CSA: Mobile Phones and Fringe Coverage

CSA: Mobile Phones and Fringe Coverage

.
I have this habit with mobile phones and cell coverage that when I see something that interests me, even if I am holiday, I have to see what I can find out about it there and then. Whilst on holiday in Cornwall I noticed the area I was staying had fringe coverage. I thought this was strange as I would have expected to find the Cornish village of Mousehole to have at least a microcell, given the popularity of this tourist attraction to see the Mousehole Lights at Christmas. I decided to conduct an experiment to see how various mobile phones would react under fringe coverage radio conditions. I used no special equipment, nor did I switch ON an network engineering software. The mobile phones were as any ordinary user would have them and the radio conditions with which they would be faced. Yes, I know I know, I can be a bit of an anorak at times.

1. The place I was staying was Duck Street, Mousehole, Cornwall. Accessed at one end by a no through road for cars to use a car park and Duck Street narrows to an alley for pedestrians and no access for cars.

2. The place in Duck Street where I conducted tests is in a car park that has been marked with a black cross (X) in the photo above. The close proximity of clutter (housing and a warehouse) falls within the clutter range of 10m to 30m in line with propagation models for dense to urban areas (ITU-R P.1546-2)

3. The above image displays how far Mousehole extends and the terrain clutter, along with natural phenomenon.

4. This last image provides an approximate indication of how far the main town of Penzance is from Mousehole and the general area where the Masts were located.
.
Okay, so I have now laid out the background to the tests. For the tests I used three mobile phones, all with built-in antennas, which were a Motorola Pebble U6 (which I nicked off my wife, much to her annoyance), Alcatel BH4 735 and a Nokia 3210. I ran tests at different times of the day (morning, afternoon and evening) and with three battery charge levels (charge in battery nearly empty, charge in battery half full and fully charged battery). The GSM networks were Orange, T-Mobile, O2 and Vodafone. The test area as has been shown is at para 2, above.
.

An interesting factor I noted was that all network coverage there was fringe all day, so that was the first matter. The second, and of far more interest, was how the mobile phones reacted to the radio conditions profiling the phones when switched ON.
.
Motorola Pebble U6:
Displayed 'No Service Available'. No calls or texts could be sent or received.
.
Nokia 3210:
Displayed 'Emergency Calls Only'. No calls or texts could be sent or received.
.
Alcatel BH4 735:
Displayed 'One bar of coverage and, intermittently, no coverage'. Attempted made and received calls either rang and when answered no voice communication and/or call dropping. However, surprise, surprise I could send and receive text messages.
.
Now, bearing in mind all the tests were being conducted in the same area, yet varying results obtained indicated alot about the various sensitivity of the antennas for these mobile phones. Technically, the BER of 2% for the measurement where the received signal strength is at a standard -100dBm and that a c-value would not be obtained, theoretically, below the reference BTS1 (-105dBm). I hear, though, that because of the loose wording in the standard -112dBm has been noted in some cases. Surprising, yes, but not in the realms of fantasy as GSM defines a mask lower level received signal strength, during testing, of -120dBm.
.
These very basic practical tests I conducted opens the door, though, to considering what could be extrapolated from the results when dealing with mobile telephone call records and Mast usage. For instance, if I were to conduct radio testing at this location where a person said they were for a particular call or text and I used a Motorola test handset, I may not get a positive result and may report back that not even a text could be sent from that location. Where then might the mobile phone be suggested to be located? What if a mobile phone is put nearer to the scene of a crime than it really was? What might be an inference drawn from that?
.
What may seem an ugly, awkward problem being raised here, is indeed not as bad as it seems. It really requires taking pragmatic steps before going to site to find out what mobile phone the person was using at the material time and then formulate from there how the tests should be conducted. There are other considerations, of course, to be taken into account, as well.
.
Acknowledgement: the screen images were obtained using Google Maps:
http://maps.google.co.uk/maps?hl=en&tab=wl

CSA: From Ockham's (Occam's) Razor to Checking Mast

CSA: From Ockham's (Occam's) Razor to Checking Masts

Creating a 'de facto' standard is always going to be a hard job and none more so than when dealing with 'Cell Site Analysis', abbreviated to the acronym 'CSA'. The objective of the analysis is, as best possible; to determine a likely or approximate location of a particular mobile station (MS) at the material date and time of a call. There are a large and varied number of issues to be considered when entering into cell site analysis. Cell site analysis, or CSA, is not a precise science and this has largely lead many people to misconstrue how cell site analysis can be conducted and for those who require to make an interpretation about the interpretation being given by an expert, giving evidence, leads to mistrust about cell site analysis. So it all becomes rather a vicious circle of events, with few conceding their comprehension about the fragility and instability of the stance they have adopted.

CSA is a highly intelligent science, and an evolving forensics science at that, also. CSA has many elements in its foundation that are based on scientifically proven facts. For instance, the scientifically proven fact that 0-dBm (deciBel milliwatt) always equals 1-mW (milliWatt) of power (energy) is but one good example. Furthermore, such a scientific fact allows experts to make the declaration that each result in the measurements obtained are 'absolute' and can be demonstrated as 'relative' when compared alongside other 'absolute' results.

Given that CSA extends beyond obtaining measurements and extends also into the arena of the radio spectrum, radio protocols, beamforming etc and the infrastructure required to propagate and provide a service, this, too, is an area where many scientifically proven facts and mandatory requirements exists. This again leads to forming conclusions without the need of the expert to make assumptions.

The area where CSA needs assistance is to rely upon human intervention and that requires having deep knowledge of the subject matter and solid skillsets. Again, this does not require the person to make assumptions, but to demonstrate the possibilities and potential conclusions that may help inform a Court in order that the Court can arrive at its own conclusions.

There are indeed some useful scientific philosophy dictums that can aid and support a CSA practitioner that can be adopted when striving for the aim of being 'objective', in addition to ‘independent’ and ‘impartial’, and one of the most important of these is Ockham's (Occam's) Razor attributed to the distinguished 14th century medieval logician and philosopher William of Ockham (c1285-1349). 'Leff, Gordon'; in his 1958 work 'Medieval Thoughts: St Augustine to Ockham' enunicated the so-called Ockham's Razor as 'entities ought not to be multiplied except of necessity'. However, the use of the term 'Razor' in reference to a rather superficially simple phenomenon having a complex mechanism behind it, did not appear until after Ockham's death and, although he didn't invent it, it is the frequency, apparently, with which he used the phenomenon 'should make as few assumptions as possible' in his writings that associates Ockham to this dictum. This can be clearly seen from the dictum commonly associated with the Ockham (Occam's) Razor 'Numquam ponenda est pluralitas sine necessitate', translated, means, 'Plurality ought never be posited without necessity'. How incredible, within six words, he encapsulates in that sentence that a simple explanation would be simplistic if it failed to capture all the essential and relevant parts. It is essential to understand that language and meaning were still developing in the 14th Century and care in translation in relation to subject matter statements makes Ockham's statement even more incredible, for his comments crossed boundaries unlimited to specific subject matter. Ockham probably drew inspiration from earlier philosophers such as Aristotle (384–322 BC), Alhazen (965-1039), Maimonides (1138-1204), Thomas Aquinas (c. 1225–1274) and John Duns Scotus (1265–1308), the latter who Ockham, it has been suggested, studied under him at Oxford.

Essential to Ockham's philosophy, who later, it is suggested, influenced philosophers such as Francis Bacon, is an interpretation given to his work that, when arriving at a conclusion, it is on the basis that 'facts' have already been considered before a conclusion is drawn. It is that philosophy that relates to CSA practitioners, for invariably it is not the conclusion the expert arrives at but what is required to be known is how s/he got to a particular conclusion in the first place that will be tested. By way of illustration, my report in a recent case asked the question that prior to testing what enquiries were made to the mobile network operator as to what alterations had occurred at the Masts prior to conducting radio test measurements, and can the defence please have copies of the operator's written responses?

