Crime: Base Station Monitoring and Regular Stress Tests

Photo courtesy of the Macau Post Daily

News feed: https://www.macaupostdaily.com/article2451.html

There is no shortage of police investigations, articles and reports into cellular technology being used for some sort of illegal purposes, and that is beyond the normal seizure of mobile devices in criminal proceedings. The recent prosecution of a construction worker, reported (10-03-2017) in the Macau Post Daily, running not one but two fake base stations, is such an example.

Whilst there is a huge effort to deal with Cybercrime attacks over networks, there is a growing emphasis suggesting that more attention could be focussed to actually dealing with physical devices creating the cyber activity behind the crime.

On the 22-03-2017 Information Age website reported Chinese cybercriminals sent Android malware via fake BTSs ( http://www.information-age.com/chinese-cybercriminals-use-fake-telecom-stations-spread-malware-123465203/ ). The report was also mentioned at a number of other websites ( http://thehackernews.com/2017/03/rogue-bts-android-malware.html ;  https://blog.knowbe4.com/chinese-hackers-use-fake-cellphone-tower-to-spread-android-banking-trojan and so on). Blog.knowbe4 added useful information content beyond Information Age's report that the malware was involved, but identifies the malware as attack called "Smishing"; a subject mentioned here at trewmte.blogspot.com previously back in 2015 ( Smishing Maybe Smashed, but Fake Tache Goes On  - http://trewmte.blogspot.co.uk/2015/04/smishing-maybe-smashed-but-fake-tache.html ).

It isn't clear from these reports as to what is actually meant by 'fake BTSs'? Are the attackers merely hacking the network exploiting (S3000688) MAP security and getting hold of authentication vectors to mount a false base station attack?; maybe this is a man-in-the-middle attack using a false mobile BTS? (3GPP TS 21.133); using mobile redirector techniques for Android smartphones opening the SMS text message link to download the '.apk'; or whether a false physical tower has been erected on land through which the attacks are made?   If the latter is correct, there is more involved with this than anonymously hiding in the background. For a false physical tower to happen either the attacker/s might 'hijack' equipment on an existing tower?; add new equipment to an existing tower?; or land-base a whole new tower? The latter is possibly the most improbable to happen without the attacker/s needing new landline connections, microwave, RF and electrical power facilities, cabinets, cabling, tower rig, antenna/TRXs, etc. etc., something that resembles a cellular tower in order to get a smartphone to use its rogue radio coverage.

How can a mobile network operator deal with this? It largely depends how well the operator knows its own installation base and how regularly the operator OMC (operations and maintenance centre) and site visits are co-ordinated for stress testing. Those co-ordinated tests may need to take into account site inventory inspection across a wide range of components. For instance, has the operator sufficient information of Inventory of components for each site? One example being the Antenna Interface Standards Group (AISG), which has been around for many years, its members count amongst some of the leading global players in this arena ( http://www.aisg.org.uk/ ):

Membership of the Group at 1st May 2016

Ace Technologies Corp.	Kathrein Werke KG
Amphenol Antenna Solutions	KGP Tech Co. Ltd.
China Mobile	KMW Inc.
Comba Telecom Systems Int'l	Nokia
Commscope, Inc	NXP
Communications Components Inc.	Orange / France Telecom
Ericsson AB	Oriel Laboratories Ltd
Galtronics Corporation Ltd	Radio Design
Gammanu Inc	RFS Inc
Gemintek Corporation	RFM Wireless
Gemtek Technology Co. Ltd.	Rosenberger Asia Pacific Electronic Co. Ltd.
Guangzhou Sunrise Telecoms Equipment Co Ltd	SGC Technologies Inc
Heji Co Ltd.	Shenzhen Haina Telecom Equipment Co Ltd
Huawei Technologies Co Ltd	Shenzhen Tatfook Technology Co Ltd.
Innertron Inc	Sunsea Telecommunication Co Ltd.
Innova Telecommunication Co. Ltd.	Sunwoo Communication Co Ltd
Jiangsu YaXin Electronics, Science & Technology Co Ltd	Wuhan Hongxin Telecommunication Technologies Co. Ltd.
JMA Wireless LLC	Tongyu Communications Equipment Co Ltd
Kaelus Pty Ltd	Westell, Inc.
The following companies are members of the Ancillary Equipment Group
Amphenol-Tuchel GmbH	Recodeal Interconnect System Co. Ltd.
Franz-Binder GmbH	Sam Woo Electroncs Co. Ltd.
Guangzhou Huafeng Qiwang Electronic                               Technology Co. Ltd.	Syskim International
Lumberg Connect GmbH

Furthermore, the obvious site checks, such as, break-in to an external cabinet or site equipment room, checking CCTV and trip alarms should normally be examined against regular site visit logs and also time-to-site and time-at-site. Checking fault management, configuration management, performance management & Security Management ports and panels at site to see if they have not been tampered with to disguise normal operation is another consideration. There is a full range of security measures at site and network stress tests that can be performed.

