creates criminal exposure. The lawful uses of these datasets are network characterisation, coverage assessment, shutdown documentation and testing whether a communication was possible from a location at all.

How do I document a network shutdown or throttling event?

Combine measurement with infrastructure context. Use open measurement platforms that record connectivity and reachability from within the country, note the operators affected and the timing, and correlate against cell datasets showing which networks serve the affected areas. Record the technical evidence, the affected geography and the duration, and corroborate with reports from users and with operator or regulator statements. Preserve the raw measurement data with timestamps. This is legitimate accountability work that relies entirely on infrastructure-level data and does not require, and should not involve, any individual's device or subscriber information.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

• 3GPP TS 23.003 defines the numbering, addressing and identification structures including cell identity and location area codes.
• ITU-T Recommendation E.212 governs the international identification plan for mobile country and network codes.
• The United States Supreme Court decision in Carpenter established that historical cell site location information generally requires a warrant.
• The United Kingdom Investigatory Powers Act governs acquisition of communications data including location, with independent authorisation.
• The EU Law Enforcement Directive and national implementations govern processing of location data for policing purposes.
• The Forensic Science Regulator codes of practice set quality expectations for cell site analysis presented as expert evidence.
• ISO 17025 accreditation requirements apply to forensic units producing cell site analysis in several jurisdictions.
• The Council of Europe Budapest Convention on Cybercrime frames international cooperation for obtaining traffic and subscriber data.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

1. OpenCelliD open cell database — OpenCelliD and Unwired Labs. Crowd-sourced cell identifier positions with sample counts and ranges.
2. WiGLE wireless network observation database — WiGLE. Community-collected cellular and wireless observations with timestamps.
3. Mobile network code assignments under Recommendation E.212 — International Telecommunication Union. Authoritative mapping of country and network codes to operators.
4. Antenna Structure Registration — United States Federal Communications Commission. Register of antenna structures with coordinates, heights and owners.
5. Technical specifications for network identifiers — 3rd Generation Partnership Project. Definitions of cell identity, area codes and cell selection behaviour.
6. Spectrum licensing and coverage information — United Kingdom Office of Communications. Licence records and national coverage reporting by operator.
7. Forensic Science Regulator codes of practice and conduct — United Kingdom Government. Quality standards governing cell site analysis presented in court.
8. GSMA network and roaming resources — GSMA. Industry documentation on operator identifiers and roaming arrangements.

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: resolves cell identifiers to operators and coverage footprints with explicit error bounds. Explore the platform, or browse the rest of the library by following any tag above.