When Cell Signals Meet AI: How Investigators Can Detect the “Outlier” After an Active-Shooter Event Such As Brown University
After an active-shooter attack, investigators face a brutal clock: identify the attacker, predict the escape route, and stop the next act of violence. In that early window—when witnesses are traumatized, descriptions conflict, and the suspect may already be miles away—one of the most powerful sources of direction is the modern cellular network.
Every phone on a cellular network produces a “connectivity trail.” When combined with AI that can identify unusual movement patterns, that trail can highlight the one device trajectory that doesn’t look like everyone else’s: the “outlier” who flees the scene, travels quickly, and stops somewhere low-profile—like a motel.
1) What “cell signals” actually are in an investigation
Cellular location work is not a single technology. It’s a family of network measurements and records that can be used—alone or together—to approximate where a device was and where it went:
A. Cell-site connection records (CSLI / CDR-derived location)
When a device uses the network (voice, text, data), the carrier can log which cell site and sector served that activity at that time. A cell site is usually divided into sectors (often three) that point in different directions. The sector narrows location from “near this tower” to “in this wedge-shaped coverage area.” (Scientific Working Group on Digital Evidence [SWGDE], 2025)
B. Timing-based distance hints (Timing Advance, RTT-like measurements)
Cell networks coordinate precise timing so many phones can share radio resources. Some systems generate measurements that relate to distance from the serving cell—for example Timing Advance (TA) in LTE, which reflects how much the network must “advance” the phone’s uplink timing to arrive aligned at the base station. TA is not GPS, but it can add a useful “near/far” dimension when combined with tower/sector data. (Mahyuddin, 2017; SWGDE, 2025)
C. Network positioning methods designed for location accuracy (OTDOA and related)
LTE introduced standardized positioning methods such as Observed Time Difference of Arrival (OTDOA), where a device measures time differences between special positioning signals from multiple cells. With those measurements, the network can perform multilateration—similar in concept to how GPS solves position using time differences, but using cell sites instead of satellites. (European Telecommunications Standards Institute [ETSI], 2011; Fischer, 2014; Ericsson, 2017)
D. Targeted device-location tools (cell-site simulator operations)
In some investigations, agencies may use tools that act like a cell tower to help locate a device or obtain limited device identifiers in a defined area. From a purely technical standpoint, these tools are about forcing a known device to reveal itself (or separating one device from many nearby). (U.S. Department of Justice, 2015, 2024)
The key point: none of these sources is “perfect,” but together they can form a high-speed movement story.
2) Turning tower interactions into a movement trail
A typical cellular-driven movement reconstruction looks like this:
Collect network events for the time window (minutes before and after the attack).
Resolve each event to a cell site and sector, then translate that to geography using a carrier’s cell-site list (tower coordinates, sector azimuth/beamwidth).
Sequence events by time to create a rough path: sector A → sector B → sector C…
Add timing-based cues (when available) like TA/RTT-style indicators to estimate near/far from the tower.
Create a “corridor” rather than a single dot: a probable set of roads and directions that fit the handoffs between towers/sectors.
This is why the output is often best described as a route hypothesis. It becomes extremely powerful when combined with other evidence: traffic cameras, license plate readers, hotel check-ins, credit card activity, witness tips, and surveillance video.
3) Where AI changes the game: anomaly detection at speed
The cellular trail is only half the story. The other half is triage: which trail matters most right now?
That’s where AI—specifically trajectory outlier detection—helps. Instead of investigators manually reviewing large sets of movement traces, AI can:
Model baseline post-incident behavior (most devices cluster, stop moving, head to exits, or travel short predictable distances).
Score trajectories for outlier characteristics, such as:
rapid departure from the incident area immediately after the attack
movement that cleanly follows a major road corridor
a decisive, purposeful “leave → travel → stop” pattern
an unusual endpoint soon after the incident (e.g., a motel/hotel rather than home/work)
Rank the top candidates so investigators can focus resources immediately.
Research literature describes multiple families of trajectory outlier methods—distance-based, density-based, deviation-from-route, and learning-based approaches—designed to flag paths that diverge from the “normal” group movement. (Lee et al., 2020; Hamdi et al., 2021)
In plain language: AI can rapidly identify the few device movements that look most like flight and concealment, rather than fear-driven crowd movement.
4) The “motel outlier” pattern: why it stands out
A motel/hotel endpoint is a classic outlier signal because it is often:
temporary
low-friction (no long-term lease, easy check-in)
near highways and escape corridors
not part of a normal daily routine for most people at that hour
So if one trajectory leaves the scene quickly, transitions through highway-adjacent cell sectors, and then becomes stationary at a motel, that combination can rise to the top of an outlier list quickly—especially when compared to thousands of devices that either stop moving (shelter) or disperse locally.
5) A real-world illustration: Brown University and “cellular geolocation”
In reporting on the Brown University shooting (December 2025), Reuters reported that authorities detained a person of interest at a hotel in Coventry, Rhode Island after a police and FBI investigation that used cellular geolocation data. (Reuters, 2025)
That single phrase—cellular geolocation—often implies exactly the workflow above: use network-based location signals to narrow the probable escape route and converge on an endpoint, then verify and act with traditional law enforcement tactics.
6) What this technology can do well—and where it can mislead
Strengths
Works fast when time matters most
Produces route corridors and likely endpoints
Helps prioritize scarce resources (units, perimeter planning, interviews)
Limitations
Tower/sector location is an approximation, not a GPS dot
Dense urban networks can create ambiguous handoffs
Similar movement patterns can create false leads unless corroborated
AI ranks “unusual,” not “guilty”—human review and additional evidence remain essential
The best results come from fusion: cellular signals + cameras + tips + physical evidence + investigative judgment.
References
Ericsson. (2017, March 9). IoT positioning in LTE standardization.
European Telecommunications Standards Institute. (2011). ETSI TS 136 355 V10.2.0 (3GPP TS 36.355 Release 10): LTE Positioning Protocol (LPP).
Fischer, S. (2014). Observed time difference of arrival (OTDOA) positioning in 3GPP LTE.
Hamdi, A., et al. (2021). Spatiotemporal data mining: A survey on challenges and research directions. Journal of Big Data, 8, Article 84.
Lee, J., et al. (2020). Trajectory outlier detection: Algorithms, taxonomies, and applications. ACM Computing Surveys, 53(2).
Mahyuddin, M. F. M. (2017). Overview of positioning techniques for LTE technology. Journal of Telecommunication, Electronic and Computer Engineering.
Reuters. (2025, December 14). Police hold person of interest after Brown University shooting leaves two dead.
Scientific Working Group on Digital Evidence. (2025). Technical notes on the use of timing advance records.
U.S. Department of Justice. (2015, September 3). Use of cell-site simulator technology (Policy guidance).
U.S. Department of Justice. (2024, January 12). Use of cell-site simulator technology (Interim policy guidance).
