TrewMTE Mobile & Technology Exploration

Three years after trewmte.blogspot was launched and today it has reached over 100,000 visitors. For a small, but hopefully helpful and informative blog on mobile telephone evidence and forensics, amongst a sea of websites and blogs on the world wide web, it reminds us all of what is possible from being on the web, but also the amazing library of information that is out there available by of web.

Thanks to everyone who stopped by to see what is going on here.

Friday, October 23, 2009

Booking Form Mobile Forensics Conference UK

25-26 Nov 2009 UK MTEB Mobile Forensics Conference UK

The Booking Forms are now available. A massive email mailshot was sent out yesterday in the hope that I sent the Form to those who had requested it. Just in case I missed anyone (sorry), can you please send an email to me titled:

"MTE - Conference Booking Application Form" to request a Form being emailed to you.

Email: trewmte@gmail.com

Security vetting is in place due to some topics such as 'Mobiles as Dangerous Weapons' and 'Interception' etc etc are being covered in the Conference.

There is a good selection of speakers and training sessions delivered by experienced people. Remember this is a learning conference, not a selling conference/exhibition. Due to timings - speakers -v- training sessions - these streams happen, in some instances, at the same time. It would be within your interests to book at least two people to attend the conference. One to listen to the Conference Speakers and the other to attend the Training Sessions. The attendance fee covers the training also - so there is nothing extra to pay for attending training.

If there is uncertainty about the cost of one delegate @ £150.00 attendance fee, it is worth refreshing on the point that the common standard examination fee is £240.00 per handset; so attendance is less than the cost of one handset. Two people attending, then the cost of examining two handsets would be applicable.

Certificates of Attendance for Continuing Professional Development (CPD) will be issued to each delegate attending - so please make sure the name is clear on the Booking Form.

FAQs

Security Vetting - This is what is meant by security vetting.

Because of the content to be covered at the conference such as 'Mobiles as Dangerous Weapons' and 'Interception' etc etc, security vetting is in place and only those who have pre-booked will have a pass issued when attending conference. There is no checking into peoples' history or the need for them to justify who they are with extra documentation.

Booking Form

Please email back your booking form after you have paid, so that we have it confirmed you are attending and attendance certificate can be arranged. Booking forms should be returned no later than:

Thursday 12th November 2009

Payment

Please email confirmation with BACS payment reference number or copy of payment counterfoil at bank, so that a paid Invoice can be issued.

..............

FAQs

Attendance Bookings

There was eventually 307 who registered interest to attend the conference.To be fair to everyone the confirmed attendance system is based upon first come first serve. This was deemed to be the fairest approach given that those who originally registered in advance: some have yet to make a firm commitment; others have been diverted by work matters so cannot attend; and some we simply haven't received any further communication.The deadline for booking is:

Thursday 12th November 2009

Whilst we are doing very well at this stage for confirmed bookings I shall confirm that as soon as 150 delegates have confirmed their bookings I shall annouce it straightaway. In the meantime, please do not have any concern about over bookings or you being unable to attend.

Attendance Costs

A few people who want to attend have mentioned their boss / company accountant needed to understand what costs were involved. I could well understand if there was concern over £500.00 per ticket conference plus additional expenses but the costs here are exceedingly well placed to avoid any concern:

1) Delegate Fee is £150.00 + VAT

2) Travelodge is £19 per night

3) Advanced booking for travel train using online train ticket companies is as low as £24.00 from the North to Dorking

4) By National Express Coaches special deal savers can be obtained for as little as £1.50 one way and £11.00 return ticket.

Confirmed Bookings

For those that have booked your confirmation will be sent next week along with a paid invoice.The make up of attendance looks very good also. Not only do we have criminal evidence examiners but there is a good mix from the civil contingency too. The conference will also play host to experts and examiners flying in from the US, Australia, Europe etc.

SPEAKERS

- Greg Smith’s presentation sets out the agenda for the two days conference

- Peter Jones’s presentation set outs issues and difficulties a practitioner can face

- Solicitor’s presentation identifies evidential requirements under s129 CJA 2003

- Barrister’s presentation identifies evidential requirements at court

- Practice Manager’s presentation sets out the service expected from a practitioner

- Seizing Officer’s presentation illustrates events when seizing target phones

- Vinny Parmar’s presentation illustrates requirements when conducting examinations

- Jan Collie’s presentation looks at skills needed when investigating evidence

- Samantha Raincock’s presentation illustrates how to compare handset and call record data

- Roger Wilkins’ presentation illustrate how cell site analysis arises following examination

- Terry Wise’s presentation deals with the impacts of RIPA, DPA and PACE

- David Sullivan’s presentation sets out the skillsets employers seek for forensic work

