Tracing Packet Switch (PS) Users

Investigations into mobile activity tend largely to concentrate on recovering data from the user handset, mast (tower) data and call records. The core network (CN) is less well understood and therefore picking through a GSM/3GPP standard can often assist in understanding the identity and form of tarried/empheral data surviving in a network. The standard to be used for this discussion is:

3GPP TS 25.413 V12.0.0 (2013-12)
3rd Generation Partnership Project;
Technical Specification Group Radio Access Network;
UTRAN Iu interface
Radio Access Network Application Part (RANAP) signalling
(Release 12)

Now with an investigation underway initial enquiries lead to an active smartphone user operating in the pack switched (PS) domain. The target under surveillance requires the investigator to combine visual logs and the use of the of the handset. Unlike CS, packet data communications requires a range of information BUT for the purposes of the current investigation understanding the services being used and the geographical area where services are being obtained the trainee investigator can start with understanding what can be learned from:

Cell ID - Cell Identity
C-ID - Common Identity
IMEI - International Mobile Equipment Identity

IMSI - International Mobile Subscriber Identity

IPAddress - Internet Protocol Address

SAI - Service Area Identifier

SAP - Service Access Point

LAI  - Location Area Identifier

RNC - Radio Network Controller

RNS  - Radio Network Subsystem

Some examples of trainee investigation elements for consideration:

Para 8.16.1

The purpose of the Common ID procedure is to inform the RNC about the permanent NAS UE Identity (i.e. IMSI) of a user. This is used by the RNC e.g. to create a reference between the permanent NAS UE identity of the user and the RRC connection of that user for UTRAN paging co-ordination. The procedure may also be used to provide the SNA Access Information IE to the RNC or to provide the Management Based MDT Allowed IE to the RNC or to provide the Management Based MDT PLMN List IE to the RNC.

Para 8.17.2

If Trace Collection Entity IP Address IE is included and if the MDT Configuration IE is also included then the RNC shall, if supported, store the Trace Collection Entity IP address and use it when transferring Trace records, otherwise if MDT Configuration IE is not included, the RNC may use the Trace Collection Entity IP address when transferring trace records.

Para 8.35.2
When the transferred information in the Information Transfer Type IE relates to a Trace Session in the RNC, the Trace Activation Indicator IE indicates whether the Trace Session identified by the Trace Reference IE is activated or deactivated in the RNC. In case the Trace Session is activated, the Equipments To Be Traced IE gives the Equipment Identity of the UEs that the RNC has to trace. If the Trace Recording Session Reference IE, Trace Collection Entity IP Address IE, the IMSI IE and optionally the Serving Cell Identifier IE are included in the message, the CN shall take the information into account for anonymization of MDT data (TS 32.422 [10]).
 
The purpose of this brief discussion is to illustrate mobile networks naturally hold surviving data in the network for a range of reasons to enable the network to a have uniformed approach for the objective of operational performance, enquiry and, equally, to trace user terminals and roaming user terminals active in or obtaining services from a network.

Mini Course in Cell Site Identification (Pt3.s2)

Mini Course in Cell Site Identification (Pt3.s2)

Links to previous discussions in these Mini Course modules:

Mini Course in Cell Site Identification (Pt3.s1)
http://www.trewmte.blogspot.co.uk/2012/01/mini-course-in-cell-site-identification.html

Mini Course in Cell Site Identification (Pt2)
http://trewmte.blogspot.com/2011/12/mini-course-in-cell-site-identification_31.html

Mini Course in Cell Site Identification (Pt1)
http://trewmte.blogspot.com/2011/12/mini-course-in-cell-site-identification.html

In this module the discussion follows on, for section 3.2, identifying further locations where research material maybe obtained to assist cell site identitifcation (CSI). Previously in Pt3 s1 the observations identified where information can be obtained from a local authority or council planning department. The 'reality' of such information being existence and available to any enquiror occurs due to statutory provisions and public employees employed to provide such information and provide such identification that is accessible because of the charges made within national and local taxes. Presumably this might be the same situation in other countries.

Regulator
In the UK we have the 'communications' (previously known as the 'telecommunications') regulator called OFCOM (Office of Communications). It is the duty, accordng to EU directive, UK statute and regulation that the regulator provides accessible information that is current and up-to-date. One of the tools that an examiner will use is OFCOM's sitefinder service. There is a caveat to the information available from this service, which states (http://www.sitefinder.ofcom.org.uk/):

"Sitefinder was set up as a result of recommendations of the Stewart Report in 2000. It is a voluntary scheme under which mobile network operators make information available on the location and operating characteristics of individual base stations, so that people who wish to inform themselves about this can do so.

"Ofcom hosts the Sitefinder tool on behalf of Government, which can be searched for the location and details of mobile phone base station sites around specific locations. The data within Sitefinder is owned by the mobile network operators, who supply it on a voluntary basis. A request made under the Freedom of Information Act 2000, for Ofcom to make available the information contained within Sitefinder, is subject to an ongoing legal process. Meanwhile, the mobile network operators (except Everything Everywhere) continue to provide voluntary updates which are made every 3 months or so.

