There are three primary ways of determining where someone is by way of their phone records or CDRs (Call Detail Records):

1. Mapping by way of the azimuths.  On a 3 sector tower (the most common type of cell tower) one divides the 360% coverage/circumference into 3 “pie slices” at 120% each. (0 & 360  on the circle are always due north.)  The “azimuth”, or center of the sector, is the center point of the “pie slice”, so if the azimuth is 85%, you would add 60 to one side of 85%, subtract 60 from the other side of 85%.  This would give you a slice ranging from 25% to 145% .  85 at the center and then the range spreading out from there.
2. Mapping by way of a drive-test  This is achieved by utilizing a device that operates somewhat like a cellular handset driving a specific area and monitoring the dominant/probable and possible reach of radio frequencies and DB levels from the towers the device connects with (anyone can perform an informal drive test with their own phones, for the cell towers they ping).  [Drives tests were not invented to solve crimes, but are actually a method by which telecommunications companies can determine if they are providing adequate coverage for their clients/subscribers.]
3. Global Positioning System or GPS-this is the most precise means of determining where someone is or was.  However most phones didn’t have GPS back in 2010.  So for the purposes of this case GPS is not available for determining the location of Chase Merritt. Or it seems, Joseph McStay-although Google phones might have been equipped with GPS.  Not sure.

How does a cellular phone choose which tower it connects with?

Witness for the prosecution, FBI agent, Kevin Boles stated that a phone will choose the tower that is most “attractive”.  As he clarifies in his testimony, in 2010 this “attractiveness” was largely due to strength of signal. (Apparently phones operate differently now.)

But what then determines the strength signal or (attractiveness) of a tower?

There are a lot of factors as to why a tower gives off a weak or strong signal for a particular subscriber, here are a few:

1. Number of subscribers pinging.  So if there are a lot of people in an area–classic example is a tower near a ball park when a game is in progress–the tower can experience subscriber overload, and so even if that tower is closest, a subscriber will be “bumped” to a tower farther away from their physical location.
2. Down-tilt.  Antennas are tilted to cover areas a phone company anticipates will require the most coverage.  What direction the down-tilt is, can mean that even if at tower is closer in physical location to a subscriber, if the antenna is focused away from them, they will then possibly find a tower farther in distance to have a stronger signal.
3. Damage to the tower. If a tower is damaged, say in a storm, that can force a call to be bumped to a tower farther away.
4. Frequency at which radio waves are operating. Radio waves operating at lower frequencies travel farther than those operating at higher frequencies.
5. Obstruction to line of sight If there are physical obstructions between the subscriber and the cell tower, this can make a connection difficult, even if the tower is close by.
6. Elevation. Kevin Boles testified at the grand jury hearing for Robert Pape (People v. Pape) that higher elevation (specifically of a tower) can allow for a subscriber at a lower elevation to a tower to ping from a much greater distance than expected.  Boles gives the example of being in San Bernardino and pinging a tower in the  Arrowhead mountains, 30 miles away (see below).

Kevin Bole’s Testimony at Grand Jury Hearing

Below is a basic mapping of the three azimuths listed in the Bole’s exhibit.  Bole’s now states that only the first tower pinged counts, so the 330 azimuth may be moot.  But this does show the expected coverage for azimuths 10 and 85 in relation to the graves, and Oro Grande.  There is always the possibility though, that radio waves from an antenna travel beyond, or in different directions than anticipated, which is why drive tests reflect more accurately where a subscriber might have been, than just mapping the traditional “pie slice” range.

This slideshow requires JavaScript.

Chase Merritt Tower Pings February 1, 2010

This slideshow requires JavaScript.

Chase Merritt Tower Pings February 2, 2010

This slideshow requires JavaScript.

Chase Merritt Tower Pings February 3, 2010

This slideshow requires JavaScript.

Chase Merritt Tower Pings February 4, 2010

This slideshow requires JavaScript.

Chase Merritt Tower Pings February 5, 2010

This slideshow requires JavaScript.

Chase Merritt Tower Pings February 6, 2010

This slideshow requires JavaScript.

The various towers pinged by Chase Merritt’s phone at the following times on Feb 6, 2010– 11:30, 11:31, 11:32, 11:33,11:34, 11:52, 11:53, 12:49 & 1:30 are as much as 10 miles distance from one another, and they ping in a random rather than linear order. Also note the difference in seizure vs. elapse time.

This slideshow requires JavaScript.

Example of drive-test vs. traditional cellular tower mapping. The colors each represent the reach of the sector.  Note that some coverage expands beyond the “pie” slice of expected reach, and coverage can pop up in unexpected locations.

How Cell Tower Triangulation Works

Resources

Caselaw/Drive Tests

Author Kevin Metcalf-Books on Cellular Mapping

Cell Tower Triangulation and Tracking Evidence — How It Works

Court Rejects Cell Site RF Map

The uses and abuses of Mobile Phone Evidence

What your cell phone can’t tell police