The serving of evidence and arbitrarily what should be served or should be not served is highlighted in this Appeal case. It is noted the Appeal Court dealt with issues surrounding making burdensome requests for evidence from the police. I suspect the comments of the Appeal Court could be misconstrued meaning there is a potential for further hearings as to relevance of evidence. The Appeal Court indicates it is an abuse for the defence to get the police to do their work. Also, too much weight was being placed on the issue as to the police not supplying the evidence in the format received from the operators (in .xls(x) format as opposed to served .pdf) being used as an element in dismissing a case.
The problem with Appeal cases like this is that whilst they are excellent in giving guidance on how to go forward they do not establish what the police should be doing in relation as to what evidence to obtain in the first place. If the police simply obtain call records and cell details and do no more what weight can be given to this?
Looking at other issues
(a) If the police decide on minimal evidence (e.g. cell details) then is it the position that the police or the prosecution (for that matter) are waiting on the defence to conduct cell site analysis including radio test measurements at points of interest, thus doing the work for the police/prosecution?
(b) If the police conduct cell site radio test measurements is there a requirement to find out (i) the operational performance of the cell site/s at the material time/s to compare with conducted investigatory tests, which happen after the alleged offence has been committed, or is it the case (ii) that the defence cannot ask for justification as to the validation of any tests as to whether the police/prosecution have made the appropriate enquiries to the operator/s concerned regarding operational performance of particular cell sites?
These are just some of the many questions that arise.
Cell site analysis is important not only from a criminal investigations aspect but at national security level as well. The value as a useful investigation tool is not one sided, but can become that way if the science approach, technical understanding and evidential pillars are randomly chosen.
https://www.judiciary.gov.uk/wp-content/uploads/2015/02/boardman.pdf
Showing posts with label call records. Show all posts
Showing posts with label call records. Show all posts
Thursday, March 19, 2015
Sunday, June 20, 2010
CSA: Directed Retry Can Alter Mobile Phone's Location
CSA: Directed Retry Can Alter Mobile Phone's Location
Class│Value│
0 0 0│1 1 0 1│ Directed Retry
The accuracy or inaccuracy of cell site analysis testing measurements largely depends upon what has been considered and there are indeed many points to consider. One handover (HO) procedure, if it is included within a mobile network's radio-availability and traffic-flow arsenal, is called Directed Retry (DR). The GSM and 3GPP standards refers to this procedure.
What is Directed Retry (DR)?
Directed retry has adjustable parameters in order to define thresholds that once passed can trigger DR. When DR is set as Not Use it is inactive. Once set to Use the default value is set until the parameter is adjusted. That is to say a 'value' that is set as default can be modified in response to condtions eg quality of service (QoS) or traffic observations. A manufacturer of the say the BSS may provide recommended values, but it might be the OMC-R or BSS engineering team may require to make their own determination about values for internal or external handover procedures.
Use DR enables for example the BSS to move a mobile phone's communications to another cell (Mast or sector of a Mast) prior to call set up. That can be for an outgoing or incoming communication.
DR may be triggered by, for instance, due to 'congestion' and therefore may require internal or external handover procedures to combat that traffic condition. An outcome is that a mobile phone that receives service from the current serving cell (maybe the Mast is seen as closer to the mobile phone as well) is handed over to a cell that originates from a Mast that could be eg:
- some distance from the mobile phone's actual location
- coverage from a adjacent Mast in an area
- etc
This is one of many radio cases that when conducting radio test measurments a 2G/3G passive radio detection device and its readings may not record the appropriate network messages and thus mis-inform their users attempts in assessing a mobile phone's general location when conducting cell site analysis, as the device's readings may be incomplete. The Cell ID obtained from a call detail record (CDR) can only reflect the antenna identities on a fixed-positioned Mast and that a mobile phone has had its communications routed to and from the network using a particular Mast (so to speak). It doesn't automatically follow that the Cell ID confirms the general local area in which the mobile phone was actually located without certain radio data and other necessary checks being made.
