Tracking someone is easy - FINDING them is hard.
The announcment does not mention that the eggheads made a lot of assumptions and created a bunch of special situations to find the phone they wanted to track. The most important quote from the paper that was left out of the announcement is: "if the victim lingers within 1km of the tower for a couple of minutes, our attack would succeed." So if someone is moving fast relative to the cell or is in a smaller cell, the attack is useless. You can read the paper here:
http://www-users.cs.umn.edu/~foo/research/docs/fookune_ndss_gsm.pdfThe researchers rely on statistical methods to find the phone by forcing it to respond to the tower and capturing all the responses in the cell within a specific time period based on the GSM protocol. They generate a set of responses and use them to sift out the recurring ID codes. They also need to know where all the towers are so they could map the responses. This is not hacker stuff in that you just can't just pick up the equipment and start following anyone.
