Showing posts with label wcdma. Show all posts
Showing posts with label wcdma. Show all posts

Tuesday, September 23, 2014

CSA - Site Survey Method/LTE-UMTS SIBs

There is a huge volume of materials and standards to be considered when undertaking study or work as an InnerCity CSA (ICCSA) expert, technician or student. However, the materials and standards referred to at my webblog aim to control the flow of such volumous information and provide instead an easy guide to seeking out the information experts, technicians or students can be exposed to when involved with ICCSA.

A highly defined smartphone etc can be offered services by a range of mobile network access systems e.g. GSM, GERAN, UTRAN, e-UTRAN etc when switched ON and actively in use or in idle mode. Access system information for LTE and UMTS are mapped in System Information Blocks (SIBs). When conducting ICCSA test measurement it is useful to identify which broadcasted SIBs contain data to help understand the survey results. Knowing the content allocated to SIBs can assist enormously in interpretation and when considering the propositions highlighted in the previous discussion thread - http://cellsiteanalysis.blogspot.co.uk/2014/08/csa-site-survey-method4cell-types.html



Below are commonly referred to LTE/UMTS SIBs. GSM and GERAN data are mapped to System Information Types that will be given in the next discsssion.

LTE System Information Blocks
***************************
SIB 1 contains PLMN identity, tracking area code, and CI of the broadcasting cell. Q-RxLevMin minimumRSRP threshold that a broadcasting cell should be measured before initial cell selection, and later for random access performed by UE. SIB Mapping Info included to inform the UE which SIBs are transmitted and how they are scheduled.

SIB 2 contains timers and constants, access barring information, UL frequency information, and UL bandwidth information.

SIB 3 contains parameters for the cell reselection procedure.

SIB 4 contains neighbour cell information for intra-frequency cell reselection.

SIB 5 contains information for interfrequency cell reselection.

SIB 6 contains information for inter-RAT cell reselection to the UTRAN.

SIB 7 contains information for inter-RAT cell reselection to the GERAN.

SIB 8 contains information for inter-RAT cell reselection to CDMA2000.

SIB 9 is used to broadcast the home eNB name (HNB name).

SIB 10 and SIB 11 can be used to broadcast warning information to subscribers (e.g. tsunami warnings).

SIB 12 assigned for Commercial Mobile Alerting System (CMAS) information usage


UMTS System Information Blocks
*****************************
SIB 1 NAS System Information, UE Timer and counter for RRC idle and connected mode

SIB 2 URA Identity

SIB 3 Parameter for Cell Selection and Cell Reselection

SIB 4 Parameter for Cell Selection and Cell Reselection in RRC connected mode

SIB 5 Parameter for configuration of Common Physical Channel (CPCH) of actual cell

SIB 6 Parameter for configuration of Common and shared Physical Channel of actual cell

SIB 7 Fast changing parameter for uplink Interference and Dynamic Persistent Level

SIB 8 Static CPCH Information of actual cell [FDD only]

SIB 9 CPCH Information of actual cell [FDD only]

SIB 10 Information for UE, which DCH is controlled by Dynamic Resource Allocation Control Procedure

SIB 11 Measurement Control Information of actual cell

SIB 12 Measurement Control Information of actual cell in RRC connected mode

SIB 13 ANSI-41 System Information

SIB 13.1 ANSI-41 RAND Information

SIB 13.2 ANSI-41 User Zone Identification

SIB 13.3 ANSI-41 Private Neighbour List

SIB 13.4 ANSI-41 Global Service Redirection

SIB 14 UL outer loop power control information for common and dedicated physical channels in RRC idle and connected mode

SIB 15 Information for UE positioning method

SIB 15.1 Information for UE GPS positioning method with Differential Global Positionig System (DGPS) correction

SIB 15.2 Information for GPS Navigation-Model

SIB 15.3 Information for GPS Almanac, ionospheric and UTC Model

SIB 15.4 Ciphering Information of SIB 15.5

SIB 15.5 Information for OTDOA UE positioning method

SIB 16 Information of Radio Bearer, transport and physical channels for UE in RRC idle or connection mode in case of Handover to UTRA

SIB 17 Fast changing parameter for the configuration of Shared Physical Channels in RRC conected mode [FDD only]

SIB 18 PLMN Identifies neighbour cells

Tuesday, August 19, 2014

CSA - Site Survey Method4/Cell Types

Cell types
GSM reports, as far back as 20 years ago, distinguished three kinds of cells as the growth in GSM installations massively increased following popularity as a preferred digital cellular network: large cells, small (mini) cells and micro cells. The main difference between these kind of cells lay in the cell range, the antenna installation site, and the propagation model applying to each of them. Moreover, these cells could be overlayed one on top of another to provide coverage for varying traffic conditions and illustrated in the previous discussion http://cellsiteanalysis.blogspot.co.uk/2014/07/csa-site-survey-methodmobility-models.html.

CSA has been subjected to understanding cell layer tiering involvement in a particular geographical area and what impact the finding of tiering might have determined from radio test measurement results, and what impact the results might infer for a particular investigation. In the previous discussion on Mobility Models it highlighted a simple issue: why walk tests are important to mimic the pedestrian's experience of obtaining mobile services. Germane and relevant, whilst the mobile networks are highly intelligent networks and use memory and memoryless in their propagation models, CSA examiners, students and experts cannot apply intelligent algorithms in the manual function of their work when conducting site surveys. It is, therefore, necessary to distinguish processes and procedures hidden within the intelligent network functionality that provide us (CSA examiners, students and experts) with knowledge that helps us gain skills and experience in the performance of the work we do.

