# A Tower Dump Started With Every Phone Nearby

> A pending Ninth Circuit appeal shows how a place and a time can turn nearby phones into investigative leads, and why the important privacy decision happens before arrival.

- **Author:** Kubilay Tunca
- **Published:** 2026-11-05
- **Category:** For Experts
- **Tags:** Location Privacy, Cell Phones, Surveillance, Fourth Amendment
- **Canonical URL:** https://cyber-security-in-plain-english.com/post/experts/news/tower-dump-started-with-every-phone-nearby

---

Police started with a stretch of rural highway and a six-hour window. The warrant named no suspect, device, or phone number. It swept in location records for 1,686 devices that had connected to nearby towers.

Proximity came first. A tower dump reaches from a place to every device that connected there, handing investigators a pool of phones to examine. Your phone can join that pool before anyone knows your name or suspects you. Being nearby and talking to the cellular network is enough.

On November 3, 2026, two groups of privacy organisations filed briefs in a pending Ninth Circuit appeal over this search. The district court reached two results: the warrant was an unconstitutional general warrant, and the evidence remained admissible under the good-faith exception. The pending appeal asks what follows from both results. For anyone whose work depends on keeping attendance at a place undiscoverable, the practical lesson arrives before the appellate ruling: decide whether your everyday phone comes with you before you leave.

## The search began with a road and a six-hour window

The case is United States v. Spurlock. Investigators selected two rural highway mile markers and a six-hour period, then directed two telecommunications companies to produce cell-site location information for every device that connected to nearby towers. The warrant identified no suspect, device, or phone number in advance. It returned records for 1,686 devices.

The [McDermott account of the separate amicus filing](https://www.mcdermottlaw.com/news/mcdermott-will-schulte-files-amicus-brief-for-digital-privacy-and-civil-liberties-organizations-in-ninth-circuit-cell-tower-dump-case/) gives those boundaries. Anyone driving that stretch, stopping nearby, working in the area, or passing through with a reachable phone could enter the return unnamed. Investigators began with the road and the clock; a known phone was unnecessary.

There were two amicus filings on November 3. The ACLU, ACLU of Nevada, and EFF filed one brief in support of the defendant-appellant. A separate brief, also supporting the defendant-appellant and reversal, was filed for the Center for Democracy & Technology, Defending Rights & Dissent, the Surveillance Technology Oversight Project, and the Electronic Privacy Information Center. These organisations are friends of the court rather than parties deciding the case, and their briefs argue how the Ninth Circuit should treat the warrant and the evidence.

The appeal remains pending. The amici ask the Ninth Circuit to reject this reverse location warrant and the district court's good-faith result; the judges will decide what the law permits. If your safety turns on the rule in a particular jurisdiction, ask a lawyer who knows that jurisdiction and the case's current status.

The cellular mechanism already operates. A switched-on, reachable phone communicates with the network, and the carrier records the connection that makes service possible. A warrant can turn those routine records into the first list in an investigation by asking which devices connected near a location during a window. An ordinary drive past the selected mile markers supplies that connection before investigators know who carries the device.

## A tower dump reverses the direction of the search

A tower dump begins when investigators choose a place and time. They obtain carrier records for the devices that connected there, then work toward the people behind them. Identity comes later.

Every device represented in the requested tower records enters the starting set, including bystanders. Investigators may narrow the return, compare records, or focus on one device later, after those other phones have entered the file.

The cellular network generates cell-site location information while keeping a phone reachable for calls and messages. Movement changes the network connection, so carrier records can place a device in relation to towers over time. Their precision and meaning depend on the records and circumstances. Here, investigators sought six hours of records from towers near two mile markers.

Keep three techniques separate. An IMSI catcher, often called a stingray, impersonates a cell tower so nearby phones connect to it. A geofence request seeks devices recorded inside a mapped boundary from a holder of broad location data. A tower dump asks cellular providers which devices connected to particular towers during a stated period. The sources call this a reverse location search because place and time lead the query.

