Keeping track

Cell site analysis is a relatively new area of expertise that deals with the geographical location of a mobile phone at the time calls are made. Cell site analysis (CSA) can be used, for example, as part of an investigation to show the different journeys taken by two handsets whose users face conspiracy charges; it can show the route taken by a drug runner and can be used, in certain circumstances, to locate a handset to within a few 10s of metres. CSA was used in the Rhys Jones murder case to locate a handset in the vicinity of a garage where clothes were burnt and has been used in numerous terrorist and drugs-related cases to demonstrate the movements of handsets, and therefore of their users.

How mobile phones are monitored

The basics of CSA are quite simple. Call Data Records (CDRs) are retained by the Communication Service Provider (CSP) for billing purposes for up to 12 months. As part of an investigation these records are obtained directly from a cell phone operator such as O2 or Vodafone or may be served by the prosecution as part of an evidence bundle.

The CDRs record the start and end time of a telephone conversation or SMS message and the cell site (the mast) on which the call/SMS was made. For most operators, this includes both the starting and finishing cells and an approximation of the direction of the phone from the mast.

Simplified mobile phone coverage in a given area can be envisaged as a collection of overlapping areas of different sizes that are referred to as cells. Typically, each cell radiates in a 120 degree arc from the cell site mast, although this does vary with some cells having omni-directional antennae. Some, for instance on motorways, may just radiate in either direction along the route of the road.

A simplified example of typical coverage from a number of cells is shown in figure 1 (see print version). In this example, each mast has three 120 degree cells each radiating in a different direction and overlapping with cells from adjacent masts. The example shows a small localised cell, known as a pico-cell (that may for instance serve a shopping centre) that is completely encompassed by a larger cell (a macro cell).

A cell phone operating on the 2G network by specification monitors a number of different cells and as the phone moves (or as determined by the network) the phone will hop from cell to cell in order to maintain a good quality signal.

A telephone handset in fact monitors up to seven cells '“ the current serving cell (often referred to as the best serving cell) and up to six neighbour cells. The signal strength and other quality metrics are reported at regular intervals to the network computers by the handset. This information allows the network to direct the handset to switch cells in various circumstances. This will typically happen when the signal strength of the main serving cell drops below that of a neighbour cell (i.e. as the handset travels away from a cell tower). It can also happen if the network decides that a particular cell is handling too many calls, in which case a handset can be switched (known as a directed transfer) to another neighbouring cell providing adequate signal levels.

In practice, the 'footprint' of a cell is rarely anything approximating the simplified diagram in figure 1. The footprint is affected by the height and power of the transmitter, intervening buildings and high ground which may present radio shadows. Indeed, in some case it is possible to receive the signal and make calls 'behind' a cell.

In order to plot the real coverage based on the information from the CDRs, a cell site survey is undertaken using specialist handsets with specially modified software to monitor the radio signals in the vicinity of the relevant masts and thus determine the 'radio footprint' of the cell or cells in the area. The results of this survey in conjunction with the CDRs can be used to determine a range of locations that the telephone may have been in when the call was made.

This survey is obtained by driving and/or walking around all the streets in the vicinity of a particular cell to determine the range of possible locations that could be utilised by the handset using that cell.

Specific spot measurements are made at and around any specific incidents of a crime, such as in bars or bedrooms.

In figure 2 (see print version), each network measurement is represented by a coloured dot, with the cells received by the test software while driving along a particular route displayed in different colours. The survey only included the cells identified from the CDRs as relevant to this case. In practice, many more cells would have been monitored.

It should always be emphasised in any investigation utilising cell site analysis that it is usually only possible to place a handset in a particular geographical area. In urban sites, this could be anywhere from a few hundred yards to a few miles from the cell site mast. In the countryside, a particular cell can cover many miles. However, cell site analysis can often be used with confidence to say that a telephone could not be located in a particular area.

