Timing Advance and DAS (Distributed Antenna Systems)
Timing Advance (TA) is a type of geolocation data provided by cellular networks. It is generally regarded as providing evidence of a target phone’s approximate distance from the serving cell tower when connections were made.
A previous report published by Forensic Analytics outlined some considerations related to Timing Advance in general; we’ve published a new paper which deals with TA as it relates to one specific deployment case, known as ‘outdoor DAS’.
Why is this important? TA data is commonly used to approximately geolocate suspect’s phones; TA is really a measure of delay, from which the phone’s distance from the serving tower can be inferred. TA data provided via DAS sites can be subject to additional, and possibly variable, sources of delay, meaning that any inferred distances for phones using DAS cells may be subject to variation as well. This in turn means that the precision of any distance estimates can vary, which can limit the effectiveness of this type of geolocation data when used as evidence.
DAS – or Distributed Antenna Systems – provide a deployment method where the base station equipment that serves a location or an area is deployed centrally, with cables carrying radio signals out to a distributed set of remote antennas in the served area.
DAS is typically deployed indoors or underground, in places like shopping malls, sports stadiums and subway networks, but there is a particular class of DAS site known as ‘outdoor DAS’ that this research focuses on, where the same techniques are used to create more traditional outdoor macro and micro cells.
For TA data to reliably indicate a suspect phone’s approximate distance from the tower, practitioners need to have confidence in a number of factors:
the measurements on which TA are based must be stable – a phone at a given distance from a particular tower will always generate similar TA values
the location of the antenna the phone is connected to must be clearly understood
the location of the base station at which the TA measurements are captured must be clearly understood
Unfortunately, our research so far has indicated that none of the above factors can necessarily be relied upon in relation to some outdoor DAS sites.
TA measurements captured for some outdoor DAS cells appear to fluctuate across a wide range of delay/distance values even for test phones that are stationary. Some outdoor DAS cells are simultaneously transmitted via up to four antennas deployed at some distance from each other (up to 1 mile or 1.5km) and the tower list entries for some outdoor DAS sites make it difficult to understand where the base station is located.
All these factors add up to TA from some outdoor DAS sites being demonstrably unstable, with distance estimates varying significantly, and also generating a degree of uncertainty about which point to map any derived TA distance arcs from.
Further testing is required, but our interim recommendation is that TA data derived from outdoor DAS sites specifically should be treated with extreme caution and shouldn’t be considered to be precise enough to use as the basis of an evidential geolocation estimate.
In mitigation, many DAS cells are configured to be quite small – in dense urban areas a typical cell radius is something like a quarter of a mile (375m) and many micro cells are even smaller. If a cell can be identified as being a DAS cell, it may be enough, for the purposes of geolocation, to plot the location of the used DAS antenna and indicate that the suspect phone must have been close to that location to have used that antenna. This type of contention is, of course, more strongly supported if an RF survey can be conducted of the DAS cell’s coverage area.
Without having to issue a spoiler alert, the conclusions reached in this paper don’t suggest that practitioners avoid using TA data from DAS cells, only that they exercise more caution when forming conclusions based on that data through knowledge and an understanding of the considerations and caveats underpinning this data.
Outdoor DAS sites seem to be employed by all three major US carriers – but the testing undertaken so far has concentrated on T-Mobile. Further testing of the other two networks and of DAS sites in additional locations is required and we will publish an updated version of this paper once that testing is completed.
The Outdoor DAS Timing Advance Paper can be downloaded here:
View our previous Timing Advance paper here:
Forensic Analytics are global experts in the use of digital media in criminal investigations our CSAS software is widely used by law enforcement to save time, save money and secure convictions. Our expert witnesses support the criminal justice system and our expert trainers help develop the current and future generations of investigators. If you have any questions after reading our papers, please contact us via [email protected].