The burglary was reported at 11:58 p.m. The suspect’s phone is on Verizon. The return shows an outgoing call at 11:52 p.m., Cell ID 234117, Cell Face 2. The prosecutor asks the question every attorney asks about a cell site record: where was the phone?
The honest answer is not an address. It is a direction from a tower, inside a wedge about 120 degrees wide, for as far as that sector reaches. In a dense city that wedge may be a few blocks. On a county road it can be miles. The record never said where the phone was. It said which antenna handled the call.
Getting from that record to a map and timeline an attorney can defend is a data problem before it is a legal one. Here is what the records contain, what they do not, and how SentVi puts them on one chart.
What a cell site record actually contains
Every call on a mobile network is handled by a cell site, and the carrier logs which one. The United States Supreme Court described this in Carpenter v. United States (2018): each time a phone connects to a cell site, it generates a time-stamped record. In that case the government obtained 12,898 location points for one phone over 127 days, an average of 101 a day. The Court held that acquiring historical cell site records is a Fourth Amendment search, so a warrant is now the normal route for law enforcement. Civil litigators get the same records by subpoena.
The three major carriers deliver that location in three different ways.
- AT&T packs the location into a single bracketed field on each row of the Mobility Voice Report. AT&T’s column definitions give the format: LAC/CID, then longitude and latitude, then sector and beamwidth, all separated by colons. The coordinates are the cell tower’s, not the phone’s. On the 4G example in AT&T’s own key, the beamwidth reads -1.0, which means the width of the sector is not stated.
- T-Mobile returns the location in separate columns: 1st Tower LAT, 1st Tower LONG, 1st Tower Azimuth, and the tower’s street address, city, state, and ZIP, with a matching set of Last Tower columns for where the call ended. T-Mobile’s guide says cell site location is not available for SMS messages, and that the Switch Name column is not an indication of where the device was.
- Verizon gives a six-digit Cell ID (market number plus tower number) and a Cell Face (sector 1, 2, or 3) on each row of its VoLTE call detail. The coordinates and azimuth for each site are not on the row. Verizon’s explanation form says to check the cell site key, which arrives as a separate file.
So one return already has the coordinates in the row, one has them in a dozen columns, and one has them in a different file. Before any map exists, the analyst has to split AT&T’s bracketed field into columns and join Verizon’s Cell ID to the cell site key. Miss the join and the Verizon calls have no location at all.
What the location means
Three things are true of every cell site record and are regularly argued the wrong way in court.
The coordinates are the tower’s. AT&T’s key says so in its definition of latitude and longitude. T-Mobile’s columns are named Tower LAT and Tower LONG. A pin on a map at those coordinates is the antenna, not the suspect.
The sector gives a direction, not a point. T-Mobile’s guide explains that a tower’s coverage is generally divided into three 120-degree sectors, and the azimuth in the record is the center of the sector that served the call. An azimuth of 90 means the sector faces east and covers roughly 30 to 150 degrees. The phone was somewhere inside that wedge.
The size of the wedge depends on the neighborhood. Where towers are close together, each sector covers a small area. Where they are far apart, a single sector can cover a large one. The same record is strong evidence in one place and weak evidence in another, and the chart should make that visible rather than hide it.
Add the clock problem from last week’s post: AT&T and T-Mobile record times in UTC and Verizon lists local time, so the times have to be converted before the records are compared.
From tower list to map and timeline
The spreadsheet route is three tabs and a lot of VLOOKUP. The chart route treats the data the way it is actually shaped: phones, towers, and the calls that connect them.
In SentVi, each phone number becomes one entity and each cell site becomes one entity with its latitude and longitude. Each call becomes a relationship between the phone and the tower that served it, with the call’s start time attached. Any entity on the diagram with latitude and longitude is automatically plotted on the Map, so the moment the tower list is imported, every site that appears in the records is on the map and every call is a link to it.
From there the questions attorneys and investigators ask become actions on the chart.
- Which calls hit towers near the scene? Draw a circle or rectangle around the location with Geo Query. The towers inside it, and the phones that connected to them, are added to the chart. Keep removes everything else.
- What order did it happen in? The Timeline tab lays out the calls by their start times, down to the Hour view. The Time Range slider on the diagram hides everything outside a window as narrow as one second, so the 11:40 p.m. to midnight picture is the only thing on screen.
- Was the same phone at more than one scene? Save each incident as its own Visualizer and run Multi-Visualizer Analysis. It returns the entities that appear in several of them, which is usually a short list.
- Can I show it to someone who does not use the software? Export the map to Google Earth with the links and the timeline intact, or hand the file to the free SentVi Reader.
Keep the azimuth and beamwidth with the tower record so the sector is in the chart’s data rather than in someone’s memory. When the question comes on cross, the answer is on the entity, not in a notebook.
What the chart should say
A defensible cell site chart makes three claims and no more. This phone used this tower at this time. The tower sits here and the serving sector faces this direction. The sector covers roughly this area given the towers around it. It does not say the phone was at an address, and it does not draw a point where the record gave a wedge.
Done that way, the records that put the suspect’s phone on the east side of tower 234117 at 11:52 p.m. are evidence a court can weigh. Done the other way, they are an exhibit waiting to be excluded.
If your next case has a cell site return and a tower list in two different formats, book a demo and bring them. We will put them on one map.