The question went to the heart of the matter regarding accuracy of test results that underpin the opinion. Significantly, it is the prosecution that deserves praise for their benchmark standard they set in the Soham Murder case of Jessica and Holly and the subsequent conviction of Mr Huntley. I was not in that case, but as I understand it for the prosecution to show how Mr Huntley had used his mobile phone required the resurrection (I believe) of a decommissioned Mast and all the other Masts with a coverage footprint illuminating towards Mr Huntley's property to have been aligned so as to be the same as it was at the material time of mobile calls. This was required, as I understand it, in order to show the mobile telephone evidence had 'weight' and 'substance' and to avoid it being kicked out of evidence were it the case that Masts were generating coverage that would be incompatible with cell coverage at the material time. I have to say I am pro-prosecution on that landmark work and it is important to give praise where it is due. It does also mean, though, that the prosecution has established a precedent for standard of workmanship for a murder case, albeit in a high profile case, and set a marker that they will work to, and would not retract from, that standard for murder cases, at least. So it is clear why I would naturally request in a murder case what checks had been made to the mobile network operator regarding changes they had made to their Masts before the prosecution expert went on to conduct tests?

No names, no pack drill, just suffice to say the defence were told operators had 'no obligation' to keep records and, if they did keep records, were found on occasions to be inaccurate so they didn't ask, was the general thrust of the response. Really! What, no requirements under the Public Mobile Operators Licence (PMOL) to retain records about a Mast up to six months after it had been decommissioned? So how on earth could OFCOM ever check matters of interference to emergency frequencies bands from an unstable Mast if operators simply ditched their records or kept unreliable records? More importantly, what does this say about historical matters?

So does the approach in that recent murder case affect the previous prosecution benchmark approach? In my opinion, No it doesn't, and I have considerably more faith in the prosecution than that. The mobile network operator's witness provided to the court evidence of logs they regularly and continuously retain about changes to their base stations. Interestingly, on and prior to the dates of radio tests being conducted in that murder case the operator had in fact been making changes at some of the Masts targeted for their cell footprint.

Now, if I am picking that up in just one case, what is happening in other cases that have or are being rammed through the Court system to hit targets and what checks have or are being made regarding accuracy?

Of equal importance, the positive aspects coming out of cases like this means we can start to build a ‘de facto’ standard as we know the things that are required to be done.

Cell Site Analysis - .DT1 Files

Cell Site Analysis - .DT1 Files

Why is this electronic file extension (.DT1) and significantly the data it contains important to the law of evidence and its relevance to generated original material obtained in criminal cases, but equally for civil cases, too? I will tell you more about that soon, its introduction into evidence and the technical and evidential arguments raised to get into evidence.

For now, what you can know is it is important to cell site analysis and here is a clue about the device that generated it.

GSM Mast Installations (Density)

GSM Mast Installations (Density)

.

When planning a cellular radio network there are many aspects to consider. The matter of radio technology and their frequencies (carriers) are but two examples. A relevance to be understood from these examples relate to what services may be obtained and delivered through these carriers? GSM for basic voice and text services and W-CDMA providing high data rates for video, gaming and conferencing etc.
.

Germane and relevant to obtaining radio services are the radio access technologies needed for that - Masts and Antennas. In radio engineering terms, antennas provide the physical technology to access the services obtained in the radio coverage by use of transmitters and receivers, commonly referred to by the acronym TRXs. The Masts provide the physical location for the siting of the TRXs. An important aspect of Mast installations is knowing the potential customer numbers that will use the services obtained from them. The calculation used for the number of customers and the number of calls that can be handled by one Mast's TRXs is calculated using the Erlang formulae - the number of calls and time length of each call in an hour.
.

Generally, though, to understand how Erlang can be used to determine the number of Masts and TRXs for an area let's just say there are 50,000 potential customers for a particular area. Let us also say to retain quality of service three sectors with 2 or 4 TRXs per sector, s222 or s444 respectively, are required. Let's also indicate that it is known that:

.

=======

.
1 TRX = 3 erlang, 2 TRXs = 5 erlang, 3 TRXs = 15 erlang, 4 TRXs = 20 erlang
.

The relevant TRXs selected for this Mast installation scenario are 2 TRXs and 4 TRXs.
.

Let:
.

50,000 x 0.02 erlang, where 0.02 erlang is used per customer = **1000 erlang
.

Each sector of an s444 may carry up to 20 erlang x 3 sectors = **60 erlang
.

**1000/**60 = 16.7
.

Therefore:
.

16.7 (17) Mast installations would be needed where a configuration of TRXs s444
.

or where
.

33.4 (35) Mast installations would be needed where a configuration of TRX s222
.

================

.

Remember the above is intended only to be illustrative so that it can be used to draw inferences about Masts installations and potential user numbers based upon the density of Masts in an area. An inference, such as, why a Mast further away than Masts sited closer to where a mobile station (MS) may be located routed the text message to the MS?

.

There are a large number of issues to be considered but let us take iwo important issues to be considered are:

.

- Point-to-Area predictions for terrestrial services 30 MHz to 3000 MHz

- Point-to-Point short message service (SMS)

.

In relation to point-to-area it could be the height of buildings surrounding the MS may be a cause for a distant Mast routing a point-to-point SMS text message. Alternatively, it may be the routing of the point-to-point SMS text message from a distant Mast occurred because the MS, in the idle mode, was surrounded by Masts that were at call traffic capacity. Alternatively it could be because of a combination of both buildings and call traffic capacity.

.

Knowing matters like these are very useful when dealing cell site analysis and a reason why they are incorporated into the Core Skills Knowledge of the TrewMTE training courses:

.

GSM Cell Site Analysis Training Course

-------------------------------------------------------

.

Course One: GSM Core Skills Knowledge Course (CSA Part 1)

3-days training

.
Course Two: GSM Cell Site Analysis Course (CSA Part 2)

3-days training
.

Course Three: GSM Cell Site Analysis Course (CSA Part 3)

3-days training
.

3G Cell Site Analysis Training Course

----------------------------------------------------

Course One: 3G Core Skills Knowledge Course (CSA Part 1)

4-days training

.
Course Two: 3G Cell Site Analysis Course (CSA Part 2)

3-days training

.
Course Three: 3G Cell Site Analysis Course (CSA Part 3)

3-days training

.

SIM Card Training

-------------------------
GSM SIM Card Training Course

3-days training

.
USIM/UICC Card Training

------------------------------------

3G USIM/UICC Training Course

3-days training

.
GSM/3G Handset Examination Training

------------------------------------------------------

GSM/3G Mobile Telephone Training Course

4-days training

------------------------------------------------------
MTEB Mobile Telephone Evidence Diplomas (MTEdipl).

GSM MS List of States for the cell selection process

GSM MS List of States for the cell selection process

The GSM mobile station (MS) enters various states when switched on, but in the idle mode. Three such states are PLMN selection, cell selection and location registration that GSM standards described as a "set of states". The overall state of the mobile is thus a "composite of the states of the three processes". As TS 100 930 makes mention "In some cases, an event which causes a change of state in one process may trigger a change of state in another process, e.g., camping on a cell in a new registration area triggers an LR request." Below are those states relevant for MS cell selection but for a more detailed description of the behaviour of these states read GSM05.08.

C1 Normal Cell Selection ‑ This is the process of initial cell selection, searching all RF channels.
.
C2 Stored List Cell Selection ‑ This is the process of initial cell selection where BCCH carrier information (e.g. a BA list) for the selected PLMN is stored in the MS.
.
C3 Camped Normally ‑ This is where the MS is camped on a cell of the selected PLMN and may be able to make and receive calls. (Whether or not the MS can make and receive calls depends on the state within the location registration process). The MS monitors received level and the system information and checks whether cell reselection is needed.
.
C4 Normal Cell Reselection ‑ This is where the MS has determined that cell reselection is needed and an attempt is being made to reselect a new cell.
.
C5 Choose Cell ‑ This is where the MS has returned to idle mode from "connected mode" and is choosing a suitable cell to camp on.
.
C6 Any Cell Selection ‑ This is where the MS is unable to camp normally on any cell of the selected PLMN, or cannot obtain service because of certain responses to a location registration (LR) attempt. It is searching for a cell of any PLMN to camp on (so that emergency calls can be made).
.
C7 Camped on any Cell ‑ This is where the MS has camped on a cell irrespective of its PLMN identity, so that emergency calls can be made.
.
C8 Any Cell Reselection ‑ This is where the MS is attempting to reselect a cell, irrespective of PLMN identity.
.
C9 Choose Any Cell ‑ This is where the MS is returning to idle mode, after having entered "connected mode" from the "camped on any cell" state to make an emergency call. It is attempting to find an acceptable cell to camp on.