Friday, June 18, 2010
Cell Site Analysis - Criminal Case
Cell Site Analysis - Criminal Case
http://www.courtsni.gov.uk/NR/rdonlyres/4F39A7FC-5350-4E4B-BB76-FA8DC4BA08D6/0/j_j_KER7057Final.htm
It is not proven with cell site analysis that evidence obtained relating to mobile call records, the Masts and their details associated with handling the calls and conducting radio test surveys combined together form a precise indication of the geographical location of a mobile telephone at the material time. Therefore, it is unlikely an alleged opinion that it is consistent to place a mobile telephone at a particular location holds weight. That cell site analysis might generally indicate the possible movement of a mobile telephone in relation to Masts that it used and no more.
Whilst the Appeal Case for the appellants (McCartan and Skinner) did not succeed it was not because cell site analysis was able to pinpoint the location of the appellants' mobile telephones, which it is unable to do, but the appellants' failure to identity what was happening with their mobile telephones at the material times. The following commentary from this Appeal Case is worth reading.
'The cell site analysis
[37] An expert in this field, David Sanderson, gave evidence, submitted a report on the subject and made a Power Point presentation to the court. Mr Fee suggested that Mr Sanderson’s evidence established that (a) call mapping was carried out in respect of telephone 008 (attributed to Mr McCartan) and telephone 301 (attributed to Mr Skinner); (b) call mapping provides an approximate indication of where a mobile phone was when a call was made; (c) call mapping is used primarily to show the likely movement of a cellular phone with a general indication of location; (d) the cellular phone may be anywhere within the best serving coverage of the sector; (e) there is boundary overlap between sectors served by different masts; (f) the extent of the best serving coverage sector is unknown; (g) the indication of movement of the person using the telephone is no more than consistent with a suggested pattern of progress – it cannot establish positively that the user of the telephone in fact moved in the mooted direction; (h) calls 15, 16 and 17 from 008 at 20.53: 20.55: 20.55 were made when the telephone was not in the vicinity of Euston Street.
[38] On the basis of this evidence Mr Fee argued that the cell site analysis did no more than provide a very imprecise indication of general movements. In the absence of a capacity to identify a precise location of the telephone within the area of best coverage it was not possible to provide any precise indication of travel direction. We are disposed to accept that Mr Fee has correctly identified the limitations that apply to the cell site analysis. As he has acknowledged, however, it does provide a general indication of the movements of the users of the telephones. If the appellants followed a different pattern of movements on the day in question, it was open to them to give evidence about those movements and to explain where they had been at the critical time in relation to the shooting. Their failure to do so, combined with the general indication that the cell site analysis provided, constituted strong evidence against them that their movements were as indicated by that analysis. In Mr McCartan’s case, his inquiry of the interviewing police officers as to how precisely he could be tied down to a particular area was also, in our judgement, extremely telling.'
The comments of the Appeal Court in para [38] suggests the appellants' own lack of self-preservation to state what their mobile telephones were doing and the reasons for going in a direction following the line of Masts used for handling calls, undermined the cell site analysis element of their appeal.
IN HER MAJESTY'S COURT OF APPEAL IN NORTHERN IRELAND
Neutral Citation no. [2008] NICA 5
THE QUEEN v RICHARD DAVID McCARTAN and BARRY DAVID SKINNER.
Appeal Court: Kerr LCJ, Campbell LJ and Morgan J
It is not proven with cell site analysis that evidence obtained relating to mobile call records, the Masts and their details associated with handling the calls and conducting radio test surveys combined together form a precise indication of the geographical location of a mobile telephone at the material time. Therefore, it is unlikely an alleged opinion that it is consistent to place a mobile telephone at a particular location holds weight. That cell site analysis might generally indicate the possible movement of a mobile telephone in relation to Masts that it used and no more.
Whilst the Appeal Case for the appellants (McCartan and Skinner) did not succeed it was not because cell site analysis was able to pinpoint the location of the appellants' mobile telephones, which it is unable to do, but the appellants' failure to identity what was happening with their mobile telephones at the material times. The following commentary from this Appeal Case is worth reading.