Regulators may wish to assess the security breach with an operator and see if an industry-wide practice is involved selling equipment on the merits on merely the forecast of Total Cost of Ownership and Return On Investment as opposed to an assessment of the person/organisation buying equipment? Another assessment might be to considered reports of stolen equipment and marking of components etc.

It isn't difficult to imagine more cases like the above could occur but it doesn't mean it will; and doom and gloom is not the note this discussion is going to end. Think about all of the towers and base station installed around the world and the customer-base they serve. The mobile network operators provide an amazing service delivering trillions of calls, communications and other services annually. It is a testament to their predominantly well run mobile networks that they operate that the majority of users will not be talking in terms of throwing in the towel and ditching their mobiles tomorrow for landline telephones because of these crime reports.

Finally, India's state-owned quality control agency, Standardisation Testing & Quality Certification (STQC), has started ( http://economictimes.indiatimes.com/news/company/corporate-trends/india-to-start-screening-imported-telecom-gear-from-april-2017/articleshow/56054263.cms ) screening of all mobile network components, feature phones and smartphone under the requirements of National Security. This may pave the way for other countries without such a screen procedure to adopt a similar model.

Data Usage in Cell Site Analysis

Data Usage in Cell Site Analysis

There are numerous common mistakes that can be made when conducting cell site analysis, and a mistake becoming prevalent when dealing mobile data usage is the error of using Distance-to-Mast (DtM*) instead of using Distance-to-Usage Parameters (DtUP*). With mobile data usage on the increase and with wireless WCDMA, but equally LTE, will start to break the monopoly of landline internet usage by 2016 (that is four years time) those producing evidence and Judges looking at evidence in Court really need to be aware.
        
*copyright (c) GSmith 2005-2012

Checking Masts - CSA 2

Checking Masts - CSA 2

.

In response to the discussion at Checking Masts - CSA, a couple of questions that I have been asked:

.

- Do you, yourself perform Cell Site Analysis/Surveys for cases?

.

- If so what equipment do you use for this very interesting task??

.

Answer:

Yes I do and have been doing so since the early 90s for GSM and since 2006 for 3G.

.
I use Nokia network monitor for 2G and have used, but do not particularly like, some of these newer independent flash files that enable some smartphones to obtain 3G network control data. I do continue to use them as one tool but for fairness reasons in dealing with the radio evidence. The reason for that is there are no:

.

1) forensic standards for the calibration of test equipment generating evidence

2) forensic standards for the content or quantity of radio data captured for evidence

3) forensic requirements for user mobile phones to be calibrated

4) standards that requires a mobile phone after it has left the manufacturing production line to maintain its radio mask calibration longer than 12-months.

.

For example, dealing with point 4) most mobiles in use do not precisely meet calibration standards, but largely their radio mask is towards the upper or lower limits due to the way in which mobile phones are treated by their users: dropped, fall in water, exposed to fag ash, drink splatter, overcharging, over heating, running the battery flat during calls etc etc. All these things and more take there toll on mobile phone operation over time and it is not surprising to find that calibrated radio engineer test equipment often produce a better RxLv sensitivity. For instance, if one puts a used mobile phone side by side with a radio engineers test rig they both record 'absolute' measurments, obviously, but the disparity between 'relative' measurements can be surprising.

.

For radio engineer test rig I use Anite's Nemo Handy. Also I have secured in evidence the requirement for the readings and the electronic files that contain the readings and the screen prints to be served in evidence because:

.

a) they are original evidence

b) it exposes not just preservation of evidence but the processes which brought the evidence about

c) it means the prosecution can meet the Golden Rule without being fed spurious argument of why things can't be done

d) it stops outsourcer firms holding back on evidence or unilaterally deciding that they control what our courts and criminal justice system can or cannot see

e) whilst I used Anite's Nemo Handy .dt1 file for the criminal case in which I was advising, the requirement is not limited to simply radio test measurements from Nemo Handy but all other radio test equipment etc and equally applies to handset and U/SIM card evidence.

.

The additional benefit this offers is that where the police want to save money extracting and harvesting data that is subsequently produced in reports and want to cut down on unessential data, this means they can still produce reports with only the content they want to show. The full copy of data are still obtained by the examiner and this means the defence, having a copy of the full data in electronic format, can examine all the other data to see whether any vital evidence for the defendant's case has been overlooked or not.

.

Moreover, the defence can still examine the exhibit as the prosecution will have already produced their evidence. This will allow for variations in evidential standard or interpretation to be checked and exposed, if any, in order to maintain the principle 'nothing lost in translation.'