The Sitefinder tool therefore remains available and reasonably current (except for Everything Everywhere sites); meanwhile Ofcom will not release the underlying database pending the outcome of the legal process.

Ofcom cannot accept liability for any inaccuracies or omissions in the data provided within Sitefinder, or its currency."

The OFCOM service does provide useful information about cell sites and an examiner would be quite foolish to ignore it, but as equally foolish to believe this is the only source of information, independent from actual enquiries to the mobile network operator and so on.  By way of illustration, I was able to show that information from the local council identified that historcially a base station (cell site) had moved from its original installation (relevant to a particular investigation), which was not revealed by using the OFCOM service. This revelation is further support for an examiner being not only being aware but, equally, being astute.

Examples of the discovery process from the OFCOM sitefinder website is a glimpse at the density of cell sites in a given area:

The relevance of  density of cell site was discussed here -  http://trewmte.blogspot.co.uk/2008/06/gsm-mast-installations-density.html

Moreover, the sitefinder site also provdes details that have been registered by an operator about a particular mast:

Mobile Network Operator
However, the discovery process doesn't stop there but additionally investigation to a particular mobile network operator's website and searching for coverage in a particular geographical area is as equally important to have performed that task. For this reason I have for quite sometime provided links to UK mobile network operators' websites so that examiners can make investigative searches of a particular operator's site regarding coverage relevant for a particular geographical area.

International Marketplace
It is also relevant to be aware that mobile communications also includes 'Roaming' calls and discovery in other countries. The narrative in the aforementioned would largely be wasted without some reference sources and below I have listed a few website in order to bring an international understanding to this discussion:

US cell sites
http://www.cellreception.com/

Austria
http://www.senderkataster.at/

France
http://www.cartoradio.fr/netenmap.php?cmd=zoomfull

Malta
https://www.mca.org.mt

Netherlands
http://www.antennebureau.nl/

Sweden PTT
http://www.pts.se/en-gb/Radio/

GSMA Roaming and Coverage Maps
And for coverage aspects relevant to roaming an examiner can also visit the GSMA website to see what can be revealed about cell site identification and its coverage before conducting site surveys etc:

http://maps.mobileworldlive.com/

In this module it hasn't provided the definitive elements cell site identification (CSI), but it does provide observations for examiners to explore the options about details about a cell site (Mast) and also coverage from it. This may also reveal where the latter can provide important material, such as to define aspects about coverage, which may not have been revealed in documents / information presented by the other side.

As a refresher, readers of this mini course in cell site identification may recall at the very off I set out factors that impact on propagation from a mast and an interpretation of the possible function and responsibility of a mast and thus the natural and obligatory requirement for an exmainer to discover as much about the cell site (mast) as possible. The relevant parts produced thus far have intended to show that even before the examiner peruses call records / mast details obtained for a particular case, the examiner cannot simply take those details on face value and must make strenuous effects to understand that cell site identification is not merely about a cell ID, LAC, postocde, NGR, etc but additionally information about defined coverage that should assist the examiner prepare for site surveys etc. Furthermore, to assess the information provided by the other side to identify or isolate omissions in it/them which, once revealed, may provide an entirely different fact or influence about the evidence the other side had failed to present.

Checking Masts - CSA 2

Checking Masts - CSA 2

.

In response to the discussion at Checking Masts - CSA, a couple of questions that I have been asked:

.

- Do you, yourself perform Cell Site Analysis/Surveys for cases?

.

- If so what equipment do you use for this very interesting task??

.

Answer:

Yes I do and have been doing so since the early 90s for GSM and since 2006 for 3G.

.
I use Nokia network monitor for 2G and have used, but do not particularly like, some of these newer independent flash files that enable some smartphones to obtain 3G network control data. I do continue to use them as one tool but for fairness reasons in dealing with the radio evidence. The reason for that is there are no:

.

1) forensic standards for the calibration of test equipment generating evidence

2) forensic standards for the content or quantity of radio data captured for evidence

3) forensic requirements for user mobile phones to be calibrated

4) standards that requires a mobile phone after it has left the manufacturing production line to maintain its radio mask calibration longer than 12-months.

.

For example, dealing with point 4) most mobiles in use do not precisely meet calibration standards, but largely their radio mask is towards the upper or lower limits due to the way in which mobile phones are treated by their users: dropped, fall in water, exposed to fag ash, drink splatter, overcharging, over heating, running the battery flat during calls etc etc. All these things and more take there toll on mobile phone operation over time and it is not surprising to find that calibrated radio engineer test equipment often produce a better RxLv sensitivity. For instance, if one puts a used mobile phone side by side with a radio engineers test rig they both record 'absolute' measurments, obviously, but the disparity between 'relative' measurements can be surprising.