'The cell site analysis
[37] An expert in this field, David Sanderson, gave evidence, submitted a report on the subject and made a Power Point presentation to the court. Mr Fee suggested that Mr Sanderson’s evidence established that (a) call mapping was carried out in respect of telephone 008 (attributed to Mr McCartan) and telephone 301 (attributed to Mr Skinner); (b) call mapping provides an approximate indication of where a mobile phone was when a call was made; (c) call mapping is used primarily to show the likely movement of a cellular phone with a general indication of location; (d) the cellular phone may be anywhere within the best serving coverage of the sector; (e) there is boundary overlap between sectors served by different masts; (f) the extent of the best serving coverage sector is unknown; (g) the indication of movement of the person using the telephone is no more than consistent with a suggested pattern of progress – it cannot establish positively that the user of the telephone in fact moved in the mooted direction; (h) calls 15, 16 and 17 from 008 at 20.53: 20.55: 20.55 were made when the telephone was not in the vicinity of Euston Street.
[38] On the basis of this evidence Mr Fee argued that the cell site analysis did no more than provide a very imprecise indication of general movements. In the absence of a capacity to identify a precise location of the telephone within the area of best coverage it was not possible to provide any precise indication of travel direction. We are disposed to accept that Mr Fee has correctly identified the limitations that apply to the cell site analysis. As he has acknowledged, however, it does provide a general indication of the movements of the users of the telephones. If the appellants followed a different pattern of movements on the day in question, it was open to them to give evidence about those movements and to explain where they had been at the critical time in relation to the shooting. Their failure to do so, combined with the general indication that the cell site analysis provided, constituted strong evidence against them that their movements were as indicated by that analysis. In Mr McCartan’s case, his inquiry of the interviewing police officers as to how precisely he could be tied down to a particular area was also, in our judgement, extremely telling.'
The comments of the Appeal Court in para [38] suggests the appellants' own lack of self-preservation to state what their mobile telephones were doing and the reasons for going in a direction following the line of Masts used for handling calls, undermined the cell site analysis element of their appeal.
GSM Radio Test Measurements - Non-Dominance
GSM Radio Test Measurements - Non-Dominance
Screen Image 1
Readers and cell site analysis students will recall the thread GSM Radio Test Measurements, below. In that thread the discussion related to possible anomalies and interpretation regarding radio test measurements. In this thread I want to highlight another radio anomaly termed non-dominance that may occur.
Generally speaking, non-dominance occurs when radio coverage from two or more radio sources are equally aligned so that they all become dominant. The rare event in Screen Image 1 displays coverage quality and signal strengths of four radio sources are all equal to each other, in a confined area, where the receiver is in the idle mode and at ground level. Attempting to define that one particular Mast would be used to make or receive a mobile call in these circumstances might be difficult. The problems interpreting outcomes due to non-dominance could be numerous. For instance:
i) Who is to say that the receiver camped on a Mast's coverage shown by ACT would actually use that Mast? The coverage at NC2, NC3 and NC4 are equally as likely to be candidates to carry a mobile call.
ii) What happens in the case that the Mast's coverage upon which the receiver is camped at ACT the Mast is not actually best placed or line of sight with the receiver and in other circumstance would not be considered at first instance to serve the geographical area? The receiver under these conditions could be placed in an entirely different geographical area simply from summarising the Mast details shown in the mobile call records.
iii) When call setup (OACSU) takes place and a connection made it could be possible a mobile ‘phone starts a connection for less than a second on the Mast at ACT but forced into hard handover immediately thereafter thus shifts the call to another Mast (say, NC4)? It could be possible the Mast at ACT is shown as the Mast in the call records, which could be rather misleading when attempting to consider geographical location of the mobile telephone when compared to a particular mobile call.
iv) How can the radio examiner, from looking at historical records, correspond radio test measurements against the outward set of event elements recorded in call records? Non-dominance may mean a series of calls being made at one location handled by numerous Masts – thus may amount to a suggestion from analysis of the Masts usage from the call records that the mobile is on the move when in fact it is rather confined to an area. Non-dominance may result in a high number of short duration mobile calls shown in the call records. The short duration calls may not be due to the user terminating the calls, but rather the network dropping the calls.