.

This can also work on other levels as well. Such as, we know the Forensic Regulator is due to launch soon and the public sector are rushing around to create and approve their own standards. However, the independent sector has not had the opportunity to qualify whether the public sector standards are better than the standards in the independent sector. The work I have been doing is to highlight issues and attitudes to mobile phone evidence and to let the courts know there is evidence the courts can have. If the Regulator accepts procedures created by the public sector it should not bar the independent sector procedures being accepted also.

.

If the independent sector were automatically disbarred from having their own procedures accepted it could potentially lead to following public sector standards containing systemic failure being promulgated throughout the country. Not only that but the knock-on can directly affect small business by placing heavy regulation and financial demands upon small business, causing collapse and unemployment in MPs constituencies. Apart from which there may be the issues associated with breach of human rights under the Human Rights Act and the European Convention on Human Rights.

.

Apologies for the length of commentary. It was necessary to go along this discussion path because it is important to promote standards and to highlight choices available to people interested in mobile telephone evidence and identify what is possible by knocking over artificially generated psychological boundaries. I would hope to get the message into evidence in the London area, but my instructions come from outside of London these days and London appears to be a bit of a no-go zone.

.

If you want to start a new topic, ask a question or join the discussion on ny previous postings then please join in a Forensic Focus Mobile Forensic Discussion Forum.

CHECKING MASTS - CSA

CHECKING MASTS - CSA

.
I have had several discussions with people who are new to mobile telephone evidence and have asked me to provide further discussion on matters concerning Checking Masts. Also from police sections asking me to open up the discussion as to what might happen when Mast checks are not made and how that might impact on a criminal case. Whilst the criminal case discussion is hypothetical, some events happening in the discussion are factual and drawn from a number of criminal cases.
.
The necessity to check with a mobile network operator regarding details of a particular Mast (Cell Site) and the bearing of coverage (azimuth) from it, for a particular Cell ID, at the material time to see whether it has changed prior to conducting cell site analysis is a useful rule to follow. There are, of course, many other matters that need to be checked also, but I have simplified the issues for the purposes of this discussion.
.
The details of Mast changes are recorded by Operators and recorded in their databases. Single Point of Contact (SPOC) is not prevented from asking about Checking Mast details and obtaining the relevant information. However, as a SPOC doesn’t decide what evidence should or shouldn’t be required for a criminal investigation, the SPOC should be asked to obtain this information.
.
The Masts
Below is an image (a) which displays a Mast's radio coverage for a particular Cell ID illuminating in a westerly direction towards a block of flats.

Image (a)

.
The next image (b) below displays the same Mast (as above) relating to radio coverage with its associated Cell ID but this time the radio coverage is illuminating in an easterly direction, in the opposite direction towards a house.

Image (b)
.

For the purposes of this discussion the Mast is shown close to the properties in both images. This was done for artistic purposes and is not intended to mean the Mast is actually that close to both properties. Also an actual Cell ID has not been shown but the inference about Cell ID being relevant is inferred by the presence of radio coverage being displayed.

.

Criminal Case
Imagine if you will that on a particular date, let us say the 30th March 2008, a dead body is found in the house, shown in image (b). The police have been alerted to the property by a neighbour because of a dreadful smell emanating from the direction of the house. Upon entering the property the police find a decomposing body of a woman on the floor. The Pathologist is called and indicates, following assessment of the decomposing body, that the body had been dead for approximately two weeks. That would generate a time line back to Tuesday 16th March 2008.

.

The police conduct door-to-door enquiries and one neighbour next door but one mentions that two weeks ago as she passed the house there was shouting emanating from inside the property and cries for help. The neighbour thought nothing more of it because the couple that lived there had regular arguments, which the neighbours and passers-by could overhear.

.
The police asked the neighbours had they noticed anything else? One lady who lived a few doors away replied that she looked out of her window and that she had seen the man that lived there leave the property at about 8.30pm, and that would have been a Tuesday, and funnily enough that was about two weeks ago.

.

To cut a long story short, the police found the man who lived in the house a month later, seized his mobile telephone and having retrieved his mobile telephone subscriber details, obtained call records and identified the Masts that routed mobile calls to and from his mobile phone. From the records it was noted that two weeks before the body was found his mobile had used a Mast for a call (on Tuesday at 8.00pm), the Mast was sited 2.4Km away from where he lived with his partner. This was also the nearest Mast to the house.

.

The police called for radio test measurements to be conducted outside the house three weeks later. The time-span from the estimated time of death to radio testing was approximately 9 weeks. The radio tests confirmed that the Cell ID recorded in the call records is the same as detected outside the house.

.

