GSM localizer without GPS – Part 1

By on December 20, 2010
Pin It

Download the article





Do you still think you need GPS to know where a person or vehicle is? Well, here is some news for you: by using cellular network data and properly querying Google, even a simple GSM module is able to determine one’s position, with a fairly acceptable error margin.


Although so far all localization systems have been based on GPS technology, it is now conceivable to be able to fairly precisely locate a vehicle or person carrying a GSM cellular device without having to resort to a satellite dish. Is this a miracle? Of course, not! It is simply an ingenious marriage between the information provided by the radio mobile phone network and the cell coordinate data drawn from Internet portals such as Google Maps.  To be sure, GPS is not entirely dispensed with, but this new system allows for localization without directly utilizing GPS technology; simply put, we are able to locate the desired object fairly precisely by using database availability together with the geographic position of the cells themselves. Officially, cell coordinates are not publicly known; in fact, they are carefully guarded by those companies that use them for the services they provide. If so, where do we find such data? Who can give them to us, and how? The answer is very simple. There are numerous Internet portals that have stored the information we need using those very services they provide to their users. For instance, through Google Maps Mobile, Google has been able to store billions of data regarding the location of its clients’ cell phones; such data are provided by the phones themselves: once a smartphone connects to the Google service, it sends out both the cell identifier with which it is associated and the geographic location obtained from its own GPS. However, some sites embrace an open-source  philosophy and utilize information willfully sent by their users in order to create databases such as the one mentioned above. These systems allow them to receive automatically and update the coordinates of the various cells that play a fundamental role in GSM localization. It is important to point out that, unlike in Italy, in some countries, phone companies make those cell coordinates available, which greatly facilitates the entire localization process. Though this is but one hypothesis among others, it may very well be that Google has relied on its Maps Mobile service to obtain the data it needed. Some, on the other hand, claim that the vehicles employed to shoot films to be used for Street View were equipped with cell phones so that the position of cells with respect to the coordinates provided by GPS devices could be detected and recorded. Thus, whenever the phone switched cells, a computer would record their coordinates, which in turn would feed the database. This latter hypothesis may in part be true; however, it is more likely that Google built its archive using its Maps Mobile service. If this is correct, in exchange for a free service, Google used its own clients to obtain information that would have otherwise taken time (simply to go around and record the position of cells) and money to pay for staff and moving expenses or to buy data from phone companies, providing they were willing to sell them. Naturally, there is nothing wrong with this strategy: a similar strategy is used by big supermarkets, which give their most loyal clients discounts in exchange for a membership card through which they are able to determine how much everyone spends and to get precious information that allows them to optimize sales according to geographic area and time of year. A favor in exchange for a favor… But how does GSM localization work? The radio mobile network is made up of a number of adjacent radio cells, each of which is characterized by an identifier consisting of four data: a progressive number (Cell ID), a code related to the area in which that given cell is (LAC, or Local Area Code), the code of national network to which the cell belongs (MCC, an acronym for  Mobile Country Code), and finally the company code (MNC, or Mobile Network Code), which obviously identifies the phone company itself. For this reason, once a cell name and coordinates are known, and considering the maximum distance allowed between this cell and a phone  before the phone connects to a new cell, it is possible to find out, approximately, the most distant position of the phone itself. For example, if the maximum distance has been determined to be one mile, the cell phone can be within a one-mile radius. It can be deduced that the more cells are found in a given area, the more precisely one can determine where the phone is located (up to 200-350 feet). The idea of employing only a GSM device to build a remote localization system occurred to us when we realized that Google Maps Mobile, which had been conceived to allow smartphones equipped with a GPS receiver to use Google for satellite navigation, was extended to all cell phones, as long as they were able to support GPRS or UMTS data.   That realization made a light bulb go on, and not only in our heads. Indeed, many people started wondering how on earth Google was able to tell someone whose phone was devoid of a GPS receiver where he or she was at that particular time. Given that the technique in question has inflexible rules, we thought of the only possible solution, which is totally understandable considering that, in the GSM radio mobile phone system, the radio connection allowing for phone calls and access to data and Internet services is maintained by a network of radio bridges, that is, the cells mentioned above.  When a cell phone is on, it connects to the cell that allows for the best possible connection, but also detects signals from neighboring  cells so that the phone can switch to a new one when the cell being used starts performing poorly due, for example, to the fact that the user is moving. The communication message between a cell phone and a cell contains the cell’s identifier, sent out by the cell itself; every identifier is unique. This entails that every cell phone, when connected to the network of a given network, has specific information about the cell it is relying on. We, therefore, concluded that Google Maps Mobile is able to track the position of a cell phone by simply associating the name of a given cell with the data regarding its position; in other words, a cell phone transmits the data of the cell it is connected to via the GPRS network, and the Google Maps Mobile Server associates such data to the position of the cell itself. While working out the details of our project, we were still testing the ground, given that Google not only is disinclined from publishing its data on the web, but also refrains from explaining how to use them. So, what we did was connect a USB-interfaced GPRS cell phone (on which we had uploaded Google Maps Mobile) to a computer which, in turn, was connected to the web via LAN. Using programs such as Microsoft Network Monitor, we sniffed the communication between the cell phone and the Google server and realized that our hypothesis was indeed correct: Google knows the position (or coordinates) of the cells of the radio mobile system and can even state where a cell is if provided with that cell’s ID. Once the position of a cell is known, and considering that the coverage radius for each cell is also known, it is easy to find the circular zone, whose radius equals the coverage radius, where the cell phone requesting location tracking is located. Naturally, this method allows but for a rough estimate: determining the precise position of the cell phone hinges on data regarding the coverage of a given cell which can only be provided by the Google server.