2-HOUR TRAINING SESSION MODULES

- Session 1 Seizure Procedure

- Session 2 Dangerous Weapons

- Session 3 Examination procedure

- Session 4 Examining phones

- Session 5 Hex Dumping

- Session 6 U/SIM Card Examination

- Session 7 Analysing data

- Session 8 Interception

Sunday, October 11, 2009

Extra-Statutory

Extra-Statutory

Where, for illustrative purposes only, a Home Office circular regulates e.g. the use of listening devices and aural and visual procedures, the standards set by that document may be the same as those under a Stature (say RIPA or, previously, IOCA) but that Home Office circular does not mean by following its guidance it makes any acts or omissions compliant with the statutory provisions; conduct arising from following the circulars regulation, and not the statute, could be "wholly extra-statutory" and would probably contravene the European Convention on Human Rights - see Malone v Metropolitan Police Commissioner [1979] Ch 344; cf Malone v United Kingdom (1984) 7 EHRR 14.

.
The above represents past history events and matters have or should have moved on since then. When RIPA was introduced it was made clear that "no" extra-statutory conduct or operations were possible arising out of that new legislation. That any acts outside of that may amount to contravention and be unlawful.

.
Having illustrated a simplistic model about "extra-statutory" activity by public authority and public bodies or their personnel to avoid giving advice, direction or guidance which would/could probably mean such acts may operate in parallel to the statutory provisions instead of being enshrined within them, the same principle of extra-statutory can apply across many other areas covered by other statutes, too.

.
Advice, direction and guidance given to facilitate the transmission of sensitive and/or unlawfuly material over public systems to aid extraction and harvesting of data from device/s might probably be "wholly extra-statutory" conduct or operations. That is even where it is a one-off case. Where advice is given to do acts which appear to go against previously stated authority in dealing with certain types of materials, the expert/examiner should record all dealings with those acts that have been instructed.

.
I picked up on this whilst reading books and papers dealing with judicial review of administrative action, Blackstones Criminal Practice, Archbold, telecommunications law and practice and the laws of the internet etc etc. I also noted that ACPO Guidelines and other provisions in public sector procurement documents appear not to cover any examiner/expert who enters into extra-statutory acts.

.
These are only my observations based upon what I read, which may assist other examiners/experts. I am not giving legal advice and I do hold out to be a lawyer. It could be from what I have read that my observations may be wrong and therefore it is always recommended to seek legal advice about instructions given or past instructions acted upon, under the belief those instructing were authorised to give such directions to do such acts in the first place.

Extra-Statutory

Extra-Statutory

Monday, September 21, 2009

SMS Text Messages - Hearsay Evidence

SMS Text Messages - Hearsay Evidence

C2247 / R v Leonard 2009

YEAR OF CASE: 2009

CITATION: [2009] EWCA Crim 1251

COURT: Court of Appeal

SUMMARY:

Large quantities of various types of Class A drugs and cash were found in L's bedsit and on his person during a search by police.

At trial for possession of class A drugs with intent to supply, the prosecution argued that L was a street dealer and those drugs found had been his 'stock pile'. The defence argued that the drugs were for his personal use and that he was not a dealer but he had the large amount that was found because he intended to share them with his girlfriend.

The prosecution wished to admit two text messages as evidence to support its case. Both were from different people, one to compliment the 'gear', the other to complain about it. The defence argued that the text messages were inadmissible hearsay. The judge rejected the argument and admitted them as evidence of bad character as opposed to hearsay.

L was convicted and appealed arguing that the judge had been wrong in law.

Held:

Appeal dismissed. Convictions upheld. The text messages were hearsay evidence and not evidence of bad character. They fell in the scope of section 114 and 115 of the Criminal Justice Act 2003 and had to for the following reasons;

(i) they had not been made in oral evidence,

(ii) they were statements of fact or opinion within the meaning of section 115(2) of the 2003 Act,

(iii) the reason for the evidence being admitted was to establish the matters stated in the texts to try to prove that L had supplied the drugs to the senders of the texts, and

(iv) each message was designed to make the person in receipt of them believe the matters stated in them as required by section 115(3).

Once it is established that the texts are hearsay they then fall to be analysed as to whether they meet the statutory requirements regarding admission. The only basis upon which they could be admitted would be under section 114(1)(d); that it was in the interests of justice to do so. To ascertain whether that is the case, regard must then be had to the 9 propositions in section 114(2) and as they fail to meet some or all of those criteria, they may be hearsay, but they are inadmissible hearsay evidence. Despite this there was still a very strong case against L without them and their admission had not tainted the rest of the trial.

