upvote
> The first is what a cellular network does for tracking a user. It's not returning a set of GPS coordinates.

From the perspective of someone working on the RF side of cellular networks, you are absolutely correct.

Modern cellphone baseband chips however are required to implement MT-LR, which allows the network to request that the device respond with its latitude and longitude. In the US this is legally required to be accurate to within 300 meters, so it comes from GPS or AGPS. By sending LAWFUL_INTERCEPT_SERVICES as the client type in the request, the phone is required to not notify the user in any way or log the request.

There is a reason China has been caught with their hand in the US "lawful intercept" cookie jar at least three times.

reply
The good old lawful interception capabilities, like in the Greek wiretapping case of 2004–05, also referred to as Greek Watergate.

https://en.wikipedia.org/wiki/Greek_wiretapping_case_2004%E2...

"involved the illegal tapping of more than 100 mobile phones on the Vodafone Greece network belonging mostly to members of the Greek government and top-ranking civil servants."

"In September 2011, new evidence emerged indicated the US Embassy in Athens was behind the telephone interceptions."

reply
If that’s the short version, you should really write up a blog post.
reply
There are more precise methods than GSM Cell ID

"Multilateration: More advanced systems use the signal strength and timing from multiple adjacent cell towers to triangulate the phone's position. This is more accurate in urban areas where cell tower density is high."

https://en.wikipedia.org/wiki/Mobile_phone_tracking#Network-...

In many cases accuracy better than 200 meters can be reached.

"Database correlation method for GSM location". IEEE VTS 53rd Vehicular Technology Conference, Spring 2001 https://doi.org/10.1109%2FVETECS.2001.944052

https://3gpp-explorer.com/glossary/mta/

reply