Thursday, September 15, 2011

Safe and Unsafe Use of Mobile Phone Evidence

1. Introduction
In 2007/8 the authors became involved in the review of the mobile phone evidence used to convict Mr Phuong Ngo in 2000 for organising the murder of John Newman, a member of the NSW Parliament, in 1994. The case was dubbed ‘the first political assassination3 in Australia’. Mr Ngo was convicted at his third trial where location information from mobile phone call records was used by the prosecution to infer his location at various critical times on the night of the murder. ABC 4 Corners ran a program in April 2008 airing what was a simmering debate about the safety of the verdict. Thereafter the NSW Chief Justice established an inquiry to report to him on whether the conviction was well founded or not. That inquiry is now underway.
Since reviewing the mobile phone evidence and the way it was presented in court, the authors have reviewed the way the courts have dealt with location information contained in mobile phone records across Australia and have referred to press reports of some overseas examples. Broadly, while the use of mobile phone location information has become very popular both in Australia and overseas, the way it has sometimes been used in NSW4 appears to be a case of “making too much of too little” potentially leading to unsafe verdicts over the last 15 years. The usual problem is to move from using the records to show that calls were made and received (which is unexceptional) to using the same records as a basis for showing that a phone (and thus its user) was moving from precisely this location to precisely that location – a use that is fraught with problems. The purpose of this paper is to examine this issue.
The paper will provide a tutorial introduction as to how call records, generated by mobile phone calls by the mobile phone network operators so as to bill customers, can provide law enforcement agencies with useful information. While most of the charge data concerns the timing and duration of calls, this paper focuses on the likely location of particular mobile calls based on the cell site included in the charge record. We will not deal with more information that is gathered for a telecommunications inception and will focus on the evidence that is usually sort by police from the carriers both in their enquiries and to develop a case as to the ‘inferred’ location of one or more parties from their mobile phone records.
The paper will not address the now growing number of mobile phones incorporating GPS5, or where the operator uses information from multiple base stations to provide the user and subsequently a 3rd party (eg 000 service) user location with better accuracy than that usually available and discussed here.
The paper will address the question what can mobile phone evidence tell us and what can’t mobile phone evidence tell us? The volume and complexity of mobile phone evidence from cases well known to co-author Coutts (involving dozens of mobile phone calls, both fixed and mobile) suggests a pattern of the courts ONLY being presented with calls that support the prosecution case. Thus the paper further asks the question what is required by way of training and experience to be an ‘expert’ and the briefing of that expert to be able to comment on mobile phone evidence in a way which assists rather than confuses or misleads the fact finder?
2. Background
The use of mobile phone evidence by law enforcement agencies is just one of several forms of ‘high tech’ evidence being used to investigate crime around the world raising questions about our Justice System. [Aronson R and McMurtrie J 2007] So today with explosion in the use of mobile phones “cellular forensics” [Al-Zarouni M 2006], as it is called has become a huge industry in the US where just the provision of mobile call history of suspects by carriers in the US is provided by a specially trained staff unit that operates 24X7! A recent article in Crime and Justice in the US6 provides a picture of this growing industry. While there are other issues such as the encroachment of privacy, this paper is concerned with how mobile phone information is used in evidence at trial so as to prove necessary facts, rather than in the investigation phase where it may be a useful tool.
Usually the ‘raw’ data is gleaned from historical call records of the carrier. Investigators find out what mobile phone numbers were accessed by a suspect (later the accused) and obtain the call records for times of interest. Rather less often investigators are monitoring the use of mobile phone numbers when a crime is being prepared and carried out.
The mere production by a carrier to a trial court of its mobile call history for a specified phone number is not a matter of expert evidence. Rather the making of those records is simply a contemporary example of a ‘business record’, being a record that is regularly created in the course of the business of providing equipment to make and receive mobile phone calls.
The interpretation of those records, beyond the fact that a call was made at a particular time to a particular phone for a recorded time, is however, a matter for expert opinion. Decision makers (both trial judges and jurors) seek the help of experts when there is information that cannot be understood adequately, or at all, without the help of expert explanation and opinion. Because decision makers are forced to rely upon experts, and judges must give clear reasons for their decisions (such as whether to allow or not allow opinion evidence, or how much weight to give to evidence) it

