How far can cell site observations take you without survey data?

Cell site analysis is often boiled down to "which cell did the phone connect to?" The more interesting question is what we can actually say about where a phone was, given what the network tells us.

That question got very real, very fast, during a fast-paced investigation into a missing 14-year-old girl in June 2025. Police had call data records for her phone and for the phone of the man suspected of abducting her. The two phones were on different networks, and both had connected to adjacent pairs of antennas in south-central London.

The catch was that nobody had survey data mapping the service areas of those cells, and this was a "life in danger" query, so there was no time to go and get some. So the team worked from what they did have: the locations and azimuths of the antennas, plus timing-advance information the operator supplied for the suspect's phone. From that they estimated an area for each phone, and then, on the assumption that the phones were together, narrowed it to a patch roughly 125 metres long and under 50 metres wide.

That estimate reached investigators within half an hour of the data arriving. Combined with other information, including an address linked to a known sexual offender just outside the estimated area, it helped police find the girl and the suspect at that address.

The paper is careful, though, about what that outcome does and doesn't show. The methods were unvalidated, and the authors passed them to investigators with that caveat. A good result in one case isn't validation, and they're clear that anything used as evidence would need proper controlled testing first. In a city, an area that size could contain hundreds of phones, so this kind of estimate shouldn't be used in isolation.

The authors also set out where the work needs to go next: models that treat location as a matter of likelihood rather than hard cutoffs, methods that account for terrain and clutter (which weren't a factor here but will be elsewhere), and, importantly, access to raw timing-advance values rather than the operator's own pre-interpreted radii, so that practitioners can be transparent about how they reached their conclusions.

For anyone working with cell site data, it's a valuable real-world case, and a reminder that the value lies less in the data itself than in how openly and carefully it's interpreted.

Read the full paper here.