Cell Phone Record Analysis in Support of Criminal Cases Reference Manual Volume No. 16-W060 Ohio State Bar Association Continuing Legal Education is a division of the Ohio State Bar Association.
Ohio State Bar Association CLE is a division of the Ohio State Bar Association. CLE speakers are volunteers serving the legal profession in its highest and best tradition and as recommended by the Ohio Rules of Professional Conduct. CLE supports gender neutral language. Unless used to illustrate a specific case, all references to gender should be understood to refer, without bias, to male and female. Books and seminar materials are published as part of the Ohio State Bar Association s educational services. Authors are given the opportunity to express their individual interpretations and opinions. These do not reflect in any way a position of CLE, the Ohio State Bar Association or its governing board. Chapters written by employees of state or federal agencies are not necessarily statements of governmental policies. 2016 by Ohio State Bar Association CLE. All Rights Reserved. Ohio State Bar Association CLE publications, oral presentations, video, audio and electronic media programs are provided with the understanding that the Ohio State Bar Association and OSBA CLE do not render any legal, accounting, or other professional advice or service. Attorneys using OSBA CLE publications or orally, visually or electronically conveyed information in dealing with a specific client s or their own legal matters should also research original sources of authority. The CLE office is located at 1700 Lake Shore Drive, Columbus, Ohio 43204 Mail may be addressed to: P.O. Box 16562 Columbus, Ohio 43216-6562 CLE telephone numbers are: 614-487-8585 800-232-7124
OHIO STATE BAR ASSOCIATION CONTINUING LEGAL EDUCATION The Ohio State Bar Association Mission Statement Our Core Purpose To advance the professional interests of members of the Ohio State Bar Association. Our Core Values Member satisfaction, professionalism, foresight, and quality services and products. Our Goal To make membership in the Ohio State Bar Association indispensable to Ohio Lawyers. THE CLE STAFF Fran Wellington Director fwellington@ohiobar.org Todd Burch CLE Program Manager tburch@ohiobar.org Kerschie Byerly Senior CLE Publications Editor kbyerly@ohiobar.org Deanna Freeman CLE Program Administrator dfreeman@ohiobar.org Jennifer Harrell Senior CLE Program Manager jharrell@ohiobar.org Jim Hogan Printing Manager jhogan@ohiobar.org Don Lee Production Coordinator dlee@ohiobar.org Chris Loehrer Studio Operations Manager cloehrer@ohiobar.org Betsy Metzger CLE Program Administrator bmetzger@ohiobar.org Lynda Morris CLE Program Coordinator lmorris@ohiobar.org Melissa Quick Manager of CLE Certification and Specialization mquick@ohiobar.org Jeff Ross Printer jross@ohiobar.org Judy Ann Schiewer CLE Registrar jschiewer@ohiobar.org
Cell Phone Record Analysis in Support of Criminal Cases Vol. # 16-W060 1.0 CLE CREDIT HOUR Wednesday, June 29, 2016 at 1:00pm Featuring: Benjamin Bierce; Bierce Associates LLC; Bargersville, Ind. This presentation is a live webcast. If you have a question for the speaker during the presentation, please feel free to submit your inquiry to webquestions@ohiobar.org with Cell Phone Record Analysis in the subject line or call 1-800-232-7124, and let the operator know that you have a question for the seminar speaker. The Supreme Court Commission on CLE has requested that we advise you that this webcast seminar is considered self-study. Under current regulations you are allowed to earn up to 6 of your 24 required CLE credits through self-study. In order to receive CLE credit for this webcast, you must view the entire program. No partial credit can be given. As you watch today s webcast at your computer, you should be looking for four unique Attendance Verification code letters. Each part of the code consists of a single letter that will appear on your screen periodically during the program. These four letters form a four-part code that documents your participation in this CLE program. When the course ends, go back to your self-study CLE account, from where you launched the webcast. Click on the tab marked Certificate and enter the four code letters in the order you received them. If the code is correct, the participation code requirement will display complete. You will also need to complete the course evaluation. Once these two requirements are met, you will be able to access a Certificate of Completion documenting your attendance and CLE credit hours. CLE regulations require that we submit requests for credit within 30 days of the date of the seminar or be assessed a late fee. If you do not enter the attendance verification codes or complete the evaluation, then we will not be able to report your credit.