When expert opinion is offered about whether a hypothesis is credible or not it is important that any limitations in the hypothesis are duly noted and explained. For example, if there are two competing versions of an event, and each is capable of being evaluated, it is grossly misleading to purport to evaluate one version while ignoring the other. From time to time the ‘interpretation’ of mobile phone evidence has forgotten these essentials, possibly leading to injustice.
3. Basics of a Mobile Network
This section describes the basics of a mobile phone network and the way records of calls made over and between networks are captured into a bill. More particularly, for this paper, we describe how these records for a mobile call also record the cell site for the outset of a call (or message) that can provide an indicator of location.
There are several related records generated by a single mobile phone call and the basic call data is captured in a Call Charge Record (CCR) including the time of the call, duration and (at least) the originating telephone number and the cell site used. CCRs are generated for every answered call and a CCR is generated by each of the networks traversed by the call to provide the basis for the retail bill to the calling party and an inter-carrier bill to enable operators to bill each other.
The diagram also shows a number of base stations (ie radio equipment) that communicate with the mobile phones establishing the location of the user that is the subject of this paper. Then the Base Station Controller (BSC) sets up a voice channel. The Base Station Controllers (BSCs) often co-located with the MSC sets up the communication from the mobile phone and interconnects the calls to other customers either in the mobile network or in the PSTN. Also shown is how messages (eg SMS) are delivered over the network over the Signalling Network. (ie the SS7 Network) not requiring any traffic channel where these also generate Cell ID information on their associated CCRs.
Coverage of the Service Area
Figure 3.1 shows a number of base stations (three in this figure) that are deployed every several km that provide ‘coverage’ over a full service area such as a city. To provide coverage an initial theoretical design is shown in Figure 3.2 where the coverage is provided by adjacent hexagons albeit of different areas to provide contiguous coverage. Each base station usually has a number of cell sites7 that use different frequencies and transmit in different directions from the base station and the pattern of hexagons is to assure the required ‘frequency re-use’ pattern to make best use of the available spectrum.
A typical urban base station coverage would be split into three sectors of coverage as shown in Figure 3.2 using direction antennas that amplify the signals in their forward direction constituting the arc of intended coverage and attenuate signals from other directions corresponding to the other sector directions. The intended coverage area for a particular cell site is deliberately confined in direction by the directional properties of the 120 degree sector antenna and confined in distance due to the power of the base station. Thus if a particular cell site is cited in a call charge record, a preliminary assumption would be to assume that the mobile phone user at the time of call establishment was located within the intended coverage area. However, there are several technical factors that complicate the potential to be overly definitive of the likely location of the mobile at the time of the call. Secondly, the language that has been used8 in some court cases in questions to the expert witness that the cell site location cited in the CCR for a particular mobile call is ‘consistent with’ the mobile being at a particular area (eg the crime scene) as it is ‘in the intended coverage area’ is potentially VERY misleading unless qualified through adequate cross examination.
Several technical factors that complicate making overly definite location statements based on the cell site cited in the CCR are summarised but there are ‘anomalous’ random propagation factors that can play a role but won’t be discussed.
First of all, the actual coverage area of a cell is very different from the idealised initial design due to the terrain of the area to be covered. A computer modelling prediction tool is used to enable detailed coverage design where the tool models the effects of the terrain and buildings that are available on a data base for the service area. A predicted dominant coverage from a 3 cell base station is shown in Figure 3.3 noting particularly the range of the coverage is variable. The computer prediction design is then followed up by selective drive tests to get better accuracy for more difficult spots

Secondly, while the direction of coverage area defined by the sector antenna is more reliable than the distance as seen in Figure 3.3, the likely cell site to be used depends on the dominant cell amongst adjacent cells and can be VERY different from that intended in the broad coverage design. Figure 3.4 shows a computer prediction of the overall coverage area showing the dominant cells. This means that if the mobile is at the edge of the intended call coverage area where the mobile may have adequate field strength from several adjacent cells, the cell site chosen may literally depend on the time of day with traffic loading in these cells9 or a minor variation in orientation of the mobile relative to the head of the user. While these factors are often mentioned in transcripts as noted previously no actual field information potentially available is presented.
Thirdly, the likely cell site choice near the base station can be uncertain so that if the mobile is very close (ie low signal attenuation) to the ‘back’ of the base station where the antenna characteristics are more irregular then the cell site chosen can be in the opposite direction assumed from preliminary assumption. Such a possibility can be predicted by computer modelling as shown in Figure 3.5 as was done for the Phuong Ngo case. What can also be noticed from comparing the intended three sector coverage design shown in Figure 3.4 with the predicted coverage from computer modelling that takes into account both the antenna characteristics as referred to above but also the terrain and the ‘area of uncertainty’ is the area around the tower where either 1 of 2 cell sites may be the preferred call site for call establishment.