Note:

In this instance the senders of the text messages were never identified. If the authors can be identified then the text messages may become admissible where the authors can be potential witnesses. Thus allowing the evidence to be tested by way of cross-examination with any requisite measures in place, for example special measures under the Youth Justice and Criminal Evidence Act 1999 to alleviate such issues as fear.

http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=4567

SMS Text Messages - Hearsay Evidence

SMS Text Messages - Hearsay Evidence

C2247 / R v Leonard 2009

YEAR OF CASE: 2009

CITATION: [2009] EWCA Crim 1251

COURT: Court of Appeal

SUMMARY:

Large quantities of various types of Class A drugs and cash were found in L's bedsit and on his person during a search by police.

L was convicted and appealed arguing that the judge had been wrong in law.

Held:

(i) they had not been made in oral evidence,

(ii) they were statements of fact or opinion within the meaning of section 115(2) of the 2003 Act,

(iii) the reason for the evidence being admitted was to establish the matters stated in the texts to try to prove that L had supplied the drugs to the senders of the texts, and

(iv) each message was designed to make the person in receipt of them believe the matters stated in them as required by section 115(3).

Note:

http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=4567

Mobile Market Stats

Mobile Market Stats

Useful OFCOM mobile market statistics collated from the UK mobile network operators.

Sunday, September 13, 2009

BCCH data uncovered

BCCH data uncovered

.
The data found in the elementary file broadcast control channel (EFBCCH) 7F20:6F74 / 7F21:6F74 can provide useful data relating to a geographical radio area when combined with location area information data.
.
Method for translating BCCH information data. The question is, is the translation below to find the BCCH frequencies correct and what have I not mentioned below? You will need copies of GSM11.11, GSM03.03, GSM04.08 as well as understanding coding schemes.
.
FIGURE 1 What the Standard states:

.
FIGURE 2 What that means:
.

.
FIGURE 3 Harvested data from a Orange SIM Card read:
.

.
FIGURE 4 Translating the hex output to binary:
.

.
FIGURE 5 Converting to decimal digits which translates again and corresponds to GSM assigned uplink/downlink frequencies:
.
BCCH Frequencies (ARFCN)
761 765 766 774 781 782 786 787 789 790 797 799 801 803 806 813 816 825 828 829 838 846 847 849 869
.
FIGURE 6 Corroborating the conversion using another tool:
.

.
More on Cell Site Analysis: http://cellsiteanalysis.blogspot.com

BCCH data uncovered

BCCH data uncovered

.
FIGURE 2 What that means:
.

.
FIGURE 3 Harvested data from a Orange SIM Card read:
.

.
FIGURE 4 Translating the hex output to binary:
.

.
More on Cell Site Analysis: http://cellsiteanalysis.blogspot.com

Tuesday, September 08, 2009

Mobile Phone Identity Theft

Mobile Phone Identity Theft

With a title like that you could be forgiven if you thought that someone had taken your mobile phone, stolen the name off it and just chucked the hardware back at you. Not interested in the phone, only want the name. Oh yes, call me Nokia N70 from now on.

The latest scare of Mobile Phone ID Theft as reported by Matt Cole Newsbeat Report for BBC online service Newsbeat can be found here:

http://news.bbc.co.uk/newsbeat/hi/technology/newsid_8242000/8242709.stm

Crimes like these create scepticism because the logistics encumbent upon the perpetrators to ensure that the enterprise of this crime succeeds are so long winded, bearing in mind that the mobile phone isn't being stolen, just a filing cabinet of personal information collated from various sources; and for what, so someone can run up a mobile phone bill. A solution to this part of the Identity Theft conundrum is to get a prepaid mobile phone and stick £5.00 on it. Now the matter is no longer ID theft, but call theft - £5 worth.

As for obtaining the filing cabinet of personal information about you? The only easier way that the perpetrators could speed up that process is if they were getting hold of information obtained from others who are themselves engaged in the business of selling and trading in people's personal details.

