I'm pretty sure this technology is not used anymore, but essentially as I understand it was possible to issue a anytime interrogation request command with only knowing the cell subscribers phone number it would return the cell tower ID which then you could lookup in known databases to determine location.