Geolocating a MAC Address Needs the Mechanism, Not the Identifier

Ciberpatrulla's "Geolocalizar una dirección MAC: cuándo se puede y cómo" opens with a Google AI answer that says you cannot geolocate a MAC address, and then explains why that answer is wrong in a specific, instructive way (Ciberpatrulla, "Geolocalizar una dirección MAC: cuándo se puede y cómo", 11 Aug 2026, https://ciberpatrulla.com/geolocalizar-direccion-mac/). The AI answer confuses two different claims. One: the MAC does not contain coordinates. That is true. Two: you cannot find where it is. That is false, because public databases have been associating WiFi identifiers with geo-referenced observations for more than twenty years. The property (geolocatability) does not come from the identifier; it comes from the mechanism — a wardriving database plus a signal-weighted centroid merge. Theorem 3: a property is guaranteed exactly when its mechanism is implemented and measuring. The MAC is the key; the database and the merge are the mechanism.

Key Conclusions

• A MAC address does not contain GPS coordinates (true), but a WiFi access point that has been observed by wardriving contributors can be geolocated via public databases like WiGLE, which has run since 2001 and associates BSSID identifiers with geo-referenced observations (Ciberpatrulla, 11 Aug 2026).
• The property comes from the mechanism, not the identifier. The BSSID is the lookup key; the wardriving database plus the signal-weighted centroid merge are the mechanism that derives the location. Without the mechanism, the identifier yields only the manufacturer.
• The coordinates WiGLE returns are an estimation, not a measurement. WiGLE's own documentation describes the calculation as trilateration by weighted centroid — observations averaged with signal strength as the weight. Treating the result as a postal address is the most common and most expensive error.
• The scope boundary is explicit: the article cites Spain's Ley 5/2014, which requires the investigation to be necessary, suitable, and proportional (necesaria, idónea, proporcionada), and excludes the intimate life that occurs inside the domicile. Everythink holds the same civil-and-defensive scope.

The identifier does not contain the property; the mechanism derives it

The Ciberpatrulla article draws the line that the Google AI answer blurs. A MAC address is a network-interface identifier — the license plate a device uses to speak inside a local network. It does not carry coordinates. The first three octets of a factory-assigned MAC point to the manufacturer (the IEEE assigns those blocks), and "look up the manufacturer" is the advice the AI answer stops at. But the manufacturer is not the location, and the article is honest about why "look up the manufacturer" is a partial answer: the IEEE now distributes large, medium, and small blocks, and randomized MACs carry no manufacturer information at all. "Look up the manufacturer" is a mechanism that sometimes returns a weak signal and sometimes returns nothing — Partial ⚠️ as a geolocation mechanism.

The geolocation mechanism is different and the article names it: WiGLE, the Wireless Geographic Logging Engine, running since 2001, collects wardriving observations — volunteers walking or driving with WiFi scanning and GPS active, logging every access point they detect with the coordinates where they detected it. An access point that has been observed by any contributor is in the database, and a BSSID lookup returns the estimated coordinates, the network name, and the first-and-last observation dates. The mechanism is: a crowd-sourced cache of geo-referenced observations, indexed by BSSID, merged by a signal-weighted centroid. The identifier is the key; the mechanism is the cache plus the merge. We tag WiGLE's mechanism Production ✅ as a real, running, documented system. We tag the geolocation of a specific BSSID Partial ⚠️ — the property holds for that BSSID only if the mechanism has observed it, and an unobserved network returns nothing.

[UNIQUE INSIGHT] The article's strongest move is the distinction between a fixed access-point BSSID and a randomized client MAC. A fixed access point has been emitting beacon frames from the same location for years — the same identifier, the same coordinates, observed by multiple wardriving passes. A client MAC (a phone, a laptop) travels with its owner and modern operating systems randomize it to hinder tracking. The article is explicit: do not treat a client MAC as a stable, geolocatable identifier. That is the same distinction as a stable contract vs. a volatile one — the property (geolocatability) holds when the identifier is stable (fixed BSSID), not when it is volatile (randomized client MAC).