GSM Timers

GSM Timers

In the thread Cell Site Analysis-Call Analysis it highlighted the range of Cause Failures for mobile calls. The overview it provided can be quite helpful, but behind those Cause Failures there can be a range of Timers and some of them can be the reason a Cause Failure occurs (positive or negative outcome). For example we can see that timer T3216 (below) in essence relates to the failure of a Immediate Assignment Request, but the "root cause" of the failure can infact be due to SDCCH congestion or poor radio link, such as: interference, coverage restriction or radio path imbalance. Understanding the "Causes for the cessation or loss of mobile communication" requires more than knowing the Cause Code or Timer but all the "root cause" behind them.

The Timer table below provides a useful but not exhaustive list. It essential to keep monitoring the GSM and 3GPP standards. Finally, it is important to recognise that Timers have different durations dependent upon when the timer is applicable. For instance, for radio resources management the durations are often denoted in seconds and some timers are in milliseconds.

However, other timer durations (expiration) are used for internal operation for devices such as mobile telephone or SIM and can be in minutes and in some instances hours. An example of the latter can be the elementary file EFHPLMN (7F206F31) - see GSM11.11. The Timer is set in decimal-digit increments e.g. 01, 02, 03 and so on. Each increment represents a value of n-minutes which the standard GSM0211 refers to as 6 minutes, but commonly rapid updates can cause drain on the mobile telephone's battery it is understood that n-minutes can be 30-minutes. The maximum the timer can be set for is 8-hours. The timer value is network operator dependent, which means either timer method may be used.

Timers and counters for radio resource management

Timers on the mobile station side
T3122: This timer is used during random access, after the receipt of an IMMEDIATE ASSIGN REJECT message.Its value is given by the network in the IMMEDIATE ASSIGN REJECT message.

T3124: This timer is used in the seizure procedure during a hand-over, when the two cells are not synchronized.Its purpose is to detect the lack of answer from the network to the special signal. Its value is set to 675 ms if the channel type of the channel allocated in the HANDOVER COMMAND is an SDCCH (+ SACCH); otherwise its value is set to 320 ms.

T3126:This timer is started either after sending the maximum allowed number of CHANNEL REQUEST messages during an immediate assignment procedure. Or on receipt of an IMMEDIATE ASSIGNMENT REJECT message, whichever occurs first. It is stopped at receipt of an IMMEDIATE ASSIGNMENT message, or an IMMEDIATE ASSIGNMENT EXTENDED message. At its expiry, the immediate assignment procedure is aborted. The minimum value of this timer is equal to the time taken by T+2S slots of the mobile station's RACH. S and T. The maximum value of this timer is 5 seconds.

T3128:This timer is started when the mobile station starts the uplink investigation procedure and the uplink is busy.It is stopped at receipt of the first UPLINK FREE message. At its expiry, the uplink investigation procedure is aborted. The value of this timer is set to 1 second.

T3130:This timer is started after sending the first UPLINK ACCESS message during a VGCS uplink access procedure.It is stopped at receipt of a VGCS ACCESS GRANT message.At its expiry, the uplink access procedure is aborted.The value of this timer is set to 5 seconds.

T3110:This timer is used to delay the channel deactivation after the receipt of a (full) CHANNEL RELEASE. Its purpose is to let some time for disconnection of the main signalling link. Its value is set to such that the DISC frame is sent twice in case of no answer from the network. (It should be chosen to obtain a good probability of normal termination (i.e. no time out of T3109) of the channel release procedure.)

T3134:This timer is used in the seizure procedure during an RR network commanded cell change order procedure. Its purpose is to detect the lack of answer from the network or the lack of availability of the target cell. Its value is set to 5 seconds.

T3142:The timer is used during packet access on CCCH, after the receipt of an IMMEDIATE ASSIGNMENT REJECT message. Its value is given by the network in the IMMEDIATE ASSIGNMENT REJECT message.

T3146:This timer is started either after sending the maximum allowed number of CHANNEL REQUEST messages during a packet access procedure. Or on receipt of an IMMEDIATE ASSIGNMENT REJECT message during a packet access procedure, whichever occurs first. It is stopped at receipt of an IMMEDIATE ASSIGNMENT message, or an IMMEDIATE ASSIGNMENT EXTENDED message. At its expiry, the packet access procedure is aborted. The minimum value of this timer is equal to the time taken by T+2S slots of the mobile station's RACH. S and T are defined in section 3.3.1.2. The maximum value of this timer is 5 seconds.

T3164:This timer is used during packet access using CCCH. It is started at the receipt of an IMMEDIATE ASSIGNMENT message. It is stopped at the transmission of a RLC/MAC block on the assigned temporary block flow, see GSM 04.60. At expire, the mobile station returns to the packet idle mode. The value of the timer is 5 seconds.

T3190:The timer is used during packet downlink assignment on CCCH. It is started at the receipt of an IMMEDIATE ASSIGNMENT message or of an PDCH ASSIGNMENT COMMAND message when in dedicated mode.It is stopped at the receipt of a RLC/MAC block on the assigned temporary block flow, see GSM 04.60. At expiry, the mobile station returns to the packet idle mode. The value of the timer is 5 seconds.

Timers on the network side
T3101:This timer is started when a channel is allocated with an IMMEDIATE ASSIGNMENT message. It is stopped when the MS has correctly seized the channels. Its value is network dependent. NOTE: It could be higher than the maximum time for a L2 establishment attempt.

T3103:This timer is started by the sending of a HANDOVER message and is normally stopped when the MS has correctly seized the new channel. Its purpose is to keep the old channels sufficiently long for the MS to be able to return to the old channels, and to release the channels if the MS is lost. Its value is network dependent. NOTE: It could be higher than the maximum transmission time of the HANDOVER COMMAND, plus the value of T3124, plus the maximum duration of an attempt to establish a data link in multiframe mode.)

T3105:This timer is used for the repetition of the PHYSICAL INFORMATION message during the hand-over procedure. Its value is network dependent. NOTE: This timer may be set to such a low value that the message is in fact continuously transmitted.

T3107:This timer is started by the sending of an ASSIGNMENT COMMAND message and is normally stopped when the MS has correctly seized the new channels. Its purpose is to keep the old channel sufficiently long for the MS to be able to return to the old channels, and to release the channels if the MS is lost. Its value is network dependent. NOTE: It could be higher than the maximum transmission time of the ASSIGNMENT COMMAND message plus twice the maximum duration of an attempt to establish a data link multiframe mode.

T3109:This timer is started when a lower layer failure is detected by the network, when it is not engaged in a RF procedure. It is also used in the channel release procedure. Its purpose is to release the channels in case of loss of communication. Its value is network dependent. NOTE: Its value should be large enough to ensure that the MS detects a radio link failure.

T3111:This timer is used to delay the channel deactivation after disconnection of the main signalling link. Its purpose is to let some time for possible repetition of the disconnection. Its value is equal to the value of T3110.

T3113:This timer is started when the network has sent a PAGING REQUEST message and is stopped when the network has received the PAGING RESPONSE message. Its value is network dependent. NOTE: The value could allow for repetitions of the Channel Request message and the requirements associated with T3101.

T3115:This timer is used for the repetition of the VGCS UPLINK GRANT message during the uplink access procedure. Its value is network dependent. NOTE: This timer may be set to such a low value that the message is in fact continuously transmitted.