So  we know "walk tests" are unavoidable (thus inescapable) forming part of the methodology we should apply, where relevant, during site surveys. Whilst this requirement is a basic simple binary style approach to CSA that doesn't mean to suggest mobile networks aren't sophiscated, convoluted, NASA style complex system because mobile networks are very much the latter. These grass root levels are important to CSA. For instance a GSM mobile network may use Cell Selection Procedures C1 and C2. The network can use components from C2  (cell reselection) to identify coverage for a slow moving mobile (e.g. pedestrian/walk test) which can be used to understand the microcell coverage. Drive testing equally needs to be represented for the benefits it provides for CSA.



    



Above, three tiers of cell coverage have been illustrated. Microcells are distnguished as a cell type because predominantly this type of cell in GSM (or CDMA for that matter) is usually represented as localised coverage to a small area. Pedestrian is seen as relevant to it. However, vehicular mobile usage is largely predicted within the network as "fast moving". Let us take the case of the getaway car speeding away from the scene of crime. Would it not seem strange to you to find the target's mobile phone call records identifying a number of Microcell IDs designed to cope with long dwell time in an area associated with slow mobile movements (e.g.5~10mph) compared with Macrocell umbrella coverage designed to handle accelerated speeds (e.g. 30~70mph). Why would the getaway car be driving so slowly after a crime, unless the *bogey wanted to be caught red-handed and why s/he commited the crime in the first place just to be arrested? On first blush of the call record evidence it wouldn't make sense.

*The term bogey has been adopted from the military theatre of war identification procedure representing an un-identified (unknown criminal) target, whereas a bandit is an identified (known criminal) target. In criminal investigations the latter can also suggest surveillance in progress on the target's activities.

But drive testing can throw up unexpected issues. CSA demands keeping an open mind and, as previously mentioned at my blogs, CSA examiner, student and expert should be "not only be environmentally aware, but equally be environmentally astute." A case I dealt with in the North of England concerned a series of smash-n-grabs at wholesale and retail outlets.  From my radio tests I suggested the radio evidence did not follow the getaway route the police required that I test. CSA involves noticing factors that could impede or record a particular route. In this case a speed camera that was in lock-n-load (active) to capture speeding vehicles was located at an early stage on the suggested getaway route. When I asked did the speed camera record a speeding violation, the response came back "no", yet the ascertion by the police was the getaway vehicle was speeding. However, the radio test measurement survey along the complete route did not entirely match the cell IDs in the call records either as some of the cell IDs were for slower mobile traffic and cells covering a middle layer coverage area and the use of these cells suggested the mobile dwell time was not travelling outside a certain geographical area. Eventually, a more senior detective suggested a route that veered away from the first route getaway route. My attention was drawn to an area inbetween local buildings, a mud track leading to a field and a nearby cemetary and housing estate. Infact the bogeys turned out to be previously known bandits and the entire operation of the smash-n-grabs was orchestrated from a house on the estate sited perfectly for comings and goings for the many crimes but quite hard to detect. CSA played an effective part to support other evidence and intel.       




However, umbrella macrocell coverage in a geographical location can be used to support high speed getaways e.g. where CCTV has recorded or an eyewitness had seen the getaway vehicle speeding through dense urban area. Given the speed of the vehicle the network would be detecting the mobile's short dwell time in that area. The omission of use of overlayed microcells providing limited area coverage is a suggestion of fast moving traffic. The use of a macrocell would not be out of place supporting the notion of a fast moving mobile. This can be stated in relation to the density of non-used microcells and their cell boundarys compared to macrocell cell boundaries and, of course, any location updates, time, velocity etc.

Since 2010 Cells types have rapidly moved on with a split between voice/data and data-only cells transforming the way CSA is and will be conducted in the future. For instance, there are increases in carriers (2G frequencies allocation migrating (re-use) to 3G frequencies allocation) Moreover, with LTE linking with WiFi/WLAN etc there are enormous advantages and dis-advantages that have crept into CSA site survey methodology.

 
The impact of these changes requires improved comprehension about the various cells and as higher frequencies are used or are brought into use cell coverage gets smaller. This fact is a benefit because the approximated location of the mobile is improved and significantly improves where smaller cells are relevant. It may not be GPS accuracy but there seems no reason why it could not meet justification under an e.g. Daubert test. Furthermore, it doesn't means CSA should jettison early styles of CSA site survey method which will remain relevant for some years to come. But CSA will become even more localised creating a specialism in InnerCity CSA (ICCSA) compared with rural CSA. A beneficary of  ICCSA knowledge will be the neuromancer cybercrime arena utilising our forensic and investigative skills to comprehend the technicality behind a suspected crime defined by the outcome from particular usage of technology.

Site survey methods do not have to be overly complicated, merely identify the radio technology at given points and by using a structured appraisal, distinguishing each wireless carrier available at particular geographical locations, to show the relevance to an investigaion or crime scene.

So what are the potentially inter-connected Cell types that fall within the scope of CSA large cell and small cell environments:

Macrocells
Minicells
Microcells
Metrocells
Picocells
Nanocells
Femtocells
WIMAX cells
WLAN cells
WiFi cells
etc

And in support of that environment it should not under-estimate the importance of devices capability from providing services and to accessing services. This mean from not simply the network, but the radio network e.g. BTS/(e)NodeB/H(e)NB etc to the enhanced (U)SIM and handset terminal. That requires knowning which Release (R) is relevant to the investigation:

R99    (Release 1999)
Rel-4    (Release 4)
Rel-5    (Release 5)
Rel-6    (Release 6)
Rel-7    (Release 7)
Rel-8    (Release 8)
Rel-9    (Release 9)
Rel-10    (Release 10)
Rel-11    (Release 11)
Rel-12    (Release 12)  
etc

Sunday, November 03, 2013

Directed Retry

A fundamental and vital goal of any mobile communication network is to maintain communications between the network and the mobile station (MS), whether the MS is dwelling in an area or on the move. To assist the aims and objectives GSM is commonly known to use 'Handover' for which there is a specific GSM standard TS03.09 [cf W-CDMA see 3GPP TS23.009].