Featured Speaker Benjamin Bierce Bierce Associates LLC Bargersville, Indiana Mr. Bierce is managing member and analyst f his firm. He organized Bierce Associates LLC in 2012 in order to assist police departments, prosecutors, and attorneys. Mr. Bierce draws on his experience and expertise to assist in ongoing criminal cases, criminal prosecution, and civil cases. As a Detective with the Indianapolis Metropolitan Police Department, he analyzed phone records for the Homicide/Robbery branch. Mr. Bierce is a retired Special Agent with the U.S. Army Criminal Investigation Division Command. He is a frequent presenter on topics related to his areas of expertise. For additional information, please visit www.bierceassociates.com/index.html.
Preserving and Obtaining Cell Phone Records Benjamin Bierce Bierce Associates LLC Bargersville, Indiana Table of Contents Preserving and Obtaining Cell Phone Records PowerPoint Presentation... 1 Preserving and Obtaining Cell Phone Records i
ii Cell Phone Record Analysis in Support of Criminal Cases
Preserving and Obtaining Cell Phone Records Benjamin Bierce Bierce Associates LLC www.bierceassociates.com ben@bierceassociates.com 317 527 1446 Bierce Associates LLC ben@bierceassociates.com 1 About Bierce Former Detective Indianapolis Police Computer & Digital Forensics Unit and Homicide Robbery Branch Retired Special Agent, U.S. Army Criminal Investigation Division (CID) Managing Member, Bierce Associates LLC Bierce Associates LLC ben@bierceassociates.com 2 Preserving and Obtaining Cell Phone Records 1
About Bierce Training Basic Mobile Device Investigations National Computer Forensics Institute, US Secret Service, 2015 Mobile Device Investigation Program Federal Law Enforcement Training Center, 2014 Cell Phone Data & Mapping Police Technical, 2014 Smartphone Forensics & Advanced Cellular Technology Public Agency Training Council, 2012 Fundamentals of Intelligence Analysis Training National White Collar Crime Center, 2012 Basic Cell Phone Investigations National White Collar Crime Center, 2010 Bierce Associates LLC ben@bierceassociates.com 3 What Do We Want To Know Where was the phone at the time of the crime Voice Text Data Who uses the phone Verify the suspect uses the phone Who does the user call Bierce Associates LLC ben@bierceassociates.com 4 2 Cell Phone Record Analysis in Support of Criminal Cases
317 555 9626 Cell Sites Accessed between 12:30 PM and 2:32 PM August 20, 2013 7137 Portland Square 5637 W. 51 st Pl. 3359 Ashley Ln. 3503 Kebil Dr. 8/20/2013, 12:30 PM 1 Outbound Call NEID 422 Cell 1580 Preserving and Obtaining Cell Phone Records 3
7137 Portland Square 5637 W. 51st Pl. 3503 Kebil Dr. 3359 Ashley Ln. 8/20/2013, 1:09 PM 1 Outbound Call NEID 422 Cell 1559 5637 W. 51st Pl. 3503 Kebil Dr. 3359 Ashley Ln. 8/20/2013, 1:09 PM 1 Outbound Call NEID 422 Cell 1559, Sector 1 4 Cell Phone Record Analysis in Support of Criminal Cases
7137 Portland Square 5637 W. 51st Pl. 3503 Kebil Dr. 3359 Ashley Ln. 8/20/2013, 1:23 PM 1 Inbound Call NEID 422 Cell 1583 3503 Kebil Dr. 3359 Ashley Ln. 8/20/2013, 1:23 PM 1 Inbound Call NEID 422 Cell 1583, Sector 1 Preserving and Obtaining Cell Phone Records 5
7137 Portland Square 5637 W. 51 st Pl. 3359 Ashley Ln. 3503 Kebil Dr. 8/20/2013, 1:48 PM 1 Inbound Call NEID 422 Cell 1559 5637 W. 51 st Pl. 3503 Kebil Dr. 3359 Ashley Ln. 8/20/2013, 1:48 PM 1 Inbound Call NEID 422 Cell 1559, Sector 2 6 Cell Phone Record Analysis in Support of Criminal Cases
7137 Portland Square 5637 W. 51 st Pl. 3359 Ashley Ln. 3503 Kebil Dr. 8/20/2013, 1:54 PM 1 Inbound Call NEID 422 Cell 1563 7137 Portland Square 5637 W. 51 st Pl. 3359 Ashley Ln. 3503 Kebil Dr. 8/20/2013, 1:58 PM 1 Outbound Call NEID 422 Cell 1574 Preserving and Obtaining Cell Phone Records 7