T3117:This timer is started by the sending of a PDCH ASSIGNMENT COMMAND message and is normally stopped when the MS has correctly accessed the target TBF. Its purpose is to keep the old channel sufficiently long for the MS to be able to return to the old channels, and to release the channels if the MS is lost. Its value is network dependent. NOTE: It could be higher than the maximum transmission time of the PDCH ASSIGNMENT COMMAND message plus T3132 plus the maximum duration of an attempt to establish a data link in multiframe mode.

T3119:This timer is started by the sending of a RR-CELL CHANGE ORDER message and is normally stopped when the MS has correctly accessed the new cell. Its purpose is to keep the old channels sufficiently long for the MS to be able to return to the old channels, and to release the channels if the MS is lost. Its value is network dependent.NOTE: It could be higher than the maximum transmission time of the RR_CELL CHANGE ORDER, plus T3134, plus the maximum duration of an attempt to establish a data link in multiframe mode.

T3141:This timer is started when a temporary block flow is allocated with an IMMEDIATE ASSIGNMENT message during a packet access procedure. It is stopped when the mobile station has correctly seized the temporary block flow. Its value is network dependent.

Cell Site Analysis - Call Analysis

Cell Site Analysis - Call Analysis

An element of Cell Site Analysis is Call Analysis. Evidence seen at court is often on the basis that the call records show a call which is implied that the call was started and end in the normal way - that being the user is assumed to have pressed the end key to terminate the call.

I have mentioned before in other threads how reading the GSM Standards requires consideration before undertaking work in mobile telephone evidence:

GSM Timers (see above)
Cell Site Analysis (see below)

The list below is to illustrate some of the causes for output that need to be considered regarding cessation or loss of a mobile communication. It is not exhautive as can be noted by reading the Standard.

GSM Standard GSM04.08
Digital cellular telecommunications system;
Mobile radio interface;
Layer 3 specification
(GSM 04.08)

Causes for the cessation or loss of mobile communication

Annex F (informative): GSM specific cause values for radio resource management
This annex is informative.
Cause value = 0 Normal event;
indicates that the channel is released because of a normal event or that an assignment or handover is successfully, and normally, completed.

Cause value = 1 Abnormal release, unspecified;
indicates that the channel is released because of an abnormal event without specifying further reasons.

Cause value = 2 Abnormal release, channel unacceptable;
indicates that the channel type or channel characteristics are not acceptable.

Cause value = 3 Abnormal release, timer expired;
indicates that the release is caused by a timer expiry.

Cause value = 4 Abnormal release, no activity on the radio path;
indicates that some supervisory function has detected that the channel is not active.

Cause value = 5 Pre-emptive release;
indicates that the channel is released in order to be allocated to a call with priority (e.g. an emergency call).

Cause value = 8 Handover impossible, timing advance out of range;
indicates that a handover is unsuccessful because the target BTS is beyond the normal range and the target BTS would not accept an out of range timing advance.

Cause value = 10 Frequency not implemented
indicates that the MS does not have the capability to operate on (at least one of) the requested frequency(ies).

Cause value = 65 Call already cleared;
indicates that a handover is unsuccessful because the connection has been released by the network or the remote user.

Cause value = 101 No cell allocation available;
indicates that an assignment or handover is unsuccessful because the MS has no current CA.

Annex G (informative): GSM specific cause values for mobility management
This annex is informative.
G.1 Causes related to MS identification
Cause value = 4 IMSI unknown in VLR
This cause is sent to the MS when the given IMSI is not known at the VLR.

G.2 Cause related to subscription options
Cause value = 13 Roaming not allowed in this location area
This cause is sent to an MS which requests location updating in a location area of a PLMN which does not offers roaming to that MS in that Location Area.

G.3 Causes related to PLMN specific network failures and congestion
Cause value = 17 Network failure
This cause is sent to the MS if the MSC cannot service an MS generated request because of PLMN failures, e.g. problems in MAP.

Cause value = 22 Congestion
This cause is sent if the service request cannot be actioned because of congestion (e.g. no channel, facility busy/congested etc.)

The purpose of identifying issues like this is to show that Cell Site Analysis is not about going to specific geographical locations, taking radio test measurements and then making a conclusion about a mobile telephone's location.

For instance, fairly recently evidence before a criminal court dealt with a mobile call that started on a cell site (Mast) and although the general location for the mobile 'phone had at least another seven (7) Masts within 1Km to 7Km of each other and the mobile 'phone in which to handover for a mobile call, the call was in fact handled and ended (dropped after a short period of time) on a Mast some 25Km away. This could generate an impression that the mobile telephone was travelling at impossible speeds in a vehicle between two locations in order to use each Mast for the start and end of the mobile call.

In reality, the fact that closer Masts to the mobile telephone were not used, does present the conundrum why were these Masts were excluded from use for a Mast much, much further away? Were these seven Masts all out of action at the same time, or did something else occur? This is the job of the investigator to find out when conducting Cell Site Analysis.

What a credit though to the GSM mobile telephone network displaying its amazing versatility in endeavouring to hold onto and maintain a mobile call.

Cell Site Analysis - Criminal Case

Cell Site Analysis - Criminal Case

IN HER MAJESTY'S COURT OF APPEAL IN NORTHERN IRELAND

Neutral Citation no. [2008] NICA 5

THE QUEEN v RICHARD DAVID McCARTAN and BARRY DAVID SKINNER.

Appeal Court: Kerr LCJ, Campbell LJ and Morgan J

http://www.courtsni.gov.uk/NR/rdonlyres/4F39A7FC-5350-4E4B-BB76-FA8DC4BA08D6/0/j_j_KER7057Final.htm


It is not proven with cell site analysis that evidence obtained relating to mobile call records, the Masts and their details associated with handling the calls and conducting radio test surveys combined together form a precise indication of the geographical location of a mobile telephone at the material time. Therefore, it is unlikely an alleged opinion that it is consistent to place a mobile telephone at a particular location holds weight. That cell site analysis might generally indicate the possible movement of a mobile telephone in relation to Masts that it used and no more.

Whilst the Appeal Case for the appellants (McCartan and Skinner) did not succeed it was not because cell site analysis was able to pinpoint the location of the appellants' mobile telephones, which it is unable to do, but the appellants' failure to identity what was happening with their mobile telephones at the material times. The following commentary from this Appeal Case is worth reading.

'The cell site analysis

[37] An expert in this field, David Sanderson, gave evidence, submitted a report on the subject and made a Power Point presentation to the court. Mr Fee suggested that Mr Sanderson’s evidence established that (a) call mapping was carried out in respect of telephone 008 (attributed to Mr McCartan) and telephone 301 (attributed to Mr Skinner); (b) call mapping provides an approximate indication of where a mobile phone was when a call was made; (c) call mapping is used primarily to show the likely movement of a cellular phone with a general indication of location; (d) the cellular phone may be anywhere within the best serving coverage of the sector; (e) there is boundary overlap between sectors served by different masts; (f) the extent of the best serving coverage sector is unknown; (g) the indication of movement of the person using the telephone is no more than consistent with a suggested pattern of progress – it cannot establish positively that the user of the telephone in fact moved in the mooted direction; (h) calls 15, 16 and 17 from 008 at 20.53: 20.55: 20.55 were made when the telephone was not in the vicinity of Euston Street.

[38] On the basis of this evidence Mr Fee argued that the cell site analysis did no more than provide a very imprecise indication of general movements. In the absence of a capacity to identify a precise location of the telephone within the area of best coverage it was not possible to provide any precise indication of travel direction. We are disposed to accept that Mr Fee has correctly identified the limitations that apply to the cell site analysis. As he has acknowledged, however, it does provide a general indication of the movements of the users of the telephones. If the appellants followed a different pattern of movements on the day in question, it was open to them to give evidence about those movements and to explain where they had been at the critical time in relation to the shooting. Their failure to do so, combined with the general indication that the cell site analysis provided, constituted strong evidence against them that their movements were as indicated by that analysis. In Mr McCartan’s case, his inquiry of the interviewing police officers as to how precisely he could be tied down to a particular area was also, in our judgement, extremely telling.'