The man, during questioning, confirmed he had not been back to the house since leaving on the Saturday. That being the Saturday prior to the Tuesday when it is approximated the death took place. He had also been living in a Bedsit because the relationship with his partner had irrevocably broken down and they had agreed to split and go their separate ways.
.
The police believed from the evidence that they had thus far that it was enough to hold the man, now a suspect, and the death case turned into a murder case. The evidence they relied upon was:

.

1) The neighbours hearing regular arguments and cries for help on the fateful day
2) The neighbour that says she saw the suspect leaving the house at 8.30pm
3) The call records that shows a call on the Tuesday from the suspect's mobile telephone using a Cell ID from a Mast that is sited 2.4Km away and is the nearest Mast to the house
4) The radio test measurements that show the Mast’s coverage, thus Cell ID, used by the suspect's mobile phone illuminated outside the house.

.

So at minimum there appears to be four good pillars of evidence. However, when the radio test measurements were conducted no checks had been made with the mobile operator whether any changes had been made to the Masts in the area prior to radio test measurements being conducted. It subsequently came to light at trial that the Cell ID illuminating towards the house (image (b)) had only been illuminating eastwards towards the house from Thursday 18th March 2008 after the alleged murder due to changes at the Mast. Prior to that date the Mast had been illuminating westwards, towards a block of flats (image (a)).

.

Impact on Criminal Case
So when the police had noted from the suspect's call records that over the last few months they showed the suspect's mobile phone using a particular Cell ID for mobile calls that the police thought could be made or received from the house, they were mislead and operated under a false assumption. The suspect had, in fact, been having an affair with a married woman in the block of flats (image (a)) and didn't want to say anything for fear of reprisals from the woman’s husband who was known to have a temper and may take it out on the woman if she was called as a witness. It was this affair that the victim, when she was alive, and been tipped off about some months earlier and the cause of the couple constantly arguing.

.

The lack of discovery about any changes to a particular Mast prior to conducting radio test measurements impacted on the case by:

.
- the test results, that should add value to a case, were inaccurate and unhelpful- introduced delays into an investigation as the test results steered the police investigation in the wrong direction
- operational man-hours increased
- operational costs increased
- worst still, a false allegation of murder was made against an innocent person

.

As to the other pillars of evidence: 3) and 4) were no longer valid and the woman with whom the suspect was having an affair corroborated the dates and times she was with the suspect. As to 1) and 2)? On the fateful day, 1) the argument that was heard by a neighbour turned out to be the victim's ex-boyfriend from a previous relationship whom she had given evidence against him for drug dealing, some 5 years earlier, and who had been released from prison 20 days before the murder. He had vowed to seek revenge against the victim. 2) The neighbour who saw the suspect at 8.30pm at night in fact saw a silhouette of the man she thought was the suspect because it was 8.30pm at night and her eyesight wasn't as good at night. The silhouette leaving the house was the ex-boyfriend leaving after having murdered his ex-girlfriend.

.

Further Observations

In consequence, by not checking with the operator about their Masts prior to conducting radio test measurement caused lost investigation time to find the real culprit, unnecessary redundant evidence, increased costs, investigation time increased exponentially, apart from wrongly accusing a person. Moreover, as checking the Masts is a well known procedure, not to have checked it during an investigation may amount to act of intent to plant evidence to create incrimination against someone by using an act of deliberate omission during an investigation.

.

This is only a hypothetical discussion, but if these acts were operated in reality on a regular basis in criminal cases and applied as policy in widespread use across England, it may potentially lead to £20 millions in retrials. Of course that shouldn’t be possible arising from the 'Golden Rule' of disclosure, enunciated by Lord Bingham in R -v- C & H (February 2004), when he said that ‘fairness requires that full disclosure should be made of all material held by the prosecution that weakens its case or strengthens that of the defence’. The test is an objective one and is grounded on what is ‘reasonable’. However, the guidance makes it plain that an expert witness is no longer to be trusted to exercise his or her own judgment in deciding what falls within this definition and what is and is not relevant.

.

It is the influence of the Golden Rule placing affirmative duties on the prosecution from 2004 onwards that safeguards the reliability of evidence in criminal cases. That suggests were Her Majesty's Inspectorate called upon to require the prosecution tomorrow to provide, from randomly selected 200 cases from across the country by the Inspectorate, documents of enquiry to a particular operator seeking to be notified of any changes to a particular Mast in a particular case and the documented response received from the operator, they could do so.

.