Different machinery leads to one question for the person carrying a phone: did the device create a record that associates it with the sensitive place? Initial inclusion in the pool can expose another person at a source meeting or gathering. Investigators may narrow the return later, but the larger set has already placed the device near the chosen location and may already reveal the association its owner meant to hide.

The [EFF account of the November 3 filing](https://www.eff.org/deeplinks/2026/11/were-asking-ninth-circuit-hold-reverse-location-warrants-categorically) describes a demand for location data about every phone in an area at a given time. In Spurlock, one place-time query reached 1,686 devices, nearly 1,700 unique phones.

The list itself can carry sensitive meaning. Presence near a meeting may reveal participation, and co-location may expose a relationship between a reporter and a source. Attendance near a gathering can identify people through the carrier connection alone. Careful message security protects the conversation while network records supply the fact that mattered most: who was nearby. The carrier can produce that location record without reading any encrypted message because the handset generated it while connecting to network infrastructure.

Divide the threat model by layer. Encrypted messaging covers the protected content exchanged between participants. A VPN changes the apparent origin of internet traffic seen by online services and routes that traffic through the VPN service. Carrier location metadata records the handset's separate radio connection. The cellular provider still handles that connection to keep the phone reachable, so neither encrypted content nor the VPN path removes the carrier record at issue in a tower dump.

Airplane mode can disable radios, depending on the device's state and what you enable later. Connections made along the route or before the switch may already be recorded, and reconnecting at the destination resumes the network relationship. A late toggle leaves the earlier trail in place.

## The district court found a general warrant, then admitted the evidence

The district court found an unconstitutional general warrant forbidden by the Fourth Amendment. Applying the good-faith exception, it declined suppression and kept the evidence in the case.

A general warrant permits an exploratory search without the particular focus the Fourth Amendment requires. This one named no suspect, device, or phone number and called for records tied to every device connecting near the selected towers. The district court held that structure constitutionally defective.

That good-faith ruling kept evidence from the unconstitutional search in the case. The amici support the defendant-appellant and ask the Ninth Circuit to reject that result while deciding what the Fourth Amendment requires for this kind of search.

The [district court's order](https://plover.com/~mjd/misc/cell-tower-dump-opinion.pdf) contains both holdings: the warrant was an unconstitutional general warrant, and the good-faith exception kept the evidence from suppression.

In their [filed amicus brief](https://assets.aclu.org/live/uploads/2026/11/Spurlock-File-Stamped.pdf), the ACLU, ACLU of Nevada, and EFF argue that applying good faith here would leave the constitutional finding without a suppression remedy. They support the defendant-appellant in the Ninth Circuit. Four other privacy and civil-liberties organisations filed separately for the defendant-appellant and reversal. The amici advocate for that outcome; the court controls the decision.

The good-faith result leaves evidence in play after a court finds the warrant unconstitutional. A plan that relies on a later judge excluding a location record hands your safety to a legal process you do not control.

As of November 5, 2026, the Ninth Circuit has not ruled. The district court order stands, and the amici briefs filed on November 3 may help shape the appeal. Any final account of Ninth Circuit law must wait for the appellate decision.

A carrier can retain records generated through ordinary network operation, and investigators can later request a geographically defined set. Courts review the search and its fruits after the phone has already connected and the carrier has produced the return. Your choice to carry that phone into a sensitive location comes first, often without warning that the routine service record will later become evidence or an investigative lead.

Legal challenges provide accountability through counsel, and legal rules can constrain broad location demands. They cannot retroactively remove a device from a completed return or undo the investigators' access to the association it revealed. For a sensitive meeting or gathering, decide before travel whether to create the carrier connection at all. Later review determines the legal treatment of the search, while the earlier carry decision determines whether that everyday handset appears in the requested records.