The assumption being made for these cause values is that the MS is seeking to obtain a service for speech calls

│7 6 5│ 4 3 2 1│ │

│0 0 0│0 0 0 0│ │Radio interface message failure │

│0 0 0│0 0 0 1│ │Radio interface failure │

│0 0 0│0 0 1 0│ │Uplink quality │

│0 0 0│0 0 1 1│ │Uplink strength │

│0 0 0│0 1 0 0│ │Downlink quality │

│0 0 0│0 1 0 1│ │Downlink strength │

│0 0 0│0 1 1 0│ │Distance │

│0 0 0│0 1 1 1│ │O and M intervention │

│0 0 0│1 0 0 0│ │Response to MSC invocation │

│0 0 0│1 0 0 1│ │Call control │

│0 0 0│1 0 1 0│ │Radio interface failure, reversion to old channel │

│0 0 0│1 0 1 1│ ││

│0 0 0│1 1 0 0│ │Better Cell │

│0 0 0│1 1 0 1│ │Directed Retry │

│0 0 0│1 1 1 0│ ││

│0 0 0│1 1 1 1│ │Traffic

Key and germane to handover being successful is that operators can use various handover techniques controlled by handover triggering algorithms. These triggers activiate when detection mechanisms identify propagation or network conditions at the existing cell or for the target cell where neither meet a set criteria for usage. One such condition is referred to by Professor Sami Tabbane in Management of Radio Mobility: The Handover Procedure - 8.1.4.2 Intercell and Intra-BSC Handover "A handover that is triggered for reasons of traffic loading and occurs during call setup is called directed retry." 

Examiners are expected to know about Directed Retry, to take account of its possibility when conducting CSA (cell site analysis) investigations and understand its influence and impact on evidence record in call records and associated cell data. A point of contention in evidence for often arises where a defendant states "I was not at the location claimed by the prosecution but was in a different area". Invariably this receives a response "Why does your mobile use the radio coverage from a particular sector (azimuth) from a particular fixed mast (BTS)?" Directed retry makes possible the scenario of having a mobile phone in an adjacent cell from the one shown in the call records. Directed Retry is not a trigger simply triggering every few minutes but arises as Professor Tabbane records, due to traffic loading at the time of call setup.

A mistake that experts and investigators could make would be to ignore the existence of Directed Retry and, even more problematical, not to have asked the question was Directed Retry active at cell/BSC level at the material time of the calls, apart from any intervention within the network.

GSM standards make Directed Retry explicit that which might be implicit to for a GSM radio location area. This logically raises questions how can Directed Retry be configured and activated? Mobile network radio equipment manufacturers offer the capability in their equipment for mobile network engineers to radio fine tune post-installation, and the parameters that can be fine tuned are the Handover triggers of which Directed Retry is one such trigger:




As each equipment manufacturer vary the way fine tuning may be implemented using a GUI to input the trigger parameters is one methiod. Another is to incorporate data into the .mdb or .xls file which has been scripted to produce e.g. an .xml output for uplifting to the radio base station database. This means Directed Retry can be checked that it is active in a particular GSM radio location area. Furthermore, due to continuing radio fine tuning updates to the trigger parameters can occur and older versions of .mdb/.xls maybe recovered from archive.

Experts and Investigators will need to be aware of the triggers Directed Retry (DR) and Forced Directed Retry (FDR) and identify when, in a mobile network, either of these triggers would be implemented and activated for the radio network. This equally means tracking down the equipment manufacturers that offer one form or another or both forms of Directed Retry.

Sunday, October 20, 2013

MTEB CSA Fundamentals Training

The MTEB has received an increase in the number of enquiries about fundamental (core) training in Cell Site Analysis.

It could be useful for readers to be reminded in brief, scoping CSA requires applying a wide-ranging methodology incorporated in the investigation and analysis of mobile device activity and mobile communications. That means a CSA participant needs to understand:

- the science operating behind and underpinning CSA
- identifying forensic stepping stones for CSA
- evidence produced for CSA
- reporting on the findings from the conducted CSA.

None of the MTEB subject headers (below) on the course for each of the sections takes precedence over another as all topic elements in the course requires the investigator/examiner/expert to:

- constantly balance and accommodate all of the investigation elements and lines of enquiry
- correlate constants vis-a-vis ambiguities and determine the findings in each of the topics and confirm what the combined findings mean from all topics when aggregrated
- findings should support and cooroborate / deny and disprove the investigation outcome set out in the engaging party's instructions.

MTEB Cell Site Analysis Fundamentals Course
[]GSM []GSM/(W)CDMA/ []GSM/(W)CDMA/LTE []Other Bespoke Networks

Section 1 Introduction - CSA Fundamentals
Section 2 Legal and Technical Frameworks
Section 3 Guidelines, Specifications, Standards. Reference Sources etc
Section 4 PLMN - Mobile Network Installation and Mobile Elements
Section 5 Originating evidence
Section 6 Cross-referencing originating sources of evidence
Section 7 Techniques/skills for Cell Site Identification
Section 8 Techniques/skills for Cell Site Analysis
Section 9 Techniques/skills for Radio Results Analysis
Section 10 Final Analysis and Reporting

Saturday, September 14, 2013

sim2usim


Examination and Evidence from SIM and USIM Cards. Now an open blog. 

http://sim2usim.blogspot.co.uk/


(U)SIM Examination (Physical) Pt1

(U)SIM Examination (Physical) Pt1

We begin with GSM as this is the original starting place where examiners first learned about subscriber identity modules (SIM). There are many ways to learn about SIM: using a SIM reader tool is one way, receiving instruction during training that concentrates on the types of user and network data that can be harvested by examiners. An education and training process can equally include a training module or modules on the physical aspects of a card and identify, for the examiner, material parts of the SIM, the known routes to understanding electrical aspects, processing aspects, storage geometry and memory mapping, so on and so forth. The thinking here is analogous to the way in which there is an expectation that a computer examiner would understand HDD disc geometry, clusters and sectors, BIOS etc even before entering into the search and study of the 'content' that may be recorded on the disc. It is or should be the same for (U)SIM.