.

For radio engineer test rig I use Anite's Nemo Handy. Also I have secured in evidence the requirement for the readings and the electronic files that contain the readings and the screen prints to be served in evidence because:

.

a) they are original evidence

b) it exposes not just preservation of evidence but the processes which brought the evidence about

c) it means the prosecution can meet the Golden Rule without being fed spurious argument of why things can't be done

d) it stops outsourcer firms holding back on evidence or unilaterally deciding that they control what our courts and criminal justice system can or cannot see

e) whilst I used Anite's Nemo Handy .dt1 file for the criminal case in which I was advising, the requirement is not limited to simply radio test measurements from Nemo Handy but all other radio test equipment etc and equally applies to handset and U/SIM card evidence.

.

The additional benefit this offers is that where the police want to save money extracting and harvesting data that is subsequently produced in reports and want to cut down on unessential data, this means they can still produce reports with only the content they want to show. The full copy of data are still obtained by the examiner and this means the defence, having a copy of the full data in electronic format, can examine all the other data to see whether any vital evidence for the defendant's case has been overlooked or not.

.

Moreover, the defence can still examine the exhibit as the prosecution will have already produced their evidence. This will allow for variations in evidential standard or interpretation to be checked and exposed, if any, in order to maintain the principle 'nothing lost in translation.'

.

This can also work on other levels as well. Such as, we know the Forensic Regulator is due to launch soon and the public sector are rushing around to create and approve their own standards. However, the independent sector has not had the opportunity to qualify whether the public sector standards are better than the standards in the independent sector. The work I have been doing is to highlight issues and attitudes to mobile phone evidence and to let the courts know there is evidence the courts can have. If the Regulator accepts procedures created by the public sector it should not bar the independent sector procedures being accepted also.

.

If the independent sector were automatically disbarred from having their own procedures accepted it could potentially lead to following public sector standards containing systemic failure being promulgated throughout the country. Not only that but the knock-on can directly affect small business by placing heavy regulation and financial demands upon small business, causing collapse and unemployment in MPs constituencies. Apart from which there may be the issues associated with breach of human rights under the Human Rights Act and the European Convention on Human Rights.

.

Apologies for the length of commentary. It was necessary to go along this discussion path because it is important to promote standards and to highlight choices available to people interested in mobile telephone evidence and identify what is possible by knocking over artificially generated psychological boundaries. I would hope to get the message into evidence in the London area, but my instructions come from outside of London these days and London appears to be a bit of a no-go zone.

.

If you want to start a new topic, ask a question or join the discussion on ny previous postings then please join in a Forensic Focus Mobile Forensic Discussion Forum.

CHECKING MASTS - CSA

CHECKING MASTS - CSA

.
I have had several discussions with people who are new to mobile telephone evidence and have asked me to provide further discussion on matters concerning Checking Masts. Also from police sections asking me to open up the discussion as to what might happen when Mast checks are not made and how that might impact on a criminal case. Whilst the criminal case discussion is hypothetical, some events happening in the discussion are factual and drawn from a number of criminal cases.
.
The necessity to check with a mobile network operator regarding details of a particular Mast (Cell Site) and the bearing of coverage (azimuth) from it, for a particular Cell ID, at the material time to see whether it has changed prior to conducting cell site analysis is a useful rule to follow. There are, of course, many other matters that need to be checked also, but I have simplified the issues for the purposes of this discussion.
.
The details of Mast changes are recorded by Operators and recorded in their databases. Single Point of Contact (SPOC) is not prevented from asking about Checking Mast details and obtaining the relevant information. However, as a SPOC doesn’t decide what evidence should or shouldn’t be required for a criminal investigation, the SPOC should be asked to obtain this information.
.
The Masts
Below is an image (a) which displays a Mast's radio coverage for a particular Cell ID illuminating in a westerly direction towards a block of flats.

Image (a)

.
The next image (b) below displays the same Mast (as above) relating to radio coverage with its associated Cell ID but this time the radio coverage is illuminating in an easterly direction, in the opposite direction towards a house.

Image (b)
.

For the purposes of this discussion the Mast is shown close to the properties in both images. This was done for artistic purposes and is not intended to mean the Mast is actually that close to both properties. Also an actual Cell ID has not been shown but the inference about Cell ID being relevant is inferred by the presence of radio coverage being displayed.

.

Criminal Case
Imagine if you will that on a particular date, let us say the 30th March 2008, a dead body is found in the house, shown in image (b). The police have been alerted to the property by a neighbour because of a dreadful smell emanating from the direction of the house. Upon entering the property the police find a decomposing body of a woman on the floor. The Pathologist is called and indicates, following assessment of the decomposing body, that the body had been dead for approximately two weeks. That would generate a time line back to Tuesday 16th March 2008.

.