## One ordinary phone can become a record of attendance

With its screen dark, a phone in your pocket remains attached and reachable. The display state leaves the cellular relationship intact. Calls and messages can still arrive because the handset maintains service through a network connection, and that connection can produce the carrier records later gathered by a tower dump.

The “Tracked just by being on” section of “The Mobile Leash” chapter in The Anonymity Playbook explains the relationship: a powered-on phone stays connected to the cellular network. Avoiding app activity limits what those apps create, and avoiding photographs removes another source of evidence. The reachable handset continues its cellular relationship throughout. For this threat, attachment to the network matters more than whether you touch the screen during the trip.

Ordinary errands usually justify accepting that trace because phone service is useful and the consequence of exposure is low. Groceries seldom warrant it. Match the precaution to the adversary, the place, and the cost of being identified there.

At a source meeting, location records from two everyday phones can expose co-location and the association both people meant to hide. Encryption covers written messages. Careful handling protects the spoken conversation within its own boundary.

At a gathering, attendance may matter more than anything said. A reverse location search starts there, asking which devices appeared near the chosen place before moving toward identities and leads.

Spurlock puts a number on that exposure: 1,686 devices around two rural highway mile markers over six hours. Prior suspicion of each person was unnecessary. A connection near the selected area during the selected period put the device in the return.

Your everyday phone travels through familiar places under an account tied to ordinary life. A new appearance near a sensitive place drops into that identity context. Keeping the handset switched off may create a conspicuous gap in its normal pattern; powering it on nearby reconnects it and can mark its return.

Leaving it behind costs you communication, navigation, authentication prompts, and immediate access. Pay that cost during planning: arrange directions, timing, emergency contacts, and the rest before the device becomes indispensable on the route.

Use this narrow rule when the stakes warrant it: if carrier records from your everyday phone must not reveal your presence, keep that phone away from the route and location. Leave it in its normal place. The measure cuts off the record at its source, the usual handset making the trip.

## Know where each control stops

Name the trace each security tool controls. Tower dumps concern records from the cellular network, below the apps where most privacy choices happen. Each layer has its own boundary.

Encrypted messaging covers the content exchanged between participants. Carrier location metadata remains a separate record of the handset's connection to infrastructure serving an area, created without access to the conversation.

A VPN works at the internet layer. It routes traffic through the VPN service and changes the source address visible to the destination. That is its benefit. The handset first reaches the VPN through the cellular provider's radio and data layers. Tower records arise at that earlier connection, before VPN routing changes the path presented to the destination.

Airplane mode can control radios, subject to the device's state and any radios later re-enabled. Timing sets the limit. Enabling it after the journey leaves prior carrier records intact.

While a phone remains genuinely powered off, ordinary cellular communication stops. That protection lasts only as long as the device stays off. A later power-on can place the carried device nearby and restore the network relationship in the same area you meant to keep out of its records. Its absence may also create a gap in an established pattern when an adversary has enough context. For a high-consequence meeting, leave the everyday phone in its normal place and avoid that chain of power changes.

Signal-blocking pouches vary, and the named book chapter warns that some may leak. Isolation depends on testing the product and keeping it sealed. Test yours against the connections you need it to block before relying on it, then seal it before movement. Count any opening as the end of isolation because the handset may reconnect as soon as the barrier is gone. The everyday device also travels to the sensitive place inside the pouch, where a failed seal, an untested product, or one quick check can restore the network relationship.

Choose a control by the trace it governs and the moment its protection begins. Reconnection restores the cellular relationship.

For an ordinary threat model, a fully powered-off phone stops routine radio contact more reliably than a software privacy setting. That comparison assumes ordinary device behaviour rather than a targeted compromise. Suspected sophisticated spyware, especially on a device whose battery cannot be removed, puts the power state itself in doubt and changes the assessment. Keep that suspect device away from the sensitive activity instead of trusting its controls near the people or place you need to protect.

