Re: [base428] NYPD search for parachutists who landed in Manhattan
ok, im an it guy and electric engineer with real hands on experience on gsm.
i worked quite some time on doing some security research and playing around with the gsm baseband and i have quite a bit of understanding of the air interface.
1. i had access to a radio spectograph, and i can assure you that nothing is coming from a mobile that is turned off. you can try this with a cheap radio. stick your mobile to it and drive around, as soon as you enter a new cell it makes this crappy noise. now turn the mobile off, and see what happens.
2. gsm in your mobile is either on or off, there is no powersaving mode or anything fancy to keep it connected while not sending/receiving. the gsm mobile end has to listen all the time since it has to stay synchronized (the network channels are frequency seperated, but also time seperated, so if youre not synchronized you cant receive or send)
since you can move your mobile it is not possible to stay fully synchronized even within one cell without from time to time send an update. so if you move further away from the base station while staying in the same cell, you would slowly slip out of your time slot because of the propagation delay of the radio signal, yes, gsm is really that timing critical.
there is some cool piece of free software that is called osmocmBB.
this can be used to sniff (eavesdrop) the stuff that is sent around in the network. most traffic (speech, sms ...) is encrypted, however the part of network that is used for administrative purposes is not. so you can see when someone comes into your gsm cell and his mobile loggs onto this cell, same when someone leaves the cell, turns on, or off their mobile, and much more stuff...
when you turn the mobile off, it sends a goodbye message to the cell that forwards it to the infrastructure behind.
i can again assure you that after the mobile sent its goodbye, no more messages are sent, either from network side nor from mobile side.
gsm (and all newer generations) specifications are available online, the one for gsm is a few 1000 pages, but since you can narrow it down to the air interface (um) you can dig through the few 100 youre interested, and theres nothing in there that would describe what would be necessary to let the network know your location while your not assigned to a bts, therefore have a fully turned on mobile that is linked to the network.
http://www.3gpp.org/specifications