Gives technical overview of different technical methods to find location of mobile phones, with focus to in-phone software metods

1. TERMINAL-BASED MOBILE
POSITIONING FOR DEVELOPERS
Jaak Laineste

2. Automatic mobile positioning methods
• Mobile operator dependent
Mobile Positioning (Cell-ID; A-GPS)
Passive location data
• Terminal-based, operator independent
Special GPS devices
Normal mobile phones
With GPS
Without GPS, using Cell-ID

3. Topics
• Different mobile platforms
API: J2ME, Symbian, Windows Mobile,
iPhone, Android
• Terminal positioning methods
Methods in different platforms
Getting Cell-ID
Convert Cell-ID to geographical location
Technical security

4. Mobile API platforms
• Closed OS (e.g. Nokia S40) (over 70%)
• Symbian Series 60 (~15%)
• Symbian UIQ (<1%)
• Windows Mobile (<1%)
• Blackberry – Java-based
• iPhone – Mac Os X
• Google Android – Java-based
• Other Linux phones

5. Mobile platform APIs
• Most platforms – SIM Toolkit, WAP, J2ME
• Closed OS (e.g. Nokia S40) – only J2ME and WAP
• Symbian Series 60 – Native (C++)
• Symbian UIQ – Native (C++)
• Windows Mobile – Native (C#, C++), J2ME
• Blackberry – Specific mobile Java, J2ME
• iPhone – iPhone OS/Mac OS X; Objective-C and Javascript
• Google Android – Specific mobile Java
• Linux phone – native, Java SE
• Java Phone – Java

6. Positioning base data methods
• SIM Toolkit
Non-standard, there is no in-phone API, can get data only by server (OTA: SMS; USSD) or
using SIM Toolkit API. Can see several cells and Rx.
JSR-177 API theoretically allows access to SIM Toolkit application from J2ME, but no
real implementations
• WAP
Server-based Mobile Positioning can only be used (Ericsson MPS etc)
• J2ME
JSR-179 Location API for internal GPS: location, address, orientation, course, speed,
altitude, landmarks, xtra info (lif, nmea), ProximityListener.
External Bluetooth GPS: BT serial connection, NMEA information
Cell-ID based: can get Cell-ID, LAC, MNC for some phones
No direct way to see WiFi basestation ID-s (or Rx values)
• Native libraries
Symbian, Windows Mobile: Cell-iD, LAC, MNC
3rd party libraries for WiFi positioning (e.g. Skyhook), Bluetooth positioning
Typically vendor-specific
• Vendor-specific APIs
Motorola iDen API: com.motorola.iden.position.*
Android mapping and location APIs
iPhone location APIs

7. Symbian-specific in-phone positioning
J2ME Application + native location
Fully native application
gateway

8. J2ME-specific in-phone positioning
Non-standard: Cell-ID
Standard: GPS-based

9. Mobile operator solutions
A-GPS based
Cell-ID based

10. Cell-ID : SonyEricsson phones
• Requirement
Java Platvorm 7.3 or newer
Phones released around 2006 and newer
Older phone may need firmware update (7.1 
7.3)
Does not work in SE Symbian (i.e. UIQ) or
Windows Mobile (Xperia X1) phones
• Method :
String cellID =
System.getProperty(quot;com.sonyericsson.net.cellidquot;);
• Data:
Cell-Id, LAC, MNC, CMNC, MCC, CMCC, RAT

11. Cell-ID : Nokia phones
• Requirement
Series 40 3rd FP1 edition, requires operator or
manufacturer signing
Series 60 3rd Edition, FP2 (phones released
2008 and newer, does not work on e.g. N95), no
signing required
• Method :
System.getProperty(quot;com.nokia.mid.cellidquot;); // S60,new
S40
System.getProperty(quot;Cell-IDquot;); // S40 3rd FP1
• Data:
Cell-Id, LAC (not in S60), countrycode,
networkid

12. Other Java phones/platforms
• Motorola
String cellID =
System.getProperty(quot;phone.cidquot;);
• Blackberry
class net.rim.device.api.system.GPRSInfo.GPRSCellInfo
Methods getCellId() , getBSIC() , getARFCN()
• Google Android
Class android.location.Location
Methods: getAltitude(), getLatitude(), getLongitude(),
getSpeed()
Class android.location.Geocoder
Package com.google.android.maps (Google Maps) with
com.google.android.maps.MyLocationOverlay

