Section: Justice & right Author: IN Reading Length: ~27 min Sources and further reading: 22 items Topics: police, location data, § 88a, wiretapping, ZEK, data retention, BTS, digital trace SEO / Working Title: How does police mobile phone tracking work?
How does police cell phone tracking work? The question sounds simple until we notice that the film and the writing are not comparing the same thing. The judge's order opens up network metadata, not call content. The cell indicates the device in the transmitter's coverage, not the apartment door. Six months with an operator is not the same as four months of wiretapping. And a Union breach of blanket retention does not automatically invalidate a single criminal order. The following text is about legal procedure. It is not about forensic interpretationtraces as a judgment on a person and is not about how to avoid the cell.
1. There is a cell in the file. Three other questions on the table
The file contains the name of the base station and the time. The investigator says: the phone was in that cell. The defense attorney says: the cell is not a door, the device could have been in the car. The journalist writes: the police eavesdropped on him. The official at the operator says: we have data according to the law, including BTS Start and BTS Stop, not a movie pin on the screen.
At first glance, it's a dispute about whether the police can find the phone. In fact, each describes a different problem. The investigator talks about the registration of the device in the network and the time. The advocate talks about the relationship between the device and the person. The journalist talks about the content of the communication, although the file may only contain metadata. The operator talks about what the law obliges him to keep and what he can release to the authorized body.
Therefore, they can all be partly right and the common headline still wrong. "The police targeted him" sounds like the end of proof. In the file, it is often the beginning of a chain: number, IMSI, IMEI, cell, time, command, coverage map, other evidence, and only then the person.
This article is about the procedure. It does not address whether a particular defendant had the phone in his hand. This is a forensic question that the Other Context series discusses elsewhere in the sentence "The phone was at the scene of the crime." This is about which title opened which metadata.
The command opens the network metadata. The cell is not proof that the owner was there.
— Jiný Kontext
2. Police localization has at least six layers
The phrase "mobile phone location by the police" connects things that need to be separated. The first layer is the network. The mobile device communicates with base stations, the network works with identifiers, and the law and decree determine which data is stored. Decree No. 357/2012 Coll. it lists, among other things, the IMSI, the device identifier and the Start and Stop base station designations [5].
The second layer is time. It is not just a place, but the beginning and end of the communication or session and the period defined by the command. The third layer is the title. In criminal proceedings, it may be § 88a of the Criminal Code, other times the consent of the user of the device, a search according to the Police Act or other authorizations listed in the ZEK [2] [4] [6].
The fourth layer is the output. The operator does not automatically issue a photo of a person on the street. It issues the data it has that match the request. The fifth layer is the GNSS contrast. GPS on the phone or AML on an emergency call are different methods and often different legal channels than asking the operator. The sixth layer is an interpretation about the person. Linking the device to the holder is another chain of evidence.
This layering is not an escape from the answer. It's a way to not screw up the answer. If there is a cell in the file, we know something about the device in the network. We don't know everything about man yet.
3. The best reading is the one whose confusion the writing can bear the least
With location data, the most expensive mistake is often the subtle one. It's not that all metadata is worthless. It's that it reads like something else. Metadata as content. A cell as a door. Device as human. Search for a missing person as a criminal warrant. Time in the system as the time of the deed.
| A kind of failure | What does he look like? | How to test it | What will limit the damage |
|---|---|---|---|
| Interchange of institutes | "Wiretapping" where § 88a was involved | Compare § 88 and § 88a, content and metadata | Read the order and its legal basis |
| Swap output | BTS reads like a pin in a door | Compare the output with Decree 357/2012 | Read station designation as coverage, not address |
| Person substitution | The cell is read as accused | Asking who held the device | Additional evidence outside the cell itself |
| Title swapping | § 68 PolZ looks like § 88a TŘ | Verify the purpose: investigation or criminal matter | Separate urgency and process |
| Time confusion | The operator's stamp is read as the civil time of the act | Compare command period and event time | A timeline, not an isolated piece of data |
The table is not a network bypass. It is an aid to reading the file. A good defense, a good editorial, and a good investigation all need the same brake: first find out exactly what the document says. And then what he doesn't say.
It does not follow that the cell is a weak trace. It follows that its strength depends on the chain. The more an article or file jumps over layers, the more certainty it borrows without support.