That doesn't mean to say if the prosecution mobile telephone case has 50 Masts used for calls that documentation for each of the 50 Masts would be necessary, as rarely are all Masts relevant to an alleged crime, anyway, and a large proportion being used for padding simply to show movement. The relevant Masts are those where the Masts and coverage can illustrate that the mobile telephone or telephones could potentially be at the scene of crime, which on the whole usually relates to the last three to six Masts nearest the scene of crime. Besides I couldn't see the prosecution being hoodwinked into believing that because there are 50 Masts in a case that the number amounted to far too many enquiries to be made to the operator and so didn't make any enquiries at all.

.

As I have mentioned above this is purely hypothetical, but hopefully it illustrates the importance of Checking Masts before conducting radio test measurements.

.

UK Criminal Evidence Delays

UK Criminal Evidence Delays
.

Due to delays in passing evidence to the defence certain building blocks of evidence used against a defendant are not being held by the prosecution, but worst still, the expert who obtains, for instance the tests and results, holds on to them because they claim their client (the Police) haven't made that a term of the instructions to pass them over. The police say they don't need to have it because the expert hasn't said it's necessary so they wont ask for it.
.

So what makes me and others think that we should expect, as a requirement, all the mobile telephone/cell site analysis evidence upfront from the prosecution and why do we think, as a requirement, the prosecution have a lawful duty to have obtained all the evidence from their expert, in order to meet the first requirement?
.

It is the lawful duty, so we are told, of the prosecution to look at, examine and retain a copy of all evidence (e.g. tests and results) and to conduct an assessment of risk, which is the principle enunciated in the "Golden Rule" by none other than Lord Bingham.
.

Examiners/Experts at common law are no longer entitled or permitted to arbitrarily withhold any evidence from their work in a case but are required to produce to the prosecution an index of all used and unused material they are holding which should replicate the actual physical copy of evidence given to the prosecution. So for a case involving mobile telephone/cell site analysis that would mean:
.

1) written instructions of work to be undertaken
.

2) call records/subscriber details
.

3) cell site details and data
.

4) GPS/CCTV evidence
.

5) handset/SIM (USIM) data and report
.

6) copy of the actual radio test measurement results obtained at site and presented in a visible, legible and intelligible format (with the electronic file of the original radio test measurements to accompany them)
.

7) copy of the expert's analysis of the results, report and any supporting exhibits
.

8) copy of written questions to and written responses from the mobile network operator
.

9) material considered and unused material and/or material disgarded as not relevant
.

.......and so on.
.

This enables the prosecution to sit down and examine what is on file put before them by the examiner/expert (usually the data can be recorded onto a CD costing less than £1.00) and all the material on CD and/or in paper form are identified on a tick sheet. The prosecutor/prosecution should then avail him/herself/themselves of the knowledge of that material by familiarisation with the information on the CD and/or in paper form. As some information may not be readily understood the examiner/expert should be called (by phone, written or in a meeting) to explain material or information not understoood. The risk assessment can then be made.
.

It is equally understood that the right of the defence to investigate the evidence held against a defendant was and is to stop cases being brought against anyone where evidence was being withheld, in a deliberate or clandestine fashion, in order to meet the principles of ECHR (Foucher v France). No evidence on file can be withheld from a defendant and no steps should be taken to find mechanisms to avoid holding or hiding evidence from the defendant. For the avoidance of doubt, I am not referring to public interest immunity (PII) information, which is another matter entirely.
.

So it is easy to see the principles enunciated by Lord Bingham in the Golden Rule contain impeccable logic and foresight. The Golden Rule requires the prosecution to logically assess that it has a complete copy of the evidence e.g. tests and results and if they were not held by the prosecution:
.

A) How would it be possible for the prosecution to conduct a risk assessment without the full evidence made available to them from their examiner/expert?
.

B) What happens, for instance, if the examiner/expert dies and no one can find the test results?
.

.... and the list goes on.
.

So what are the current delays? Whenever asking for standard mobile telephone evidence, for instance items such as cell site radio test measurement data or ask for corroboration of enquiries to and written responses from the mobile operator, the prosecution do not readily hold the evidence and massive delays ensue until just before going before the Judge part of the evidence suddenly emerges and then the defence are left to hurry an examination of that evidence.
.

I have a case on right now where I requested evidence on the 6th March 2009 and apart from the prosecution correcting mistakes in their material which the defence had to point out to make any sense of what the prosecution's evidence was meant to mean, the other corrobating information expected to be found in the file or CD under the Golden Rule principle and could/should have have been disclosed up front in March, this still has NOT been served. For instance, the radio test results have still not been served along with other information.
.

These delays impact by causing problems for the defence in many ways. Some examples are:
.

i) Defence experts are expected to tidy up the technical errors and mistakes (not typos though) with the prosecution's evidence. This implicitly means though that defence experts are acting as quasi-prosecution experts. These errors and mistakes are red-herrings though and occupy defence time to put them right, so by the time the requested evidence comes through the trial date is upon us and then the defence have limited time to conduct a proper and orderly analysis, which implicitly means the defence are equally being cajoled into overlooking some evidence or make mistakes due to being rushed.
.

