DIGITAL FORENSICS GUIDE CELL PHONE LOCATION AND TRACKING FORENSICS

Transcription

1 DIGITAL FORENSICS GUIDE CELL PHONE LOCATION AND TRACKING FORENSICS Larry Daniel, DFCP, BCE, EnCE, ACE, AME, CTNS, CTA, CWA Spencer McInvaille, CTNS, CTA, SMART+ Copyright 2018,, All Rights Reserved.

2 Methods of Locating Cell Phones Call Detail Records The approximate location of a cell phone in reference to a cell tower is the most common method of phone location you will see in cases. This is because this is the easiest type of evidence to obtain. Precision Location Data i.e. PCMD, RTT or NELOS In some cases, Network Equipment Location Service (NELOS), Per Call Measurement Data (PCMD) and Real Time Tool (RTT) data may be present in addition to call detail records. None of these methods contains particularly accurate GPS locations and are highly suspect for any kind of use for determining the location of a cell phone other than a general location that is really no more precise and in many cases less precise than the use of call detail records. NELOS data is a form of precision location that is performed by At&t in their network. However, the data does not provide any more specific information than a GPS coordinate with nothing to substantiate its accuracy other than the a better than xx meters estimate. It is interesting in this type of data that the data points can vary in accurate by thousands of meters in minutes. NELOS was not created as a method for location people, it is for At&t s commercial purposes, and is not the same as the emergency location of a cell phone. Drive Testing Drive testing is a process that uses radio frequency measuring equipment to analyze the strength of cellular radio signals. This purports to give a better estimate of the radio coverage footprint of a cell tower sector. E-911 Records This is the process of determining the location of the cell phone in real time. This method delivers an actual geo- location of the phone and is the most accurate means of location a phone based on the wireless phone company. Phone Based Location Using the phone itself for location is one of the most accurate methods for locating a cell phone. This would include GPS locations stored in the phone device. Find my iphone This service forces the phone to provide its GPS location via an icloud or other location account.

3 Call Detail Records - The Evidence What are they? Call detail records are the most common form of evidence used in cases involving cell phone location and tracking forensics. Legal proof of a service provided Call detail records are proof that the service the customer is paying for; voice, data and text, is being provided. The fact that call detail records are created as the result of the customer s phone using the wireless phone company s network is proof that the service is being provided. A technical road map of a call Each call detail record contains technical details such as the date and time of the phone call or text message. Each record may also contain the starting and ending cell tower used for a phone call and in some cases text messages and data sessions. A financial transaction record As part of the billing system, the call detail record is summarized into phone bills that are provided to the customer. How to get call detail records Account holder can request with notarized letter This works but does not always result in getting a full set of records, depending on the phone company Via subpoena from the phone carrier Language for use in discovery motions and court orders for Call Detail Records and Cell Tower Locations. The items in red should be edited to fit your particular case details.

4 Example Subpoena language Defendant, by and through his or her attorney, requests the following information be provided regarding cell phone communications in the form of historical call detail records and tower locations, for cell phone number(s) for the period of time between and All information including but not limited to: 1. Subscriber information for the above listed numbers, including financially responsible party, billing address, features and services and equipment, 2. All call originations, call terminations, call attempts, voice and text message transactions, including push to talk, data communications, SMS and MMS communications, and voice communications, including the originating and receiving phone numbers or network IDs for all incoming and outgoing call transactions, data transactions and push to talk sessions. 3. Records are to include the IMEI, IMSI or other equipment or handset identification information for the target phone number if known. 4. All stored SMS content, MMS content and / or Browser Cache if available. 5. Beginning and ending switch and cell site / tower identifiers for each call, SMS MMS and data transmission, including the location information and azimuth for the tower and sector used for the call. 6. A complete table of cell towers / cell site information for all cell towers / cell sites in the LAC, NEID or service area and or for all switches used, active at the time period for the call detail records requested. This shall include: a. cell tower location information including latitude and longitude b. cell tower / cell site designation information / identification numbers c. information for each cell site sector including azimuth. d. equipment type used at the cell site, i.e. Lucent or Nortel, etc. e. NOTE TO ATT MOBILITY: Even though the tower location information is in the call detail records, this subpoena also requests a list of cell tower locations with the latitude, longitude of each tower, the sector azimuth and the beam width, if known, for the time period covered, in comma delimited or Excel format, for every tower referenced in the call detail records responsive to this subpoena. 7. a legend and definition for any and all abbreviations used in the reports provided 8. An explanation of how to read the call detail records. 9. Any precise measurement data such as PCM Data, e-911 location data, REVEAL data, RTT data, NELOS data and or any other data recorded for the time period that will provide additional location data. 10. Specific information regarding the time stamps / time zones of the records.