The police conduct door-to-door enquiries and one neighbour next door but one mentions that two weeks ago as she passed the house there was shouting emanating from inside the property and cries for help. The neighbour thought nothing more of it because the couple that lived there had regular arguments, which the neighbours and passers-by could overhear.

.
The police asked the neighbours had they noticed anything else? One lady who lived a few doors away replied that she looked out of her window and that she had seen the man that lived there leave the property at about 8.30pm, and that would have been a Tuesday, and funnily enough that was about two weeks ago.

.

To cut a long story short, the police found the man who lived in the house a month later, seized his mobile telephone and having retrieved his mobile telephone subscriber details, obtained call records and identified the Masts that routed mobile calls to and from his mobile phone. From the records it was noted that two weeks before the body was found his mobile had used a Mast for a call (on Tuesday at 8.00pm), the Mast was sited 2.4Km away from where he lived with his partner. This was also the nearest Mast to the house.

.

The police called for radio test measurements to be conducted outside the house three weeks later. The time-span from the estimated time of death to radio testing was approximately 9 weeks. The radio tests confirmed that the Cell ID recorded in the call records is the same as detected outside the house.

.

The man, during questioning, confirmed he had not been back to the house since leaving on the Saturday. That being the Saturday prior to the Tuesday when it is approximated the death took place. He had also been living in a Bedsit because the relationship with his partner had irrevocably broken down and they had agreed to split and go their separate ways.
.
The police believed from the evidence that they had thus far that it was enough to hold the man, now a suspect, and the death case turned into a murder case. The evidence they relied upon was:

.

1) The neighbours hearing regular arguments and cries for help on the fateful day
2) The neighbour that says she saw the suspect leaving the house at 8.30pm
3) The call records that shows a call on the Tuesday from the suspect's mobile telephone using a Cell ID from a Mast that is sited 2.4Km away and is the nearest Mast to the house
4) The radio test measurements that show the Mast’s coverage, thus Cell ID, used by the suspect's mobile phone illuminated outside the house.

.

So at minimum there appears to be four good pillars of evidence. However, when the radio test measurements were conducted no checks had been made with the mobile operator whether any changes had been made to the Masts in the area prior to radio test measurements being conducted. It subsequently came to light at trial that the Cell ID illuminating towards the house (image (b)) had only been illuminating eastwards towards the house from Thursday 18th March 2008 after the alleged murder due to changes at the Mast. Prior to that date the Mast had been illuminating westwards, towards a block of flats (image (a)).

.

Impact on Criminal Case
So when the police had noted from the suspect's call records that over the last few months they showed the suspect's mobile phone using a particular Cell ID for mobile calls that the police thought could be made or received from the house, they were mislead and operated under a false assumption. The suspect had, in fact, been having an affair with a married woman in the block of flats (image (a)) and didn't want to say anything for fear of reprisals from the woman’s husband who was known to have a temper and may take it out on the woman if she was called as a witness. It was this affair that the victim, when she was alive, and been tipped off about some months earlier and the cause of the couple constantly arguing.

.

The lack of discovery about any changes to a particular Mast prior to conducting radio test measurements impacted on the case by:

.
- the test results, that should add value to a case, were inaccurate and unhelpful- introduced delays into an investigation as the test results steered the police investigation in the wrong direction
- operational man-hours increased
- operational costs increased
- worst still, a false allegation of murder was made against an innocent person

.

As to the other pillars of evidence: 3) and 4) were no longer valid and the woman with whom the suspect was having an affair corroborated the dates and times she was with the suspect. As to 1) and 2)? On the fateful day, 1) the argument that was heard by a neighbour turned out to be the victim's ex-boyfriend from a previous relationship whom she had given evidence against him for drug dealing, some 5 years earlier, and who had been released from prison 20 days before the murder. He had vowed to seek revenge against the victim. 2) The neighbour who saw the suspect at 8.30pm at night in fact saw a silhouette of the man she thought was the suspect because it was 8.30pm at night and her eyesight wasn't as good at night. The silhouette leaving the house was the ex-boyfriend leaving after having murdered his ex-girlfriend.

.

Further Observations

In consequence, by not checking with the operator about their Masts prior to conducting radio test measurement caused lost investigation time to find the real culprit, unnecessary redundant evidence, increased costs, investigation time increased exponentially, apart from wrongly accusing a person. Moreover, as checking the Masts is a well known procedure, not to have checked it during an investigation may amount to act of intent to plant evidence to create incrimination against someone by using an act of deliberate omission during an investigation.

.

This is only a hypothetical discussion, but if these acts were operated in reality on a regular basis in criminal cases and applied as policy in widespread use across England, it may potentially lead to £20 millions in retrials. Of course that shouldn’t be possible arising from the 'Golden Rule' of disclosure, enunciated by Lord Bingham in R -v- C & H (February 2004), when he said that ‘fairness requires that full disclosure should be made of all material held by the prosecution that weakens its case or strengthens that of the defence’. The test is an objective one and is grounded on what is ‘reasonable’. However, the guidance makes it plain that an expert witness is no longer to be trusted to exercise his or her own judgment in deciding what falls within this definition and what is and is not relevant.