The SIM Card can be seen as a composition of at least three constituent parts:

- The physical card (the storage carrier).
- An integrated circuit card micro-processing chip (the operating system and content storage device).
- The subscriber identity module; an area of physical memory allocated at manufacturing for pre-market and post-market recording by the mobile network operator and SIM user.
 -  A fourth constituent part could be a Card with an etched antenna for RFID/NFC for use by (US)SIM (but this part is not included or discussed at this stage).
- etc

To enable test and inspection of these constituent parts GSM approved and adopted GSM11.17 to assist manufacturers, operators and service providers help formalise and uniform the test and inspection procedures rather than have a mish-mash of randomly selected tests for SIM cards submitted for use in GSM. The former is highly desirable as the goal of GSM has always be about interconnection-compatiblity and interconnection backward-compatibility. By way of illustration, a GSM SIM Card Phase 1 should still be able to be inserted into a GSM Phase 2+ mobile device and allow communications to take place, unless the operator or device manufacturer has declared and stated otherwise.

From an examiner's viewpoint we would desire to know how those three constituent parts translate to the work we do? Some examples are set out below

Physical Card
Due to the form factors used in GSM we can make assessment to determine the supply chain and manufacturer of the card itself. We look at the card to see if has been cut down for use and any attempts of anonymity by removal of the SIM Serial Number (SSN) compared to manufacture polarisation techniques. Later 3G/LTE USIM Cards have undergone some changes since GSM's inception; the latter will be dealt at a later date.


 Image courtesy of wikipedia - http://en.wikipedia.org/wiki/Subscriber_Identity_Module

ICC Chip
Manufacturer and technical specification are important to determine a range of potential evidence, including release into the marketplace and technological and electronic capability. Clearly the geometry and memory mapping are important. There are various techniques to deal with a card with a damaged chip. One example is called 'acid-etching' used to gain access to the physical chip itself by removal of the outer protective coverings used in the manufacturing process. 

 
  Image courtesy of wikipedia - http://en.wikipedia.org/wiki/Subscriber_Identity_Module

Physical Memory
Determining geometry and memory mapping forms part of the testing and inspection process set out in GSM1117. We can use these procedures to formulate a forensic analysis programme, similar to the way in which computer forensic examiners seek to determine specifically data discovered and recovered from a particular memory location on the HDD and define the data from its binary and encoded states and any formatting that may be applicable to the data. That being so, would it be out of the question in SIM examination terms for the EFBCCH file to be formatted as .bmp?  Below are a set of powerpoint slides I have prepared so that examiners can comprehend procedures approved and adopted for test and inspection for GSM SIM Cards. Later on when we 3G/LTE (U)SIM this GSM starting point assists formulate how to identify differences between the various (U)SIM/LTE cards but equally identify expansion of technology services and content so the examination limit or avoid omissions during the investigative/evidential process.      













































Friday, August 23, 2013

Operational Audit Check (OAC) is part of Cell Site Analaysis (CSA)

Cell Tower Fire 
 














There is a news aticle on News96.5.com about a mast (US cell tower) that caught figure during an install/maintenance work (http://www.news965.com/news/news/local/cell-phone-tower-burning-could-fall/nZYBg/). The article provides us with a useful reminder when conducting cell site analysis (CSA) to remember to conduct an operational audit check (OAC) and request confirmation that the target mast and the density of support radio coverage masts in the immediate area were all operational at the material time. This should be requested as soon as practicalable to do so.

Invariably, an event (e.g. a serious crime) requires instant action and requires, if relevant, knowing the cell coverage at the scene of crime (SoC) and the coverage in surrounding areas (e.g. identifying potential get away routes). It could impact the investigation if an OAC is not conducted regarding the density of surrounding masts and it later comes to light a mast was out of commission for a period and other masts in trh surrounding area had their coverage increased.

In some cases, it may not be possible at short notice to draught-in coverage from other masts and a radio black spot may occur. This, too, is in important to anticipate and be considered when analysing call records, road networks and the density of masts (thus coverage) upon the landscape. Moreover, if the out of commission mast is at a central location of a road network or town/city, consider also the base stations delivering small cell/micro cell coverage. Many of these base stations have their antennas tilted. There are two types of tilt commonly available: electrical and mechanical. Electrical tilt enables the network to remotely alter the tilt angle of the antennas. Mechanical tilt requires an engineer to visit site and mechanically alter the antenna tilt. Here again, not considering these points could mean an investigation can include arriving at erroneous conclusions that may be uncovered later on.

My experience of performing OAC for particular cases can vary from the experience of others. I am not able to say why information I have found was available was not accessible to other experts/investigators. It seems to me that an illustration of the information that supports the above comments I made should be demonstrated. I have hidden some cell site/mast details from the data served in a particular case, that of site name, address and NGR, as this relevation is not necessary to specifically identity the cell site/mast details in that particular case. However, it is assumed that site name, address and NGR are standard details that form part of the request of the information sought from a particular operator.



Below is further reading material I hope you will find helpful, which I have produced here at the blog in the past, and that the events/actions mentioned in them might provide further support or clarity to you about the issues discussed above or during an investigation.