A broad conclusion that can be drawn from this discussion of the factors that complicate definite conclusions about the location area of a mobile phone at the time of a call is that it is generally easier to say in many cases the areas where the mobile phone was unlikely to have been at the time of a call! As is often found in forensic work it is ‘exclusion’ not ‘identification’ that is the safest use of available technology.
4. Requirements to be an Expert on Such Matters
Given the complexities of the interpretation of cell phone location information contained in call charge record data for mobile phone calls (and SMS messages), the paper summarises the knowledge and experience required in our view to be an expert.
The broad areas of knowledge required are:
Radio transmission knowledge including propagation, radio system design and antenna principles
Telecommunications network engineering including call management and
charging principles And the areas of experience required are:
The specifics of cellular mobile engineering including radio network planning and design
Basic telecommunications network switching
Billing systems
It should be noted that experience of cellular radio network planning, design and practice including the radio systems elements, propagation and the capabilities of computer coverage prediction tools is a very specialised area.
While broad area of knowledge is acquired through an appropriate Engineering Degree (eg Electronic Engineering), more specific knowledge in propagation together with operational experience in a mobile communications business or major equipment vendor would characterise an expert in this area.

5. Discussion of Cell Site Evidence Used in Australia
Before considering the use of cell site evidence in Australia, it is useful to highlight a few ‘prominent’ cases reported from overseas that illustrate the same pattern of ‘assumed’ accuracy of location from cell site information captured in call charge records. While there has been no opportunity to review how this ‘evidence’ was dealt with in the respective courts, they illustrate the global nature of the issue.
From the UK a report on the conviction of Ian Huntley in the press for the double murder trial in 2003 there were quite inaccurate cell phone location attributes cited, saying the mobile phone ‘can be traced to within a short distance’. In January 2008 in the US there was chorus of protest to appeal the conviction of R&B singer Waymond Anderson in 1993 in the US who has been in gaol for murder for 13 years,0,1655641.story?coll=la-home-headlines partly on the basis of cell phone records purportedly indicating location. The report says “call logs proved Anderson was in the neighbourhood….” and “the implacable digital testimony the defence didn’t dare challenge: Anderson’s cell phone.” It was only when the physical witnesses admitted they had been ‘verballed’ by police that the cell phone evidence was questioned!
In mid July 2008 one of the authors contacted all Australian Directors of Public Prosecutions asking about their practice in the use of cell site information from mobile phone call charge records. The response from the various jurisdictions is summarised in Attachment 1.
What emerges is that the evidence is almost always led by the prosecution and where there is no objection, the cell site evidence of ‘possible’ location is merely supporting a fact already well established and becomes an ‘agreed fact’. However, when such evidence is led by the prosecution to ‘pinpoint’ movement or location but is contested by an effective defence, examination of all the relevant records10 will often point to many anomalies. In summary, critical reliance should not be based on such evidence.
The reasons given for decision by Blaxell J in Western Australia cited in Appendix 1 is recommended as background reading (along with this paper!) for any lawyer participating in a hearing at which mobile phone evidence is being led.

6. Conclusions
In conclusion the ubiquity in the use of mobile phones in society has been recognised by law enforcement agencies around the world as a useful tool to potentially provide information on the location of persons of interest when using the phone. The basic cell site information recorded in the mobile phone call charge record is useful to indicate the likely location area where the call was made. More recent mobile phones that use more accurate location technology such as GPS are not discussed.
The paper describes the basics of how a network of overlapping cells is designed from initial theoretical coverage, detailed design using a software prediction tool followed up with selective drive test measurements. The ‘actual’ coverage characteristic is constantly evolving as more cells (and equipment) are added and the coverage is ‘tuned’ to maximise coverage but minimise interference. In this context of the complex changing ‘intended’ service area coverage, some of the sources of potential anomaly of asserting likely phone location from the recorded cell site are explained. There are more!
From examination of the Phung Ngo cell phone evidence11 including the expert witness transcripts, the feedback from other jurisdictions on the use of cell phone location data and with some reference to some overseas cases, it is clear while cell phone data is useful for police investigation, it should be used with great caution in a court as an authoritative form of evidence of location.


Public Defenders
Criminal Law Conference

Paper by Reg Coutts1 and Hugh Selby2

No comments:

Post a Comment