The comments of the Appeal Court in para [38] suggests the appellants' own lack of self-preservation to state what their mobile telephones were doing and the reasons for going in a direction following the line of Masts used for handling calls, undermined the cell site analysis element of their appeal.

GSM Radio Test Measurements - Non-Dominance

GSM Radio Test Measurements - Non-Dominance

Screen Image 1

Readers and cell site analysis students will recall the thread GSM Radio Test Measurements, below. In that thread the discussion related to possible anomalies and interpretation regarding radio test measurements. In this thread I want to highlight another radio anomaly termed non-dominance that may occur.

Generally speaking, non-dominance occurs when radio coverage from two or more radio sources are equally aligned so that they all become dominant. The rare event in Screen Image 1 displays coverage quality and signal strengths of four radio sources are all equal to each other, in a confined area, where the receiver is in the idle mode and at ground level. Attempting to define that one particular Mast would be used to make or receive a mobile call in these circumstances might be difficult. The problems interpreting outcomes due to non-dominance could be numerous. For instance:

i) Who is to say that the receiver camped on a Mast's coverage shown by ACT would actually use that Mast? The coverage at NC2, NC3 and NC4 are equally as likely to be candidates to carry a mobile call.
ii) What happens in the case that the Mast's coverage upon which the receiver is camped at ACT the Mast is not actually best placed or line of sight with the receiver and in other circumstance would not be considered at first instance to serve the geographical area? The receiver under these conditions could be placed in an entirely different geographical area simply from summarising the Mast details shown in the mobile call records.
iii) When call setup (OACSU) takes place and a connection made it could be possible a mobile ‘phone starts a connection for less than a second on the Mast at ACT but forced into hard handover immediately thereafter thus shifts the call to another Mast (say, NC4)? It could be possible the Mast at ACT is shown as the Mast in the call records, which could be rather misleading when attempting to consider geographical location of the mobile telephone when compared to a particular mobile call.
iv) How can the radio examiner, from looking at historical records, correspond radio test measurements against the outward set of event elements recorded in call records? Non-dominance may mean a series of calls being made at one location handled by numerous Masts – thus may amount to a suggestion from analysis of the Masts usage from the call records that the mobile is on the move when in fact it is rather confined to an area. Non-dominance may result in a high number of short duration mobile calls shown in the call records. The short duration calls may not be due to the user terminating the calls, but rather the network dropping the calls.

I introduced, I believe, GSM non-dominance as an important radio anomaly to be considered regarding evidence of radio test measurements into the first criminal case in the UK back in 2003 at the Central Criminal Court (Old Bailey). GSM non-dominance was identified and shown in my evidence. Three other experts appearing for the prosecution or other defendants received my report. Acceptance of my results and findings were agreed and no challenges were made. However, I should point out that the discovery that non-dominance can occur for radio coverage was not my invention but arose from radio propagation studies by mobile network radio engineers endeavouring to agree anomalies for radio principles. The non-dominance principle had already been adopted for the Tetra standards and is accepted in GSM radio parlances as a noteworthy event. Therefore, I was fairly well armed with other independent findings.

The purpose of this discussion thread is to provide yet another example of radio conditions that can prevail when conducting GSM radio test measurements. That simply analysing call records may only present half a picture – a trompe l’oiel ( a lie to the eye) if you will.

GSM Radio Test Measurements

GSM Radio Test Measurements

Radio Test Measurements 1

The screen image (Radio Test Measurements 1) represents the output results of radio coverage detected at the receiver (mobile telephone) and represent a single static view of that coverage at one instance. During cell site analysis there will be many screens obtained but for the purposes of this discussion this single screen image will do the job. Firstly, the reader will need to comprehend, at least, an interpretation that can be given to the identifiers in the screen image above.

TOP ROW
1. Chan: this indicator refers to the Broadcast Control Channel number.
2. RxLv: this indicator refers to the received strength of signal at the test handset measured in deciBel milliwatts, (dBm), where dBm is the notion for the measurement of power of the received radio signal e.g -75dBm.
3. C1: this is a quality indicator (path loss criterion) and is used for cell selection and cell reselection. The parameters are determined from the signal strength, the minimum received power levels for initiation of signals between the mobile and network, the maximum transmit power for accessing the network and the power of the mobile phone itself.
4. C2: this is an indicator used only for cell reselection optimisation and identifies parameters to aid the mobile phone in its cell reselection process.

LEFT COLUMN
5. 'ACT' denotes the strongest, thus dominant, serving cell coverage at that location providing the best quality associated with the BCCH number (Chan). Meaning the mobile telephone has completed the cell selection/reselection processes for normal service and has chosen a cell from which it plans to receive all available services (known as "camping on a cell").
6. 'NC2-NC6' denotes other cells available in an area that may equally offer service, but that the mobile phone has not camped upon them. However, the mobile network is aware that the mobile phone has choices available to it. Displayed beside the NCs are the cells, identified by their respective Broadcast Control Channel (BCCH) numbers.

OBSERVATIONS

If it is accepted that Chan (Channel) identifies the BCCH frequencies of the radio coverage that the receiver (mobile telephone) has detected in the ether (or as Professor Clerk-Maxwell (1886) so put it "ethereal wind" when describing electro-magnetic energy in the air ) then the consideration of the RxLv (signal strength) and C1 and C2 can then be considered.

Signal Strength

The maximum received signal strength at the receiver is understood to be -40dBm for GSM (see e.g GSM 11.10 etc) and commonly -40dBm is said to be at or very close to the transmitter. However, when looking at Radio Test Measurement 1 for ACT and NC1 we see Chan 81 and 87 detected at the receiver with signal strength -27dBm and -37dBm respectively. This raises the suggestion of saturation by the transmitter's coverage determined at the receiver, where the receiver is located on the ground. So what could be the reason for this?

One suggestion might be the sensitivity at the receiver is out of spec. For this instance it would be wrong. When I conduct cell site analysis I have five (5) mobile telephones with me set in network engineering mode in order to account for a faulty handset and other anomolies and for the purposes to determine when several mobile telephones are switched ON and side by side whether they would detect and camp on the same cell (GSM terminology for radio coverage from a particular Mast) or other cells. For the radio test measurements in this case all five (5) were switched ON and all detected Chan 81 with signal strength ranging from -27dBm / -30dBm.

So if it is accepted that the mobile telephones collectively are not revealing false-positives, what other occurrence might cause this to occur. To determine this matter readers may wish to investigate by way of the GSM Standards to comprehend the standard for upper and lower limits of signal strength and review the requirements for BTS (Base Transceiver Station) transmission power etc.

It may equally be helpful to mention at this point that the signal strengths for NC2 (- 44dBm), NC3 (-67dBm), NC4 (-68dBm), NC5 (-69dBm) and NC6 (-70dBm) are very respectable levels of signal strength being that they are of high quality. When I refer to high quality I am of course referring to the term as used by the objective GSM Standard GSM03.22. It contains a useful reference when considering the quality of signal strength (RxLv) recorded in radio test measurements that a mobile network "shall be understood to be received with high quality signal if the signal level is above ‑85 dBm".

Moreover, GSM05.08 identfies the threshold RXLEV (same as RxLv) on the downlink for handover process to commence. Typical range -103 to -73 dBm. Thus NC2 to NC6 received signal strength at the receiver, being above -73dBm, could one conclude from that were the mobile telephone to have camped on either one of NC2 to NC6 the network is unlikely to handover the mobile to another cell in the list? My observation to any reader would be investigate the GSM Standards in order to consider all the elements in order to produce a more rounded opinion on this matter.