7137 Portland Square 5637 W. 51 st Pl. 3359 Ashley Ln. 3503 Kebil Dr. 8/20/2013, 2:07 PM to 2:28 PM 2 Inbound & 3 Outbound Calls NEID 422 Cell 1589 7137 Portland Square 5637 W. 51 st Pl. 3359 Ashley Ln. 3503 Kebil Dr. 8/20/2013, 2:31 PM 1 Inbound Call NEID 422 Cell 1600 8 Cell Phone Record Analysis in Support of Criminal Cases
7137 Portland Square 5637 W. 51 st Pl. 3359 Ashley Ln. 3503 Kebil Dr. 8/20/2013, 2:32 PM 1 Inbound Call NEID 422 Cell 1589 Types of Records Billing records Subscriber information Start time to the minute Voice Data (maybe) Text (without content) Length of call to the minute No cell towers No text message content Bierce Associates LLC ben@bierceassociates.com 18 Preserving and Obtaining Cell Phone Records 9
Types of Records Call Detail Records (With Cell Sites) Records with Cell towers Exact location (Verizon, Sprint, AT&T) Text Message Content (Verizon) Data and Text usage (may or may not have cell towers) May require a court order (recommended) Bierce Associates LLC ben@bierceassociates.com 19 What Will These Records Give Us Call Detail Records with Cell Site Info Data Detail Text Detail Precise Location NELOS (AT&T) PCMD (Sprint) RTT (Verizon) Bierce Associates LLC ben@bierceassociates.com 20 10 Cell Phone Record Analysis in Support of Criminal Cases
How Long do Companies Keep the Data AT&T CDR with cell sites, back to July 23, 2008 NELOS, about 30 days No text messages No seconds on call time, but seconds of duration Bierce Associates LLC ben@bierceassociates.com 21 How Long do Companies Keep the Data Sprint CDR with cell sites, 18 months PCMD, 14 days No text messages Bierce Associates LLC ben@bierceassociates.com 22 Preserving and Obtaining Cell Phone Records 11
How Long do Companies Keep the Data T Mobile/Metro PCS CDR with cell sites, 2 Years No RTT, PCMD or anything like it No text messages Bierce Associates LLC ben@bierceassociates.com 23 How Long do Companies Keep the Data Verizon CDR with cell sites, 1 year Text messages, 7 days RTT, 7 days Bierce Associates LLC ben@bierceassociates.com 24 12 Cell Phone Record Analysis in Support of Criminal Cases
How Long do Companies Keep the Data So, we have one year from the date of the incident to identify the phone number and preserve the records Bierce Associates LLC ben@bierceassociates.com 25 18 U.S. Code 2703 Requires phone companies to maintain records for 180 days Will maintain for additional 90 days upon request Bierce Associates LLC ben@bierceassociates.com 26 Preserving and Obtaining Cell Phone Records 13
Preservation Request What to ask for Different for each company Bierce Associates LLC ben@bierceassociates.com 27 What to Ask For AT&T Subscriber Information All Communication including Tower Locations Voice Data Text NELOS (Network Event Location System) Voicemail Messages including content AT&T Cloud Content A detailed definitions page which identifies all the information in the records Bierce Associates LLC ben@bierceassociates.com 28 14 Cell Phone Record Analysis in Support of Criminal Cases
What to Ask For Sprint Subscriber Information All Communication including tower locations Voice Data Text PCMD (Per Call Measurement Data) Voicemail Messages Bierce Associates LLC ben@bierceassociates.com 29 What to Ask For T Mobile/Metro PCS Subscriber information All communication Voice Data Text Voicemail Messages Text messages (Metro PCS) Bierce Associates LLC ben@bierceassociates.com 30 Preserving and Obtaining Cell Phone Records 15