The weighted centroid is the same merge as the Oracle's ensemble

WiGLE's coordinate calculation is documented in its own FAQ, and the Ciberpatrulla article cites it: WiGLE averages the coordinates of all observations of a network using signal strength as the weight, so a strong-signal observation counts more than a weak-signal one. WiGLE itself calls it trilateration by weighted centroid. That is a merge mechanism — multiple observations combined into a single estimate, weighted by a quality signal. It is the same form as the Oracle's ensemble merge in the HAI Engine.

[PERSONAL EXPERIENCE] Each Sister in the HAI Engine is a typed personality (analyst, contrarian, disruptor, historian, institutionalist) producing a draft forecast. A single Sister's forecast is a single observation — a weak signal, like a single wardriving pass that heard the network faintly from one street. The Oracle merges the Sisters into a calibrated ensemble, and the merge weights the Sisters by calibration quality — a well-calibrated Sister counts more than a poorly calibrated one, the same way a strong-signal observation counts more than a weak-signal one in WiGLE. The Oracle's merge is a weighted centroid of forecasts; WiGLE's merge is a weighted centroid of coordinates. The form is shared; the domains are separate; the cross-domain claim is Partial ⚠️. What is Production ✅ on Everythink's side is the Oracle's merge mechanism — implemented and measuring, with entropy computed on every merge.

The bias problem is the same in both. WiGLE's FAQ warns that the estimate holds reasonably unless the network was observed always from the same side — if the wardriving contributor walked one street and never went around the block, the point skews toward that street. The Oracle has the same failure mode: if all Sisters share the same framing, the merge produces a confident estimate that is biased by the shared framing, and the entropy is low. Low entropy is the Oracle's "all observations from the same street" — a concentrated ensemble adds no diversification, the same way a one-sided wardriving pass adds no spatial constraint. We tag the Oracle's entropy measurement Production ✅ because it runs on every merge and would flag a low-entropy (concentrated) ensemble as a weak signal. WiGLE does not expose an equivalent entropy metric — the user has to infer the bias from the observation count and dates. That is a Partial ⚠️ on WiGLE's side: the merge is implemented, but the bias-detection measurement is left to the analyst.

Three neighbors, one window — coherence vs. independence

The Ciberpatrulla article makes a point that is easy to miss and that matters beyond OSINT: several BSSIDs grouped in the same zone do not mathematically tighten the error, but they reinforce the spatial coherence of the hypothesis — with a nuance. They reinforce more when it is clear they belong to distinct access points. If they are several BSSIDs from the same device, you are looking at the same data three times.

That is the independence distinction. Three neighbors pointing at the same block are three independent observations only if they looked from three different windows. If all three looked from the same window, they saw the same thing from the same place — that is one observation counted thrice, not three. The article's image is exact: it is more like asking around a neighborhood. If three unrelated neighbors, without having spoken to each other, point at the same block, you have more reason to go look there than if one neighbor told you. But if they all leaned out of the same window, they are not three opinions — they are one.

The Oracle's entropy measures exactly this. A high-entropy merge is three neighbors from three windows — the Sisters carry uncorrelated evidence, and the merge reduces variance. A low-entropy merge is three neighbors from one window — the Sisters say the same thing, and the merge adds no diversification. The article's rule ("an investigator with judgment does not look for the network that interests them; they look for the neighborhood that surrounds it") is the same rule the Oracle follows: do not trust the single Sister, trust the ensemble's coherence, and measure the entropy to know whether the coherence came from independent evidence or from a shared framing.

The honest limits: estimation, not measurement

The Ciberpatrulla article is honest about what WiGLE does not give you, and the honesty is the load-bearing part of the piece. WiGLE does not identify anyone — it returns the estimated position of a device, not a name, not a line holder, not a domicile. The jump from "there is a router here" to "this person lives here" is not made by the tool; it is made by the investigator cross-referencing other sources, and it is a jump that has to be justified. WiGLE does not guarantee anything — the license agreement expressly excludes any warranty on the data. WiGLE's coverage is uneven — it depends on where someone walked with the app open. Urban centers are well covered; an industrial park or a small town may be empty. That a network does not appear does not mean it does not exist; it means nobody saw it.

The article tags the license constraint separately and it deserves the attention: WiGLE's agreement is literally called the Individual, Non-Commercial Data License Agreement. It grants use for personal, research, or educational, non-commercial purposes. If the results are going to end up inside a paid professional service, the individual license does not cover it — WiGLE offers commercial licenses negotiated by email. The article's read: it is not a prohibition of professional use, it is a condition for it. The Honest Architect discipline is the same — cite the real source, respect the license, and if the use case changes the license obligation, get the right license before shipping the report.