Friday, September 04, 2009

Subsidiarity Isn't working

Subsidiarity Isn't working

.
Sometimes, something can be said, a word or phrase, that sticks in my mind and eventually I have to go and research it, just to see where it leads.
.
Throughout most of the 80s a "fit the need of the moment terminology” was being used by European ministers which had been noted with particular emphasis embracing the word "Subsidiarity".
.
Subsidiarity was pulled from EC Drafts in the 1990s having been subjected to rigorous intelligent and intellectual debate, it was suggested it was a liberalising tendency that was difficult to put into practice and found not to work apparently. Subsidiarity doesn’t help people, instead it is used as a control by more localised forces in a rather draconian fashion by distributing power without election, but uses an outward set of images portrayed throw a Kaleidoscope to mask what can go on behind it.
.
Today, subsidiarity has been in operation, ticking away, and what might have been with good intention to introduce this 'thing' it appears to have been more corrosive to and eroding of standards, good practises, and good values than it has been of help and can be seen to affect all our lives. So what is this 'thing'?
.
We are told that it is a 'principle' quote plucked from the obscurity of Catholic social doctrine where it lurked until Pope Pius XI raised it again. Pius XI defined the word ‘subsidiarity’ in a 1931 encyclical: "Society's decisions should always be taken at the lowest practical level" - it is a "grave evil" for higher authorities to usurp powers which can be exercised by smaller local bodies.
.
Pope Pius XI may have delivered a philosophical scripture that could have been perfect for its time and place in 1931, particularly given the changed landscape following occupation in the aftermath of World War I (1914-1918) and maybe attempting to make sense of that change, in addition to being conscious of current World tensions at that time (but Pius XI I do not suggest had clairvoyance to see World War II 1939-1945).
.
Why I am writing about this now? Some months back I heard a programme on radio where an MP (for the life of me I cannot think who that was), but anyway, he suggested, along the lines, that subsidiarity isn't working. I knew the word 'subsidiarity' seemed familiar to me but I could not remember in what context. I found the source now that put it in my mind originally and that was The Times July 23 1991.
.
In 1991 subsidiarity was still being mooted as useful across the spectrum, not merely as social doctrine but useful in business as well. At that time, also, the Chinese had a 'thing' of its own called the ‘social contract’ (a word bond); a bi-lateral agreement between two business people who sat down and talked openly and honestly as to what they both wanted to get out of doing business together and what each would be prepared to agree to. Once agreed, they shook hands and the contract was formed. No higher authority was needed, no written contract necessary. The Chinese didn't invent this business strategy, but tweaked it to their cultural conditions, which seems perfectly reasonable. The concept of a ‘word bond’ actually comes from the English custom and manner, and was known as 'a gentleman's word is his bond'.
.
Subsidiarity in business tries to use concepts like these on the principles on 'when in Rome....' but fails to appreciate that rules apply and people need to play their part if the business is to succeed, or the social doctrine is to work. This is where subsidiary appears to be flawed. Because it introduces the notion that everyone is empowered (from the highest to the lowest) and we now see the rules being made up as they going along, with no litmus test to define the outcome. The employer sets rules, but doesn't really know what the employee is doing, and the employee develops actions out of those rules that may not have been intended by the rule because the monitoring of rules is operated on the principle 'hopefully it will work out alright in the end.'
.
Harold Macmillan spoke of the problems of empowerment and who's in charge on television over 35 years ago. He was speaking about changing society and changing Britain. Whether he was hankering after upstairs/downstairs society I don't know, as I only knew about him from what he said when he was alive and from time to time I would see him on television, hear recordings of him on the radio or see his comments in newspapers. Nonetheless, he did express a view on television that appears quite profound in today's context.
.
He viewed the evolution of class barriers breaking down, wealth distribution and opportunity for the less privileged, which was a large proportion of the nation at the time, as positive footsteps. He foresaw problems though of power/control elevation rising in society and potential problems with unscrutinised people having unscrutinised power and control. He demonstrated this elevation process by illustrating a 'pyramid', the pinnacle being the top and the base being the foundation, obviously. However, he demonstrated that by increasing the foundation of the pyramid the pinnacle sinks down until it reaches a flatline but then continues descending on until one ends up with an 'inverted pyramid'. No one, or worse, still the wrong elements, ends up in control; mayhem ensues.
.
If one could classify the above with historical events, then perhaps the footsteps Macmillan observed could be analogous to knowledge and understanding. In that regard, the 19th-Century Toynbee Hall in the East End of London comes to mind; where the un-educated and poverty stricken men were given education in order to take charge of their lives. Education leading to capability and an ability to generate income and wealth, perhaps Toynbee Hall’s principles sprung from Adam Smith and Bentham-ism, who knows. However, Toynbee Hall was a success, and its education structure I believe was adopted by Hull House in Chicago, itself acted for the chrysalis for the Open University.
.
So the footsteps are a positive direction. But the flatlining of the pyramid suggests polarisation and, of course, the pyramid becoming too top heavy, eventually inverts. History remembers such an inverted pyramid event defined by Dr Carroll Quigley in his book Tragedy and Hope: A history of the World in our time. Quigley refers to the diamond and gold mine masters in South Africa, when Cecil Rhodes and Lord Milner despatched to find out what was happening out there, discovered the masters living in squalid conditions living in sheds with the servants living in and running the manors. Re-education was needed and the Kindergarten was born.
.
We live in an enlightened age today and see the lack of understanding and the lack of wisdom when divisions are created for the ‘haves and have not’, ‘us and them’, ‘master and slave’ and so on. However, putting all this is contrast with subsidiarity and Macmillan's vision of an inverted pyramid, does it suggest unscrutinised rules are being made up by people who have obtained unscrutinised privilege, but carry no responsibility for their unscrutinised actions. Maybe the vision of this Statesman, Macmillan, gave us a sagacious warning of what can happen if checks and measures are thrown out of the window.
.
Britain today maybe getting perilously close to flatlining as isolationism is projected in society; we find self-elected emperors around every corner. A broken, divided society is a broken nation. Britain has a brilliant heritage and glorious history, if in some parts difficult, but it deserves far better than to be broken; which can be the inevitable consequence of excessive streamlining of a system to regenerate a desired reordered society. That process introduces a Rhadamanthine approach in political and governance terms that is excessive in an attempt to portray an outcome suggested to be 'just' and 'necessary'.
.
So maybe perhaps if that was what was meant by subsidiarity isn't working then history has signposts to show us what can happen, and that we don’t have to make these mistakes. Of course, these are only observations and they could be wrong.