LTE, Test Trials and Cell Site Analysis
http://trewmte.blogspot.co.uk/2012/10/lte-test-trials-and-cell-site-analysis.html

CSA - R&TTE Directive
http://trewmte.blogspot.co.uk/2012/06/csa-r-directive.html

GSM Mast Installations (Density)
http://trewmte.blogspot.co.uk/2008/06/gsm-mast-installations-density.html

Basic Terrain Plot, GPS & CSA
http://trewmte.blogspot.co.uk/2011/11/basic-terrain-plot-gps-csa.html

CSA: From Ockham's (Occam's) Razor to Checking Masts
http://trewmte.blogspot.co.uk/2008/11/csa-from-ockhams-occams-razor-to.html

Cell Site Analysis (CSA) Images
http://trewmte.blogspot.co.uk/2009/08/cell-site-analysis-csa-images.html

Cell Site Analysis (CSA) Images Part 2
http://trewmte.blogspot.co.uk/2009/08/cell-site-analysis-csa-images-part-2.html

Cell Site Analysis (CSA) Images
http://trewmte.blogspot.co.uk/2009/08/cell-site-analysis-csa-images.html

Mobile Phones and Fringe Coverage
http://trewmte.blogspot.com/2008/11/mobile-phones-and-fringe-coverage.html

Evolving Cell Site Analysis (CSA)
http://trewmte.blogspot.co.uk/2011/05/evolving-cell-site-analysis-csa.html

Mini Course in Cell Site Identification (Pt3.s2)
http://trewmte.blogspot.co.uk/2012/04/mini-course-in-cell-site-identification.html

Mini Course in Cell Site Identification (Pt3.s1)
http://www.trewmte.blogspot.co.uk/2012/01/mini-course-in-cell-site-identification.html

Mini Course in Cell Site Identification (Pt2)
http://trewmte.blogspot.com/2011/12/mini-course-in-cell-site-identification_31.html

Mini Course in Cell Site Identification (Pt1)
http://trewmte.blogspot.com/2011/12/mini-course-in-cell-site-identification.html

Saturday, March 30, 2013

(U)SIM Examination (Physical) Pt1

(U)SIM Examination (Physical) Pt1

We begin with GSM as this is the original starting place where examiners first learned about subscriber identity modules (SIM). There are many ways to learn about SIM: using a SIM reader tool is one way, receiving instruction during training that concentrates on the types of user and network data that can be harvested by examiners. An education and training process can equally include a training module or modules on the physical aspects of a card and identify, for the examiner, material parts of the SIM, the known routes to understanding electrical aspects, processing aspects, storage geometry and memory mapping, so on and so forth. The thinking here is analogous to the way in which there is an expectation that a computer examiner would understand HDD disc geometry, clusters and sectors, BIOS etc even before entering into the search and study of the 'content' that may be recorded on the disc. It is or should be the same for (U)SIM.

The SIM Card can be seen as a composition of at least three constituent parts:

- The physical card (the storage carrier).
- An integrated circuit card micro-processing chip (the operating system and content storage device).
- The subscriber identity module; an area of physical memory allocated at manufacturing for pre-market and post-market recording by the mobile network operator and SIM user.
 -  A fourth constituent part could be a Card with an etched antenna for RFID/NFC for use by (US)SIM (but this part is not included or discussed at this stage).
- etc

To enable test and inspection of these constituent parts GSM approved and adopted GSM11.17 to assist manufacturers, operators and service providers help formalise and uniform the test and inspection procedures rather than have a mish-mash of randomly selected tests for SIM cards submitted for use in GSM. The former is highly desirable as the goal of GSM has always be about interconnection-compatiblity and interconnection backward-compatibility. By way of illustration, a GSM SIM Card Phase 1 should still be able to be inserted into a GSM Phase 2+ mobile device and allow communications to take place, unless the operator or device manufacturer has declared and stated otherwise.

From an examiner's viewpoint we would desire to know how those three constituent parts translate to the work we do? Some examples are set out below

Physical Card
Due to the form factors used in GSM we can make assessment to determine the supply chain and manufacturer of the card itself. We look at the card to see if has been cut down for use and any attempts of anonymity by removal of the SIM Serial Number (SSN) compared to manufacture polarisation techniques. Later 3G/LTE USIM Cards have undergone some changes since GSM's inception; the latter will be dealt at a later date.


 Image courtesy of wikipedia - http://en.wikipedia.org/wiki/Subscriber_Identity_Module

ICC Chip
Manufacturer and technical specification are important to determine a range of potential evidence, including release into the marketplace and technological and electronic capability. Clearly the geometry and memory mapping are important. There are various techniques to deal with a card with a damaged chip. One example is called 'acid-etching' used to gain access to the physical chip itself by removal of the outer protective coverings used in the manufacturing process. 

 
  Image courtesy of wikipedia - http://en.wikipedia.org/wiki/Subscriber_Identity_Module

Physical Memory
Determining geometry and memory mapping forms part of the testing and inspection process set out in GSM1117. We can use these procedures to formulate a forensic analysis programme, similar to the way in which computer forensic examiners seek to determine specifically data discovered and recovered from a particular memory location on the HDD and define the data from its binary and encoded states and any formatting that may be applicable to the data. That being so, would it be out of the question in SIM examination terms for the EFBCCH file to be formatted as .bmp?  Below are a set of powerpoint slides I have prepared so that examiners can comprehend procedures approved and adopted for test and inspection for GSM SIM Cards. Later on when we 3G/LTE (U)SIM this GSM starting point assists formulate how to identify differences between the various (U)SIM/LTE cards but equally identify expansion of technology services and content so the examination limit or avoid omissions during the investigative/evidential process.      


















































Monday, November 26, 2012

US Handset Serial Number Databases

US Handset Serial Number Databases

US operators maintain their own stolen and blacklisted cellphone databases. As of the 31st October 2012 the GSM operators AT&T and T-Mobile began sharing their databases. CDMA operators Verizon and Sprint have taken the decision to merge their databases but that will not be complete until November 2013, so we are told.