4. Section 88 is not Section 88a
The most common public confusion is simple: everything is called wiretapping. However, the Criminal Code differentiates between the content of communication and the data on the telecommunications traffic carried out. Section 88 regulates interception and recording of telecommunications traffic, i.e. interference with content. It generally targets crimes with a maximum sentence of at least eight years and listed offences. The order is issued for a maximum of four months and can be extended, always for a maximum of another four months [1].
§ 88a is a different institute. It refers to data about the telecommunications traffic carried out, typically metadata. The general branch aims at an intentional crime with an upper limit of the criminal rate of at least three years or at enumerated crimes. It requires a written and reasoned order of the president of the senate, in the preliminary proceedings of the judge at the proposal of the public prosecutor, and subsidiarity: if the objective pursued cannot be achieved otherwise or if the achievement would be substantially more difficult [2].
The numbers need to be read with a unit. Eight years and four months describes interception of content under Section 88. Three years describes the general threshold rate for metadata under Section 88a. They do not measure the rate of police requests and say nothing about the accuracy of the cell.
When a newspaper text writes "wiretapping" where location data was concerned, the reader changes the intervention. When the file talks about § 88a, it is not about the content of the call. It's a different layer.
5. Operational data is not location data, although they are often requested together
ZEK distinguishes between operational data and location data. Operational data according to § 90 are related to the transmission of a network message or to the billing of a service. They are not the content of the communication [4]. Location data according to § 91 determine the geographical location of the telecommunications terminal device of the user of a publicly available service [4].
In practice, they may be requested together. But that doesn't erase the difference. The information about who communicated with whom and when is a different layer than the information about the location of the end device in the network. Both can be sensitive. Both can be relevant to criminal proceedings. But they don't say the same thing.
This distinction also helps when reading the words "telecommunications traffic data". They do not automatically mean that the police know the content of the message. Nor do they automatically mean that it has a GNSS coordinate from the phone. They may include identifiers, times, communication directions and network data according to legal basis and decree.
Therefore, the right question is not only: did the police get the data? They are: what kind of data, for what period, under what provision and in what format? Without these answers, metadata can easily become a story that looked more accurate than it was.
6. BTS Start/Stop is not the phone's GNSS coordinates
Decree No. 357/2012 Coll. is more sobering than a movie scene. For the mobile network, it takes into account the Start and Stop base station designations, the IMSI and the device identifier [5]. This is the output about the relationship of the device to the network. It is not the phone's automatic GNSS coordinates.
GPS.gov lists the typical accuracy of a GPS-enabled smartphone as 4.9 meters in an open-sky radius [17]. This number measures the capability of the receiver in the phone under the given conditions. It does not measure the accuracy of the cell-ID in the file according to § 88a. Nor does it measure the operator's ability to determine the apartment. It's a contrast, not a converter.
Forensic literature shows that location from mobile devices is not a single quantity. A 2020 review by DFRWS/Forensic Science International cites an example of a GSM antenna with a range of up to 35 kilometers and in addition states a U-TDOA in the order of 30 to 50 meters [16]. These numbers must be kept in check. These are literary examples of methods and rules, not the official accuracy table of the Police of the Czech Republic for the year 2026 and not a measurement guide.
Therefore, public sources do not allow writing a single sentence like "the police cell has an accuracy of X meters". Sometimes the data can be raw, sometimes supplemented with additional data. But the BTS Start/Stop from the decree is still not 4.9 meters from the GNSS chip.
The direction of the evidence is also important. When the system saves the station label, an item is created that can be planted in the network. Only the next step tells us what territory this station practically covered at the given time and whether it may have overlapped with other stations. This step can be professional and helpful. However, it must not be passed off as the original data. Otherwise, the administrative designation becomes an exact dot just because someone drew it over the map base.
Therefore, it makes sense to request the raw output and its interpretation separately in the file. The raw output answers the question of what the operator issued. Interpretation answers the question of how space is inferred from this. And when further evidence answers the question of who had the phone with him.
7. The order of the judge in the TŘ is not a request according to § 68 on the Police
The police can work with location data in different modes. Criminal proceedings according to § 88a is one of them. The search for a specific wanted or missing person according to § 68 of the Act on the Police of the Czech Republic is different. The purpose here is narrower: to find out the time and place of such a person's residence, and the law binds the result to that purpose [6].
Before confusing search and criminal proceedings
The first question is which paragraph is in the file or in the application. The second, whether it is a criminal activity or a missing person. Third, whether the purpose and period for which the data is requested is described. Section 71 of the Police Act adds another special branch for a specific terrorist threat [6]. She's not a generic "anytime police" either.
