Cell Phone Record Analysis in Support of Criminal Cases

Transcription

1 Cell Phone Record Analysis in Support of Criminal Cases Reference Manual Volume No. 16-W060 Ohio State Bar Association Continuing Legal Education is a division of the Ohio State Bar Association.

2 Ohio State Bar Association CLE is a division of the Ohio State Bar Association. CLE speakers are volunteers serving the legal profession in its highest and best tradition and as recommended by the Ohio Rules of Professional Conduct. CLE supports gender neutral language. Unless used to illustrate a specific case, all references to gender should be understood to refer, without bias, to male and female. Books and seminar materials are published as part of the Ohio State Bar Association s educational services. Authors are given the opportunity to express their individual interpretations and opinions. These do not reflect in any way a position of CLE, the Ohio State Bar Association or its governing board. Chapters written by employees of state or federal agencies are not necessarily statements of governmental policies by Ohio State Bar Association CLE. All Rights Reserved. Ohio State Bar Association CLE publications, oral presentations, video, audio and electronic media programs are provided with the understanding that the Ohio State Bar Association and OSBA CLE do not render any legal, accounting, or other professional advice or service. Attorneys using OSBA CLE publications or orally, visually or electronically conveyed information in dealing with a specific client s or their own legal matters should also research original sources of authority. The CLE office is located at 1700 Lake Shore Drive, Columbus, Ohio Mail may be addressed to: P.O. Box Columbus, Ohio CLE telephone numbers are:

3 OHIO STATE BAR ASSOCIATION CONTINUING LEGAL EDUCATION The Ohio State Bar Association Mission Statement Our Core Purpose To advance the professional interests of members of the Ohio State Bar Association. Our Core Values Member satisfaction, professionalism, foresight, and quality services and products. Our Goal To make membership in the Ohio State Bar Association indispensable to Ohio Lawyers. THE CLE STAFF Fran Wellington Director Todd Burch CLE Program Manager Kerschie Byerly Senior CLE Publications Editor Deanna Freeman CLE Program Administrator Jennifer Harrell Senior CLE Program Manager Jim Hogan Printing Manager Don Lee Production Coordinator Chris Loehrer Studio Operations Manager Betsy Metzger CLE Program Administrator Lynda Morris CLE Program Coordinator Melissa Quick Manager of CLE Certification and Specialization Jeff Ross Printer Judy Ann Schiewer CLE Registrar

4 Cell Phone Record Analysis in Support of Criminal Cases Vol. # 16-W CLE CREDIT HOUR Wednesday, June 29, 2016 at 1:00pm Featuring: Benjamin Bierce; Bierce Associates LLC; Bargersville, Ind. This presentation is a live webcast. If you have a question for the speaker during the presentation, please feel free to submit your inquiry to webquestions@ohiobar.org with Cell Phone Record Analysis in the subject line or call , and let the operator know that you have a question for the seminar speaker. The Supreme Court Commission on CLE has requested that we advise you that this webcast seminar is considered self-study. Under current regulations you are allowed to earn up to 6 of your 24 required CLE credits through self-study. In order to receive CLE credit for this webcast, you must view the entire program. No partial credit can be given. As you watch today s webcast at your computer, you should be looking for four unique Attendance Verification code letters. Each part of the code consists of a single letter that will appear on your screen periodically during the program. These four letters form a four-part code that documents your participation in this CLE program. When the course ends, go back to your self-study CLE account, from where you launched the webcast. Click on the tab marked Certificate and enter the four code letters in the order you received them. If the code is correct, the participation code requirement will display complete. You will also need to complete the course evaluation. Once these two requirements are met, you will be able to access a Certificate of Completion documenting your attendance and CLE credit hours. CLE regulations require that we submit requests for credit within 30 days of the date of the seminar or be assessed a late fee. If you do not enter the attendance verification codes or complete the evaluation, then we will not be able to report your credit.

5 Featured Speaker Benjamin Bierce Bierce Associates LLC Bargersville, Indiana Mr. Bierce is managing member and analyst f his firm. He organized Bierce Associates LLC in 2012 in order to assist police departments, prosecutors, and attorneys. Mr. Bierce draws on his experience and expertise to assist in ongoing criminal cases, criminal prosecution, and civil cases. As a Detective with the Indianapolis Metropolitan Police Department, he analyzed phone records for the Homicide/Robbery branch. Mr. Bierce is a retired Special Agent with the U.S. Army Criminal Investigation Division Command. He is a frequent presenter on topics related to his areas of expertise. For additional information, please visit

6 Preserving and Obtaining Cell Phone Records Benjamin Bierce Bierce Associates LLC Bargersville, Indiana Table of Contents Preserving and Obtaining Cell Phone Records PowerPoint Presentation... 1 Preserving and Obtaining Cell Phone Records i