C1/C2

Cell selection and cell reselection are rather complex and convoluted matters to discuss in this short discussion thread. My observation to the reader would be to look at C1/C2 and see whether at first instance the threshold results are identical or different? What does it mean if they are not identical? Also look closely to see if cells are indicated as not available for selection or reselection - denoted in Radio Test Measurement 1 as -99. Why would a cell not be selected and/or reselected? Is it due to poor signal strength; the mobile telephone has calculated its own power capability as low; or is it detecting interference etc?

The above is just a fraction of the information that needs to be considered during and following cell site analysis and from the little I have extrapolated above means that a casual approach to radio test measurements and cell site analysis can result in erroneous conclusions being drawn.

For more on Cell Site Analysis, see Cell Site Analysis Part 1.

Cell Site Analysis Obervations

Cell Site Analysis Obervations

"Radio, she is a beauty but a mistress to none. Just when you think you have her coralled up she'll jump and kick you right in the backside when you least expect it. She is indeed a worthy challenge."

I said that in 1994, and I haven't changed my mind todate.

The above will be brought home to you only too quickly when you deal with digital radio and the art of cell site analysis. If you want a starting point with GSM, then start with the GSM standards. Having spent many years dealing with GSM and the evidence that can be produced from it, I am still in awe today as I was back in 1993 when I first started to work with GSM. For those not yet having an insight into the GSM, I can only say we really do stand on the shoulders of geniuses. I cannot think of any other technology where the authors produced such an amazing system and went on to fully document what they have done, only asking you respect what they have done by reading the standards and comprehending, and then go on to use it.

For example, when considering GSM, it is worth knowing at least four principles to be understood:

- There are mandatory requirements with mandatory outcomes
- There are mandatory requirements with optional outcomes
- There are optional requirements with mandatory outcomes
- There are optional requirements with optional outcomes

This appears to apply right across the GSM system.

There are some very good radio detection systems around, such as TEMS, Sagem etc, useful for part of the job of cell site analysis radio data acquisition. Each provides different ways to assess the radio system. An expert or examiner cannot get by though relying on devices alone. You need knowledge, skill and experience in order to comprehend the radio assessment and then how to apply it.

If you do come to our branch of forensic science, do make sure you understand the GSM system and not simply knowing how the device works. It does make for better quality of evidence and assist in a higher degree of certainty about the opinion that may be expressed regarding mobile telephone evidence.

Also, if you intend to enter 3G forensic investigation, you will find it much easier having a GSM background understanding and how it impacts; and of course having read the 3G standards.

The caveat in all of this, of course, is both systems (GSM & 3G) are constantly evolving. Even with all the years I have been working with GSM, what I have found is the more I know, the more I need to know. I find exactly the same with 3G.

Evidence and Admissibility Part 2

Evidence and Admissibility Part 2

.

In the first discussion on Evidence and Admissibility that appeared in Part 1 there was reference made to the International standards ISO17025 and ISO17020 and their proposed use as laboratory standards suited to forensics and evidence - http://trewmte.blogspot.com/2010/06/evidence-and-admissibility-part-1.html . In Part 2 further reference is made to ISO17025, the Forensic Science Regulator and UKAS and the Diplomas and their potential future influence dealing with evidence and admissibility. The purpose of making reference to these matters allows comparison to made between past technical, forensics and evidential events and potentially where the future lies when dealing with mobile telephone evidence.
.
The FSR (Forensic Science Regulator) as we know has identified a standard for laboratories that is said to be directly applicable to the field of digital mobile telephony, which is ISO/IEC 17025. To recap on background information; this is the main standard used by testing and calibration laboratories. This standard was formally known as ISO/IEC Guide 25. This standard contains many commonalities with QA standard ISO9000. When the second release of ISO17025 occurred in 2005 it did so based upon the agreement that its quality system wording was closely aligned with IS09000 version 2000. Readers may remember I referred to adopted principles in ISO17025 and QA standards in my previous posting Evidence and Admissibility Part 1.
.
So why is ISO/IEC 17025 applicable to all experts and examiners? Significantly, unlike ISO9000 and BS5750, this standard introduces the concept of, and the requirement for, 'competence' of the individual to be included into the equation because the standard applies directly to those organisations that produce testing and calibration results. The fit for purpose requirement of tools is set out under a different requirement, which is 'validation'. In order for 'tools' to remain valid equally relies upon the individual's competence, and at minimum should be:
.
a) Possess the highest competencies or attain them if the organisation is to rely on the individual to work with a tool;
.
b) To have been independently assessed by long-term experienced and skilled individuals as opposed to tool suppliers merely approving to get the sale of a tool;
.
c) Know what the 'tool' does;
.
d) Have the skills to assess whether the 'tool' is technically failing or systemically flawed in its operation;
.
e) To be able to maintain the 'tool's' performance - equally means maintaining an individual's skills;
.
f) To know and understand the requirements of future-proofing and sustainability.
.
How can the above be achieved? For sometime there has been a call for Mobile Phone Forensics Degrees but the Universities failed to take up the proposition. From enquiries made into this matter, it became clear the Universities, despite producing MSCs with one or half of one module containing something on mobile phone examination, the Universities do not have the competencies and skillsets for the work, nor could they identify the materials needed for the degrees or have the ability to assess student competence. That arises because the area is a specialism, thus requires a specialist approach and therefore this is no poor reflection on the academic brillance of Universities. So in this regard it makes no criticism of the Universities for not offering every specialism in the marketplace. This is why the Diplomas (http://trewmte.blogspot.com/2010/05/diplomas-mobile-telephone-evidence.html) have been introduced to solve this particular dilemma in the marketplace given the tens of hundreds involved with this field of distinction. The Diplomas provide a stepping stone to recognising 'competence', which currently examiners are being denied. Moreover, the modules have been prepared in the Diplomas to follow a similar structure to the way in which a student would undertake an MSC.
.
Another area where the Diplomas assist is in relation to cost. Currently MSC degrees cost between £3K to £7k per annum. The latest reported news in the media is that these tuition fees are set to increase even higher, maybe even skyrocket. The Diplomas work the other way around, the more modules you undertake the lower the costs become due to the way the discounts work. The encouragement to undertake the Diplomas therefore doesn't just include imparting real-world knowledge and experience passed on by seasoned professionals, but incentive discounts offered by uptake of the modules enables the securing in-advance of the professionals time which otherwise wouldn't be possible. Furthermore, and at the same time, they offer affordability to students.
.
Why is the way forward given above a better way than the current status quo? Neither the Forensic Science Regulator (FSR) or UKAS can approve the 'competence' of individuals for each particular field of forensic /evidential distinction. Universities as we know do not have the skillsets necessary to rollout degree courses in mobile telephone evidence. Specific to our field of distinction, the Mobile Telephone Examination Board (MTEB) was set up specifically to address peer review; the Diplomas are one way to gain peer review leading to recognition through the MTEB. The foundation to each of the modules in each of the Diplomas map principles to be found in simulated annealing for deterministic and random events that are often understood to be the basis of how evidence from mobile telephone usage occurs. The Universities gain from Diplomas as they work in harmony with them to aid students find the academic path to follow for a specific subject rather than the current way of devaluing and diluting other sciences and forensic fields to build up modules introduced into hybrid technology degree courses. So we need to understand the influences and impact of the quality or state of existing in or assuming different educational forms (generically speaking, polymorphic).
.
The future of mobile communications and its impact on society will grow even more than hitherto it has. The driving forces for this can be traced as much to remarks on future Global economies by industry illuminaries such as the head of LM Ericsson, the largest telecommunications manufacturer, when he said the future is "wireless" as much to the growth in smartphones and wireless smart devices and the newer wireless transmission and protocols, functionality and applications introducing diversity in the wireless world that looks set to surpass the cable world. However, to meet those exciting and progressive markets, Business can no longer afford to wait for degree students to flock out from Uni after 3 years and then spend another 1-2 year/s bringing them up to speed in the fast-changing wireless environment.
.
An example of fast-changing wireless environment which identifies sustained regular change can be found in the wireless standards used nationally and globally:
.
_____________________________________________________________
3GPP specifications
The term "3GPP specification" covers all GSM (including GPRS and EDGE) and W-CDMA specifications. The following terms are also used to describe networks using the 3G specifications: UTRAN, UMTS (in Europe) and FOMA (in Japan).
.
Revised versions of many of these specifications are produced up to four times a year following the quarterly TSG plenary meetings (TSG GERAN meets five times a year.)
_____________________________________________________________
.
The Diplomas take all of those conditions above, turn them around and re-work them. Students pursue the business goals first, being effective and self-managed at work, and then use the academic route to refine and hone particular, finite skills to optimise the end result for the benefit of the business. This model can assist Universities to get students wanting to achieve the technical hardcore goals in order to develop products, systems and services tailored from the diversity of the business enterprise and working environment. This can be so because the student's constructive thought process is based upon real-world exposure, not school-to-university idealogical observations. Moroever, there are examiners already working in the field who (a) have not had a fair opportunity to have their competencies recognised by (b) their peers and in the community. The Diplomas remove that unfair stigma for those mobile phone examiners being treated as second class.
.
So what are some of the future evidence and admissibility issues to be considered?
.
1. Recognised competence so reliance is NOT solely placed upon the tool; thus the removal of "push-button forensics" used to side-step the need for competency
.
2. Validation of tools will come about (thus side-stepping compliance is unavoidable). Indeed one particular tool developer agrees validation is entirely achieveable. So this is a step forward for validation, but again does not of itself qualify the 'competency' of the individual if trained to use the tool beyond gaining exposure to the tool's operation and use, but not the detail of the subject matter of the science, the technology using the science or, indeed, interpretation of outcomes or data.
.
3. Item 2 (above) is really a further qualification as to why the FSR and UKAS do not appear as candidates to qualify/recognise individual 'competency' in the subject matter or science.
.
In the next part, Part 3, the discussion deals with specific technical issues and their impact on evidence and admissibility.