.

It is the influence of the Golden Rule placing affirmative duties on the prosecution from 2004 onwards that safeguards the reliability of evidence in criminal cases. That suggests were Her Majesty's Inspectorate called upon to require the prosecution tomorrow to provide, from randomly selected 200 cases from across the country by the Inspectorate, documents of enquiry to a particular operator seeking to be notified of any changes to a particular Mast in a particular case and the documented response received from the operator, they could do so.

.

That doesn't mean to say if the prosecution mobile telephone case has 50 Masts used for calls that documentation for each of the 50 Masts would be necessary, as rarely are all Masts relevant to an alleged crime, anyway, and a large proportion being used for padding simply to show movement. The relevant Masts are those where the Masts and coverage can illustrate that the mobile telephone or telephones could potentially be at the scene of crime, which on the whole usually relates to the last three to six Masts nearest the scene of crime. Besides I couldn't see the prosecution being hoodwinked into believing that because there are 50 Masts in a case that the number amounted to far too many enquiries to be made to the operator and so didn't make any enquiries at all.

.

As I have mentioned above this is purely hypothetical, but hopefully it illustrates the importance of Checking Masts before conducting radio test measurements.

.

Location Area Codes (LAC)

Location Area Codes (LAC)

The desire to create databases containing MCC/MNC/LAC/CellID may seem a good idea but might produce inaccurate or erroenous results depending upon the way in which the information is used. It is known that LACs (and CellIDs for that matter) change and therefore a database becomes out of data fairly quickly.

LACs change for various reasons. Commonly LAC Dimensioning can be implemented due to heavy paging load or many LACs under one BSC causing frequent Location Updates are just two examples. The outcome of Dimensioning can require reprogramming BSC (GSM) / RNC(WCDMA) for each cell. Moreover, reprogramming at the MSC. On some occasions re-parenting at the MSC maybe required that requires re-programming LACs. Cell shapes, size and traffic capacity can change from the material time.

Unlike MCCs and MNCs, LACs are not published. LAC identifiers can by assigned by the network operator. It is essential as with all broadcast data to understand what the data mean and the data relevance to mobile telephone evidence.

Location Area Code (LAC) which is a fixed length code (of 2 octets) identifying a location area within a GSM PLMN. This part of the location area identification can be coded using a full hexadecimal representation except for the following reserved hexadecimal values:

0000, and FFFE

These reserved values are used in some special cases when no valid LAI exists in the MS.

The Location Area Identification is a type 3 information element with 6 octets length.
....8......7......6......5......4......3......2......1....
+-----------------------------------------------+
│ ...Location Area Identification IEI..│ octet 1
+-----------------------------------------------│
│ ....MCC digit 2 │ MCC digit 1..... │ octet 2
+-----------------------+-----------------------│
│ .....MNC digit 3 │ MCC digit 3.....│ octet 3
+-----------------------+-----------------------│
│ ...MNC digit 2 │ MNC digit 1...│ octet 4
+-----------------------------------------------│
│ .......................LAC......................│ octet 5
+-----------------------------------------------│
│ ............LAC (continued)............│ octet 6
+-----------------------------------------------+
Figure 10.5.3: Location Area Identification information element


Table 10.5.3: Location Area Identification information element
+----------------------------------------------------------------------+
MCC, Mobile country code (octet 2 and 3)
The MCC field is coded as in CCITT Rec. E212, Annex A.

If the LAI is deleted the MCC and MNC shall take the
value from the deleted LAI.

In abnormal cases, the MCC stored in the mobile
station can contain elements not in the set
{0, 1 ... 9}. In such cases the mobile station should
transmit the stored values using full hexadecimal
encoding. When receiving such an MCC, the network
shall treat the LAI as deleted.

MNC, Mobile network code (octet 3 bits 5 to 8, octet 4)
The coding of this field is the responsibility of each
administration but BCD coding shall be used. The MNC
shall consist of 2 or 3 digits. For PCS 1900 for NA, Federal
regulation mandates that a 3-digit MNC shall be used.
However a network operator may decide to use only two
digits in the MNC in the LAI over the radio interface. In this
case, bits 5 to 8 of octet 3 shall be coded as "1111".
Mobile equipment shall accept LAI coded in such a way.

Note 1: In earlier versions of this protocol, the possibility to use a one digit MNC in LAI was provided on the radio interface. However as this was not used this possibility has been deleted.

Note 2: In earlier versions of this protocol, bits 5 to 8 of octet 3 were coded as "1111". Mobile equipment compliant with these earlier versions of the protocol may be unable to understand the 3-digit MNC format of the LAI, and therefore unable to register on a network broadcasting the LAI in this format.

