The cell network routinely does TDoA triangulation in order to help choose which tower should serve the client mobile device. Accuracy is about 20m, and may be better at 5G frequencies. 911 gets the location from the mobile network provider, but the network provider could provide it to anyone, and they do.
Tons of "free" and crapware apps are also recording location, and sending it to data brokers.
Using LTE Timing Advance feature, especially on 5G, accuracy can be much higher.
https://5g-tools.com/5g-nr-timing-advance-ta-distance-calcul... shows an example of the parameters necessary. I don't think you can get your smartphone to dump those stats for you, but the granularity of the individual distance measurement is in the tens of centimeters.
Of course this strongly depends on cell infrastructure being placed precisely, continuously updating correction factors, and a bunch of antennae being around the target to get measurements for, but in most cities that isn't much of a challenge if the operator is working together with whoever wants to spy on citizens.
Phone detects that you call emergency service and enables gps.
Last time I called 911 (well, it's 112 in my country) my android phone asked if I want to provide gps coordinates. I did, but they still asked for address, so probably this is not integrated/used everywhere.
The phone could literally pop up a consent alert asking whether to respond to a GPS ping request from the carrier. Or just not honor the pings at all unless you dialed 911 within the last hour.
This is a specific service inside the phone that looks for messages from the carrier requesting a GPS position, it could just refuse, or lie. It's not the same as cell tower triangulation.
I can imagine situations where the emergency is noticed by other people that might not be near the location itself, and the person whose location would need to be determined is not able to use the mobile phone, such as could be the case in many accidents.
I think it would be sufficient to just have a log of this information being queried, and cases where the information has been pinged without a legitimate use case would the be investigated.
The article does not explain in detail how all this works. But educated guess is that if a baseband SoC provides this information, that's it. The phone operating system (iOS, Android) does not get a chance to decide what to do, since baseband soc is a sort of autonomous computer, it has its own firmware, cpu and ram.
Carrier* Android and iOS both integrate with RapidSOS UNITE. RapidSOS then processes the rich emergency information from the user's device (enhanced location, videos and photos, etc), and is available to the 911 dispatcher in their dispatch software. 99.99% of Americans are covered by RapidSOS integrations in their municipalities.
In the UK, it happens when you call 999 or 112. I don't think 911 is supported, although it probably should be (it'd be a mess to get everyone to agree to add it to their routing tables, but I bet there's a nonzero proportion of people who watch American TV programmes and think the emergency number is 911 - or, for that matter, American tourists).
When you dial 999 it forwards your phone's GPS location if it has a lock to the provider, who then forwards it on to one of the 999 call handling centres in the UK, who then in turn forward that on to the appropriate emergency service control room. All the various services use various different products for telephony and dispatch but they will show the incoming location, and often will prepopulate an incident with the location.
The system that does this is called "EISEC" - Enhanced Information Service for Emergency Calls - and has a lot of cool stuff defined in the spec (which is publically available! You can just go and read it! BT offer a "Supplier's Information Note" with the protocol and details of how the information is encoded) that also handles calls from landlines. These are easy - your telephone provider knows where you live. OMG! The phone company know where I live? Yes, dumbass, they pulled a wire right into your house, of course they know where it is. For VoIP the situation is a little different but you can notify your VoIP provider of the location that the number is being used at, and it'll inject that into the EISEC request.
You can do other cool stuff like if you've got fixed mobile telephone in a vehicle, you can assign the make, model, registration number, colour, and so on in the EISEC database, so given a call from a phone number they know what car they're looking for. No-one uses this.
The very great majority of calls coming in to 999 are from mobiles. It's extremely rare to get one from a landline.
None of the providers use triangulation for determining where a phone is, it's all GPS.
The cell network routinely does TDoA triangulation in order to help choose which tower should serve the client mobile device. Accuracy is about 20m, and may be better at 5G frequencies. 911 gets the location from the mobile network provider, but the network provider could provide it to anyone, and they do.
Tons of "free" and crapware apps are also recording location, and sending it to data brokers.
https://www.wired.com/story/jeffrey-epstein-island-visitors-...
Using LTE Timing Advance feature, especially on 5G, accuracy can be much higher.
https://5g-tools.com/5g-nr-timing-advance-ta-distance-calcul... shows an example of the parameters necessary. I don't think you can get your smartphone to dump those stats for you, but the granularity of the individual distance measurement is in the tens of centimeters.