Evidence and Admissibility Part 1

Evidence and Admissibility Part 1

The analysis that can never stop relates to issues associated with evidence and admissibility. We need thought provoking discussions to inform our knowledge. Also, we need to exercise our understanding of the work we are doing and whether it meets an acceptable criteria in the practices and procedures we follow. Moroever we should challenge perceptions we hold to discover where things could go wrong and make revelation of them to see how best they can be put right.

The discussion below contains references to Statutory Law and Case Law. I am not legally qualified and do not hold myself out to be giving legal advice. The legal references that have been used are there to help identify requirements that are in place or to merely demonstrate an interpretation.

STATEMENTS, TOOLS & PROCEDURES
The independence, objectivity and impartiality of a witness or expert can only be seen if each are responsible for producing their own research, analysis and reports and their own exhibits and the content in them unfettered from control by others who are not giving the evidence. Problemical is that any desire to achieve these laudable principles can be thwarted due to deficiencies in the system.

Using mobile phone examination tools to acquire data, that data maybe subjected to the limited capability of the tool that extracted the data in the first place from the target device (the "exhibit"). The accuracy of the harvested data can again have limitations if the tool that extracts data is equally set to work to translate the data. Most of 'the' tools do this. When I put the word 'the' in parenthesis I do so because I am of course referring to mobile phone tools and not every tool. Notwithstanding the aforementioned limitations, a further limitation can occur from which a tool outputs the data into datafields. This largely leaves the examiner to believe, any data that does not appear or cannot fit into a datafield, it is not (worthy) evidence for inclusion and doesn't get served. Extracted data that are not the subject of translations remains in a raw state in the electronic file and doesn't get served. If the examiner doesn't know what data to look for or does not understand the relevance of the data this too can contribute to evidence not seeing the light of day. If this is not revealed in the report/statement, and left unchallenged, it corrodes the principles and right to fair trail by diluting revelation in the criminal justice system.

It can also be the case that where the report/exhibit design and datafields for cell site analysis evidence are predefined and examiners/experts are told the format they must follow, again this leads to corruption of the principles mentioned at the outset. If the format is predefined it causes the examiner/expert to look only at a certain set of criteria and only the data for that criteria; other data that should have been considered gets ignored, and again does not see the light of day. Furthermore, it prevents the examiner/experts from corroborating facts prior to disclosure.

What observations might be drawn from the views above? One observation might be to look at the Industry Standards, Technical Standards (GSM/3GPP, ETSI/ITU/ISO, proprietory, etc) and QA Standards (ISO etc) to determine discovery and revelations that should be made. For instance, using the example of the proposed QA Standards of ISO17025 and ISO17020 the principles in them are drawn from ISO9000, an international QA Standard having principles in it that originated from the British QA Standard BS5750. So there is as an historical reference and appreciation to be aware that Britain is fully aware of using a quality approach when dealing with 'technical' material and the importance of its revelation. However, the different between ISO17025/ISO17020 and ISO9000/BS5750 is that the former are said to be directly applicable for forensic evidence where as the latter have never been directly applicable for forensic evidence, but have often been suggested as achieving a criteria sufficient for evidence.

More importantly, to this discussion, would the tools used for examination fail the crietria set out in ISO17025 and ISO17020? An example to look at might be the QA criteria relating to "non-conforming" product. If the examination tool does not possess the capability to know if the product (the "exhibit") is non-conforming or by use of that tool it introduces non-conformance into the product (the "exhibit"), then the tools output may fail the test. The analysis of the failure thus requires to be determined: to define whether the coding in the tools have been written incorrectly or the coding incorporates commands of a generic nature - meaning device-specific commands may not have been considered or used? The latter might cause data changes residing in the handset. Changes to data and failure to reveal that prior to disclosure undermines the discovery to be understood about served data and can affect a tribunal's understanding of the "defendant's behaviour in relation to the data" (s129 CJA (Criminal Justice Act) 2003). Under s69 of the Police and Criminal Evidence (PACE) Act 1984 (repealed) that occurrence would have been less likely because s69 compulsorily required prior consideration and affirmation before admissibility and allowed transparency upto the point that enabled probative enquiries and tests of the system (in some cases) to seek validation about a system's performance.

Evidence submitted in the past (pre s69 PACE repeal) came with a meaningful statement that was naturally attached with the evidence; post s69 PACE there is no equivalent technical statement of any compliance whatsoever, unless it is voluntarily made but simply not referenced to s69. When such a statement in the past was made it contained references to affirming the position required by s69 PACE 1984 as to the operation of the computer/s and affirmation (certificate) required by other provisions.

One might be forgiven for thinking the Police when they present evidence are excluded from making at least some declarations about the operational performance of their computer/s and program/s generating evidence. They are not excluded from doing so, there is simply no enforcement to include good QA declarations in their statements/reports about evidence they generate - whether obtained from mobile phones, computers, CCTV/Video and so on. In contrast, currently mobile operators producing billing records etc (served as evidence generated from a computer and program/application) still make a QA reliability statement that the computer that generated the evidence operated properly and if not it would not as such cause alteration to the state of the business record (data). So why shouldn't the Police and examiners make the same statements? Afterall they do use computers and programs to extract and harvest data from an exhibit and it is that data from the computers that the court sees.

CONTROLING REVELATION
The discussion, having dwelt on the subject of identifying some aspects of limitations that can occur with examiner skillsets, flawed tools, contaminated evidence, conflicts with standards and lack of appropriate procedural requirements, there are still the issues of 'control' of revelation as to how evidence is presented and what might influence that to happen?

Where examiners are forced to extract, harvested, examine and report evidence with preset requirements for revelation that may not fully corroborate "behaviour" when compared with the data that has been revealed under any enforced procedure, it may amount to undue preference or undue discrimination. The words 'preference' and 'discrimination' do not attract prohibition. Instead, the emphasis is on 'undue', which in dictionary terms can mean "improper", "unreasonable" and, in particular, "excessive". That emphasis might be applicable where commercial contracts, such as public sector contracts for the employment of outsourced services occurs that may have legal requirements, either express or implied, associated with them, that require the contracted party to use discrimination when revealing data by predicting only particular data to be available and be served (disclosed).