In abnormal cases, the MNC stored in the mobile
station can have
- digit 1 or 2 not in the set {0, 1 ... 9}, or
- digit 3 not in the set {0, 1 ...9, F} hex.
In such cases the mobile station
shall transmit the stored values using full hexadecimal
encoding. When receiving such an MNC, the
network shall treat the LAI as deleted.

The same handling shall apply for the network, if a
3-digit MNC is sent by the mobile station to a network using
only a 2-digit MNC.

LAC, Location area code (octet 5 and 6)
In the LAC field bit 8 of octet 5 is the most
significant bit and bit 1 of octet 6 the least
significant bit.

The coding of the location area code is the
responsibility of each administration except that
two values are used to mark the LAC, and hence the
LAI, as deleted. Coding using full hexadecimal
representation may be used. The location area code
consists of 2 octets.

If a LAI has to be deleted then all bits of the
location area code shall be set to one with the
exception of the least significant bit which shall be
set to zero. If a SIM is inserted in a Mobile Equipment
with the location area code containing all zeros, then
the Mobile Equipment shall recognise this LAC as part
of a deleted LAI
+-----------------------------------------------------+

More on Cell Site Analysis: http://cellsiteanalysis.blogspot.com

Location Area Codes (LAC)

Location Area Codes (LAC)

The desire to create databases containing MCC/MNC/LAC/CellID may seem a good idea but might produce inaccurate or erroenous results depending upon the way in which the information is used. It is known that LACs (and CellIDs for that matter) change and therefore a database becomes out of data fairly quickly.

LACs change for various reasons. Commonly LAC Dimensioning can be implemented due to heavy paging load or many LACs under one BSC causing frequent Location Updates are just two examples. The outcome of Dimensioning can require reprogramming BSC (GSM) / RNC(WCDMA) for each cell. Moreover, reprogramming at the MSC. On some occasions re-parenting at the MSC maybe required that requires re-programming LACs. Cell shapes, size and traffic capacity can change from the material time.

Unlike MCCs and MNCs, LACs are not published. LAC identifiers can by assigned by the network operator. It is essential as with all broadcast data to understand what the data mean and the data relevance to mobile telephone evidence.

Location Area Code (LAC) which is a fixed length code (of 2 octets) identifying a location area within a GSM PLMN. This part of the location area identification can be coded using a full hexadecimal representation except for the following reserved hexadecimal values:

0000, and FFFE

These reserved values are used in some special cases when no valid LAI exists in the MS.

The Location Area Identification is a type 3 information element with 6 octets length.
....8......7......6......5......4......3......2......1....
+-----------------------------------------------+
│ ...Location Area Identification IEI..│ octet 1
+-----------------------------------------------│
│ ....MCC digit 2 │ MCC digit 1..... │ octet 2
+-----------------------+-----------------------│
│ .....MNC digit 3 │ MCC digit 3.....│ octet 3
+-----------------------+-----------------------│
│ ...MNC digit 2 │ MNC digit 1...│ octet 4
+-----------------------------------------------│
│ .......................LAC......................│ octet 5
+-----------------------------------------------│
│ ............LAC (continued)............│ octet 6
+-----------------------------------------------+
Figure 10.5.3: Location Area Identification information element


Table 10.5.3: Location Area Identification information element
+----------------------------------------------------------------------+
MCC, Mobile country code (octet 2 and 3)
The MCC field is coded as in CCITT Rec. E212, Annex A.

If the LAI is deleted the MCC and MNC shall take the
value from the deleted LAI.

In abnormal cases, the MCC stored in the mobile
station can contain elements not in the set
{0, 1 ... 9}. In such cases the mobile station should
transmit the stored values using full hexadecimal
encoding. When receiving such an MCC, the network
shall treat the LAI as deleted.

MNC, Mobile network code (octet 3 bits 5 to 8, octet 4)
The coding of this field is the responsibility of each
administration but BCD coding shall be used. The MNC
shall consist of 2 or 3 digits. For PCS 1900 for NA, Federal
regulation mandates that a 3-digit MNC shall be used.
However a network operator may decide to use only two
digits in the MNC in the LAI over the radio interface. In this
case, bits 5 to 8 of octet 3 shall be coded as "1111".
Mobile equipment shall accept LAI coded in such a way.

Note 1: In earlier versions of this protocol, the possibility to use a one digit MNC in LAI was provided on the radio interface. However as this was not used this possibility has been deleted.

Note 2: In earlier versions of this protocol, bits 5 to 8 of octet 3 were coded as "1111". Mobile equipment compliant with these earlier versions of the protocol may be unable to understand the 3-digit MNC format of the LAI, and therefore unable to register on a network broadcasting the LAI in this format.

In abnormal cases, the MNC stored in the mobile
station can have
- digit 1 or 2 not in the set {0, 1 ... 9}, or
- digit 3 not in the set {0, 1 ...9, F} hex.
In such cases the mobile station
shall transmit the stored values using full hexadecimal
encoding. When receiving such an MNC, the
network shall treat the LAI as deleted.