7 ii Cell Phone Record Analysis in Support of Criminal Cases

8 Preserving and Obtaining Cell Phone Records Benjamin Bierce Bierce Associates LLC Bierce Associates LLC 1 About Bierce Former Detective Indianapolis Police Computer & Digital Forensics Unit and Homicide Robbery Branch Retired Special Agent, U.S. Army Criminal Investigation Division (CID) Managing Member, Bierce Associates LLC Bierce Associates LLC 2 Preserving and Obtaining Cell Phone Records 1

9 About Bierce Training Basic Mobile Device Investigations National Computer Forensics Institute, US Secret Service, 2015 Mobile Device Investigation Program Federal Law Enforcement Training Center, 2014 Cell Phone Data & Mapping Police Technical, 2014 Smartphone Forensics & Advanced Cellular Technology Public Agency Training Council, 2012 Fundamentals of Intelligence Analysis Training National White Collar Crime Center, 2012 Basic Cell Phone Investigations National White Collar Crime Center, 2010 Bierce Associates LLC 3 What Do We Want To Know Where was the phone at the time of the crime Voice Text Data Who uses the phone Verify the suspect uses the phone Who does the user call Bierce Associates LLC 4 2 Cell Phone Record Analysis in Support of Criminal Cases

10 Cell Sites Accessed between 12:30 PM and 2:32 PM August 20, Portland Square 5637 W. 51 st Pl Ashley Ln Kebil Dr. 8/20/2013, 12:30 PM 1 Outbound Call NEID 422 Cell 1580 Preserving and Obtaining Cell Phone Records 3

11 7137 Portland Square 5637 W. 51st Pl Kebil Dr Ashley Ln. 8/20/2013, 1:09 PM 1 Outbound Call NEID 422 Cell W. 51st Pl Kebil Dr Ashley Ln. 8/20/2013, 1:09 PM 1 Outbound Call NEID 422 Cell 1559, Sector 1 4 Cell Phone Record Analysis in Support of Criminal Cases

12 7137 Portland Square 5637 W. 51st Pl Kebil Dr Ashley Ln. 8/20/2013, 1:23 PM 1 Inbound Call NEID 422 Cell Kebil Dr Ashley Ln. 8/20/2013, 1:23 PM 1 Inbound Call NEID 422 Cell 1583, Sector 1 Preserving and Obtaining Cell Phone Records 5

13 7137 Portland Square 5637 W. 51 st Pl Ashley Ln Kebil Dr. 8/20/2013, 1:48 PM 1 Inbound Call NEID 422 Cell W. 51 st Pl Kebil Dr Ashley Ln. 8/20/2013, 1:48 PM 1 Inbound Call NEID 422 Cell 1559, Sector 2 6 Cell Phone Record Analysis in Support of Criminal Cases

14 7137 Portland Square 5637 W. 51 st Pl Ashley Ln Kebil Dr. 8/20/2013, 1:54 PM 1 Inbound Call NEID 422 Cell Portland Square 5637 W. 51 st Pl Ashley Ln Kebil Dr. 8/20/2013, 1:58 PM 1 Outbound Call NEID 422 Cell 1574 Preserving and Obtaining Cell Phone Records 7

15 7137 Portland Square 5637 W. 51 st Pl Ashley Ln Kebil Dr. 8/20/2013, 2:07 PM to 2:28 PM 2 Inbound & 3 Outbound Calls NEID 422 Cell Portland Square 5637 W. 51 st Pl Ashley Ln Kebil Dr. 8/20/2013, 2:31 PM 1 Inbound Call NEID 422 Cell Cell Phone Record Analysis in Support of Criminal Cases

16 7137 Portland Square 5637 W. 51 st Pl Ashley Ln Kebil Dr. 8/20/2013, 2:32 PM 1 Inbound Call NEID 422 Cell 1589 Types of Records Billing records Subscriber information Start time to the minute Voice Data (maybe) Text (without content) Length of call to the minute No cell towers No text message content Bierce Associates LLC ben@bierceassociates.com 18 Preserving and Obtaining Cell Phone Records 9

17 Types of Records Call Detail Records (With Cell Sites) Records with Cell towers Exact location (Verizon, Sprint, AT&T) Text Message Content (Verizon) Data and Text usage (may or may not have cell towers) May require a court order (recommended) Bierce Associates LLC ben@bierceassociates.com 19 What Will These Records Give Us Call Detail Records with Cell Site Info Data Detail Text Detail Precise Location NELOS (AT&T) PCMD (Sprint) RTT (Verizon) Bierce Associates LLC ben@bierceassociates.com Cell Phone Record Analysis in Support of Criminal Cases

18 How Long do Companies Keep the Data AT&T CDR with cell sites, back to July 23, 2008 NELOS, about 30 days No text messages No seconds on call time, but seconds of duration Bierce Associates LLC 21 How Long do Companies Keep the Data Sprint CDR with cell sites, 18 months PCMD, 14 days No text messages Bierce Associates LLC 22 Preserving and Obtaining Cell Phone Records 11