Spurlock concerns carrier location records gathered through a warrant. App permissions, Wi-Fi signals, Bluetooth broadcasts, commercial location data, and fake towers are separate exposure routes with separate controls. This case supplies one precise lesson: a normal cellular connection can place a device in a reverse location request.

Start planning with the record you cannot afford to create. When that record is your everyday phone connecting near a sensitive location, decide whether the phone travels before app settings enter the plan. Distance between that phone and the place controls the carrier connection at issue.

## Make the decision before you leave

Habit brings the ordinary phone to sensitive meetings. Directions, tickets, contacts, and authentication all live on its screen, delaying the privacy decision until arrival. By then, the journey may already exist in network records.

Use a short sequence while you still have time to change the plan.

1. **Define what must remain hidden.** Decide whether you need to protect message content, the identity of a participant, attendance at the place, or the association between people. For a tower-dump threat, the critical fact is that the everyday device appeared near the selected towers during the relevant period.

2. **Name the adversary and the consequence.** Ask who could request or obtain carrier records and what discovery of your presence would expose. A routine private appointment and a source meeting can justify different precautions because the harm and likely interest differ.

3. **Choose before the journey.** If presence must remain undiscoverable through the phone's carrier trail, leave the everyday device behind in its normal place. Do this before starting the route. Switching modes in the car park comes after the phone may have made the connections you meant to avoid.

4. **Plan around the missing phone.** Write down the route, settle the time and place, arrange a missed-meeting procedure, and decide how emergencies will work. Removing the phone without replacing its legitimate functions encourages improvisation, and improvisation often ends with the device coming back out.

5. **Keep separate devices separate.** If your threat model and work require another device, its identity and handling need their own plan. Powering a second device beside your everyday phone can link the two through co-location. A separate handset carried together with your usual one once may cease to be meaningfully separate.

6. **Review the whole movement.** Check the route in, time at the location, departure, and every nearby point where the everyday phone could reconnect. Carrier exposure can begin on the approach, continue at the destination, or return during departure and reconnection. A phone that stays quiet in the room may still have connected beside the meeting place before arrival or after you left. Draw the boundary around the full journey rather than the minutes spent inside.

Use this sequence to calibrate the cost before convenience takes over. Daily movements with little consequence may justify carrying the phone and accepting the routine carrier trace. A source meeting or gathering where attendance must remain undiscoverable can justify losing navigation, authentication, and immediate communication for the trip. Reserve the disruption of leaving the device behind for those high stakes.

At a high-consequence source meeting, leaving both everyday phones at their respective normal places prevents those handsets from creating cellular records of co-location there. That is a precise benefit: the usual devices cannot appear together in the tower records around the meeting. The protection ends at that carrier route. Travel records and cameras may reveal movement, witnesses may recognise either person, payments can mark the stop, and later disclosures can expose the encounter.

For an activist at a sensitive gathering, attendance itself may be the protected fact. A tower dump can start with the gathering's area and period, sweeping in nearby carrier connections without prior suspicion of each attendee. An everyday phone left at home cannot connect to the towers serving the gathering. That protection matches the mechanism exactly.

Because the appeal remains pending, take legal questions to counsel rather than treating Ninth Circuit law as settled. A lawyer can assess the jurisdiction, current rulings, and facts of a real case. Operational planning handles the traces you create; counsel handles what the law does with them.

## Place and time write the first list

Place and time formed the first list in Spurlock. The six-hour warrant gathered records for 1,686 devices near two rural highway mile markers without naming a suspect, device, or phone number in advance. Routine network presence gave investigators their starting set.

Two parts define the legal result. The district court found an unconstitutional general warrant and admitted the evidence under the good-faith exception. In the pending Ninth Circuit appeal, the judges will determine the appellate treatment of this search.