5 Provide the following information regarding cell tower locations for the following areas containing cell towers actively in service between 0/0/20XX and 0/0/20XX. Include the below AT&T cell tower information: LAC CID Latitude Longitude Sector Azimuth 11. Any records or information regarding cell towers that were undergoing maintenance, or were out of service the time period in this request. All responsive data is to be provided in both Adobe PDF format and Microsoft Excel format,.txt or.csv format. Please indicate in your response to this subpoena if there is any data loss due to the time difference between the date of the receipt of this subpoena and the time period requested, and if so, a detailed description of what data is not recoverable versus what data would be recoverable based on the carrier s retention period for call detail records. Please respond to this subpoena via to: [your ] Via discovery from opposing counsel Subpoena responses and warrant returns from wireless phone companies will contain specific files that are delivered via , on disk or via a secure web portal. It is very important that you received all of the files returned to the requester. Also, copies of the original subpoena and or warrant with the affidavit are very helpful for your expert. There are spreadsheets and documents that provide such information as subscriber information; the call detail records themselves, cell tower location keys, explanation forms and disclaimers. These disclaimers are important, as they provide pertinent information regarding location accuracy or time-zone information. Each carrier stores their records in various formats and below you will find the specific data you should receive organized by four of the major carriers. Other carriers like US Cellular follow a similar pattern. Verizon Wireless Verizon Wireless call detail records also require a cell tower key to determine the location of the towers in the area. Call detail records will often be labeled Cell sites incoming outgoing and the tower key with

6 contain a city name and LEA. Verizon records may also contain Voice Over LTE records which will contain VOLTE in the spreadsheet name. If requested in the proper timeframe, you may receive Real Time Tool records, the spreadsheet name will contain RTTM. Verizon also provides subscriber information, explanation information for each of the different spreadsheets as well as disclaimers. Each of the spreadsheets containing location information will be in Microsoft Excel format and explanation forms are typically in Portable Document Format (.pdf). Sprint Sprint also provides call detail records and cell site keys in separate spreadsheets. Again, both are needed to analyze the records. Sprint s records also come in Microsoft Excel format and are typically labeled with a number. There will be several spreadsheets all containing the various information. They may also provide Per Call Measurement Data (PCMD) if requested in the proper timeframe. Sprint also provides need explanation forms and disclaimers. AT&T/Cricket provides their call detail records and text detail, with location information, in one spreadsheet. This is typically labeled Reports AU and comes in two formats, Text format (.txt) and Portable Document Format (.pdf). This is standard for all requests, unless otherwise specified. At&t will provide subscriber information, as well as needed explanation forms and disclaimers. At&t may also provide, if requested, Network Event Location Service (NELOS) data. It is important for your expert to receive the text format (.txt) files for analysis, this format allows for data to be imported into various software platforms for converting time zones and analysis. T-Mobile / MetroPCS T-Mobile / MetroPCS provides call detail records in Microsoft Excel spreadsheets that are typically labeled CDR Mediations. This spreadsheet will provide the call record as well as the tower location information needed. Subscriber information will be provided and explanation forms will also be provided. Depending on the year the records were provided, they may be kept in different time-zones, for this reason the explanation form is important. No other location information is available from T-Mobile at this time. How are call detail records used? Associate a phone transaction with a cell tower. Call detail records can contain the cell tower used for a phone call and in some cases, text messages. This associates a phone call with a cell tower location. Based on this limited information, an analyst will determine the approximate location of a cell phone. Note that this is not the location of the phone, but the location of the cell tower.

7 Show connections between phone numbers Call detail records can be used determine if one phone has contacted another particular phone number. These connections are used to determine if a person knows another person, or in some cases is used as evidence in spoofing cases. Show frequency of connections The analysis of the frequency of connections between two or more phone numbers is used to show that one person may be directing the actions of others, or that two or more persons are in collusion. Show user activity Voice call activity Voice call activity is the only type of activity that will always result in a record containing cell tower information if the phone call is not a forwarded call. Call forwarding information When a phone does not answer a call, i.e. the user simply failed to pick up for some reason, the phone has a dead battery and is off the network, or the phone is out of range of a cell tower, the phone calls may be forwarded to a voic service, if the phone account has voic service. The fact that calls are forwarded is not an indication of the phone being turned off to hide its location, as there are a number of reasons for a user to fail to pick up the phone. Text message transactions While all carriers have a short or no retention period for text message content, the fact that a text message was sent or received can be obtained in the call detail records or as a separate report from the phone company. Bear in mind that text messages may be in a single time zone, i.e. always in Central Standard Time or in Pacific Daylight Time depending on the carrier. Data transactions Other than showing that a phone is on and connected to the cellular network, data transactions are not reliable enough to be used for location purposes. How are they used? Analysis of call detail records is used quite often in criminal cases to attempt locate a person of interest, either as they go about their criminal enterprises, or in relation to a particular incident or crime. This type of analysis is also used in civil litigation involving vehicle accidents, property damage claims and other types of cases where the location of a particular cell phone at a particular time is of interest. Cell phone location analysis is also used to locate missing persons who may have their phone with them when they go missing. This type of cell phone location is normally triggered through an exigent

8 circumstances request to the cellular carrier to begin actively pinging the cell phone using the E911 location system to attempt to locate the phone. Most common type of evidence in Cell Phone Location Maps You have the location of the cell tower, NOT the phone. A tenuous relationship to the phone s location this is NOT triangulation. The term triangulation is often misused when applied to the analysis of historical call detail records. Call detail records only contain information about a single cell tower used when a call was made. To triangulate the location of any phone or object, for best accuracy you have to have three points or more of reference.