The matters of undue preference and undue discrimination have been dealt with by the House of Lords previously. Lord Keith and Lord Merriman outlined definitions in two separate actions involving the same case - South of Scotland Electricity Board -v- The British Oxygen Company - that concerned disputes with the provision of costs and supply of electricity as to how the meaning of 'undue' may have influence. These cases may provide useful pointers where controlled evidence is being used. Lord Keith in the first action ( [1956] 1 W.L.R. 1069 ) stated that the word "undue" encompassed not only illegitimate reasons but could also mean "excessive". In the later action ( [1959] 2 All E.R. 225 ) Lord Merriman addressed the matter in three parts. The first is use of the phrase "shall not exercise any undue discrimination" had to be considered as a whole. Secondly, making reference to objectives he identified "a fair distribution of the cost of supplying electricity as between one class of users and another is not to be left out of consideration any more...." followed by the use of the incisive comments for the third part "....'than any other circumstance which would affect mens' minds."

If the above principles are applied to evidence, then it would suggest the need to re-instate encumbent obligations (like s69 PACE) requiring performance of fair acquisition of data and fair distribution of evidence for delivery to a class of users (eg the Courts, Prosecution and Defence) and to protect against blind-siding and stumbling blocks that may cause undue discrimination. In addition, public sector contracts may well benefit from containing a contractual clause protection mechanism to enable the immediate use of the law to act as a 'shield and not a sword' when a penalty is threatened or issued against the outsourcer where the outsourcer has identified that the data under the schedules supporting the contract does not permit other important data to be incorporated into the datafields of the template that is being enforced to be used, thus prevents revelation. Such omission of data prevents the Prosecution from meeting their obligations under the Golden Rule enunciated by the noble Lord, Lord Bingham in the case of R .v. C & H (February 2004) to conduct a fair risk assessment when in possession of all the evidence and the facts in order to determine the risk, if any, that the evidence poses. The impeccable logic behind the requirement: if there is fundamental misunderstanding about the evidence and there are too many twist and turns being used to skew the path to appropriate discovery and revelation, that may interfere with others (who are not technical) in allowing them to meet their duty required by the statutory provisions, e.g. s9(2) Criminal Procedures and Investigations Act 1996?

MTEdipl Diplomas

MTEdipl Diplomas

.

For registered students and those going through the process of registering for the Diplomas for the start of the September 2010 intake:
.
Three Months Notice (June/July/August) Advanced reading to help you prepare for the distance learning and self study. The following book comes highly recommended and will help you with setting your objectives particularly for the research and study modules for each Diploma.
.
LITERATURE:
Skills for Success, The Personal Development Planning Handbook
Author: Stella Cottrell Paperback: 312 pages
Publisher: Palgrave Macmillan (2 May 2003)
Language English ISBN-10: 1403911320
.
Amazon link:
http://www.amazon.co.uk/Skills-Success-Personal-Development-Planning/dp/1403911320

MTEdipl Diplomas

MTEdipl Diplomas

.

For registered students and those going through the process of registering for the Diplomas for the start of the September 2010 intake:
.
Three Months Notice (June/July/August) Advanced reading to help you prepare for the distance learning and self study. The following book comes highly recommended and will help you with setting your objectives particularly for the research and study modules for each Diploma.
.
LITERATURE:
Skills for Success, The Personal Development Planning Handbook
Author: Stella Cottrell Paperback: 312 pages
Publisher: Palgrave Macmillan (2 May 2003)
Language English ISBN-10: 1403911320
.
Amazon link:
http://www.amazon.co.uk/Skills-Success-Personal-Development-Planning/dp/1403911320

Diplomas: MTEdipl Syllabus and Student Handbook

Diplomas: MTEdipl Syllabus and Student Handbook

The distance learning and self-study Diplomas: Mobile Telephone Evidence (MTEdipl) Syllabus and Student Handbook is now available for download:


http://www.4shared.com/document/7XHHJ1Ru/MTEdipl_Cata20.html

Diplomas: MTEdipl Syllabus and Student Handbook

Diplomas: MTEdipl Syllabus and Student Handbook

The distance learning and self-study Diplomas: Mobile Telephone Evidence (MTEdipl) Syllabus and Student Handbook is now available for download:


http://www.4shared.com/document/7XHHJ1Ru/MTEdipl_Cata20.html

Diplomas: Mobile Telephone Evidence (MTEdipl)

Diplomas: Mobile Telephone Evidence (MTEdipl)

.
The Diplomas provide individuals with a path to recognition for demonstrating development of students knowledge, skill and experience for those involved in mobile telephone examination and evidence or for anyone interested in this field of distinction.
.
Empowering students to have confidence in themselves, their knowledge and skills, is one feature in the Diploma modules. Another feature is the Diplomas can have value-added benefits for employers. Each Diploma carries a requirement that the student MUST present as part of their assignment a tested practice and procedure plan and be able to offer a possible solution to potential employers for practices and procedures for dealing with mobile phone evidence along with other enhancement value-added benefits, such as market potentials for future planning options that may benefit an employer.
.
The Diplomas are recognised by the Mobile Telephone Examination Board, fully backed with my experience over two decades in forensics and evidence and additional guidance and support from other experienced examiners in the field and identified materials from academics and experts in mobile telephony. The Diplomas enable students to organise their own time and work, without pressure, to study, complete and produce assignments for each Diploma module undertaken.
.

• Diploma for Foundation and Research Skills - Mobile Telephone Diploma Core CFRS

• Diploma for Mobile Evidence QA and Evidence Handling - Mobile Telephone Diploma Core CQAE1

• Diploma for SIM and USIM Technology Examination - Mobile Telephone Diploma Core CSUT2

• Diploma for MS and UE Technology Examination - Mobile Telephone Diploma Core CMSU3

• Diploma for Call Records and Network Records Analysis - Mobile Telephone Diploma Core CCRN4

• Diploma for Cell Site Analysis - Mobile Telephone Diploma Core CCSA5

A Diploma Mobile Telephone Evidence (MTEdipl) is awarded for each module that has been completed and passed. An Advanced Diploma is issued only when a student has completed and passed all the Diploma modules and must produce based upon an expert assignment a report containing all of the subjects in the Diploma modules that is presented to a Peer Review Board.
.
Diploma Module Completion Period:

CFRS - completion: 3 months
[1 months study / 1 month to submit assignment / 1 month assessment]
.

CQAE1 - completion: 4 months
[2 months study / 1 month to submit assignment / 1 month assessment]
.

CSUT2 - completion: 5 months
[3 months study / 1 month to submit assignment / 1 month assessment]
.

CMSU3 - completion: 5 months
[3 months study / 1 month to submit assignment / 1 month assessment]
.

CCRN4 - completion: 5 months
[3 months study / 1 month to submit assignment / 1 month assessment]
.

CCSA5 - completion: 6 months
[4 months study / 1 month to submit assignment / 1 month assessment]
.
For further details, costs and registration form:

Email: trewmte@gmail.com

Orange and Vodka - mixing mobile networks

Orange and Vodka - mixing mobile networks

(shaken, not stirred)

.

Good title for a book or article that heading. I thought this would be a useful post regarding the unusual occurrence of roaming onto a forbidden UK network from the home UK network.These screenshots record an event that happened on my wireless broadband. In the area I was located at the time Orange provided GPRS at 56K but download rates of under 6.5kbps (no 3G) - so not very good at all.
.

.
Such a matter like this may have an influence, if understood that it may occur, on any post-obtained radio test measurements after an alleged crime, or may even taint what may be considered a flawless opinion or conclusion, that is when conducting cell site analysis (CSA) investigations for evidential purposes.

.

.
It is not the fact that post-obtained radio test measurements failed to replicate an earlier event, it is the fact that a 'possibility' that may need to be explored to provide a more rounded opinion or conclusion in a report and at Court maybe missed or overlooked.
.
There are answers to the above conundrum but this is not the point of this post, which has been to highlight a technical event that might impact on evidence.