Page 7 doesn't detail how it works, but does seem to describe what it does. From cell base station creates a connection to a target cell phone without the user of the cell phone being aware. Can then use RF direction finding to identify location of cell phone. Obviously multiple base stations required to be more accurate.

More explanation available in this patent application - https://data.epo.org/publication-server/rest/v1.0/publicatio...