b) Device verifies the cell linked and sends a request via GPRS to Google

About Staff


  1. Pingback: [Thursday] GSM tracking without GPS - Hack a Day

  2. Pingback: GSM tracking without GPS | Boomeroo Web Resources

  3. Pingback: GSM tracking without GPS | House of Mods

  4. Pingback: GSM tracking without GPS « Black Hat Security

  5. Pingback: GSM tracking without GPS | No Chance With B

  6. Tom

    March 24, 2011 at 10:16 AM

    I downloaded the magazine article. And also downloaded the from the magazine publisher’s website. The zip file only contains the circuit board cad files and one other set of unrelated circuit board files, not the firmware or sources needed to successfully complete this project. However I understood that the was suppose to contain the firmware and sources. Where can I get the firmware? Seems like the article is useless without the firmware. Also, I don’t see a source for the GSM module listed anywhere. The manufacturer does not seem to sell directly to the public.

  7. Boris Landoni

    March 24, 2011 at 12:12 PM

    Hi TOM,
    you can download the firmware here.
    You can also buy the module here.

  8. Pingback: Blog » Blog Archive » Position location with GSM cellular

  9. Rob

    September 21, 2012 at 3:41 PM

    HI, I am interested in buying the finished version of this to try. I am not experienced at building such a fine electronics board but actually want to practically test the capabilities before progressing on a non-gps project.
    I am looking for a very light weight tracker for a micro-UAV and can also use a RF transceiver set-up if this can get me close enough.

    • Haim Rodrik

      April 21, 2013 at 6:32 PM

      i can help you , i am familiar also with devices and UAV

      • Rob

        April 25, 2013 at 11:06 AM

        Hi, I had stopped looking at these modules as a possible solution but would be interested to know more about your possible solution. What I need has to be very very light!

        • Haim Rodrik

          August 10, 2013 at 6:32 AM

          its not so recommended in UAV in case your flight is above the base stations. The direction of the antennas (the angle) turns to ground. When your flight is higher you will start to get reflected waves from the ground. You need light and cheap modules of RF FSK modulated and use as radio link.
          i will send you data sheet and very easy to get them in UK

    • Haim Rodrik

      April 21, 2013 at 6:35 PM

      note: gsm tracking is not solution for uav, because the base stations and repeaters not directed to the sky. for uav other specific solutions

  10. Ping

    October 24, 2012 at 7:28 AM

    This circuit does not need any external antenna? Can this circuit integrate with GPS tracker?

    • BorisLandoni

      November 2, 2012 at 9:20 AM

      The circuit needs a GSM antenna.

  11. Pingback: styczen

  12. Woofita

    April 1, 2015 at 4:58 PM

    Dear Boris,
    I would like to buy gsm localised with sim 900 without gps. As I am living in thailand, can you suggest me how to pay the price?

Leave a Reply