19 How Long do Companies Keep the Data T Mobile/Metro PCS CDR with cell sites, 2 Years No RTT, PCMD or anything like it No text messages Bierce Associates LLC ben@bierceassociates.com 23 How Long do Companies Keep the Data Verizon CDR with cell sites, 1 year Text messages, 7 days RTT, 7 days Bierce Associates LLC ben@bierceassociates.com Cell Phone Record Analysis in Support of Criminal Cases

20 How Long do Companies Keep the Data So, we have one year from the date of the incident to identify the phone number and preserve the records Bierce Associates LLC U.S. Code 2703 Requires phone companies to maintain records for 180 days Will maintain for additional 90 days upon request Bierce Associates LLC 26 Preserving and Obtaining Cell Phone Records 13

21 Preservation Request What to ask for Different for each company Bierce Associates LLC 27 What to Ask For AT&T Subscriber Information All Communication including Tower Locations Voice Data Text NELOS (Network Event Location System) Voic Messages including content AT&T Cloud Content A detailed definitions page which identifies all the information in the records Bierce Associates LLC ben@bierceassociates.com Cell Phone Record Analysis in Support of Criminal Cases

22 What to Ask For Sprint Subscriber Information All Communication including tower locations Voice Data Text PCMD (Per Call Measurement Data) Voic Messages Bierce Associates LLC 29 What to Ask For T Mobile/Metro PCS Subscriber information All communication Voice Data Text Voic Messages Text messages (Metro PCS) Bierce Associates LLC ben@bierceassociates.com 30 Preserving and Obtaining Cell Phone Records 15

23 What to Ask For Verizon Subscriber Information All communication Voice Data Text RTT (Round Trip Time) Voic Messages Verizon Cloud Bierce Associates LLC 31 Legal Demand Wording is the same as the preservation request Subpoena vs. Court Order/Search Warrant Subpoena Usually only the billing records AT&T and Verizon say they will include cell sites Much larger pool of requests Slower Bierce Associates LLC Cell Phone Record Analysis in Support of Criminal Cases

24 Legal Demand Court Order/Search Warrant Will get content Safest to ensure you will get the info you need Smaller pool of requests Faster Bierce Associates LLC 33 Mapping Maps the cell sites, not necessarily the phones location The CDR usually provides the first and last cell sites used during the call Also usually provides the sector of the cell site used Bierce Associates LLC 34 Preserving and Obtaining Cell Phone Records 17

25 Mapping Scenario Burglary occurs on Oakhurst Dr. 7/17/2014 between 5:00 PM and 6:00 PM Suspect s address listed on Countrybrook Rd. Bierce Associates LLC ben@bierceassociates.com 35 Mapping Bierce Associates LLC ben@bierceassociates.com 18 Cell Phone Record Analysis in Support of Criminal Cases 36

26 Mapping Bierce Associates LLC 37 Mapping Countrybrook Rd. Oakhurst Dr. Bierce Associates LLC 7/17/2014, 5:14 PM 1 Outbound Call NEID 420 First Cell Site 1581, Sector 3 38 Last Cell Site 1568, Sector 2 Preserving and Obtaining Cell Phone Records 19

27 Call Analysis See the calls around the time of the crime Bierce Associates LLC 39 Call Analysis Scenario Suspect & Joe Coconspirator want to burglarize Jim Victim s apartment Suspect works for Acme Rocket Skate Company Doesn t show up for work Bierce Associates LLC ben@bierceassociates.com Cell Phone Record Analysis in Support of Criminal Cases

28 Call Analysis Bierce Associates LLC 41 Call Analysis Identify the user of the phone Identify the most frequently called numbers Compare and rank associations Bierce Associates LLC 42 Preserving and Obtaining Cell Phone Records 21

29 Call Analysis Bierce Associates LLC 43 Frequent Area Analysis Identify the most frequently used cell sites Patterns of location Bierce Associates LLC Cell Phone Record Analysis in Support of Criminal Cases

30 Frequent Area Analysis Bierce Associates LLC 45 Frequent Area Analysis Bierce Associates LLC 46 Preserving and Obtaining Cell Phone Records 23

31 Frequent Area Analysis Bierce Associates LLC 47 Conclusion Any time you want to know Where someone (the phone) was If he or she was on the phone Who someone associates with The strength of association between 2 people Areas frequented Bierce Associates LLC ben@bierceassociates.com 24 Cell Phone Record Analysis in Support of Criminal Cases 48

32 Conclusion Time is critical Tower information can be lost as soon as 1 year Text messages and precise locations start to disappear in as little as 7 days Bierce Associates LLC ben@bierceassociates.com 49 Conclusion Identify the phone in question early Exemplar calls should be made as close to the time of the incident as possible Identifying the phone will enable the same type of phone to be used Identifying the carrier will reduce the number exemplar calls necessary Bierce Associates LLC ben@bierceassociates.com 50 Preserving and Obtaining Cell Phone Records 25

33 Bierce Associates LLC Benjamin Bierce Bierce Associates LLC Cell Phone Record Analysis in Support of Criminal Cases