The said objective of these initiatives are to improve track and trace. As an example, GSM uses a 56-bit decimal digit s/n, whereas CDMA uses a 56-bit hexadecimal digitals s/n. However, in the US there are variations of s/ns to consider.

The engine for these changes is driven by the FCC initiative - http://www.fcc.gov/document/announcement-new-initiatives-combat-smartphone-and-data-theft

To accommodate this and other cellphone/cellular changes I have altered my CDMA training material and GSM training material. As consequence these changes will also have an impact on WCDMA and LTE, either on a national level or international level. These training materials have also changed, too.

_________________
Institute for Digital Forensics (IDF) - LinkedIn
Mobile Telephone Examination Board (MTEB) - LinkedIn

Tuesday, October 30, 2012

LTE 4GEE

LTE 4GEE

As Orange/T-Mobile has launched Everything Everywhere (EE) 4G/LTE ahead of the other major UK MNO players I took a web-stroll over to their website to look at their coverage checker.

https://explore.ee.co.uk/coverage-checker

Improving the coverage checker maps
I made several post code area searches to familiarise myself how coverage is presented. It isn't up to much at this stage. Too much vague generality, whereas customers, I think, would much prefer to see a single cell coverage map for each BTS/NodeB/eNode (or Mast, so to speak) identifying signal strength (defined by colours) coverage every 100-metres (small cell) or 500-metres (macro-cell) or in the alternative coverage including coloured signal strength upto the equal power boundary.   


Skyfall, MI5 and MI6
During my search I looked at various locations and, as I have recently been to see the latest Bond 007 Film, 'Skyfall' ('excellent' is my rating), I wondered what MI5 and MI6 coverage would be like? A quick web search for the addresses and enter post code to EE's website and here is coverage to MI5 HQ:


Naturally, they get excellent coverage.

Monday, July 16, 2012

The Art of Mobile Jamming Pt 2 (c)2012

The Art of Mobile Jamming Pt 2 (c)2012

Part 1 - http://trewmte.blogspot.co.uk/2012/07/art-of-mobile-jamming-pt-1-c2012.html

In Pt 2 the discussion highlights some confusing legal issues that this Bill may need to resolve if it is to be transformed into legislation such that the technical criteria and application of testing jammers might be adopted.


UK legal observations
The advice recorded at Ofcom's website does not specifically define illegality with respect to possession of a Jammer, merely the 'installation' or 'use'. If  such a device was illegal to be in the 'possession' of anyone in the UK none of the retail shop outlets would be able to stock such device. The fact they are sold through outlets is on the basis for export sales etc and therefore  the lawful requirements in this area is unclear if those outlets need to demonstrate a working product. Ofcom have authorised the use of Jammers but under strict conditions and the enforcement how Jammers are being sold and used is largely policed through market surveillance and/or complaint.

One clue regarding the absence of that approval for jammers maybe due to a general legal approval for purpose-built jammers; that is in context when thinking about what is and what isn't 'acceptable' regarding the source of interference.  That may also be understood from omission of official recognition of this type of devices by an approved name, the same way mobile phones are officially identified and recognised:- e.g mobile phones can be found in historical materials, such as Phase II Directive 91/236/EEC and, currently, in the Radio and Telecommunications Terminal Equipment Directive (R&TTE), 1999/5/EC of the European Union. This legislation sets out essential requirements applicable to radio & telecom terminal equipment and places the burden of responsibility for their compliance on those involved in their design, manufacture and supply to and into the EU members' markets. Given that this article is relevant to Bill 15 introduced to the House of Commons on 20 June 2012 is titled PRISONS (INTERFERENCE WITH WIRELESS TELEGRAPHY) BILL it makes sense to conform that the 1995/5/EC has been implemented into UK law through The Radio Equipment and Telecommunications Terminal Equipment Regulations 2000 (SI 2000 No.730) and amendments SI 2003 No.1903 and SI 2003 No.3144.

Why should that make sense? Because Bill 15 seeks to introduce the legality for use of jammers where the jammer is of an 'apparatus' type, thus may need technical definition for that purpose. For instance when defining mobile telephones the R&TTE Regulation has relevance to them because it covers apparatus that are both RE (radio equipment) and TTE (telecommunications terminal equipment) and mobile telephones are defined as being both RE and TTE.

Jammers might need some form of recognition as a basic RE apparatus, if nothing. Why? Because how will the government determine:

(i) the sale to government and the procedural path for government to purchase?
(ii) who will resolve disputes/remedies if the goods don't match description and fitness for purpose (Sale of Goods Act 1979 s13, s14 etc)?
(iii) how will description and fitness (ii) be assessed in order to advance the corect details for purchase when there is no official test enforcement in place?
(iv) how could test enforcement (iii) be followed where there are no approved Jammer technical standards (when compare for instance with testing standards for mobile phones: ETSI, GSM, 3GPP etc)? 

It the UK parliament were to produce a designated British Standard (BS) and compliance according to such a standard might then introduce mandatory test and regulation, which raises another conundrum. For a designated BS standard for test and regulation to be required that may amount might to a breach of Articles 40-46 of the EU Treaty. Basically these Articles seek proactive reduction and removal of trade barriers brought about by mandatory regulation to aid the principle of free movement of goods (Article 100A).

Can the Wireless Telegraphy Act 2006 with description and test? It would be appear not because the usefulness of the Act was intended to be as generic and the wide possible definitions being available to it to not only cover specific definition but also where no definition is assigned to particular apparatus or equipment a Court could construe an 'ordinary' meaning being given to e.g. a particular device. Moreover, the Act is not limited to what a device might be that produced emissions (the cause) but also the consequences produced by the cause, the interference (the effect).     