Before the phone travels, ask whether its carrier record near the route or destination would expose attendance or association you cannot afford to reveal. For that high-consequence case, leave the everyday phone in its normal place. The precaution prevents that handset from connecting to cellular infrastructure around the sensitive place. Its scope ends there; other exposure routes and the legal treatment of a search require their own controls and advice.

*Get practical security guidance in one email per month. Subscribe to the newsletter.*

## Sources

- [Electronic Frontier Foundation: We're Asking the Ninth Circuit to Hold Reverse Location Warrants Categorically Unconstitutional](https://www.eff.org/deeplinks/2026/11/were-asking-ninth-circuit-hold-reverse-location-warrants-categorically), accessed 2026-11-05
- [ACLU, ACLU of Nevada, and Electronic Frontier Foundation: Filed amicus brief in United States v. Spurlock](https://assets.aclu.org/live/uploads/2026/11/Spurlock-File-Stamped.pdf), accessed 2026-11-05
- [McDermott Will & Schulte: Amicus brief for digital privacy and civil liberties organizations in Ninth Circuit cell tower dump case](https://www.mcdermottlaw.com/news/mcdermott-will-schulte-files-amicus-brief-for-digital-privacy-and-civil-liberties-organizations-in-ninth-circuit-cell-tower-dump-case/), accessed 2026-11-05
- [United States District Court for the District of Nevada: Order in United States v. Spurlock](https://plover.com/~mjd/misc/cell-tower-dump-opinion.pdf), accessed 2026-11-05

---

## About the author

Kubilay Tunca — Senior Full Stack Developer and Author. Founded Cyber Security in Plain English to translate complex security concepts into clear, practical advice, and writes the accompanying books on security, privacy, secure development, and AI systems.

## Books by this author

- **The Digital Fortress** — Your Everyday Guide to a Safer Digital Life. A warm, plain-English guide for people with real lives and finite patience. Learn the handful of habits that genuinely protect your money, accounts, and family, and get honest permission to ignore the rest. [Amazon](https://buy.cyber-security-in-plain-english.com/digital-fortress) · [Details](https://cyber-security-in-plain-english.com/books/the-digital-fortress)
- **The Anonymity Playbook** — Digital Survival for Whistleblowers, Journalists, Activists, and Everyone Else. A practitioner’s field manual for journalists protecting sources, whistleblowers, and activists. It explains how the surveillance actually works, what each technique costs you, and exactly where it fails. [Amazon](https://buy.cyber-security-in-plain-english.com/anonymity-playbook) · [Details](https://cyber-security-in-plain-english.com/books/the-anonymity-playbook)
- **Secure Software Development** — Practical patterns for building secure software. A hands-on security guide for developers and IT professionals who ship real software. Build, deploy, and maintain secure systems without slowing down or drowning in theory. [Amazon](https://buy.cyber-security-in-plain-english.com/secure-software-development) · [Details](https://cyber-security-in-plain-english.com/books/secure-software-development)
- **The Secure Harness** — Shipping Production Code with AI Coding Agents. A calm, practical guide to letting agents do useful work inside boundaries you set, enforce, and audit. Ships with 15 copy-pasteable artifacts: hook scripts, permission configs, release gates, and MCP templates. [Amazon](https://buy.cyber-security-in-plain-english.com/secure-harness) · [Details](https://cyber-security-in-plain-english.com/books/the-secure-harness)
- **The AI Native Engineer** — Build, Evaluate, and Ship AI Systems That Work in Production. Sixteen hands-on chapters, one real product. Grow it from a single model call into a retrieved, tool-using, observable, production-grade system, with evaluation treated as a habit from the first feature. [Amazon](https://buy.cyber-security-in-plain-english.com/ai-native-engineer) · [Details](https://cyber-security-in-plain-english.com/books/the-ai-native-engineer)

Full catalogue with contents and intended audience: https://cyber-security-in-plain-english.com/books

_As an Amazon Associate I earn from qualifying purchases. Buying through these links costs you nothing extra and helps pay for the blog._