9 Important Cases regarding obtain phone records or historic cell site location information (CSLI) Carpenter v. United States Issue: Whether the warrantless seizure and search of historical cellphone records revealing the movement f a cellphone user over the course of 127 days is permitted by the fourth Amendment United States v. John Boynton Sidbury Raymond Tarlton and Elliot Abrams represented two co-defendants charged in federal court after an investigation by Raleigh PD into marijuana dealing. The case was built on cell tracking and vehicle tracking. They challenged both and United States District Judge Flanagan ultimately ordered the suppression of the fruits of the tracking, adopting the Magistrate Judge s finding that the standard NC LEO cell tracking order is unconstitutionally overbroad. In the 3-day evidentiary hearing, it became apparent that this is the standard form used throughout the state in many drug and other investigations to track cell phones. So they thought to pass this along so folks can consider whether to challenge real-time cell phone tracking and have a framework for doing so. Here's a link to the original motion to suppress, which includes the applications and orders they attacked, as well as a declaration by our cell phone expert-- Cell-Phone-Tracking-with-Exhibits-DE-128.pdf.

10 Call Detail Records (Retention) Carrier Subscriber Call History Only Call History with Towers SMS Content "Precision Location" Verizon 7-10 Years 7 Years Rolling 12 months 3 to 10 days 8 Days AT&T/Cricket 7 Years 7 Years 7 Years N/A 8 Days Sprint 10 Years 18 Months 18 Months N/A 180 Days T-Mobile/ Metro PCS 3 to 5 years 23 Months 23 Months N/A 23 Months US Cellular 7 Years Rolling 12 Months Rolling 12 months 3 to 5 Days N/A

11 Call Detail Records Structure Call Detail Records (AT&T) Call Detail Records (Sprint) Call Detail Records (Sprint Towers) Cell# NEID Repoll# Address1 City State Zip Latitude Longitude BTS Manufacturer Sector Azimuth Metzerott Road College Park MD LUCENT 1 110

12 Metzerott Road 2960 Metzerott Road College Park MD LUCENT College Park MD LUCENT Silver - Georgia Ave. Spring MD LUCENT Silver - Georgia Ave. Spring MD LUCENT Silver - Georgia Ave. Spring MD LUCENT 3 255

13 What About Prepaid aka Burner Phones? What are they? Pre-Paid Phones No verification of identity needed and no valid Subscriber information. These are phones that can be purchased as a phone in a box from big box retail stores. The purchaser contacts the phone carrier and pre-pays for an allotment of time and or data. Normally one or more months of service. The phone can be re-loaded with additional time. How to you get the records? All wireless or cell phones must have a carrier network for operations. These carrier networks are going to be based on one of the major infrastructure systems maintained by Sprint, Verizon, T-Mobile, At&t, US Cellular or a regional phone company. When you subpoena the phone records, they will usually be provided by the actual phone carrier that maintains the network or through a third party data storage company like NeuStar.

14 Getting the records You can find the carrier for the phone number several ways, one of which is to use When you enter the phone number, fonefinder.net can determine the original carrier or phone company for the number. However, bear in mind that with modern number porting, i.e. you decide to leave Sprint and subscribe with Verizon, you can take your phone number with you. This is called porting your number. Since fonefinder.net does not have any porting information, the web site can only tell you the original wireless company for the phone number. Remember that all pre-paid phones have a phone company and the actual service provider is going to be one of the majors such as T-Mobile / Metro PCS, Verizon, etc. Bear in mind that pre-paid phone records may have a shorter retention period than a post-paid phone. In fact, pre-paid phone records are limited to 90 to 180 days in many cases Cell Phones The Flip Phone In 1973, the first cell phone was invented by Martin Cooper of Motorola who was influenced by the Star Trek communicator! The flip phone was introduced in 1996 s by Motorola as the StarTAC. Originally just a 2 way radio in the form of a telephone. You could dial a phone number and talk to someone without having to press a button and say Roger! or Over and Out! Newer forms of basic phones can do Calls, Texts, Apps and may have GPS. The example below is an LG 329 GS phone.

15 The Smart Phone Smart phones today are a powerful handheld computer. A modern smart phone is about a thousand times faster than the 1975 Cray-1 Supercomputer.

16 Still, at its heart, it is a fancy 2-way radio with the addition of a camera, screen and keyboard. Today the smartphone is becoming the computing platform of choise for many people who do not own computer or pad. Students are even doing homework and writing term papers on smartphones today. Look, Mom, I m Writing a Term Paper on My Smartphone By Charlie Wells Updated Feb. 17, :33 p.m. ET When it comes time to get serious about doing his schoolwork, 16-year-old Daniel Self doesn t need a desktop, laptop or tablet. He picks up his smartphone. A junior at North Carolina s Southeast Raleigh Magnet High School and a self-described procrastinator, Daniel says his phone is his saving grace, academically speaking. He has used his phone to research and compose a slideshow about Donald Trump, a presentation on the architecture of sheds and a creative writing assignment tied to Fahrenheit How does a cell phone work? Communications

17 As mentioned, a cell phone is a walkie-talkie that uses two radio frequencies: One to send and one to receive.

18 Registration with the network: On Power up the phone tunes to a known frequency and begins to listen. In order for the cell phone to be able to use a wireless phone company s network, it must have an active subscription. The registration process is how the phone and the network talk to each other and is when the network authenticates the phone. Once the network acknowledges the subscriber account, the network will allow the phone to use the services that are part of the subscription. For example, a phone that does not have a data plan will not be allowed to use the data portion of the network to access steaming music services and so on.