I introduced, I believe, GSM non-dominance as an important radio anomaly to be considered regarding evidence of radio test measurements into the first criminal case in the UK back in 2003 at the Central Criminal Court (Old Bailey). GSM non-dominance was identified and shown in my evidence. Three other experts appearing for the prosecution or other defendants received my report. Acceptance of my results and findings were agreed and no challenges were made. However, I should point out that the discovery that non-dominance can occur for radio coverage was not my invention but arose from radio propagation studies by mobile network radio engineers endeavouring to agree anomalies for radio principles. The non-dominance principle had already been adopted for the Tetra standards and is accepted in GSM radio parlances as a noteworthy event. Therefore, I was fairly well armed with other independent findings.
The purpose of this discussion thread is to provide yet another example of radio conditions that can prevail when conducting GSM radio test measurements. That simply analysing call records may only present half a picture – a trompe l’oiel ( a lie to the eye) if you will.
Friday, May 14, 2010
Diplomas: Mobile Telephone Evidence (MTEdipl)
Diplomas: Mobile Telephone Evidence (MTEdipl)
.The Diplomas provide individuals with a path to recognition for demonstrating development of students knowledge, skill and experience for those involved in mobile telephone examination and evidence or for anyone interested in this field of distinction.
.
Empowering students to have confidence in themselves, their knowledge and skills, is one feature in the Diploma modules. Another feature is the Diplomas can have value-added benefits for employers. Each Diploma carries a requirement that the student MUST present as part of their assignment a tested practice and procedure plan and be able to offer a possible solution to potential employers for practices and procedures for dealing with mobile phone evidence along with other enhancement value-added benefits, such as market potentials for future planning options that may benefit an employer.
.
The Diplomas are recognised by the Mobile Telephone Examination Board, fully backed with my experience over two decades in forensics and evidence and additional guidance and support from other experienced examiners in the field and identified materials from academics and experts in mobile telephony. The Diplomas enable students to organise their own time and work, without pressure, to study, complete and produce assignments for each Diploma module undertaken.
.
- Diploma for Foundation and Research Skills - Mobile Telephone Diploma Core CFRS
- Diploma for Mobile Evidence QA and Evidence Handling - Mobile Telephone Diploma Core CQAE1
- Diploma for SIM and USIM Technology Examination - Mobile Telephone Diploma Core CSUT2
- Diploma for MS and UE Technology Examination - Mobile Telephone Diploma Core CMSU3
- Diploma for Call Records and Network Records Analysis - Mobile Telephone Diploma Core CCRN4
- Diploma for Cell Site Analysis - Mobile Telephone Diploma Core CCSA5
A Diploma Mobile Telephone Evidence (MTEdipl) is awarded for each module that has been completed and passed. An Advanced Diploma is issued only when a student has completed and passed all the Diploma modules and must produce based upon an expert assignment a report containing all of the subjects in the Diploma modules that is presented to a Peer Review Board.
.
Diploma Module Completion Period:
CFRS - completion: 3 months
[1 months study / 1 month to submit assignment / 1 month assessment]
.
CQAE1 - completion: 4 months
[2 months study / 1 month to submit assignment / 1 month assessment]
.
CSUT2 - completion: 5 months
[3 months study / 1 month to submit assignment / 1 month assessment]
.
CMSU3 - completion: 5 months
[3 months study / 1 month to submit assignment / 1 month assessment]
.
CCRN4 - completion: 5 months
[3 months study / 1 month to submit assignment / 1 month assessment]
.
CCSA5 - completion: 6 months
[4 months study / 1 month to submit assignment / 1 month assessment]
.
For further details, costs and registration form:
Email: trewmte@gmail.com
.
Diploma Module Completion Period:
CFRS - completion: 3 months
[1 months study / 1 month to submit assignment / 1 month assessment]
.
CQAE1 - completion: 4 months
[2 months study / 1 month to submit assignment / 1 month assessment]
.
CSUT2 - completion: 5 months
[3 months study / 1 month to submit assignment / 1 month assessment]
.
CMSU3 - completion: 5 months
[3 months study / 1 month to submit assignment / 1 month assessment]
.
CCRN4 - completion: 5 months
[3 months study / 1 month to submit assignment / 1 month assessment]
.
CCSA5 - completion: 6 months
[4 months study / 1 month to submit assignment / 1 month assessment]
.