Tuesday, September 01, 2009

Cellphones Cause Brain Tumors

Cellphones Cause Brain Tumors, Says New Report By International EMF Collaborative

Photo courtesy of Radiation Research

Report available: http://www.radiationresearch.org/pdfs/15reasons.asp

For those who haven't seen the report named above announced on the 25 August 2009, it reports on a further international investigation into what impact the use of mobile phones may have on the human brain. I do not propose to make a judgmental article that argues the 'fores and againsts' as I think you need to make up your own.

You may agree with me that when highly skilled people come together to collaborate on research like this that we should at least allow for the opportunity to acquaint ourselves with what it is they are saying and see if we can learn how to reduce or remove any risks that might be.

Reading the report and placing the concepts in it relating to testing in confined spaces where numbers of mobile phones, awaiting examination or are being examined, are all switched ON and bursting at full power to the network to register, then that process and procedure needs to be looked at closely to see if there is any risks to health that could exist. As I understand it, talking with the report publisher today, brain tumours are less likely to show up within 10-15 years (which is approximately the life of GSM at present) as the cycle of a brain tumour may not be known for 25 years, and in other cases 40 years. I am not a medical expert, but I am listening to what is being said.

I mention the time periods because it has always been my argument that if there was a case to answer relating to mobile phones and Masts radiating everyone to death or causing health issues, surely the exposure to mobile phone usage spanning from 1985 (when UK TACS was introduced) to the present time with GSM surely that respresents some form of semi-empirical test result; meaning not all the issues have been considered in the fullest sense by qualified research, but common-sense applies. However, 25-40 years may mean there could be issues down the line to deal with that wont be known yet. So hopefully, to my professional mobile telephone colleagues, do not ignore this issue, be prepared to read without prejudice.

The full press release that was issued is below:

Cellphones Cause Brain Tumors, Says New Report By International EMF Collaborative

August 25, 2009
.

BERKELEY, CALIF. & SUTTON COLDFIELD, ENGLAND--(BUSINESS WIRE)-- A new report, "Cellphones and Brain Tumors:15 Reasons for Concern, Science, Spin and the Truth Behind Interphone," was released today by a collaborative of international EMF activists. Groups affiliated with the report include Powerwatch and the Radiation Research Trust in the U.K., and in the U.S., EMR Policy Institute, ElectromagenticHealth.org and The Peoples Initiative Foundation. Download the report.
.

The exposé discusses research on cellphones and brain tumors and concludes:
.

There is a risk of brain tumors from cellphone use;
Telecom funded studies underestimate the risk of brain tumors, and;
Children have larger risks than adults for brain tumors.

This report, sent to government leaders and media today, details eleven design flaws of the 13-country, Telecom-funded Interphone study. The Interphone study, begun in 1999, was intended to determine the risks of brain tumors, but its full publication has been held up for years. Components of this study published to date reveal what the authors call a ‘systemic-skew', greatly underestimating brain tumor risk.
.

The design flaws include categorizing subjects who used portable phones (which emit the same microwave radiation as cellphones,) as ‘unexposed'; exclusion of many types of brain tumors; exclusion of people who had died, or were too ill to be interviewed, as a consequence of their brain tumor; and exclusion of children and young adults, who are more vulnerable.
.

Lloyd Morgan, lead author and member of the Bioelectromagnetics Society says, "Exposure to cellphone radiation is the largest human health experiment ever undertaken, without informed consent, and has some 4 billion participants enrolled.Science has shown increased risk of brain tumors from use of cellphones, as well as increased risk of eye cancer, salivary gland tumors, testicular cancer, non-Hodgkin's lymphoma and leukemia. The public must be informed."
International scientists endorsing "Cellphones and Brain Tumors: 15 Reasons for Concern" include:

Ronald B. Herberman, MD, Director Emeritus, University of Pittsburgh Cancer Institute; David Carpenter, MD, Director, Institute for Health and the Environment, University at Albany; Martin Blank, PhD, Associate Professor of Physiology and Cellular Biophysics, Columbia University; Professor Yury Grigoriev, Chairman of Russian National Committee on Non-Ionizing Radiation Protection, and many others.