19 The Hook Up: Choosing a Tower How does the phone choose a tower? A cell phone is in constant communication with the network to ensure that the phone will be able to connect to a cell tower to make or receive a phone call. When you look at your phone screen and watch the antenna bars change over time, this is a result of the phone and the network communication about service quality, signal strength and availability. Some phones will even show when the service type changes from LTE to 3G or even 2G. This scanning of network allows the phone to choose the tower that it will use for the next incoming or outgoing transaction; voice, text or data.

20 There are a number of factors that come into play in the process of a phone choosing a tower and these will be discussed in the following sections. However, the call detail records will not reflect any of these factors. While it is important to understand that the cell tower used for a phone call may not be the absolute closest cell tower to the phone, the only thing you know is what was recorded in the call detail record about the cell tower that was used at the time of the call. Equidistant When equidistant, no way to know what the deciding factor was in choosing a cell tower. Occlusions In the illustration below, we have Godzilla blocking the line of sight between the cell phone and the nearest cell tower. Because organic materials like Godzilla, leaves, your head, all both absorb and block radio waves, it would be possible that the phone would select the tower on the left, rather than the closer tower on the right.

21 Overload Channels must be available: In our snow example below, the phone may not be able to use the tower on the right due to an overload of calls by worried parents attempting to contact their children for an early school pickup. In this case the cell phone would connect to the next closest tower that it can obtain a signal and channels. Again, this would not be reflected in the call detail records.

22 Choosing a Tower: Moving Around Hand Offs Hand offs occur when the cell phone determines that it needs to move to a different tower to avoid disconnecting the current call. However, once the phone is actively in a phone call, the phone is no longer picking the next tower, that is a function of the network or a combination of the network and the phone.

23 Intermediate Handoffs No record of intermediate hand offs: As a phone moves around, the phone will have to use different towers. This is called handing off and for the most part is transparent to the phone user. In some cases where cellular coverage is spotty, the phone call quality may degrade before the phone hands off to the next cell tower. The important point about this as that there is no record of the towers that the phone uses during this time other than the cell tower recorded at the start of the phone call and in some network the cell tower recorded at the end of the phone call.

24 How the Cellular System Works Cell Towers For most of us, when we think about the cellular or wireless phone network, we may think of cell towers, as this is the only easily seen, visible part of the network. Cell towers can be hidden inside structures, mounted on top of structures like water towers or buildings and road signs. Disguised as trees or flagpoles or mounting on poles or super tall metal towers.

25 The Cellular System: Cell Site More properly called a cell site, the figure below shows some of the pieces that make up a functioning cell site. Antennas Send and receive signals to and from cell phones that in radio range of the cell site or tower. Base Station Transceiver or enode B equipment controls the communications of the cell site. This equipment manages the overall radio traffic that the cell site can handle. The BTS and or enode B is connected to the standard phone network via thick network cables. Once a phone connects to a cell tower via radio, everything else uses the regular telephone system or Plain Old Telephone System (POTS).

26 Cell Tower Sectors / Sector Layout and Azimuth Cell towers can have from 0 to 6 sectors The most common configuration is three sectors like the diagram below. The azimuth is the direction the antenna points, i.e. an Azimuth of 0 is due north. The important note is that the azimuth or direction is not standard. The wireless phone company chooses which direction to point each sector for best and most efficient coverage of a particular area.

27 Cell Tower Coverage Coverage area size is determined by customer needs and some radio frequency engineering limitations. The process of cell phone tracking using call detail records and tower locations is based on the concept of radio frequency reuse planning. This is the method that cellular companies use to determine when to add cell towers to an area to accommodate increases in user demand. At the basic level a cell phone is just a two way radio. It requires one channel or frequency to transmit and one channel or frequency to receive. Cell phones can both send and receive at the same time, unlike a walkie-talkie that uses a single channel to send and receive where you have to wait your turn and push the button to send. The reason that there is a requirement for radio frequency reuse planning is both simple and practical The Federal Communications Commission, (FCC) allots a limited number of radio frequencies to each wireless company. The number of frequencies available is far too small to accommodate millions of phone calls at the same time. In order to compensate for this lack of radio frequencies, wireless companies use technology that allows them to split the frequencies into small sections so to speak, to allow more phones to use the frequencies than would be possible if a phone took up the entire radio channel. The two primary methods for sharing radio channels are Time Division Multiple Access (TDMA) which is used in the Global System for Mobile Communications (GSM) network and Code Division Multiple Access (CDMA) which is used in the CDMA network. For instance, AT&T is a GSM wireless company and Sprint is a CDMA wireless company. For our purposes here, the methods used to split up radio channels is not important. What is important to understand is that the wireless system needs to support a huge amount of demand for radio channels at any given time and the wireless companies had to figure out a way to do that. Even with the current technology for splitting up radio channels to handle more calls; that alone is not enough to cover a large number of cell phone users. To overcome that limitation, the wireless companies re-use those same radio frequencies over and over by putting them into clusters of cells, (hence the name cellular), and then separating sets of frequencies by distance so they will not interfere with each other.