For further details, costs and registration form:
Email: trewmte@gmail.com
Sunday, February 17, 2008
Cell Site Analysis
Cell Site Analysis
http://www.courtsni.gov.uk/NR/rdonlyres/4F39A7FC-5350-4E4B-BB76-FA8DC4BA08D6/0/j_j_KER7057Final.htm
It is not proven with cell site analysis that evidence obtained relating to mobile call records, the Masts and their details associated with handling the calls and conducting radio test surveys combined together form a precise indication of the geographical location of a mobile telephone at the material time. Therefore, it is unlikely an alleged opinion that it is consistent to place a mobile telephone at a particular location holds weight. That cell site analysis might generally indicate the possible movement of a mobile telephone in relation to Masts that it used and no more.
Whilst the Appeal Case for the appellants (McCartan and Skinner) did not succeed it was not because cell site analysis was able to pinpoint the location of the appellants' mobile telephones, which it is unable to do, but the appellants' failure to identity what was happening with their mobile telephones at the material times. The following commentary from this Appeal Case is worth reading.
'The cell site analysis
[37] An expert in this field, David Sanderson, gave evidence, submitted a report on the subject and made a Power Point presentation to the court. Mr Fee suggested that Mr Sanderson’s evidence established that (a) call mapping was carried out in respect of telephone 008 (attributed to Mr McCartan) and telephone 301 (attributed to Mr Skinner); (b) call mapping provides an approximate indication of where a mobile phone was when a call was made; (c) call mapping is used primarily to show the likely movement of a cellular phone with a general indication of location; (d) the cellular phone may be anywhere within the best serving coverage of the sector; (e) there is boundary overlap between sectors served by different masts; (f) the extent of the best serving coverage sector is unknown; (g) the indication of movement of the person using the telephone is no more than consistent with a suggested pattern of progress – it cannot establish positively that the user of the telephone in fact moved in the mooted direction; (h) calls 15, 16 and 17 from 008 at 20.53: 20.55: 20.55 were made when the telephone was not in the vicinity of Euston Street.
[38] On the basis of this evidence Mr Fee argued that the cell site analysis did no more than provide a very imprecise indication of general movements. In the absence of a capacity to identify a precise location of the telephone within the area of best coverage it was not possible to provide any precise indication of travel direction. We are disposed to accept that Mr Fee has correctly identified the limitations that apply to the cell site analysis. As he has acknowledged, however, it does provide a general indication of the movements of the users of the telephones. If the appellants followed a different pattern of movements on the day in question, it was open to them to give evidence about those movements and to explain where they had been at the critical time in relation to the shooting. Their failure to do so, combined with the general indication that the cell site analysis provided, constituted strong evidence against them that their movements were as indicated by that analysis. In Mr McCartan’s case, his inquiry of the interviewing police officers as to how precisely he could be tied down to a particular area was also, in our judgement, extremely telling.'
The comments of the Appeal Court in para [38] suggests the appellants' own lack of self-preservation to state what their mobile telephones were doing and the reasons for going in a direction following the line of Masts used for handling calls, undermined the cell site analysis element of their appeal.
IN HER MAJESTY'S COURT OF APPEAL IN NORTHERN IRELAND
Neutral Citation no. [2008] NICA 5
THE QUEEN v RICHARD DAVID McCARTAN and BARRY DAVID SKINNER.
Appeal Court: Kerr LCJ, Campbell LJ and Morgan J
It is not proven with cell site analysis that evidence obtained relating to mobile call records, the Masts and their details associated with handling the calls and conducting radio test surveys combined together form a precise indication of the geographical location of a mobile telephone at the material time. Therefore, it is unlikely an alleged opinion that it is consistent to place a mobile telephone at a particular location holds weight. That cell site analysis might generally indicate the possible movement of a mobile telephone in relation to Masts that it used and no more.
Whilst the Appeal Case for the appellants (McCartan and Skinner) did not succeed it was not because cell site analysis was able to pinpoint the location of the appellants' mobile telephones, which it is unable to do, but the appellants' failure to identity what was happening with their mobile telephones at the material times. The following commentary from this Appeal Case is worth reading.