Monday, August 31, 2009

Forensic Focus Interviews

Forensic Focus Interviews

Forensic Focus regularly interviews well known personalities from the world of computer and mobile phone forensics.

This month it was my turn:

Mobile Telephone Expert Witness, 29/08/09

http://www.forensicfocus.com/greg-smith-interview-290809

Readers of trewmte.blogspot may also want to read the Interviews of past personalities, available at the link below:

http://www.forensicfocus.com/computer-forensics-interviews

Sean McLinden, Outcome Technology Associates, Inc. - 21/07/09
Graham Brown-Martin, Digital Safety Conference - 12/06/09
Lee Whitfield, Forensic 4cast - 10/06/09
Robert Botchek, President & Founder – Tableau, LLC - 09/06/09
Dr Chris Pamplin, Editor – UK Register of Expert Witnesses - 31/05/09
Ben Levitan, US Telecommunications Expert Witness - 08/05/09
Nick Furneaux, MD CSITech & Director, Bright Forensics - 07/05/09
Jan Collie, The Digital Detective - 24/04/09
Professor Tony Sammes, Cranfield University - 31/03/09
Simon Biles, Thinking Security - 27/11/08
Gene Spafford, CERIAS - 12/09/08
Paul Wright, City of London Police - 05/09/08
Jonathan Krause, Forensic Control - 27/08/08
Ian Kennedy, Forensic Consultant & Open University Lecturer - 14/07/08
Matt Shannon, Founder and Chief Software Architect F-Response - 19/06/08
David Sullivan, Appointments-UK - 28/04/08
Stefan Fleischmann, CEO X-Ways Software Technology AG - 27/02/08
John Patzakis, Guidance Software - 28/06/07
Harlan Carvey - 07/03/07

Wednesday, August 26, 2009

Cell Site Analysis (CSA) Images Part 2

Cell Site Analysis (CSA) Images Part 2
.

It may interest those reading the discussions that I post that Cell Site Analysis (CSA) results from terrain and clutter analysis and radio test measurements can be defined in many different ways that can demonstrate particular elements of importance to a case.
.

Image 5

.
First we need to model (Image 5) the landscape that represents the geographical area and natural and manmade phenomenon in the surrounding area. In this case the scene of crime is close to a crossroads in the middle of small urban town.
.
For the sake of comfort, juries rarely understand radio coverage that is verbally discussed but respond much better to discussion revolving around a visual aid presentation.
.

Image 6

.
In this particular case I want to show the jury that two microcells* were used and each microcell first needs to be defined (Image 6) to the jury so they have it clearly in their minds the origin and direction of the radio coverage that forms part of the discussion.
.
In the first posting below (Cell Site Analysis (CSA) Images) coverage maps were shown defining large cell/macrocell coverage. Here, it is possible to refine and finesse coverage to a specific area with microcell coverage. Importantly, it is a really good idea to make sure the first image the jury sees represents the first radio coverage that a particular mobile phone has used that you want to talk about.
.

Image 7

The second microcell coverage (Image 7) should also be defined and distinguished. It's always best to remember with microcell coverage radio path is shaped in the same way as the High Street. Microcells don't go around corners.

Image 8

Finally the culmination of the presentation defines how the coverage from both microcells blend (Image 8 ) at particular points along the radio path.
.
*Remember that mobile telephones need to be encouraged to use microcell coverage and the microcell location, coverage boundary, speed at which a mobile phone is moving and cell reselection cause system challenges that required the use of a new criterion that was introduced into the GSM Phase 2 Standards in 1996. Do you know what that criterion is called and how it works?
.

Lastly, having mentioned microcell and large cell, the image below (Image 9) represents a visual indication about very important technical aspects concerning radio coverage and the layers depicted are often referred to in evidence. Indeed, if you care to read some of the Mobile Telephone Case Law you can find Appeal Courts referring to the importance of comprehending how far coverage extends.
.

Image 9

More on Cell Site Analysis: http://cellsiteanalysis.blogspot.com

Tuesday, August 25, 2009

Cellphone starts Gas Stove

Cellphone starts Gas Stove

The New York Times has just published a great news story 21st August 2009 titled 'Hello, Oven? It’s Phone. Now Let’s Get Cooking!' Apparently, a New Yorker's cellphone keeps switching on the Gas Stove with worrying consequences. Updated the link below.

http://www.nytimes.com/2009/08/23/nyregion/23about.html?_r=1&scp=1&sq=cellphone%20starts%20Gas%20Stove&st=cse #

From a technical point of view, Radio and EMI folks will love this story.