Section 8 of the Wireless Telegraphy Act 2006 Act forbids the installation or use of wireless telegraphy equipment (radio) in the UK mainland Northern Ireland and territorial waters, the Isle of Man and the Channel Islands, unless an appropriate licence has been obtained from Ofcom, or there are Regulations in force exempting it from the licensing requirements.

Licences are usually granted subject to terms, provisions and limitations, which must be complied with. These may include:

    use only on a certain frequency;
    use only with a certain power and certain level of emission;
    use must not cause undue interference;
    use only within a certain geographical area;
    use only of apparatus which meets specified requirements; and
    access for inspection by Ofcom staff and close down in the event of interference being caused.

The position remains unclear as to how Ofcom would assess by description or test against a technical standard, unless they already have a test schedule? 

Can the Act 2006 s68 provide any assistance where remedy is sought for deliberate interference e.g. the actual use of the jammer that has been detected due to surveillance or complaint? The use of any apparatus, whether or not wireless telegraphy apparatus, for the purpose of interfering with any wireless telegraphy, is an offence under the Wireless Telegraphy Act 2006. It is an indictable offence that upon conviction in Crown Court carries a maximum penalty of two years imprisonment and/or an unlimited fine. The courts can also order forfeit of any apparatus used in the commission of the offence. No description or test is provided for in relation to device in order to determine the penalty.


Essential as Jammers pollute the electromagnetic environment can assist be found here. Jammers are also subject to the Electromagnetic Compatibility Directive (EMC) Directive EC89/336 as amended, which has been implemented into UK law by the Electromagnetic Compatibility Regulations 2006 (Sl 2006/3418). These regulations specify that all electrical and electronic apparatus placed on the market or taken into service in the UK, including imports, satisfy specific requirements to ensure that they do not cause excessive electromagnetic interference or are adversely affected by it and have to carry the CE mark to show compliance. The European Commission supports Members States’ views that since jammers by their nature cause significant electromagnetic interference it is likely that most do not comply with the UK regulations and therefore they cannot be legally placed on the UK market. The maximum penalty for supplying non-compliant equipment under the regulations is a fine of up to £5,000. The courts can order forfeiture of stocks of equipment. Ofcom will take appropriate enforcement action, including prosecution, to enforce the above legal provisions.

This should be interesting then if, during parliamentary discussion about Bill 15, Jammers suddenly become an acceptable 'thing' for use given the history behind representation made by the UK to the EU as to what is covered by EMC regulation. 

Is there a EU harmonised position on Jammers?
A primary objective as already discussed why Jammers are not legal for placing on the market and for use is that European Conference of Postal and Telecommunications Administrations (CEPT), of which the UK are members, is the absence of a standard for the “construction", "testing" and "assessment” of Jammers to meet the requirements of the R&TTE, EMC directive etc. Were a manufacturer to produce such a device that could meet the principles of R&TTE, EMC Directive etc then it might be a different matter. Reasons behind uncertain about Jammers is largely agreement which revolves around cases where Jammers could be used (such as in penal institutions etc) but Jammers in the hands of the consumers, which CEPT doesn’t want, for concern consumers who may use them indiscriminately (for shutting up chatterboxes on trains, in restaurants and cinema etc).

Importantly, a fundamental principle under R&TTE Directive is the requirement for the safety of life and limb and the legal requirement to allow users of radio and telecommunications systems to make emergency calls. Jammers have the capability to prevent this. Stopping a chatterbox on the train with a Jammer prevents other users also making use of the spectrum.

Importantly, when the FIRST PROGRESS REPORT DIRECTIVE 1999/5/EC was published in 2004, it stated:

’2.8. Jammers
With the widespread deployment of mobile services, notably GSM, the need has arisen to deal with social problems caused by inappropriate use (irritating ring tones and usage), but also with security and safety concerns (in prisons or hospitals, for instance). Although in generalone relies on voluntary mechanisms to deal with such problems (signs forbidding use, social controls, banning of handsets), some interested parties have expressed the desire to address them by preventing the communications through technical means. This development has given rise to major concerns in the standing committee and other regulatory fora. Such an approach would legalise the sales and uncontrolled deployment of so-called “simple jammers”. These could have the effect of creating a large number of holes in GSM coverage and associated reduction of quality of service and access to emergency services, as well as voiding part of the coverage legally granted to operators via licences.

For the time being (November 2003) these devices remain illegal as no Member State has introduced a concrete regulation, which specifies the conditions under which they can be used. It is also imperative for public authorities in the EU to engage in an informed debate with those organisations, which seek to ban generic GSM communications in some places. Solutions need to be found which are effective in achieving this goal, but which do not undermine the widespread availability of mobile communications.’

And

’3.8. The borderline of the Directive
The application of the Directive to equipment that operates in aeronautical bands must be reviewed. The exclusions of annex I are ambiguous and are interpreted differently between Member States. The Commission has made proposals to the Council to handle such equipment in separate Directives.

The restriction of the Directive to only cover “radio communications” equipment has given rise to discussions on coverage of e.g. jammers, radars and radar detectors. Even though the application of the Directive was clarified for such equipment, defining its coverage as “equipment, capable of emitting and/or receiving radio waves” would facilitate the operation of the Directive.’

This reference to Jammers in the R&TTE Directive followed the ECC RECOMMENDATION (03)04 WITH REGARD TO FORBIDDING THE PLACING ON THE MARKET AND USE OF JAMMERS IN THE CEPT MEMBER COUNTRIES which consider Jammers at 900MHz and 1800MHz (June 2003)

and

ECC RECOMMENDATION (04)01 WITH REGARD TO FORBIDDING THE PLACING ON THE MARKET AND USE OF JAMMERS IN THE CEPT MEMBER COUNTRIES which consider Jammers in other technology categories such GPS, Video-link and wireless LAN jammers (February 2004). Rec(04)01 makes a specific statement regarding GPS: ‘Especially in the case of GPS jamming the safety risks are high because GPS is used for navigation, rescue services and in tracking devices.’