28 When there are a limited number of subscribers in an area, such as the example below where the tower is location in a small town in the sparsely populated Midwest, a single cell tower can cover a large geographic area.

29 Subscriber Density As subscribers increase: The coverage size per tower gets smaller to accommodate the larger number of cell sites are required.

30 How Far? How far can a cell phone be from a tower and still make or receive a call? Assuming a perfectly flat earth, extremely tall cell tower, maximum legal power output, and no other cell towers in the area GSM (AT&T or T-Mobile) = 22 miles CDMA (Sprint, Verizon, etc.) = 35 Miles Limiting factors Terrain, ground clutter, proximity of other towers, signal strength, cell phone being used, tower height, radio frequency and the list goes on Real World Issues There are a number of real world factors that impact the coverage area of a cell tower or which cell tower provides service to a particular area. In the image above, we have cell phones in different places that can affect which cell tower would provide service to the phone or perhaps a dead spot with no service. As discussed earlier, organic materials absorb and block radio waves. In the illustration above, we have a tall building constructed of inorganic materials. Most inorganic materials like concrete and steel will reflect radio waves.

31 Radio frequency map The map below shows a prediction map of radio coverage at ground level. Note in the map that the different sector radios provide coverage in quite different patterns. While the radio waves will project from the antennas in a basic vee shape, once the radio waves start to expand, they coverage area can be quite irregular.

32 Cell Tower Grouping / Switches The following maps show the locations of cell tower groups by various carriers at some point in time. While the map is labeled as Sprint, these are for illustration purposes and do not have any relationship to actual Sprint cell tower locations. The point to be made here is that cell towers are grouped together by equipment known as switches. This is important because cell tower numbers are not unique per se. In order to make sure you have the correct cell tower identified, you must combine the switch and cell tower identifier together. Example (Sprint Towers Dallas 1) In the Dallas 1 illustration below, the cell towers are green.

33 Example (Sprint Towers Dallas 2) The Dallas 2 switch above with cell towers in yellow

34 Example (Sprint Towers Ft Worth) The Fort Worth switch has cell towers that are located a long distance from the center of Dallas, TX. The Fort Worth towers are orange.

35 Example (Sprint Towers All) This map shows how a heavily populated area can require multiple groups (switches) of hundreds of connected cell towers.

36 Example (Sprint Towers All) Zoomed In The map above shows how important it is to have the correct switched information since the cell towers from the various switches are intermixed.

37 Sprint Atlanta Example The Atlanta switch is connected to cell towers in two time zones, Eastern and Central. If a phone is in Atlanta, the records produced will be in the correct time zone, Eastern. If a phone is in New Orleans, the records produced will be in Eastern Time, even though the phone is in Central time. This must be taken into consideration with reviewing the call detail records.

38 Examples The Pie-Slice! In many cases, analyst may be using software that create pie slices like the ones in the map above. The circles and sectors (pie wedges) drawn on maps to present this evidence are based on the idea that an expert can demonstrate the area covered by a cell phone by drawing circles or pie shapes on a map where the circles or pie shapes represent the approximate coverage area of a cell tower and that the cell phone will be in the area defined by the circle or pie shape. The idea is that the expert can determine the approximate coverage of a cell tower by comparing the distance between two cell towers, account for a theoretical overlap of tower coverage, and then draw a circle to represent the coverage area of each tower. The basis for this method is that cell towers are sectorized, meaning that a cell tower has more than one antenna, that each