The same handling shall apply for the network, if a
3-digit MNC is sent by the mobile station to a network using
only a 2-digit MNC.

LAC, Location area code (octet 5 and 6)
In the LAC field bit 8 of octet 5 is the most
significant bit and bit 1 of octet 6 the least
significant bit.

The coding of the location area code is the
responsibility of each administration except that
two values are used to mark the LAC, and hence the
LAI, as deleted. Coding using full hexadecimal
representation may be used. The location area code
consists of 2 octets.

If a LAI has to be deleted then all bits of the
location area code shall be set to one with the
exception of the least significant bit which shall be
set to zero. If a SIM is inserted in a Mobile Equipment
with the location area code containing all zeros, then
the Mobile Equipment shall recognise this LAC as part
of a deleted LAI
+-----------------------------------------------------+

More on Cell Site Analysis: http://cellsiteanalysis.blogspot.com

CHECKING MASTS - CSA

CHECKING MASTS - CSA

.
Since linking with Jamie Morris at Forensic Focus to create a Mobile Forensics Discussion Forum (http://www.forensicfocus.com/index.php?name=Forums&file=viewforum&f=14) to bring mobile telephone evidence to a wider audience, I have had several discussions with people who are new to mobile telephone evidence and have asked me to provide further discussion on matters concerning Checking Masts. Also from police sections asking me to open up the discussion as to what might happen when Mast checks are not made and how that might impact on a criminal case. Whilst the criminal case discussion is hypothetical, some events happening in the discussion are factual and drawn from a number of criminal cases.
.
The necessity to check with a mobile network operator regarding details of a particular Mast (Cell Site) and the bearing of coverage (azimuth) from it, for a particular Cell ID, at the material time to see whether it has changed prior to conducting cell site analysis is a useful rule to follow. There are, of course, many other matters that need to be checked also, but I have simplified the issues for the purposes of this discussion.
.
The details of Mast changes are recorded by Operators and recorded in their databases. Single Point of Contact (SPOC) is not prevented from asking about Checking Mast details and obtaining the relevant information. However, as a SPOC doesn’t decide what evidence should or shouldn’t be required for a criminal investigation, the SPOC should be asked to obtain this information.
.
The Masts
Below is an image (a) which displays a Mast's radio coverage for a particular Cell ID illuminating in a westerly direction towards a block of flats.

Image (a)

.
The next image (b) below displays the same Mast (as above) relating to radio coverage with its associated Cell ID but this time the radio coverage is illuminating in an easterly direction, in the opposite direction towards a house.

Image (b)
.

For the purposes of this discussion the Mast is shown close to the properties in both images. This was done for artistic purposes and is not intended to mean the Mast is actually that close to both properties. Also an actual Cell ID has not been shown but the inference about Cell ID being relevant is inferred by the presence of radio coverage being displayed.

.

Criminal Case
Imagine if you will that on a particular date, let us say the 30th March 2008, a dead body is found in the house, shown in image (b). The police have been alerted to the property by a neighbour because of a dreadful smell emanating from the direction of the house. Upon entering the property the police find a decomposing body of a woman on the floor. The Pathologist is called and indicates, following assessment of the decomposing body, that the body had been dead for approximately two weeks. That would generate a time line back to Tuesday 16th March 2008.

.

The police conduct door-to-door enquiries and one neighbour next door but one mentions that two weeks ago as she passed the house there was shouting emanating from inside the property and cries for help. The neighbour thought nothing more of it because the couple that lived there had regular arguments, which the neighbours and passers-by could overhear.

.
The police asked the neighbours had they noticed anything else? One lady who lived a few doors away replied that she looked out of her window and that she had seen the man that lived there leave the property at about 8.30pm, and that would have been a Tuesday, and funnily enough that was about two weeks ago.

.

To cut a long story short, the police found the man who lived in the house a month later, seized his mobile telephone and having retrieved his mobile telephone subscriber details, obtained call records and identified the Masts that routed mobile calls to and from his mobile phone. From the records it was noted that two weeks before the body was found his mobile had used a Mast for a call (on Tuesday at 8.00pm), the Mast was sited 2.4Km away from where he lived with his partner. This was also the nearest Mast to the house.

.

The police called for radio test measurements to be conducted outside the house three weeks later. The time-span from the estimated time of death to radio testing was approximately 9 weeks. The radio tests confirmed that the Cell ID recorded in the call records is the same as detected outside the house.

.

The man, during questioning, confirmed he had not been back to the house since leaving on the Saturday. That being the Saturday prior to the Tuesday when it is approximated the death took place. He had also been living in a Bedsit because the relationship with his partner had irrevocably broken down and they had agreed to split and go their separate ways.
.
The police believed from the evidence that they had thus far that it was enough to hold the man, now a suspect, and the death case turned into a murder case. The evidence they relied upon was:

.