Of course this strongly depends on cell infrastructure being placed precisely, continuously updating correction factors, and a bunch of antennae being around the target to get measurements for, but in most cities that isn't much of a challenge if the operator is working together with whoever wants to spy on citizens.
> Tons of "free" and crapware apps are also recording location, and sending it to data brokers
The last time I checked, that included Google Play Services, and some of their iOS apps.
You're thinking of Phase II E911 in the US.
That's true, but you can always be triangulated down a couple hundred meters by figuring out which towers you're connected to.
Triangulation is far more accurate than that in cities. And in rural area that accuracy is already enough to identify the house you're in.
How would that work?
Phone detects that you call emergency service and enables gps.
Last time I called 911 (well, it's 112 in my country) my android phone asked if I want to provide gps coordinates. I did, but they still asked for address, so probably this is not integrated/used everywhere.
They may also ask simply to confirm the location is correct and to help responders more quickly locate you in the vicinity.
The phone could literally pop up a consent alert asking whether to respond to a GPS ping request from the carrier. Or just not honor the pings at all unless you dialed 911 within the last hour.
This is a specific service inside the phone that looks for messages from the carrier requesting a GPS position, it could just refuse, or lie. It's not the same as cell tower triangulation.
I can imagine situations where the emergency is noticed by other people that might not be near the location itself, and the person whose location would need to be determined is not able to use the mobile phone, such as could be the case in many accidents.
I think it would be sufficient to just have a log of this information being queried, and cases where the information has been pinged without a legitimate use case would the be investigated.
The article does not explain in detail how all this works. But educated guess is that if a baseband SoC provides this information, that's it. The phone operating system (iOS, Android) does not get a chance to decide what to do, since baseband soc is a sort of autonomous computer, it has its own firmware, cpu and ram.
2 replies →
That’s not happening today. I meant how is it happening today, such that it can only ever happen when you dial 911?
Send the GPS location only when dialling a 3-digit number? Phones probably know which numbers are emergency numbers
A phone knows if it’s dialing 911. It can activate features on this criteria
It already exists. Emergency call is spec-defined.
Carrier* Android and iOS both integrate with RapidSOS UNITE. RapidSOS then processes the rich emergency information from the user's device (enhanced location, videos and photos, etc), and is available to the 911 dispatcher in their dispatch software. 99.99% of Americans are covered by RapidSOS integrations in their municipalities.
https://rapidsos.com/public-safety/unite/
When the call comes in they can click a button and query RapidSOS for current 911 calls for that number and pull the information inwards.
https://www.baycominc.com/hubfs/2025%20Website%20Update/Prod...
In the UK, it happens when you call 999 or 112. I don't think 911 is supported, although it probably should be (it'd be a mess to get everyone to agree to add it to their routing tables, but I bet there's a nonzero proportion of people who watch American TV programmes and think the emergency number is 911 - or, for that matter, American tourists).
When you dial 999 it forwards your phone's GPS location if it has a lock to the provider, who then forwards it on to one of the 999 call handling centres in the UK, who then in turn forward that on to the appropriate emergency service control room. All the various services use various different products for telephony and dispatch but they will show the incoming location, and often will prepopulate an incident with the location.
The system that does this is called "EISEC" - Enhanced Information Service for Emergency Calls - and has a lot of cool stuff defined in the spec (which is publically available! You can just go and read it! BT offer a "Supplier's Information Note" with the protocol and details of how the information is encoded) that also handles calls from landlines. These are easy - your telephone provider knows where you live. OMG! The phone company know where I live? Yes, dumbass, they pulled a wire right into your house, of course they know where it is. For VoIP the situation is a little different but you can notify your VoIP provider of the location that the number is being used at, and it'll inject that into the EISEC request.
You can do other cool stuff like if you've got fixed mobile telephone in a vehicle, you can assign the make, model, registration number, colour, and so on in the EISEC database, so given a call from a phone number they know what car they're looking for. No-one uses this.
The very great majority of calls coming in to 999 are from mobiles. It's extremely rare to get one from a landline.
None of the providers use triangulation for determining where a phone is, it's all GPS.