39 of the antennas points in a compass direction defined in degrees, and that the analyst can determine how far those signals reach based on comparing the locations of the adjacent cellular towers. However, data regarding the actual coverage area of the any tower at the time of the incident is not provided by the cellular carrier and there is no method that can be used to determine the coverage of a cell tower at the time of the incident based on historical call detail records. It is not possible to reliably determine the coverage area of a cell tower antenna as it relates to a particular cell phone at the time of a call simply by comparing the distance between cell towers Selection of a servicing cell If a handset is directly in front of, and with line of site to, the antenna for a given cell and with no other cells of greater or equivalent power close by, it would be unlikely to select any other cell. This means that within the service area of a given cell, there will be regions where a phone could not be reasonably expected to initiate (or respond to) a call on any other cell. The location in question could be termed as the dominant region of the cell. Elsewhere, the received signal strength of other cells will be closer to or supersede that of the cell in question. The effects of clutter (either by line of sight or the effects of localized interference, or fast fading ) will mean that there may be marked differences of signal strength over very many small distances. If there are other cells serving the area with similar signal strengths, the cell selected as serving by the handset may change frequently. This (usually much larger) region is termed a nondominant area. (Source: Journal of Digital Investigation, Volume 8, 2012, Historical cell site analysis Overview of principles and survey methodologies, Matthew Tart, Iain Brodie, Nicholas Gleed, James Matthews.) When preparing expert maps, analysts are trained to use the following methods for determining the approximate coverage area of a cell tower antenna sector: a. Using a standard radius of 1 mile or 3 miles projected from the tower at the center, to the edge of the coverage area or, b. Drawing the circles on the map after plotting the locations of cell towers where the circles are drawn to overlap each other based on the distance between the cell towers. c. The compass direction of the tower sector antenna used for a phone call. d. The beamwidth of the radio signal projected by the sector antenna, if known. There is no factual basis for drawing coverage circles or pie shapes on a map and the cellular company does not provide such data to experts in cases. The physical location of the cell tower masts is factual in basis because cellular carriers maintain the geo-location (GPS) coordinates of cell towers and provide those GPS locations to the expert for use in his plotting of the locations of the towers. However, there are no published set of principles or methods governing the estimation of cell tower coverage based on simply drawing circles on a map where the circles overlap based on the distance from one tower to other adjacent towers, the size of the circles being determined by the distance between cell towers. In fact, the distance between cell towers on a map have no real bearing on the coverage area of the cell tower at all for the

40 following reasons: a. Cell towers are placed based on anticipated load, which is the maximum number of cell phone calls anticipated at peak load times for the cell tower. Thus the expected coverage area can vary widely between cell towers. b. Cell towers are not always configured to provide the same amount of antenna power output, which determines the maximum range of the signal produced by the antennas. c. Cell towers are placed to cover specific areas by either mechanically or electronically tilting the antennas toward the ground and are not configured to cover an area shown as a perfect circle on a map. d. Not all tower antennas have the same beamwidth. Beamwidth is the width of the antenna signal defined in degrees. The most widely used analogy to describe beamwidth is to think of the antenna as projecting a beam of light, in the same way that a flashlight beam projects. As the beam exits the flashlight it spreads out in a pattern. In the same say that some flashlights can adjust the width of the beam of light to become wider or narrower, the antennas on a cell tower can be adjusted to project a wider or narrower beam of radio signals. In the absence of the beamwidth being provided by the carrier for each sector, it is common to assume a beamwidth of 120 degrees. This is an assumption and should not be allowed to be used as evidence when such data is not provided by the cellular company. e. Each cell tower that contains sector antennas can have 2 or more of these antennas pointing in different compass directions. Each of the antennas can be configured independent of the other antennas to suit the coverage need for that particular tower. In other words, the antennas can each have a different down tilt, beamwidth and a specified direction for the antenna. While the azimuth, which is the direction the antenna points, may be provided in the tower locations records, the actual coverage area of the sector antenna can vary widely even between sector antennas on the same tower mast. f. In today s cellular system environment, many cell towers contain more than a single set of antennas for a carrier, making it even more difficult to use the standard three sector antenna idea to estimate the coverage area. Cell tower coverage does not fit into neatly drawn circles or pie shapes. The inherent issue with using maps with circles and pie shapes drawn in to illustrate the approximate location of a cell phone is that it gives the incorrect impression, bolstered by expert testimony, that the cell phone location is limited to the area defined by the circle or pie shape. Since it is impossible to determine the distance the phone is from a cell tower at any particular time, suggesting that the phone is within an arbitrary boundary drawn on a map is inherently false. The image below demonstrates the difference between an idealized layout of a cell network, and the theoretical service areas of 3 sectors within the network. (Source: Journal of Digital Investigation, Volume 8, 2012, Historical cell site analysis Overview of principles and survey methodologies, Matthew Tart, Iain Brodie, Nicholas Gleed, James Matthews.)

41 As shown in the Fig 1 above, cell sectors do not conform to a pie shape. Nor is the coverage area a circle. A single cell site (usually a mast or building) can contain the hardware for several cells, which are then also known as sectors. Typically, there will be three sectors per cell site and each sector will usually point in a different direction (known as the azimuth) but this can vary, usually between one and six. The sectors will operate independently of each other, having unique Cell IDs usually related to each other and similar to the code for the covering cell site. Each sector will provide service over a particular geographical area, and this area will not be uniform (i.e. it will not be a circle, a triangle or any other regular shape); there may be many different shapes according to geography and the need of the network (e.g. long thin cells on motorways). There may also be disconnected areas of service known as hotspots. (Source: Journal of Digital Investigation, Volume 8, 2012, Historical cell site analysis Overview of principles and survey methodologies, Matthew Tart, Iain Brodie, Nicholas Gleed, James Matthews.) Important Cases Pie Wedges on Maps United States v. Antoine Jones UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA 918 F. Supp. 2d 1; 2013 U.S. Dist. LEXIS 8888; 90 Fed. R. Evid. Serv. (Callaghan) 648 January 23, 2013, Decided, January 23, 2013, Filed As explained above, defendant's premise here is incorrect; Agent Eicher does not claim that defendant's phone was within the pie-shaped wedges at the time the calls were made. See supra /