1) The neighbours hearing regular arguments and cries for help on the fateful day
2) The neighbour that says she saw the suspect leaving the house at 8.30pm
3) The call records that shows a call on the Tuesday from the suspect's mobile telephone using a Cell ID from a Mast that is sited 2.4Km away and is the nearest Mast to the house
4) The radio test measurements that show the Mast’s coverage, thus Cell ID, used by the suspect's mobile phone illuminated outside the house.

.

So at minimum there appears to be four good pillars of evidence. However, when the radio test measurements were conducted no checks had been made with the mobile operator whether any changes had been made to the Masts in the area prior to radio test measurements being conducted. It subsequently came to light at trial that the Cell ID illuminating towards the house (image (b)) had only been illuminating eastwards towards the house from Thursday 18th March 2008 after the alleged murder due to changes at the Mast. Prior to that date the Mast had been illuminating westwards, towards a block of flats (image (a)).

.

Impact on Criminal Case
So when the police had noted from the suspect's call records that over the last few months they showed the suspect's mobile phone using a particular Cell ID for mobile calls that the police thought could be made or received from the house, they were mislead and operated under a false assumption. The suspect had, in fact, been having an affair with a married woman in the block of flats (image (a)) and didn't want to say anything for fear of reprisals from the woman’s husband who was known to have a temper and may take it out on the woman if she was called as a witness. It was this affair that the victim, when she was alive, and been tipped off about some months earlier and the cause of the couple constantly arguing.

.

The lack of discovery about any changes to a particular Mast prior to conducting radio test measurements impacted on the case by:

.
- the test results, that should add value to a case, were inaccurate and unhelpful- introduced delays into an investigation as the test results steered the police investigation in the wrong direction
- operational man-hours increased
- operational costs increased
- worst still, a false allegation of murder was made against an innocent person

.

As to the other pillars of evidence: 3) and 4) were no longer valid and the woman with whom the suspect was having an affair corroborated the dates and times she was with the suspect. As to 1) and 2)? On the fateful day, 1) the argument that was heard by a neighbour turned out to be the victim's ex-boyfriend from a previous relationship whom she had given evidence against him for drug dealing, some 5 years earlier, and who had been released from prison 20 days before the murder. He had vowed to seek revenge against the victim. 2) The neighbour who saw the suspect at 8.30pm at night in fact saw a silhouette of the man she thought was the suspect because it was 8.30pm at night and her eyesight wasn't as good at night. The silhouette leaving the house was the ex-boyfriend leaving after having murdered his ex-girlfriend.

.

Further Observations

In consequence, by not checking with the operator about their Masts prior to conducting radio test measurement caused lost investigation time to find the real culprit, unnecessary redundant evidence, increased costs, investigation time increased exponentially, apart from wrongly accusing a person. Moreover, as checking the Masts is a well known procedure, not to have checked it during an investigation may amount to act of intent to plant evidence to create incrimination against someone by using an act of deliberate omission during an investigation.

.

This is only a hypothetical discussion, but if these acts were operated in reality on a regular basis in criminal cases and applied as policy in widespread use across England, it may potentially lead to £20 millions in retrials. Of course that shouldn’t be possible arising from the 'Golden Rule' of disclosure, enunciated by Lord Bingham in R -v- C & H (February 2004), when he said that ‘fairness requires that full disclosure should be made of all material held by the prosecution that weakens its case or strengthens that of the defence’. The test is an objective one and is grounded on what is ‘reasonable’. However, the guidance makes it plain that an expert witness is no longer to be trusted to exercise his or her own judgment in deciding what falls within this definition and what is and is not relevant.

.

It is the influence of the Golden Rule placing affirmative duties on the prosecution from 2004 onwards that safeguards the reliability of evidence in criminal cases. That suggests were Her Majesty's Inspectorate called upon to require the prosecution tomorrow to provide, from randomly selected 200 cases from across the country by the Inspectorate, documents of enquiry to a particular operator seeking to be notified of any changes to a particular Mast in a particular case and the documented response received from the operator, they could do so.

.

That doesn't mean to say if the prosecution mobile telephone case has 50 Masts used for calls that documentation for each of the 50 Masts would be necessary, as rarely are all Masts relevant to an alleged crime, anyway, and a large proportion being used for padding simply to show movement. The relevant Masts are those where the Masts and coverage can illustrate that the mobile telephone or telephones could potentially be at the scene of crime, which on the whole usually relates to the last three to six Masts nearest the scene of crime. Besides I couldn't see the prosecution being hoodwinked into believing that because there are 50 Masts in a case that the number amounted to far too many enquiries to be made to the operator and so didn't make any enquiries at all.

.

As I have mentioned above this is purely hypothetical, but hopefully it illustrates the importance of Checking Masts before conducting radio test measurements.

.