As a side matter that is also concerning. If by chance some were to suggest that the observation about quasi-prosecution experts is not true, then consider this. If defence experts were to write reports delivered at court before the jury identifying all the inherent technical flaws and what evidence had not been served or served late just before/at trial, a defence expert would be more likely to get a reprimand from the Judge for wasting time and for not raising it sooner. In the alternative, the prosecution would go away correct the mistake and put version 4 of the evidence before the jury. It still means the same thing though, that defence experts are being placed into the position of acting as quasi-prosecution expert because the work they do identifying those corrections will be used against a defendant. My natural instincts tell me this is an appaulling breach of human rights. It will take someone with a far greater mind than mine, maybe even Lord Bingham, himself, to put that in the appropriate legal context highlighting that injustice in the current criminal evidential procedures.
.

Additional note: When mentioning human rights and injustice, my comments are not intended to campaign to get criminals off, my intentions are clearly about the rules that define how evidence should be presented and the roles people play in that process and about evidence generally. It is also about safeguarding our rights, our childrens' rights and our families' right to a fair trial in Britain, as opposed to deciding who gets the better court case based upon who understands what evidence should have been presented at the outset.
.

ii) The discussion being raised is not about where mobile telephone evidence suddenly becomes relevant just before or during a trial and taking everyone by surprise, it is where the evidence has already been examined and the delays to present the evidence to the defence means changes that can be happening in the radio network or the operator deletes data after a period of time prevents the defence from pursing lines of investigation of their own or conducting tests. The delays muddy the waters for the defence to properly do their job.
.

iii) Where the defence expert is prevented from knowing the weight of the technical case against a defendant it means the defence expert cannot properly advise the defence solicitors. More importantly this handcuffs the defendant from knowing the prima facie case against him or her.
.

iv) Another matter which is causing headaches: by the prosecution's actions of delaying service of evidence which they already hold (Golden Rule requirement) but they choose not to disclose for months on end impacts as defence experts cannot afford the time locked to a case over a long period. More importantly, as cases that run for months and months means the defence expert is not being paid until the end of the case it is just not financially viable for the defence expert to take the work. Consequently defence experts are being driven out. It should be noted also defence experts have no powers to demand evidence, we can only ask. This means that we are left to correct the prosecution technical errors and point out in advance the missing evidence (see - i) quasi-prosecution expert, above).

.
These evidential delays have not just started but have been going on, and with increased regularity, long before the recession started, so the recession is not the reason for the delay occurrences. The delays are not stated in procedural requirements and are not stated to be accepted because they (the delays) are usual, standard practice. The remedy to make these problems to go away is absolutely clear and easy to achieve and that is for the prosecution to stop the delays in serving evidence and present it up front, without delay, in every case using the Golden Rule evidential acquisition process needed in order to conduct a risk assessment. The CD/paper work can then be immediately passed to the defence without delay.

.

¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬

UPDATE

¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬¬

Just wanted to add an extra piece to this discussion that I had considered when forming my observations.

.

The case in point deals with fairness, not simply from a defence view point but prosecution, too. When requesting evidence it is a 'requirement' of the defence expert (thus defence) if, during examination and analysis, there is something wrong with the evidence or there is evidence missing that the defence expert should ask for it no matter how late in the day.

.

That is because if the defence expert doesn't ask for it the defence cannot request it and it could lead to an unfair trial. So when it is thought I am giving the prosecution a hard time over requesting evidence and asking them where is this particular piece of evidence that they would naturally need in order to know whether, say have the Masts changed or not before testing, it is not my intention to make someone look bad, or imply they don't know what they doing or in some way create difficulties.

.

As an expert there is a requirement to inform the defence, whether they like it or not, tedius or not, the expert must put it to them and seek the evidence or understanding about the evidence. That is because it is the duty of the defence to raise it to the prosecution so that prosecution are given a fair chance to deal with the request.

.

For the discussion in this thread it took account of the Gleeson principle, which I record below.

.

Testing the evidence: In our adversarial system, the defence, of course, are entitled to exploit adventitious faults and failings by the prosecution. Auld LJ in his Report of the Criminal Courts Review incorporated into his judgment in the case of Gleeson [2003] EWCA Crim 3357 at paragraph 36, in which he said:

.

"To the extent that the prosecution may legitimately wish to fill possible holes in its case once issues have been identified by the defence statement, it is understandable why as a matter of tactics a defendant might prefer to keep his case close to his chest. But that is not a valid reason for preventing a full and fair hearing on the issues canvassed at the trial. A criminal trial is not a game under which a guilty defendant should be provided with a sporting chance. It is a search for truth in accordance with the twin principles that the prosecution must prove its case and that a defendant is not obliged to inculpate himself, the object being to convict the guilty and acquit the innocent. Requiring a defendant to indicate in advance what he disputes about the prosecution case offends neither of those principles."