'The cell site analysis
[37] An expert in this field, David Sanderson, gave evidence, submitted a report on the subject and made a Power Point presentation to the court. Mr Fee suggested that Mr Sanderson’s evidence established that (a) call mapping was carried out in respect of telephone 008 (attributed to Mr McCartan) and telephone 301 (attributed to Mr Skinner); (b) call mapping provides an approximate indication of where a mobile phone was when a call was made; (c) call mapping is used primarily to show the likely movement of a cellular phone with a general indication of location; (d) the cellular phone may be anywhere within the best serving coverage of the sector; (e) there is boundary overlap between sectors served by different masts; (f) the extent of the best serving coverage sector is unknown; (g) the indication of movement of the person using the telephone is no more than consistent with a suggested pattern of progress – it cannot establish positively that the user of the telephone in fact moved in the mooted direction; (h) calls 15, 16 and 17 from 008 at 20.53: 20.55: 20.55 were made when the telephone was not in the vicinity of Euston Street.
[38] On the basis of this evidence Mr Fee argued that the cell site analysis did no more than provide a very imprecise indication of general movements. In the absence of a capacity to identify a precise location of the telephone within the area of best coverage it was not possible to provide any precise indication of travel direction. We are disposed to accept that Mr Fee has correctly identified the limitations that apply to the cell site analysis. As he has acknowledged, however, it does provide a general indication of the movements of the users of the telephones. If the appellants followed a different pattern of movements on the day in question, it was open to them to give evidence about those movements and to explain where they had been at the critical time in relation to the shooting. Their failure to do so, combined with the general indication that the cell site analysis provided, constituted strong evidence against them that their movements were as indicated by that analysis. In Mr McCartan’s case, his inquiry of the interviewing police officers as to how precisely he could be tied down to a particular area was also, in our judgement, extremely telling.'
The comments of the Appeal Court in para [38] suggests the appellants' own lack of self-preservation to state what their mobile telephones were doing and the reasons for going in a direction following the line of Masts used for handling calls, undermined the cell site analysis element of their appeal.
Tuesday, October 09, 2007
Conflicts Call Records & SMS Delivery Dates
Conflicts Call Records & SMS Delivery Dates
One of the topics dealt with on my training courses just last week is getting examiners to appreciate the relevance of date and time stamps for received SMS text messages. Essentially, it should not be assumed as fact that a text message date and time stamp and call record date and time stamp for the SMS reflect the actual date and time of receipt by a mobile telephone.
The warning during training is worth raising, but there is nothing better that having a reminder about this matter. I have had two reminders of the fact that delayed text messages can occur. Over the last couple of days, Two text messages that were sent to me arrived yesterday and today. The text that was received yesterday 08/10/07 was sent on the 05/10/07. The text received today 09/10/07 was sent on the 04/10/07. Note how the older dated of the two text messages arrived later.
There may be some who might argue that:
1) 7F106F3C was full up and 7F106F43 threshold was exceeded, thus preventing texts being received? I can confirm 7F106F3C wasn't full and there is plenty of memory for incoming texts, thus 7F106F43 would not have been invoked.
2) That my mobile 'phone inbox was full up? I can confirm that it wasn't and there is plenty of memory available for incoming texts.
3) That my phone had been switched off all that time? I can confirm my mobile 'phone has been switch ON, on most occasions, except at night and for re-charging. Additionally, I have been receiving texts from others.
4) That the mobile had or has been in a poor service coverage areas? No this would not be correct because on the 04/10/07 I was right by the mobile operator's mast from which my mobile receives service and usually the location for my mobile is in a good coverage service area.
This topic raises important matters regarding mobile telephone evidence in criminal proceedings:
A) That the date and time in an SMS text message is the SMSC date and time that received the sent text message from its subscriber. There are some, not many, mobile telephones that do identify a date and time for the text folder when the message was received, but that is not the text message itself. Also the folder date and time is as accurate as the user set the clock on the mobile 'phone. The latter folder issue maybe a moot point though for where the text message is deleted and later to be recovered, the mobile telephone folder or its date and time stamp are not recovered.
B) That the call records reflect the charging parameters date and time, not necessarily the delivery date and time of an SMS text message. Therefore, this can create conflict between the call records dates and time and SMS delivery dates and times.