13. Location in other mobile platforms
• iPhone
Location API available for native application
Gives location coordinates using GPS or Cell-ID (depending on requested
accuracy), Cell-ID is invisible and automatically located
• Symbian
Location Acquisition API – provides GPS coordinates
Low-level Cell-ID data available
Requires application signing
• Windows Mobile, native apps
No built-in location API for native apps, but libraries available
GPS NMEA data available via serial connection
Cell-ID data available, but must be translated by application
• Widget platforms, at least some have location API
Google Gears Mobile: currently (Q1/09) in WinMo and Android only. Other
platforms probably coming

14. Automatic Cell-ID
• Some phones use internally Cell-ID, using vendor’s cell-id database
iPhone, with native apps. Web API is expected to come.
Nokia with JSR-179 support (S60 3rd edition and S40 6th edition)
Google Android
Some widget platforms: e.g. Google Gears Mobile
• Developer implementation :
Use standard location API (JSR-179 or Android Location API) to get
coordinates. Does not give raw cell-id, and no need for that.
Set required location accuracy to 500 m (or larger)
Note that some of these systems may use also WiFi and IP-based
positioning, actual method is typically not reveled to developer
• User configuration:
Enable network-based positioning method

15. Cell Broadcasting in J2ME
• Many GSM networks broadcast textual cell name,
which is unique and could be used for geographical
location look-up
• Usually CBS channel “050” is used
• J2ME WMA API can be used to access CBS
• Usage in practice is very limited:
Most J2ME implementations do not support CBS at all
(even if phone supports WMA API for SMS and MMS), or even if
CBS is theoretically available, then they does not show
channel 050 contents
From several tested platforms only Nokia S60 gets actual
name of cell, but it is very rarely updated (takes minutes)
No (public) cell name geolocation databases available

16. Native applications
• Symbian
Native telephony APIs/ C++ – vendor-specific
Some simple open-source Python scripts are
available(signed shell needed), suitable for
experimentation
• Windows Mobile
AT command – oldest method: AT+CREG=2
Native vendor-specfic methods with API

17. Other methods to get location info
• Network Monitor
Hidden firmware function in (old) GSM phones
No API, only for visual study
Shows all covering Cell-IDs, Rx, Color codes etc
• Cell Name Broadcasting (CBS)
In 3G networks: SAI – Service Area Indicator, rarely available
and probably similar limits like with CBS in GSM
• Other network ID-s
WiFi: SSID/MAC + RSSI. Possible with native apps (Windows
Mobile, Symbian, e.g. Skyhook libraries available), not
accessible via J2ME.
Bluetooth: MAAC. Very slow discovery, but accessible via
J2ME
Future: NFC, RFID for local area

18. CellID databases
• Open global databases for mobile network
CellSpotting.com
Placelab / wigle.net – wifi, bluetooth beacons
CellTrack
OpenCellid
Main issue: they all have still very limited coverage
• Commercial services/databases – reasonable coverage
Navizon – mobile cells, WiFi
Skyhook Wireless - WiFi
• Collect your own database – could be reasonable in small area
Mobile network can sometimes change their cell-id-s, especially in 3G networks.
There are also non-stationary base stations
• Use big vendors global databases
Yahoo ZoneTag – REST-based API. Mainly US coverage, but open and free to use
Google and Nokia have their global databases with good coverage, but there is no
public API to access them directly. Maybe in the future.

19. Security aspects
• J2ME location API (JSR-179)
Asks always user permission to give location
If signed app, one-time allow after starting app
Cannot be used for externally initiated tracking
• J2ME cell-id properties
SonyEricsson: no CellId data security, no asking from the
user. Nokia S60: no security, Nokia S40: requires operator or
manufacturer signing, which is hard for 3rd party
There is still J2ME communication security (network, file,
SMS etc)
• Symbian and Windows Mobile cell-id and GPS data
Should be signed app to get the location data from phone

20. What Nutiteq provides
• Custom Mobile mapping application
development services
• MGMaps Mobile Mapping SDK
J2ME, Blackberry, Android APIs
Advanced mapping (on-line, offline)
Positioning (GPS, Cell-ID)
Geocoding, Routing
Map overlays (KML layers etc)
Open source
Wide device support

21. Thank you!
Jaak Laineste
MSc & MBA from University of Tartu
Nutiteq LLC, CEO and founder
jaak@nutiteq.com
Mobile: +372 509 2586
Skype: nutiteq
www.nutiteq.com