The Constitutional Court in the ruling Pl. ÚS 45/17 from 2019 admitted the absence of a judicial review of the search in view of the urgency and possible threat to life, but at the same time insisted on the strict application of the retention regulation [10]. That is an accurate caveat. He doesn't say the police can do everything. He says different titles have different purposes and different insurance policies.
Replacing § 68 with § 88a means changing the nature of the intervention. One mode searches for a person. The other serves criminal matters. Both can work with data from the operator. However, they are not the same door.
8. Six months of ZEK is not four months of wiretapping
ZEK requires operators to store defined operational and location data for a period of six months. This retention window has been valid in the current regulation since 1 October 2012, when the legislator responded to the cancellation of the previous regulation [4] [10]. At the same time, the law prohibits the storage of message content in this mode [4].
Six months here measures the period of mandatory retention of metadata by public network and service providers. It does not measure the length of content listening. Section 88 of the Criminal Code stipulates this for a maximum of four months with the possibility of extension, always for a maximum of another four months [1]. Another clock, another object.
These numbers also have a second caveat. The six-month retention window cannot simply be said to mean that no data exists anywhere after it expires. There may be other legal reasons for billing, transfer or retention on a case-by-case basis. At the same time, this window cannot be turned into a live database for anyone. Access is tied to authorized authorities and title.
Four months of wiretapping and six months of metadata easily blend into the headlines. But they must be separated in the file. Otherwise, the reader does not know whether we are talking about who said what, or when and in what network context the device communicated.
9. A 2025 Union breach does not automatically cancel one order
Czech data retention has a long history behind it. The Constitutional Court in Pl. ÚS 24/10 canceled the previous regulation of data retention, the finding was published as 94/2011 Coll. Subsequently, the then § 88a, published as 43/2012 Coll., was also repealed. [8] [9]. The legislator revised the regime and set a six-month retention period from 1 October 2012.
In 2019, the Constitutional Court in Pl. ÚS 45/17 rejected the proposal to cancel the new regulation. But he emphasized the constitutionally compliant application, strict conditions and the importance of judicial review where it is required [10]. Meanwhile, the EU Court of Justice in the Tele2 Sverige cases of 21 December 2016 and La Quadrature du Net of 6 October 2020 rejected blanket and indiscriminate retention of traffic and location data with only narrow exceptions [13] [14] [15].
On December 30, 2025, in case 30 Cdo 2556/2025, the Supreme Court stated in a civil dispute about an apology that § 97, paragraph 3 of the ZEK is in conflict with EU law; press release issued on January 8, 2026 [11]. This is a strong signal of a plane mode defect. But it is not an automatic derogation of the criminal order in every case. The judgment dealt with an apology, not a blanket deletion of § 88a.
The correct sentence is narrower and more precise: the Czech retention regime is under the pressure of EU law, but as of September 2026 the law remains in the Collection and the individual procedure is assessed according to title, time, purpose and applicability in a specific matter.
There is a double caution for the reader. It is not accurate to say that blanket storage is without problems, as the Constitutional Court rejected the proposal in 2019. Nor is it accurate to say that every piece of information issued under Section 88a automatically disappeared from the file after the Supreme Court's decision. The first sentence ignores the development of EU law. The second makes a civil apology a procedural charm in a criminal case.
A better question is specific. What data was retained? According to what adjustment? For what purpose was it issued? Was it possible to proceed with less invasion of privacy? And how did the court work with the Union objection in the case, if someone raised it? Only this series of questions keeps the dispute where it really is.
10. OTT is not a mobile network. The network number is not measured by WhatsApp
Another confusion concerns applications. The Constitutional Court in Pl. ÚS 45/17 explicitly stated that the data retention obligation does not apply to OTT services, i.e. to services operating via the Internet over the access network, such as some communication applications [10]. In other words: locating a number in a mobile network is not a measurement of an encrypted chat.
This does not mean that the contents of the phone or application will never enter a criminal case. It means that different content requires a different title. Searching the contents of the device has its own rules, and § 113a of the Criminal Code is a different question than asking the operator according to § 88a [20]. The position of NSZ on securing the content of telephones and e-mails shows precisely this boundary between institutes [19].
In practice, it means a simple thing. When a file contains data from a mobile operator, it does not automatically indicate the content of WhatsApp, Signal or any other application. It can show that a device communicated with the network at a certain time and over a certain cell. It doesn't have to say what the person wrote, who they wrote to in the app, or whether they had the app open.