42 at 2. However, the Court agrees that the use of the wedges could confuse members of the jury and mislead them into believing that defendant's phone must have been within that space. Thus, in order to avoid any unfair prejudice to the defendant, the arcs used to depict the outer limit of the pie-shaped wedges should be removed from Agent Eicher's reports. [**14] The wedges will then appear as open-ended "V" shapes opening out in the direction of the sector used by the phone. With this modification, the Court does not believe that there is any danger of unfair prejudice. Experts Important Cases Expert Testimony State of Maryland v. Joseph William Payne & Jason Bond Circuit Court for Baltimore County, Maryland Case Nos. K ; K Argued: September 10, 2014 Opinion by Battaglia, J. Barbera, C.J., Harrell and McDonald, JJ., concur Filed: December 11, 2014 Experts State of Maryland v. Joseph William Payne & Jason Bond Trial court erred by allowing a police officer, who was not qualified as an expert under Maryland Rule 5-702, to testify as to the location of the cell phone towers through which the defendants cell phone calls were routed as determined by his analysis of the defendants cell phone records, because such testimony requires that the witness be qualified as an expert. Drive testing There are no principles or methods to determine the coverage area of a cell tower or cell tower sector without applying complex engineering formulae to known parameters for each cell tower sector antenna. It is not possible for anyone to reliably determine the particular coverage area of a cell tower or cell tower antenna after the fact based solely on historical cell tower location data or historical call detail records.

43 While some analysts will perform drive tests to attempt to make their presentations more scientific, this is not a reliable method for determining the coverage of a cell tower or sector at the time of an incident. In order for a drive testing to even be remotely accurate, it would have to be done within a few hours of the incident, every environmental and engineering factor would have to be exactly the same as it was at the time of the incident and this is rarely the case for drive testing in cell phone location cases. The drive test is normally done weeks, months and even years after the fact. Additionally, the drive test would have to be done at a minimum on the same day of the week, the same time of the year in areas that have large foliage variations, at the same time of day and under the same weather and cellular traffic conditions. It is simply not possible to exactly duplicate the conditions of the cellular system at some future time when the analyst gets involved in the case.

44 Another way to show drive testing results is to show a map with a trail or route that the car and equipment doing the drive testing drove along during the test. The issue with this type of drive testing is exactly the same as any other drive testing methods; if performed months to years after the fact, it has no relationship to the conditions present at the time a phone call was made. In the map below, the green lines and dots show places where the subject phone would have received a signal from the South Goldenrod tower. It immediately begs the question: If the phone is not precisely in one of the green spots, it could not possible make a phone call? Of course it could. An important point about drive testing is that radio waves are not static. They wax and wane even while a phone is stationary and can change cell towers without moving at all. Important Cases Drive Testing State of Maryland v. Bashunn Phillips (Memorandum) This was later overturned by a higher court. But the argument and analysis is very educational. Drive Testing Important Cases State of Maryland v. Bashunn Phillips (Memorandum)

45 Warrantless Tracking : Stingray Important Cases Prince Jones v. United States We agree with Mr. Jones that the government violated the Fourth Amendment when it deployed the cell-site simulator against him without first obtaining a warrant based on probable cause. Further, we reverse the trial court s inevitable-discovery ruling and reject the government s argument (not resolved by the trial court) that the good-faith doctrine precludes applying the exclusionary rule in this case. NELOS, PCMD and RTT PCMD and RTT data contains network activity traffic between a cell phone and a cell tower. The PCMD and RTT tools were created by the wireless telephone companies for the purpose of checking and overseeing their networks. They were not created for or designed for the purpose of historically locating cell phones. According to Sprint, PCMD data carries a disclaimer as: Please be advised that there are known accuracy defects with Sprint PCMD reporting. Therefore Sprint is unable to certify or testify to the accuracy of PCMD records. It is important to understand that the tool used to provide PCMD records was created as a tool for Sprint to oversee the network. It was not created as a tool to identify customer location, pursuant to exigent circumstance, or legal demand. Nevertheless, it has been used in those situations as it is a Sprint record that could possibly lead to customer location. There are several factors that may impact the accuracy of the reporting. Those factors include, but are not limited to, the use of repeaters, small cells, outdates cell records loaded into the tool, and the tool s ability to potentially pick up deactivated devices that have shared the same telephone number. The latitude and longitude found on PCMD reporting is not historical GPS for the device. PCMD is calculated based on the measurement of the Round Trip Delay (RTD), which is the time it takes the radio signal from the call tower to reach the mobile phone and return. While the speed of radio signals is well known and therefore can be used to measure the distance between a cell tower and a cellular phone, unless the signal is perfectly clean and stable and