What to Ask For Verizon Subscriber Information All communication Voice Data Text RTT (Round Trip Time) Voicemail Messages Verizon Cloud Bierce Associates LLC ben@bierceassociates.com 31 Legal Demand Wording is the same as the preservation request Subpoena vs. Court Order/Search Warrant Subpoena Usually only the billing records AT&T and Verizon say they will include cell sites Much larger pool of requests Slower Bierce Associates LLC ben@bierceassociates.com 32 16 Cell Phone Record Analysis in Support of Criminal Cases
Legal Demand Court Order/Search Warrant Will get content Safest to ensure you will get the info you need Smaller pool of requests Faster Bierce Associates LLC ben@bierceassociates.com 33 Mapping Maps the cell sites, not necessarily the phones location The CDR usually provides the first and last cell sites used during the call Also usually provides the sector of the cell site used Bierce Associates LLC ben@bierceassociates.com 34 Preserving and Obtaining Cell Phone Records 17
Mapping Scenario Burglary occurs on Oakhurst Dr. 7/17/2014 between 5:00 PM and 6:00 PM Suspect s address listed on Countrybrook Rd. Bierce Associates LLC ben@bierceassociates.com 35 Mapping Bierce Associates LLC ben@bierceassociates.com 18 Cell Phone Record Analysis in Support of Criminal Cases 36
Mapping 420 31581 21568 Bierce Associates LLC ben@bierceassociates.com 37 Mapping Countrybrook Rd. Oakhurst Dr. Bierce Associates LLC ben@bierceassociates.com 7/17/2014, 5:14 PM 1 Outbound Call NEID 420 First Cell Site 1581, Sector 3 38 Last Cell Site 1568, Sector 2 Preserving and Obtaining Cell Phone Records 19
Call Analysis See the calls around the time of the crime Bierce Associates LLC ben@bierceassociates.com 39 Call Analysis Scenario Suspect & Joe Coconspirator want to burglarize Jim Victim s apartment Suspect works for Acme Rocket Skate Company Doesn t show up for work Bierce Associates LLC ben@bierceassociates.com 40 20 Cell Phone Record Analysis in Support of Criminal Cases
Call Analysis Bierce Associates LLC ben@bierceassociates.com 41 Call Analysis Identify the user of the phone Identify the most frequently called numbers Compare and rank associations Bierce Associates LLC ben@bierceassociates.com 42 Preserving and Obtaining Cell Phone Records 21
Call Analysis Bierce Associates LLC ben@bierceassociates.com 43 Frequent Area Analysis Identify the most frequently used cell sites Patterns of location Bierce Associates LLC ben@bierceassociates.com 44 22 Cell Phone Record Analysis in Support of Criminal Cases
Frequent Area Analysis Bierce Associates LLC ben@bierceassociates.com 45 Frequent Area Analysis Bierce Associates LLC ben@bierceassociates.com 46 Preserving and Obtaining Cell Phone Records 23
Frequent Area Analysis Bierce Associates LLC ben@bierceassociates.com 47 Conclusion Any time you want to know Where someone (the phone) was If he or she was on the phone Who someone associates with The strength of association between 2 people Areas frequented Bierce Associates LLC ben@bierceassociates.com 24 Cell Phone Record Analysis in Support of Criminal Cases 48
Conclusion Time is critical Tower information can be lost as soon as 1 year Text messages and precise locations start to disappear in as little as 7 days Bierce Associates LLC ben@bierceassociates.com 49 Conclusion Identify the phone in question early Exemplar calls should be made as close to the time of the incident as possible Identifying the phone will enable the same type of phone to be used Identifying the carrier will reduce the number exemplar calls necessary Bierce Associates LLC ben@bierceassociates.com 50 Preserving and Obtaining Cell Phone Records 25
Bierce Associates LLC Benjamin Bierce 317 527 1446 ben@bierceassociates.com www.bierceassociates.com Bierce Associates LLC ben@bierceassociates.com 51 26 Cell Phone Record Analysis in Support of Criminal Cases