UPDATED COMMENTS:

Naturally reading news articles like these, this one is reported in the respected New York Times, they are still often taken with a certain amount of scepticism and caution. The implication of this could be huge, not for sensations sake, but it opens up the doors to those who already have concerns about radio signal saturation.

There are, to put it conservatively, many many millions of mobile phones used everyday around the World. In the UK with a burgeoning population creaking up to 61-million, mobile phone numbers still out-number the population at minimum 2:1. And to create 1-billion texts a month (that's without voice calls/data calls) in UK networks, clearly lots of mobile phones are switched ON and in use.

The underlying concern with this story is that which device will be found to be the culprit (if at all):

- will it be the handset generating spurious emissions causing interference at a particular n-Hz level to unprotected circuitry

- will it be the electronic circuitry on the Gas Stove having poor EMC (electro-magntic compatibility) protection allowing conducted interference

- will it be both

It is not clear what will be the outcome of this matter, it may just fizzle out, but if not then this little story could have an impact on the World than even the "radiating us to death" protestors have hitherto made.

The implications could be wide spread, should the findings unearth the conclusion of random occurences of this type of event, because it opens the door to many other possibilities with possible horrible consequences:

- Scenario 1: My house burnt down because the mobile phone ignited the oven/stove without my knowledge

- Scenario 2: There was no trace of an accelerant, save to say, we found an appliance that had started the fire and we cannot rule out that it wasn't a mobile telephone that caused the appliance to ignite it

- Scenario 3: Two bodies were found in a house with no traces of attack or arson, the authorities are puzzled

So the potential for the unforeseen disaster perhaps shouldn't be ruled out, at this stage, but it would be useful to have the exact findings and conclusions published.

In the meantime I wont be having my mobile telephone left switched ON in MY trouser pocket.

Cell Site Analysis (CSA) Images

Cell Site Analysis (CSA) Images
.
Cell Site Analysis (CSA) has had a good deal of airing recently here on the forum, so I thought you might like to see images from the work that I get involved.
.

Image 1

.
Image 1 is one slide from the training course material to introduce students to CSA when starting out discussing radio test measurements. It should be noted that this image represents less than 1% of all data acquired during radio test measurements.
.

Image 2

I thought it would be useful to include this Terrain and Clutter Map (Image 2) as I use this software to assist me in complex cases. Terrain and Clutter are discussed during training and as it was a topic of the discussion about UK Criminal Evidence Delays I thought it would be helpful to let forum members see that I am not referring to theoretical matters, terrain and clutter analysis actually takes place.

UK Criminal Evidence Delays: http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=3961

Image 3

It is essential to understand, when conducting radio test measurements, that just because radio signals can travel some distance from a particular Mast (Image 3) that coverage should not be dismissed or excluded. Operators set threshold limits, hard limits and boundary limits. It does not follow that just because a mobile is in the Green area shown in the Single Cell Prediction Map that the mobile will be excluded from using that coverage.

Do you remember the discussion that I put up here about fringe coverage?: http://trewmte.blogspot.com/2008/11/mobile-phones-and-fringe-coverage.html
.

Image 4

Best serving coverage is often posed as the deal-clincher to suggest the mobile phone was most likely or consistent with being at a particular location. There can be numerous points that could (and I say 'could' advisedly) point to best server coverage being used but rarely does it come up in evidence because the radio content in evidence rarely gets disclosed these days.

It is possible with best serving coverage that it can induce a negative outcome that may prevent calls taking place, so it is always important to see the other side of the coin, so to speak:
.
- http://trewmte.blogspot.com/2007/02/gsm-radio-test-measurements-non.html
- http://trewmte.blogspot.com/2007/01/gsm-radio-test-measurements.html
.

I hope the above provides a further illustration of how smart and intelligent a science Cell Site Analysis really is and that by not applying it properly and dumbing down this art of this forensic science:

- is not only a great loss to the law of evidence

- it reduces the examiner's/expert's knowledge and understanding about the subject with which they are dealing - mobile telephone evidence.

More on Cell Site Analysis: http://cellsiteanalysis.blogspot.com

Thursday, August 20, 2009

Is section 133 Criminal Justice Act 2003 flawed?

Is section 133 Criminal Justice Act 2003 flawed?

