Abstract: Passive location determining of a 3G handset is provided. The method may include the following steps: sending a sequence of 3G ‘Pings’ directed at a specified handset over a 3G network; determining the specified handset user identifier and the sewing base station of the specified handset based on reoccurrences of user identifiers responsive of the ping requests, captured from the forward access channel (FACH) of each base station; decoding the FACH of the serving base station responsive to an additional ping, yielding parameters required for receiving uplink dedicated channel (UL DCH); estimating, in each location associated with a base station, a time difference between fastest possible and actual arrival of a signal over the UL DCH sent by the specified handset, wherein the estimating is synchronized to the serving base station; and calculating the location of the specified handset, based on the estimated time differences associated with the locations.

Abstract: Passive location determining of a 3G handset is provided. The method may include the following steps: sending a sequence of 3G ‘Pings’ directed at a specified handset over a 3G network; determining the specified handset user identifier and the sewing base station of the specified handset based on reoccurrences of user identifiers responsive of the ping requests, captured from the forward access channel (FACH) of each base station; decoding the FACH of the serving base station responsive to an additional ping, yielding parameters required for receiving uplink dedicated channel (UL DCH); estimating, in each location associated with a base station, a time difference between fastest possible and actual arrival of a signal over the UL DCH sent by the specified handset, wherein the estimating is synchronized to the serving base station; and calculating the location of the specified handset, based on the estimated time differences associated with the locations.

Abstract: A method of invoking denial of service in 3G networks is provided. The method includes receiving a downlink UMTS signal that is operating at a downlink UMTs frequency provided by the UMTS base station. A reference downlink UMTS signal is provided with a reference downlink UMTS frequency. The reference downlink UMTs frequency is aligned with the downlink UMTS frequency based on a frequency offset between the downlink UMTS frequency and the reference downlink UMTS frequency to provide an aligned frequency. A common pilot channel (CPICH) is transmitted over the reference downlink UMTS signal operating at the aligned frequency. Service for the UMTS base station is denied when the CPICH is combined with a UMTS base station CPICH operating at the downlink frequency.