As the UK is a member of CEPT, ECC(03)04 and ECC(04)01 it require the administration to follow the recommendations:

recommends

2)         that CEPT administrations shall:
           Not allow the placing on their market nor the use of  jammers;
           Take appropriate measures to stop the transmissions of jammers;
           Exchange information on market surveillance activities with regard to jammers.

Essentially, the fundamental criteria underpinning the recommendation:

’It is not possible to construct jammers that comply with the R&TTE (1999/5/EC) or the EMC Directives (89/336/EEC) and those devices cannot therefore be legally placed on the market for use under these Directives.’

The criteria that jammers cannot comply with R&TTE presents a bit of a headache, as at the beginning of Part 2 I illustrated that the UK R&TTE and EMC Regulations are supposed to be relevant to the emissions and placing on RE apparatus for use in the UK. The Wireless Telegraphy Act 2006 was considered to see if it assisted with description.

It could be that by using the exemption or exception clauses in Acts and Regulations the government may need to design a special investigation test schedule (SITS) similar to that used by British Approvals Board for Telecommunications (BABT) in order to create a purchasing criteria, doubling as a test standard, too? The authorities still face difficulties because once in use it isn't possible to contain the emitting jammer interference to a precise area in the aether.

Moreover commercial concerns may have relevance here to, with respect to operators and the Communications Act 2003. Blocking signalling from Masts caused by radiated emissions from jammers, the Government would need to ensure services to customers around prisons are not disturbed, if claims for compensation are not to be brought against the Government. Site surveys would most likely be required.   

Possession
Jammers are sold through outlets on the basis for export sales etc and therefore the lawful requirements in this area are unclear if those outlets need to demonstrate a working product? Ofcom has authorised the use of Jammers but under strict conditions. That being the case Ofcom should have the complete details of the jammer to be used, was it purchased in the UK, imported under licence or brought in as contraband and the conditions under which it would be operated? In this regard Ofcom could furnish to parliament those details. In the alternative Ofcom conduct enforcement how Jammers are being sold and used policing through the use of market surveillance and/or complaint.

It is noteworthy that the UK Regulations allow for devices not for the market and not making approved statements to be in the UK. This appears to cover retailers selling Jammers:

’Exceptions in respect of placing on the market and putting into service
     6.  - (1) For the purposes of regulation 5, apparatus shall not be regarded as being placed on the market where that apparatus -
(a) is intended to be exported to a country outside the Community; or

(b) is imported into the Community for re-export to a country outside the Community; or

(c) is transferred from the manufacturer in a third country to his authorised representative established within the Community who is responsible on behalf of the manufacturer for ensuring compliance with the Directive; or

(d) is transferred to a manufacturer for further processing (for example, to modify the product or to integrate it into another product, or to put his own name on the product);
save that this paragraph shall not apply if the CE marking, or any inscription liable to be confused therewith, is affixed thereto.

    (2) The following principles shall apply in respect of the application of the Act and the Wireless Telegraphy Acts 1949 to 1967[33]:
(a) the display at trade fairs, exhibitions and demonstrations of apparatus which does not comply with the provisions of these Regulations is permitted if a notice is displayed in relation to the apparatus to the effect -
(i) that it does not satisfy those provisions; and

(ii) that it may not be placed on the market or put into service until those provisions are satisfied by a responsible person; and
(b) the switching on of radio equipment may be restricted for reasons related to the effective and appropriate use of the radio spectrum, avoidance of harmful interference or public health.’

The Wireless Telegraphy Act 2006 came into force in January 2007. This enactment makes no mention of Jammers and refers to Regulations of Apparatus undue interference in Part 3 Clause 53. By 2009 the European Commission issued a Guide to the R&TTE Directive 1999/5/EC Version of 20 April 2009:

1.3.4 Jammers
This issue was specifically discussed in the context of mobile
phone jammers (i.e. equipment preventing the operation of GSM
handsets). Since jamming, which is inherent to their functional
principle, cannot fulfil the essential requirements of the Directive,
the placing on the market and putting into operation of these
devices is banned.

It is noted that EU and UK references regarding Jammers has been specified for GSM and GPS. There has been no reference at all made to the network technology UMTS and the wireless transmission technology WCDMA and Jammers. Theoretically, this might mean a Jammer directed to be used against WCDMA transmission technology might not be illegal, but that is highly unlikely as the law can be construed to deal with that matter. This might also mean a legal argument is needed, although I am not legally qualified nor do I give legal advice.

So what is a Jammer?
Part 3 I shall discuss various methods I have researched and illustrate the ways jammers cause interference. In part 1 of these discussions I highlighted some issues, but more technical aspects can now be discussed for Part 3 as readers have begun to get a flavour of the way in which I am approaching this matter.

For now who is going to say, technically, what is a Jammer and what it is not? Without properly constructed standards or guidelines precisely demonstrating the construction of them (e.g. Technical Construction Files (TCF)), characteristics to succinctly define ‘interference’ that a Jammer is supposed to create and what should be the methodology to test for that, the problem runs into the old classic, do goods match description? The term Jammer is bandied around and the inclination of the criminal justice system might be not to question it provided the “thing” generally looks like its name, thus simpler to go with the flow. That is to say it may be a jammer is given an 'ordinary' meaning. However, that approach needs caution, too, if we are not to miss the lessons already learned from previous case law that assessment of a name alone to describe a “thing” needs to extend beyond simply referring to its title to make the “thing” a fact.  The Appeal Court held in the case of Patel v Controller of Customs [1966] AC356 the words “produce of Morocco” stamped upon bags of coriander were inadmissible to prove the country of origin of the coriander.  The words were stamped on the bag with express intention of asserting a fact and were thus hearsay.