The estimation-vs-measurement distinction is the one that separates a serious report from a botch. WiGLE did not physically measure where the router is. The coordinates are an estimate calculated from collected observations, and the estimate can be biased. Writing "the subject was in Alicante" falls on cross-examination. Writing "three wireless networks observed by the corporate equipment appear in a public open-access database, with last observation in March 2025, and their estimated locations converge in the town of Y" is a different thing. That does not fall; it has to be argued, and the argument happens on the terrain where you have the documented method and they do not. We tag that discipline Production ✅ — it is the honest-architect move, and it is the same move Everythink makes when it tags a forecast Partial ⚠️ rather than asserting a certainty the mechanism does not support.

The scope boundary: civil-and-defensive, not domestic surveillance

The article's case study is a teleworker who claimed to be in Madrid and was connecting from a coastal city 600 km away. The scope discipline is explicit and it matches Everythink's. Before touching any data, the client has to document their legitimate interest — Ley 5/2014 requires it before accepting the engagement. The contract object is delimited precisely: verify the habitual place of service. Not the employee's private life, not who they live with, not what they do on weekends. Article 48.3 excludes the intimate life inside the domicile from private investigation, and 48.6 requires the action to be proportional, suitable, and necessary. The second adjective — necessary, was there a less invasive way — is the one that sinks the most reports.

Everythink holds the same scope. The platform is civil-and-defensive: it forecasts scenarios for real-world actors, it does not investigate the intimate life of a domicile, and it does not promise a token, wallet, or community-credit outcome (those are Roadmap 🔵, subject to Howey review). The cross-domain claim is Partial ⚠️ — the scope discipline is shared, the domains (private investigation vs. forecasting) are separate. What is Production ✅ is the boundary itself: the article documents it, Everythink documents it, and neither quietly expands it.

Frequently Asked Questions

Can you geolocate any MAC address?

No. The method works for BSSIDs of relatively stationary access points that have been observed by wardriving contributors. A client MAC (a phone, a laptop) travels with its owner and modern operating systems randomize it — it is not a stable identifier these databases index.

Does the MAC address contain the location?

No. The MAC is an identifier; the location comes from the mechanism — a wardriving database that associates the identifier with geo-referenced observations, merged by a signal-weighted centroid. Theorem 3: the property is guaranteed by the mechanism, not by the identifier. Confusing "the data does not contain the property" with "the property cannot be derived" is the error the Google AI answer makes.

Is a WiGLE result a measurement or an estimate?

An estimate. WiGLE's own FAQ describes the calculation as trilateration by weighted centroid — observations averaged with signal strength as the weight. The estimate can be biased if the network was observed always from the same side. Treating the result as a postal address is the most common error; a serious report presents the coordinates as an estimate with a last-observation date and declared limitations.

How is the weighted centroid the same as the Oracle's ensemble merge?

Both merge multiple observations into a single estimate, weighted by a quality signal. WiGLE weights observations by signal strength; the Oracle weights Sisters by calibration. The bias problem is the same: if all observations come from the same side (WiGLE) or all Sisters share the same framing (Oracle), the merge is biased. The Oracle's entropy measures this on every merge; WiGLE leaves the bias detection to the analyst.

Does Everythink use WiGLE or do OSINT investigation?

No. Everythink is a forecasting platform, not a private-investigation firm. The cross-domain lesson is the mechanism form — the property comes from the merge, not from the identifier; the scope is civil-and-defensive, not domestic surveillance. No token, wallet, or community-credit outcome is promised; those are Roadmap 🔵, subject to Howey review.

Sources

• Ciberpatrulla, "Geolocalizar una dirección MAC: cuándo se puede y cómo", 11 Aug 2026, retrieved 2026-08-23, https://ciberpatrulla.com/geolocalizar-direccion-mac/
• WiGLE, Wireless Geographic Logging Engine, https://wigle.net/ (referenced via Ciberpatrulla)
• WiGLE FAQ, trilateration by weighted centroid, https://wigle.net/faq (referenced via Ciberpatrulla)

If your team is ready to trust the mechanism, not the identifier, create your network — the topology routes, the Sisters merge, the Oracle measures the entropy on every merge.