C) In criminal proceedings, we largely deal with historical data and therefore the subscriber of an mobile telephone account may receive a message that can be some time after the date it was sent and the message maybe subsequently saved or deleted. However it may also be the case that the subscriber may not remember down the line whether a particular text was received late or not.
To overcome this problem and for corroborative purposes, naturally, call record data that identifies details of a received SMS text message should include the network operator's record confirming receipt of the text message including date and time stamp. The network receipt arises as the mobile 'phone is required to provide confirmation of the message delivered to it. You might think this is analogous to a "Registered Post" letter requiring the addressee to sign having taken taking delivery of it.
Conflicts Call Records & SMS Delivery Dates
Conflicts Call Records & SMS Delivery Dates
One of the topics dealt with on my training courses just last week is getting examiners to appreciate the relevance of date and time stamps for received SMS text messages. Essentially, it should not be assumed as fact that a text message date and time stamp and call record date and time stamp for the SMS reflect the actual date and time of receipt by a mobile telephone.
The warning during training is worth raising, but there is nothing better that having a reminder about this matter. I have had two reminders of the fact that delayed text messages can occur. Over the last couple of days, Two text messages that were sent to me arrived yesterday and today. The text that was received yesterday 08/10/07 was sent on the 05/10/07. The text received today 09/10/07 was sent on the 04/10/07. Note how the older dated of the two text messages arrived later.
There may be some who might argue that:
1) 7F106F3C was full up and 7F106F43 threshold was exceeded, thus preventing texts being received? I can confirm 7F106F3C wasn't full and there is plenty of memory for incoming texts, thus 7F106F43 would not have been invoked.
2) That my mobile 'phone inbox was full up? I can confirm that it wasn't and there is plenty of memory available for incoming texts.
3) That my phone had been switched off all that time? I can confirm my mobile 'phone has been switch ON, on most occasions, except at night and for re-charging. Additionally, I have been receiving texts from others.
4) That the mobile had or has been in a poor service coverage areas? No this would not be correct because on the 04/10/07 I was right by the mobile operator's mast from which my mobile receives service and usually the location for my mobile is in a good coverage service area.
This topic raises important matters regarding mobile telephone evidence in criminal proceedings:
A) That the date and time in an SMS text message is the SMSC date and time that received the sent text message from its subscriber. There are some, not many, mobile telephones that do identify a date and time for the text folder when the message was received, but that is not the text message itself. Also the folder date and time is as accurate as the user set the clock on the mobile 'phone. The latter folder issue maybe a moot point though for where the text message is deleted and later to be recovered, the mobile telephone folder or its date and time stamp are not recovered.
B) That the call records reflect the charging parameters date and time, not necessarily the delivery date and time of an SMS text message. Therefore, this can create conflict between the call records dates and time and SMS delivery dates and times.
C) In criminal proceedings, we largely deal with historical data and therefore the subscriber of an mobile telephone account may receive a message that can be some time after the date it was sent and the message maybe subsequently saved or deleted. However it may also be the case that the subscriber may not remember down the line whether a particular text was received late or not.
To overcome this problem and for corroborative purposes, naturally, call record data that identifies details of a received SMS text message should include the network operator's record confirming receipt of the text message including date and time stamp. The network receipt arises as the mobile 'phone is required to provide confirmation of the message delivered to it. You might think this is analogous to a "Registered Post" letter requiring the addressee to sign having taken taking delivery of it.
Saturday, February 03, 2007
GSM Radio Test Measurements - Non-Dominance
GSM Radio Test Measurements - Non-Dominance
Screen Image 1Readers and cell site analysis students will recall the thread at http://trewmte.blogspot.com/2007/01/gsm-radio-test-measurements.html regarding GSM Radio Test Measurements. In that thread the discussion related to possible anomalies and interpretation regarding radio test measurements. In this thread I want to highlight another radio anomaly termed non-dominance that may occur.