As an example, consider a scenario where a witness has claimed that immediately after a crime a suspect was observed entering an alleyway in the centre of a town to make a telephone call. Analysis of the call logs shows that the call both started and completed on the same cell ID.

Records were obtained from the service provider and it was determined that this particular cell was what is known as a 'small footprint low power pico-cell', commissioned to handle the heavy telephone traffic associated with the town centre. After the test handset was locked to the particular cell, a survey was carried out in the immediate vicinity of the cell, focusing in particular on the alleyway where the call was said to have been made. It was determined that the signal strength of that particular cell at that location was not sufficient to make a telephone call. A graph depicting the signal strength of the cell as the test handset travels into the alleyway shows that it decreases below the strength required for a successful call indicating that the evidence provided by this witness may not be reliable (see print version).

In a second example, it was claimed that because a particular call started on one cell and completed a few seconds later on a different cell that the telephone must have been travelling between the areas covered by the two cells. The defendant claimed that he was at home at the time the call was made. A network survey and subsequent examination showed that the defendant's house was located in an area covered by both cells, and the best serving cell for any given call was determined by the location of the handset within the property.

From an investigation point of view, time is clearly paramount as a delay in requesting data from the CSP can result in the records no longer being available. It is also important to consider the effects of the passage of time on the network topography itself. New masts may have been erected between the date of the incident and the date of the survey, or the operating parameters of existing masts may have been changed. This information can and should be requested from the CSP at the time that the CDR's are requisitioned.

How to structure questions and challenging findings

Cell site analysis is not an exact science. There are few 'yes/no' answers and any number of factors that can affect the technology which spawns the data on which the analysis is based.

It is usually the case that a 'tailored' cell site analysis has been carried out. That is, the expert has been asked if they can offer a scenario that is consistent with a suspect being in a particular location at the time that a call was made. If no other possibilities are explored, then it can appear that there is irrefutable evidence placing the individual at a particular location. In practice, it is usually possible to show that the data is actually consistent with the suspect making the call from anywhere within a range that may extend over several miles.

Density of network traffic and functionality of systems can change from day to day. It could be that on the day in question there was an event taking place that might have had an impact on network traffic; a particular cell may have been out of commission at the time of the incident '“ these are factors that may be easily verified. It is worth questioning whether such research has been carried out before a conclusion has been reached.

The topography of the surrounding area can be a vital consideration. The position of a building for instance can impact on findings. It is important that a full survey of the surrounding area has been carried out taking into account signal strength at all possible locations.

If it appears to you that only the basic principles have been applied, don't be afraid to raise questions.

How can solicitors help?

The most important thing a solicitor can give a cell site investigator is time. The survey part of a cell site investigation involving multiple handsets using several cell site masts can take many days to complete. This work often needs to be fitted into a busy schedule at short notice and the pre-survey, survey data interpretation and report writing stages can take just as long if not longer.

Typically a defence case will rely on data that is supplied by the prosecution authorities as part of their case. This may be adequate, but in the instances where information is lacking any delay in the service of reports by the prosecution can mean that data is no longer available from the CSPs.

The information that is required from the CSPs (if it has not been supplied in the prosecution bundle) can take several weeks to arrive and if permission needs to be sought to undertake a survey inside private property this can also take some time to arrange.

It is quite common to get an instruction very late in the proceedings even when the solicitors have known of the requirement for months. Please make sure you instruct as early as possible, ideally two or three months before trial.

Selecting an expert

This is a relatively new field and there are few experts to choose from. That said, there are skills and experience in parallel fields that can be applied. It is essentially a mix of communications, computing and analytical skills.

As with any forensic discipline, a good expert will look beyond the immediately obvious and explore all possible avenues before offering an opinion.

When selecting a cell site expert, the same advice applies as when selecting any expert. Check the registers; request biographies; ask for examples of similar work; ask colleagues for recommendations. Talk to the engineer who will be doing the survey and analysing the resultant data (this should ideally be the same person) this could be the person who will be representing your client in court '“ do they sound technically competent and have they given evidence before?