The same care should be taken when reading the phone number used in the application. The number can serve as login or authentication data, but the application itself communicates through the Internet layer. It does not follow that the mobile network operator statement will automatically describe the movement inside the application. It can help with the device connection timeline. It is not a rewrite of the encrypted service.
The network number therefore measures the network layer. The application is the next layer. If both are in the file, each must have its own title and interpretation.
11. The time in the CDR is not necessarily the civil time of the act
Location data is read in time. That seems obvious until we ask whose time it is. An operator's record has its own system stamp, a command defines a period, and a real-world event has its own civilian timeline. These three times are to meet. They must not just be assumed to be the same.
This point is not a workaround. It's an interpretation check. In the file, you need to know during which period the judge authorized the data, when the operator recorded the data and how it relates to the time of the crime. A section older than the legal retention window may not be covered by normal retention, unless there is another legal reason for retention or prior security [4].
Also, registration delay, difference in session and communication or time zone work are issues of data interpretation. They are not proof of error, but they are a reason to read accurately. One minute can be minor in some things. In others, it can be decisive.
That's why good practice doesn't start with a map. It starts with a timeline. When was the act supposed to happen? What period did the order cover? What time does the operator give? And what happens if these times are not placed in one row, but left as separate layers?
The timeline also prevents the opposite error. Sometimes uncertainty becomes automatic doubt about everything. This is not necessary. If the command, operator output, and other evidence are aligned in time, the data can be strong. It just has to be seen what exactly matched. Accuracy does not come from not talking about time. It arises by being described.
12. A cell is not a person
A cell is talking about a device on the network. She does not say herself who held the device. The phone could have been borrowed, stolen, forgotten, left in the car or used by someone else. A contract may show a participant, but the participant is not always the current holder. IMEI can show the device, IMSI subscriber identity, service number. Man is another link in the chain.
Here this text touches on the series "The phone was at the crime scene. Was its owner there?" just as a reference. There, the main question is the forensic interpretation of the trace. Here we stay with the procedure: what can open a legal title and what does not automatically follow from the issued data.
It's not an argument against the police. It's an argument against the shortcut. A cell can be very important when it fits into other evidence: cameras, witnesses, payments, secured equipment, the contents of a phone or the movement of a vehicle. But without these clutches, it should not carry more than it can carry.
Therefore, the correct sentence is: the device was registered in a certain network context. No: one was standing in the exact spot. Between these two sentences is the entire proof.
13. GNSS on the phone is a different title than querying the operator
The GNSS position of the phone and the cell-ID from the operator can merge in public debate. Both are drawn on the map. Both are related to mobile. Legally and technically, however, these are different layers.
GPS.gov lists a typical smartphone accuracy of 4.9 meters in the open sky [17]. HZS at AML describes that a smartphone can send a location obtained from GNSS or Wi-Fi during an emergency call, among other things, and that the accuracy can be in meters to hundreds of meters depending on the conditions [18]. This is the device and emergency channel data. Not about the standard output of the operator according to § 88a.
If GNSS data appears in the file from the contents of the phone, another title comes into play. The Criminal Code knows the procedures for inspecting the contents of the device, including § 113a [20]. This is not the same as requesting metadata from the operator. The confusion is tempting because the result may end up lying on the same map. But the path to it is different.
This is also important for control. For operator data, we ask about the command, period, identifiers and cells. For phone content, we ask about device security, scope of review, data integrity, and title to the content. One map won't cancel out the difference between the two sources.
14. Threshold rate of three years is not the police at any time
§ 88a of the Criminal Code has conditions. Generally, it refers to an intentional crime for which the law stipulates a prison sentence with an upper limit of at least three years, or listed crimes. Among those listed are, but are not limited to, fraud, unauthorized access to a computer system, dangerous threats, dangerous stalking, or breach of confidentiality of transmitted messages [2].
The number three years is the threshold rate in the legal text. It does not measure the seriousness of each case and is not a free license for any curiosity. This is accompanied by subsidiarity, a written reasoned order and the identity of the user, if known [2]. In preliminary proceedings, the public prosecutor proposes and the judge decides.
Section 88a, paragraph 3 allows the consent of the user of the telecommunications equipment. Accuracy is needed here as well. Consent replaces the command for data related to the device and the user giving the consent. It is not the consent of a third party who wants to know where someone else is.
