Mobile devices use primarily two technologies to communicate with other phone users: cellular networks and Wi-Fi networks. Wi-Fi networks are often preferred because Wi-Fi communications are widely available at no cost to the consumer and rarely impose connectivity limits. Over ninety-five percent (95%) of all mobile phones actively broadcast Wi-Fi probes, whether or not they are connected to a Wi-Fi access point. Mobile phones identify available networks by broadcasting “probes” that say “I am here; is anybody out there?”. The phone identifies itself by broadcasting its MAC address.
These probes prompt access points (and routers) to respond with their SSID (Service Set Identifier) and whether or not that access point requires a password. A mobile phone might broadcast a 12-hexadecimal-character MAC address (e.g. 4A:78:1E:95:FA:23) and in response learn that three access points are within range:
- Mary’s WiFi, password required
- Comcast Xfinity, password required
- Free Public Wifi, no password required
Mobile phones probe incessantly. Even when connections to access points (i.e. hotspots) are “disabled” by a phone’s user, virtually all mobile phones continue probing. Phones perform these probes to improve location services and improve data collection for Google and Apple. While engaging “airplane mode” should eliminate a phone’s Wi-Fi radio, the Wi-Fi radio can be re-enabled while airplane mode is still engaged.
BlueFox sensors passively listen for probes. Essentially, the more probes our sensors hear, the more phones are in the neighborhood. The higher the power received from the probes, the closer the probes are. Based on trillions of probes heard by our sensors worldwide, and the hundreds of thousands of probes heard by any individual sensor, our cloud systems are able to infer a real time count of mobile phones and the length of time a phone remains in a space, among other details. We don’t know who owns the phone or why they have visited, but we often know if they’ve been here before and sometimes where they have come from.
Wi-Fi has evolved enormously since it was first introduced in the 1990s. Originally, all MAC addresses were “Global” addresses consisting of a 6-character Organizationally Unique Identifier (OUI) that identified the company making the equipment, and a 6-character serial number. Starting in 2014, after revelations by Edward Snowden about the tracking of mobile phones using Wi-Fi, Apple iPhones began probing with “Local” MAC addresses. Google’s Android phones adopted “Local” MAC addresses in 2017. Phones from both companies are able to probe and connect to access points using Local MAC addresses–though many new phones do not provide these capabilities and others don’t use them by default.