Generally speaking, non-dominance occurs when radio coverage from two or more radio sources are equally aligned so that they all become dominant. The rare event in Screen Image 1 displays coverage quality and signal strengths of four radio sources are all equal to each other, in a confined area, where the receiver is in the idle mode and at ground level. Attempting to define that one particular Mast would be used to make or receive a mobile call in these circumstances might be difficult. The problems interpreting outcomes due to non-dominance could be numerous. For instance:
i) Who is to say that the receiver camped on a Mast's coverage shown by ACT would actually use that Mast? The coverage at NC2, NC3 and NC4 are equally as likely to be candidates to carry a mobile call.
ii) What happens in the case that the Mast's coverage upon which the receiver is camped at ACT the Mast is not actually best placed or line of sight with the receiver and in other circumstance would not be considered at first instance to serve the geographical area? The receiver under these conditions could be placed in an entirely different geographical area simply from summarising the Mast details shown in the mobile call records.
iii) When call setup (OACSU) takes place and a connection made it could be possible a mobile ‘phone starts a connection for less than a second on the Mast at ACT but forced into hard handover immediately thereafter thus shifts the call to another Mast (say, NC4)? It could be possible the Mast at ACT is shown as the Mast in the call records, which could be rather misleading when attempting to consider geographical location of the mobile telephone when compared to a particular mobile call.
iv) How can the radio examiner, from looking at historical records, correspond radio test measurements against the outward set of event elements recorded in call records? Non-dominance may mean a series of calls being made at one location handled by numerous Masts – thus may amount to a suggestion from analysis of the Masts usage from the call records that the mobile is on the move when in fact it is rather confined to an area. Non-dominance may result in a high number of short duration mobile calls shown in the call records. The short duration calls may not be due to the user terminating the calls, but rather the network dropping the calls.
I introduced, I believe, GSM non-dominance as an important radio anomaly to be considered regarding evidence of radio test measurements into the first criminal case in the UK back in 2003 at the Central Criminal Court (Old Bailey). GSM non-dominance was identified and shown in my evidence. Three other experts appearing for the prosecution or other defendants received my report. Acceptance of my results and findings were agreed and no challenges were made. However, I should point out that the discovery that non-dominance can occur for radio coverage was not my invention but arose from radio propagation studies by mobile network radio engineers endeavouring to agree anomalies for radio principles. The non-dominance principle had already been adopted for the Tetra standards and is accepted in GSM radio parlances as a noteworthy event. Therefore, I was fairly well armed with other independent findings.
The purpose of this discussion thread is to provide yet another example of radio conditions that can prevail when conducting GSM radio test measurements. That simply analysing call records may only present half a picture – a trompe l’oiel ( a lie to the eye) if you will.
Saturday, November 04, 2006
Mobile Telephone Evidence
Mobile Telephone Call Records
Call Records obtained from the network operator provide the factual evidence of communications between parties to illustrate contact and association. Since July 2000 Single Point of Contact rules, the operator needs to exhibit call records and serve a statement of that fact. However, a compilation may be created by an case officer, served as an Exhibit using material from the original data. There is a glut of data appearing in evidence which is in the
form of compilation, but where the original material to create the compilation is not being automatically disclosed. This is creating problems and delays. It is essential to check originality and genuineness of compilation material against original data (R .v. Robson 1972) to determine any errors, but, equally to qualify the position of fact about each charged mobile call in the first place. You may think this is perhaps analogous to the discussion given by Professor Smith [1983] Crim LR 472 that a bank statement showing an entry of £100.00 into a bank account is not a statement that the account is in credit, but rather the fact of it.
Call Records obtained from the network operator provide the factual evidence of communications between parties to illustrate contact and association. Since July 2000 Single Point of Contact rules, the operator needs to exhibit call records and serve a statement of that fact. However, a compilation may be created by an case officer, served as an Exhibit using material from the original data. There is a glut of data appearing in evidence which is in the
form of compilation, but where the original material to create the compilation is not being automatically disclosed. This is creating problems and delays. It is essential to check originality and genuineness of compilation material against original data (R .v. Robson 1972) to determine any errors, but, equally to qualify the position of fact about each charged mobile call in the first place. You may think this is perhaps analogous to the discussion given by Professor Smith [1983] Crim LR 472 that a bank statement showing an entry of £100.00 into a bank account is not a statement that the account is in credit, but rather the fact of it.
Subscribe to:
Posts (Atom)