The question of whether a cellular
telephone is a tracking device has often
hinged on the resolution of the cell site
data. If the data consists solely of the
cell site ID, then the precision of the lo-
cation information is clearly a function
of the size of the cell. Cell sizes vary sig-
nificantly, but the following can be used
as a rough rule of thumb:u
Urban:
Suburban:
Rural:

1 mile radius
2 mile radius
> 4 mile radius
It follows that through registration
messages alone, a subscriber’s location
is recorded to the level of a metropolitan
area at a minimum, and sometimes to
the level of a neighborhood.

A Private overlay

So long as the cellular concept requires that a piece of equipment be located within a particular cell, there will be a requirement in cellular systems that an MSC be able to locate user equipment at the level of one or a small number of cell sites. It is important to note, however, that it is the equipment that needs to be located and not a specific, u Jeff Pool, Innopath, private correspondence. These areas are further reduced if the cell has multiple sectors.

named subscriber. In this section we will consider the possibility of creating a private overlay for cellular systems that protects user privacy by strictly separating equipment identity from user identity. The proposed overlay requires the addition of a Public Key Infrastructure (PKI). 10 The PKI provides the network and all subscribers with a public encryption key and a private decryption key. With this addition, a private overlay to the existing cellular infrastructure can be established as described below.

The scenario assumed here is that of a cellular telephone with standard capabilities to which has been added the ability to operate in a private mode, a private mode in which the service provider is unable to associate location data for the phone with a specific user. The private mode is predicated on a private registration process, which is enabled by having the network transmit once a day (or at some suitable interval) an identical certification message to each authorized subscriber. The certification message that is sent to each subscriber is encrypted using that subscriber’s public encryption key.

When the user enables the private cellular mode, the cellular platform sends a Privacy Enabling Registration (PER) message to the network. The PER, consisting of the certification message and a Random Equipment Tag (RET), is encrypted using the network’s public encryption key. The certification message acts as a zero-knowledge proof, showing the network that the PER was sent by a valid user, but without actually identifying the user (we will address the problem of cloning in a moment). The RET is a random number that will be entered into the VLR and the HLR and treated as if it were a phone number. The VLR and the HLR will thus collect all of the information needed to establish and maintain phone calls to the cellular platform, but will not associate this information with a particular individual or phone number. So long as the user chooses to remain in private cellular mode, subsequent registration messages will include the RET as opposed to the user’s telephone number.

Call setup, mobility management,
and roaming will all be handled exactly
as before, with the difference that the
HLR and VLR location information is
associated with the RET, as opposed to
a phone number. Data calls can be kept
private by associating the RET with a
temporary IP address.v
Incoming calls require that calling
parties know the RET. In order for the
RET to be associated with the correct
HLR, it will also be necessary that the
calling party identify the service pro-
vider that serves the called party. The
user in private cellular mode must thus
distribute, using public key encryp-
tion, his or her RET and the identity
of the service provider to those parties
from whom he or she would be willing
to receive a call.