How do we track mobile phone?

At present, there really aren't any practical alternatives. You can't improve security without making the hardware larger, heavier, expensive, power-hungry and incompatible with popular software. A four digit pin is going to get cracked in minutes, even with a low-end PC. However, that's not where the problems usually lie. To get to the filesystem, you must first access the system. If you can do that, it's usually game over - particularly on the Android, where much of the security built into Linux is either disabled or removed. Android cannot be considered a secure OS, whereas the Linux kernel it is built from is used in EAL5+ (ie: highly secure) systems.

A person would not have to hack the pin (although 10,000 possible combinations is incredibly small), logging the keystrokes would tell them everything they need. If someone just wants notes and emails written, a logger will give them that without the bother of getting to the filesystem.Note that most of this applies to ALL phone OS', not just Android. Space and compute limitations, plus some dreadful customizations to get things to work, make these incredibly insecure devices. Scrutiny tends to be poor, because of all sorts of licensing restrictions and the dreaded DMCA. Bug fixes for security are rare because app writers come to depend on bugs in the system. There would be too much disruption for a gain that customers aren't yet that interested in.Also remember that phones will be mass produced and there are major markets in countries that currently ban encryption or (in the case of the U.S.) are only talking about such a ban. It is in the interest of vendors to provide backdoors (the network vendor Cisco and the OS manufacturer Microsoft have done this in the past) or to be a little careless over who can push updates to the phone remotely, so as to not upset anyone. Of course, the phone won't care who then uses these mechanisms.For calls or pushed files, we know it is possible to build a Stingray. That one fact alone means that anyone can build one. The laws of physics are the same for everyone. It's probably possible to intercept most such traffic with a passive scanner. Anything a journalist sends to their head office could, potentially, end up almost anywhere. The journalist can't know if it was an intercept or a hack, it all looks the same.