An identifier for a mobile device and information to include in an alert message are received. An alert rule is generated and stored in a plurality of alert filters, each alert filter is associated with a respective building, such that when a mobile device with the identifier attempts to connect to a network in any of a plurality of buildings, the alert message is issued with the information. Additionally, an address of a portable device is received in a search request. A database containing entries for a plurality of locations associated with a plurality of networks is searched to find locations where the portable device connected to a network. A list of locations and times where the portable device connected to a network is returned.