This is a real attack vector. LE don't even need to get cellphone positioning data from providers, they set up their own covert positioning towers. Vendors should know better than to carry their phones with them when they go to drop off packages. The only reason I have heard why this attack may not work is because LE may not be able to determine the exact drop box a vendor used, even if they can get the sent package. One way they could try and counter this is by spraying chemical markers in all of the drop boxes in a certain radius around where the vendor is known to ship from. The attack would be something like this A. Order a package from vendor Alice, see that she ships from Bobsville. B. Spray unique chemical markers in many drop off boxes in Bobsville. C. Order packages from vendor Alice, analyze the packaging looking for traces of the chemical markers. D. Determine the exact drop boxes used by Alice, pull cellphone positioning records E. Intersect the positioning data looking for the individuals who are unique to the crowds of people who were close enough to those boxes to use them. F. Out pops Alice. A pretty complicated attack and certainly not something they would do to bust some mid level vendor, probably more in the realm of counter espionage work. But if they can determine the exact box that Alice dropped off the package in, or Alice sends from boxes that are far enough apart that they can be distinguished into groups, then her cellphone positioning information is indeed an attack vector. It is foolish to carry a cellphone with you while you are engaging in illegal activity. Another attack vector similar to this is exactly the same but using license plate recognition instead of cellphone positioning. The base attack here is an intersection attack, and it works the same way here as it does in the world of traffic analysis. Identify a crowd that you know your target could fall into. If you know the box that the package was sent from, you know that the crowd your target falls into is everyone who was near this box over a certain range of time. This is a lot of people, too many to put under targeted surveillance for most all drug cases. But then when you identify another crowd that your target could fall into, probably the same exact way you identified the first crowd, you can intersect the two crowds together. The target is now narrowed in on from 'someone in crowd A' or 'Someone in crowd B' to 'Someone in crowd A AND in crowd B'. Generally it doesn't take many intersections before you have identified the target.