.

Some important words there are "....once issues have been identified by the defence statement....." and "Requiring a defendant to indicate in advance". How can that be done if the defence expert has seen errors or omissions in the prosecution evidence but then goes on not to ask for those gaps to be filled?

.

The problem here will be that where evidence is trickle fed to the expert s/he will always be tactically put on the back foot so as not to catch up, thus potentially failing the principle whereas if all the evidence is disclosed up front would that problem still exist?

CHECKING MASTS - CSA

CHECKING MASTS - CSA

.
Since linking with Jamie Morris at Forensic Focus to create a Mobile Forensics Discussion Forum (http://www.forensicfocus.com/index.php?name=Forums&file=viewforum&f=14) to bring mobile telephone evidence to a wider audience, I have had several discussions with people who are new to mobile telephone evidence and have asked me to provide further discussion on matters concerning Checking Masts. Also from police sections asking me to open up the discussion as to what might happen when Mast checks are not made and how that might impact on a criminal case. Whilst the criminal case discussion is hypothetical, some events happening in the discussion are factual and drawn from a number of criminal cases.
.
The necessity to check with a mobile network operator regarding details of a particular Mast (Cell Site) and the bearing of coverage (azimuth) from it, for a particular Cell ID, at the material time to see whether it has changed prior to conducting cell site analysis is a useful rule to follow. There are, of course, many other matters that need to be checked also, but I have simplified the issues for the purposes of this discussion.
.
The details of Mast changes are recorded by Operators and recorded in their databases. Single Point of Contact (SPOC) is not prevented from asking about Checking Mast details and obtaining the relevant information. However, as a SPOC doesn’t decide what evidence should or shouldn’t be required for a criminal investigation, the SPOC should be asked to obtain this information.
.
The Masts
Below is an image (a) which displays a Mast's radio coverage for a particular Cell ID illuminating in a westerly direction towards a block of flats.

Image (a)

.
The next image (b) below displays the same Mast (as above) relating to radio coverage with its associated Cell ID but this time the radio coverage is illuminating in an easterly direction, in the opposite direction towards a house.

Image (b)
.

For the purposes of this discussion the Mast is shown close to the properties in both images. This was done for artistic purposes and is not intended to mean the Mast is actually that close to both properties. Also an actual Cell ID has not been shown but the inference about Cell ID being relevant is inferred by the presence of radio coverage being displayed.

.

Criminal Case
Imagine if you will that on a particular date, let us say the 30th March 2008, a dead body is found in the house, shown in image (b). The police have been alerted to the property by a neighbour because of a dreadful smell emanating from the direction of the house. Upon entering the property the police find a decomposing body of a woman on the floor. The Pathologist is called and indicates, following assessment of the decomposing body, that the body had been dead for approximately two weeks. That would generate a time line back to Tuesday 16th March 2008.

.

The police conduct door-to-door enquiries and one neighbour next door but one mentions that two weeks ago as she passed the house there was shouting emanating from inside the property and cries for help. The neighbour thought nothing more of it because the couple that lived there had regular arguments, which the neighbours and passers-by could overhear.

.
The police asked the neighbours had they noticed anything else? One lady who lived a few doors away replied that she looked out of her window and that she had seen the man that lived there leave the property at about 8.30pm, and that would have been a Tuesday, and funnily enough that was about two weeks ago.

.

To cut a long story short, the police found the man who lived in the house a month later, seized his mobile telephone and having retrieved his mobile telephone subscriber details, obtained call records and identified the Masts that routed mobile calls to and from his mobile phone. From the records it was noted that two weeks before the body was found his mobile had used a Mast for a call (on Tuesday at 8.00pm), the Mast was sited 2.4Km away from where he lived with his partner. This was also the nearest Mast to the house.

.

The police called for radio test measurements to be conducted outside the house three weeks later. The time-span from the estimated time of death to radio testing was approximately 9 weeks. The radio tests confirmed that the Cell ID recorded in the call records is the same as detected outside the house.

.

The man, during questioning, confirmed he had not been back to the house since leaving on the Saturday. That being the Saturday prior to the Tuesday when it is approximated the death took place. He had also been living in a Bedsit because the relationship with his partner had irrevocably broken down and they had agreed to split and go their separate ways.
.
The police believed from the evidence that they had thus far that it was enough to hold the man, now a suspect, and the death case turned into a murder case. The evidence they relied upon was:

.