The Charter completes the legal framework. Article 10 protects private and family life, Article 13 the secrecy of messages given by telephone and other devices [7]. This does not prevent every hit. But it forces one to ask who authorized the intervention and why.
15. The output is the station designation. There is no address of the apartment
When the data is transferred to the map, it acquires a new authority. A point, circle or surface looks like reality. It is actually an interpretation of the output. The decree talks about the marking of the Start and Stop base station [5]. Converting the BTS to a coverage map is the next step. This may be useful, but it is not identical to the original data.
Therefore, it is necessary to always request a description of the chain. What exactly came from the operator? What station identification? what time Who and how created the map interpretation? What caveats does coverage have in that location? Public sources do not give one nationwide table of cell-ID accuracy in meters for every Czech situation. Whoever asserts it without support adds extra certainty.
After the end of the case, the person has the right, under certain conditions, to learn about the order and propose a review of the legality by the Supreme Court; Section 88a paragraph 2 refers to the rules associated with Section 88, including exceptions [3]. It's not a technical detail either. It is a safeguard against the metadata remaining completely out of sight of those to whom it relates.
Therefore, look for verbs in the file. The operator "released" the data. An expert or police officer "displayed", "evaluated", "compared" or "planted" them on a map. The court "inferred" a certain factual circumstance from them. Each verb indicates the next step, and each step can have a different force. When the article replaces all verbs with the sentence "the police located", control is lost.
So the output is not the apartment address. It is an item in a string. The more precise the conclusion is to flow from it, the more precise must be the description of each step between the station and the sentence about man.
16. Three tests of what a cell cannot do
The practical test is intended for legal literacy. Not how to become invisible. It does not contain advice on turning off registration, switching identifiers, jamming base stations or delaying emergency location.
What needs to be tested in the file
First question: is it content or metadata? If someone says wiretapping, verify whether it is § 88 or § 88a [1] [2]. The second question: is there a written and reasoned order in the file, or the consent of the device user? Third: what period does the order cover against the six-month ZEK retention window [4]. Fourth: what exactly came from the operator: number, IMSI, IMEI, BTS Start/Stop, or something else according to the decree [5].
The fifth question is often the most practical: where does data end and interpretation begin? If the list contains only the designation of the base stations and the time, it is necessary to describe separately who assigned the coverage map to them and with what reservations. If the file also contains GNSS from the phone, it is not the same metadata from the operator. It is necessary to find a separate title for the contents of the device or another data source [20].
Three tests of what a cell can't do
First test: the cell is not the apartment door. If there is no GNSS in the output, do not read it as GNSS 4.9 meters and not as an address [17]. Second test: a cell is not a person. Who held the device must follow from other evidence. The third test: the cell is not a wiretapping and not a search for a missing person. To confuse § 88, § 88a and § 68 of the Police Act is a mistake of the institute, not a minor shortcut [6].
The purpose of the tests is not to weaken every piece of evidence. The idea is to prevent one kind of data from speaking in the voice of another.
A good reading can be both rigorous and fair. It is strict in that it does not allow the cell to become a human without additional couplings. It's fair that he doesn't deny the significance of the cell where it fits neatly into the timeline and other evidence. This is the difference between skepticism and control.
17. The question is not how they find you. It reads which title opened which layer
The movie question is: how do the police find a cell phone? The legal question is slower and more precise. Which title opened which metadata? What period did it cover? What did the operator issue? Was it about content or operational and location data? Is the output the station designation or the coordinates from the phone? And who held the device?
The hidden cost of a bad reading is not just a few meters wrong. It is a pin that looks like a person, but it only carries the registration of the device in the network. Such a pin can help when it is recognised as a chain link. It can be harmful when it pretends to be the end of proof.
This does not mean that police localization is unimportant. It follows that its value is procedural and evidential, not cinematic. Section 88 is not Section 88a. Six months is not four months. BTS is not GNSS. A cell is not a person.
That is why the file should be readable in layers. Not for formality, but for the control to see the same chain as the decision.
So the right final question is not: how does police mobile phone tracking work? It reads: which title opened which layer and what is still not clear from the cell marking about the door, about the time of the crime and about the person who had the phone in his hand?
Section 88 is not Section 88a. The station designation is not a pin in the door.
— Jiný Kontext
Related texts in this series
- Can a person be located by phone number? — number ≠ coordinates.
- How long does the operator keep the data… — six months of metadata, not content.
- On the website: The phone was at the crime scene. Was his owner there too? — forensic interpretation of the trace. This text is a legal procedure.