46 there is a minimum of three towers in clear line of sight to the cellular phone, the accuracy of the location will be unreliable. There are many factors that may impact the accuracy of these location measurements: Multi-Pathing: Multi-pathing is where a cellular signal is being deflected or otherwise bounced from a direction that is not in the direct line of sight between the cellular phone and the cell tower. When this occurs, it is impossible to measure the distance to the tower using round trip delay as the route is no longer a known factor. A simple way to explain multi-pathing and its effect on round trip delay time is to think if the radio-signal as a ball on a pool table. If the ball is going in a straight line from the cue tip to the rail and back, the round trip delay can be calculated very accurately. However, if the ball were to be bounced off of a random number of rails prior to completing the round trip back to the cue tip, the distance and time would no longer be a known factor but would be a random amount. This randomness in round trip delay caused by multipathing would cause a major error in the calculation and accuracy of the estimated position of the cellular phone. Capacity Issues: Capacity issues occur when the database computers and processing computers in the cellular network cannot handle all of the data being collected. When this occurs, data is lost. The data that is lost is data from the cell sites that are supposed to be reporting back round trip delay information for the purpose of calculating the estimated location of the cellular phone. When this data is lost, the system is unable to calculate all of the data associated with the PCMD system and the result is that errors are introduced. However, these errors are not displayed as part of the data provided to law enforcement or anyone else that is attempting to use the estimated locations of the cell phone to show the position of the phone at any point in time. In other words, it is impossible to know when the location information provided for a cellular phone is accurate or inaccurate based on per call measurement data since the capacity state of the system in not a known factor. For this reason, among others, it is impossible to determine the baseline accuracy of per call measurement data locations of cell phones or any known margin of error for these estimated locations. Multiple Hand-Off Connections: A hand-off refers to the process of transferring an ongoing phone call from one cell tower to another cell tower because the phone is moving away from a cell tower, approaching a cell tower, or is in a position where the signal from the cell tower the phone is connected to is not as strong and high quality as the signal from another tower, even when the cell phone is not moving. This occurs when the phone is in a soft-handoff situation and can be connected to multiple cell towers and cell tower sectors at the same time, making it impossible for the system to determine which towers are to be used in the real time delay measurement. This is because the signal of the best of all the used channels from the towers can be used at

47 any moment or all the signals can be combined to produce a clear signal. This has the same effect on the location measurement as multi-pathing. However, these multiple hand-off situations are not displayed as part of the data provided to law enforcement or anyone else that is attempting to use the estimated locations of the cell phone to show the position of the phone at any point in time. It is impossible to determine the baseline accuracy of per call measurement data locations of cell phones or any known margin of error for these estimated locations. Repeaters: Sprint and other cellular phone companies employ repeaters in their networks. A repeater is a device that can send and receive cellular signals, but is not local to the cell tower it is using for processing of the signals. It acts like a cell tower, but does not contain the equipment needed to process calls. The repeater takes the radio signal and sends the data over a land line to a cell tower that is being used to process the call. When this occurs, any round trip delay measurement of the radio signal would be measuring the distance to a repeater station and not an actual cell tower. Since the geographic location of the repeater that is connected to the cell phone is not used for the calculation, but rather the geographic location of the remote cell tower is used, the location data is inherently incorrect. In their European patent application, EP A1, Mobile device data collection for use in mobile communications network improvements, Verizon explains in [0004], Yet another technique for collecting mobile communications network operational parameters is known as per call measurement data method. In this technique, the wireless network communications network takes periodic measurements from the mobile phone and stores them in a central server with a latitude and longitude. This latitude and longitude is determined by using timing triangulation from the cellular towers of the mobile communications network. In such a method, the locations of where the measurements are taken can be very inaccurate due the limitations that result form [sic] timing triangulation. Further, the location of the mobile station can only be determined when the mobile station is seen by a plurality of cellular towers. Verizon, in response to subpoena and warrants requesting data from their RTT, Real Time Tool provides the following disclaimer: The latitude and longitude measurements of the Real Time Tool RTT report are derived solely from the Round Trip Delay measurement. They are the best estimates and are not related to any GPS measurement. Measurements with a high degree of confidence factor may be more accurate than measurements with a low confidence factor, but all measurements contained on this report are the best estimates available rather than precise location.

48

49 Case Example: WiFi Location The map above shows location data extracted from a cell phone using Cellebrite Forensic Software and Hardware. The pins show the locations of in home wireless routers that were detected by the phone as it traveled near the houses. In this case, the accused claimed that he was never in this neighborhood

50 E-911 Location The Federal Communications Commission (FCC) governs wireless telephone service in the USA. One of the requirements of the FCC for wireless telephone companies is that the company must be able to locate a cell phone that dials 911. This is true whether the cell phone has a GPS chip or if the GPS is turned off. When a cell phone calls 911, the first thing that appears on the 911 operators screen is the wireless telephone number and the cell tower and sector being used for the call. In a few more seconds, the 911 system is required to provide a GPS location for the phone. The 911 system will use GPS if 911 assist is turned on, on the phone. Otherwise, the wireless system will attempt to triangulate the phone using three or more cell towers in range of the phone. Find my iphone Device Based One the most accurate ways to determine the location of a cell phone in real time is to use the location capabilities of the phone itself. For instance, Find my iphone appears to be extremely accurate for location purposes. This is because this application is using all of the capabilities of the phone device and the network to locate itself and send that location to the Find my iphone application.