1) The neighbours hearing regular arguments and cries for help on the fateful day
2) The neighbour that says she saw the suspect leaving the house at 8.30pm
3) The call records that shows a call on the Tuesday from the suspect's mobile telephone using a Cell ID from a Mast that is sited 2.4Km away and is the nearest Mast to the house
4) The radio test measurements that show the Mast’s coverage, thus Cell ID, used by the suspect's mobile phone illuminated outside the house.

.

So at minimum there appears to be four good pillars of evidence. However, when the radio test measurements were conducted no checks had been made with the mobile operator whether any changes had been made to the Masts in the area prior to radio test measurements being conducted. It subsequently came to light at trial that the Cell ID illuminating towards the house (image (b)) had only been illuminating eastwards towards the house from Thursday 18th March 2008 after the alleged murder due to changes at the Mast. Prior to that date the Mast had been illuminating westwards, towards a block of flats (image (a)).

.

Impact on Criminal Case
So when the police had noted from the suspect's call records that over the last few months they showed the suspect's mobile phone using a particular Cell ID for mobile calls that the police thought could be made or received from the house, they were mislead and operated under a false assumption. The suspect had, in fact, been having an affair with a married woman in the block of flats (image (a)) and didn't want to say anything for fear of reprisals from the woman’s husband who was known to have a temper and may take it out on the woman if she was called as a witness. It was this affair that the victim, when she was alive, and been tipped off about some months earlier and the cause of the couple constantly arguing.

.

The lack of discovery about any changes to a particular Mast prior to conducting radio test measurements impacted on the case by:

.
- the test results, that should add value to a case, were inaccurate and unhelpful- introduced delays into an investigation as the test results steered the police investigation in the wrong direction
- operational man-hours increased
- operational costs increased
- worst still, a false allegation of murder was made against an innocent person

.

As to the other pillars of evidence: 3) and 4) were no longer valid and the woman with whom the suspect was having an affair corroborated the dates and times she was with the suspect. As to 1) and 2)? On the fateful day, 1) the argument that was heard by a neighbour turned out to be the victim's ex-boyfriend from a previous relationship whom she had given evidence against him for drug dealing, some 5 years earlier, and who had been released from prison 20 days before the murder. He had vowed to seek revenge against the victim. 2) The neighbour who saw the suspect at 8.30pm at night in fact saw a silhouette of the man she thought was the suspect because it was 8.30pm at night and her eyesight wasn't as good at night. The silhouette leaving the house was the ex-boyfriend leaving after having murdered his ex-girlfriend.

.

Further Observations

In consequence, by not checking with the operator about their Masts prior to conducting radio test measurement caused lost investigation time to find the real culprit, unnecessary redundant evidence, increased costs, investigation time increased exponentially, apart from wrongly accusing a person. Moreover, as checking the Masts is a well known procedure, not to have checked it during an investigation may amount to act of intent to plant evidence to create incrimination against someone by using an act of deliberate omission during an investigation.

.

This is only a hypothetical discussion, but if these acts were operated in reality on a regular basis in criminal cases and applied as policy in widespread use across England, it may potentially lead to £20 millions in retrials. Of course that shouldn’t be possible arising from the 'Golden Rule' of disclosure, enunciated by Lord Bingham in R -v- C & H (February 2004), when he said that ‘fairness requires that full disclosure should be made of all material held by the prosecution that weakens its case or strengthens that of the defence’. The test is an objective one and is grounded on what is ‘reasonable’. However, the guidance makes it plain that an expert witness is no longer to be trusted to exercise his or her own judgment in deciding what falls within this definition and what is and is not relevant.

.

It is the influence of the Golden Rule placing affirmative duties on the prosecution from 2004 onwards that safeguards the reliability of evidence in criminal cases. That suggests were Her Majesty's Inspectorate called upon to require the prosecution tomorrow to provide, from randomly selected 200 cases from across the country by the Inspectorate, documents of enquiry to a particular operator seeking to be notified of any changes to a particular Mast in a particular case and the documented response received from the operator, they could do so.

.

That doesn't mean to say if the prosecution mobile telephone case has 50 Masts used for calls that documentation for each of the 50 Masts would be necessary, as rarely are all Masts relevant to an alleged crime, anyway, and a large proportion being used for padding simply to show movement. The relevant Masts are those where the Masts and coverage can illustrate that the mobile telephone or telephones could potentially be at the scene of crime, which on the whole usually relates to the last three to six Masts nearest the scene of crime. Besides I couldn't see the prosecution being hoodwinked into believing that because there are 50 Masts in a case that the number amounted to far too many enquiries to be made to the operator and so didn't make any enquiries at all.

.

As I have mentioned above this is purely hypothetical, but hopefully it illustrates the importance of Checking Masts before conducting radio test measurements.

.