The great cases of the 60s, 70s , 80s and 90s saw in the introduction of good quality case law involving audio, computers and mobile telephone evidence. Cases such as R .v. Maqsud Ali (nothing lost in translation), R .v. Mahon (handling evidence), R .v. Robson (genuineness and orginality) etc, many cases included evidence that required authentication and many made reference to s27 Criminal Justice Act 1988 regarding documents containing statements served in evidence requiring to be identified from a source that is/was original, part of an original, or copy of an original no matter how many times removed.

http://www.opsi.gov.uk/ACTS/acts1988/ukpga_19880033_en_4#pt2-l1g27
27 Proof of statements contained in documents

Where a statement contained in a document is admissible as evidence in criminal proceedings, it may be proved—

(a) by the production of that document; or

(b) (whether or not that document is still in existence) by the production of a copy of that document, or of the material part of it, authenticated in such manner as the court may approve;

and it is immaterial for the purposes of this subsection how many removes there are between a copy and the original.
.

Highlighted, in the text above, are all those passages in s27 that have either changed or have been removed from s133 in the 2003 Act, which appears below.

.
http://www.opsi.gov.uk/acts/acts2003/ukpga_20030044_en_13#pt11-ch2-pb5-l1g133
133 Proof of statements in documents

Where a statement in a document is admissible as evidence in criminal proceedings, the statement may be proved by producing either—

(a) the document, or

(b) (whether or not the document exists) a copy of the document or of the material part of it, authenticated in whatever way the court may approve.

When reading section 133 CJA 2003 where is states in parenthesis "(whether or not the document exists)" expands the horizons to import much more into its meaning than its predecessor might under s27 CJA 1988 "(whether or not that document is still in existence)" as s133 might suggest that the document or a statement in it may not have needed to exist in the first place.

Thus, in the case of s133 it might open the possibility to make admissible a false or erroneous document created for a specific a purpose and to suggest the original was no longer available, whereas s27 at least required confirmation that there was an original in the first place that could at least be authenticated in such a manner that such a document did exist in the first place.

I am not a lawyer and do not hold out to be one, but I have raised this to a few lawyers who all seem to gather the point I am making and have not rejected outright my comments as folly. It does seem to me, at any rate, if ignorance of the law is no defence, then surely ambiguity is not a defence or a replacement for clarity either; but I could be wrong.

Mobile Telephone Case Law

Mobile Telephone Case Law

As you know for Judges, Lawyers, Practitioners, Experts, Law Enforcement and Students the webblog was set up for educational discussion points about mobile telephone forensics and evidence. Whilst visitors to this webblog liked the format and knowledge and experience being imparted, and want this to continue, due to the many posts I have put up since 2006 led to requests for having more discussion on these topics. To that end a discussion forum was set up relating to Mobile Forensics over at Jamie Morris' Forensic Focus Forum here:

http://www.forensicfocus.com/mobile-forensics-forum
.

Arising from the success of that we have now begun the extension of that fourm by introducing specialist sub-forums: the first sub-forum identifies case law that involves mobile telephone evidence to aid comprehension as to what principles are being argued at law regarding this subject matter; to learn about errors with evidence; to increase knowledge and act as an aid to improving skillsets.

Mobile Telephone Case Law

http://www.forensicfocus.com/index.php?name=Forums&file=viewforum&f=18
.
Below are a list of cases that have been posted to start this new specialist area sub-forum:

Mobile Phone Calls - Usage: Gun Crime Case

http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=4393
.
Cell Site Analysis (CSA) Case

http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=4383
.

Call Records, Cell Site Analysis & Omagh Bombing

http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=4398
.
Silence on Cell Site usage not a good idea

http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=4399
.
Civil Case about mobile phone functionality infringement

http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=4400

Movement, Collocation and Cell Site Analysis

http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=4405
.

Cell Site Analysis not available for Trial

http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=4406
.

Why wasn't Cell Site Analysis used?

http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=4407

I shall continue to add to the list of cases above.

Interception case

http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&p=6531862#6531862

Conspiracy, mobile calls and text messages

http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=4410

Article: Courts wary of cellphone forensics

http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=4412

Thumbnail downloads, Mobile Phones and Google

http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=4497

US Cell Site Analysis cases

http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=4498

US Case: CSA, ESN/MIN and Cloning Equipment

http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=4499

Deleted data may not amount to possession

http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=4501

US Case: Electronic Wireless Vehicle Monitoring

http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=4502

US Case: Email interception defined

http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=4503

RIPA, Emails and Interception

http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=4504

Mobile Phone Forensic Examination

Greg Smith has over 30 years (1985 to 2016) experience in handling digital and mobile telephone evidence in criminal and civil investigations and providing services to blue-chip clients in the UK. Our unit the DEEU conducts acquisition and harvesting of data from:

SIM/USIM/MMC Cards
Mobile/Smart Phones/Tablets
Satellite/WiFi
Computer Forensics/network

Forensically recovering saved and deleted data using a range of hardware and software tools to obtain or image physical data or download logical data.

Cell Site Analysis investigations and evidence since 1988.

Contact:
The DEEU
Email: trewmte@gmail.com