Cell site blog: ‘consistent’ data, or data ‘not inconsistent’

By Dr Iain Brodie, Senior Cell Site Expert

As cell site experts we are often asked to consider whether cell site data is ‘consistent’ with a specific scenario, in the knowledge that our words can have a significant impact on how a jury thinks.

For example, a typical question put to us might be:  is the data for a particular mobile phone ‘consistent’ with it having been at the scene of a particular incident which occurred, say, in the centre of Birmingham at 12:00 on a particular day?

If the cell site data for the phone shows that it connected via a cell site in the centre of Birmingham which serves the scene at 12:00, then in my opinion it is clear that the data is consistent with the phone having been at the scene. This does not mean that I think the phone necessarily WAS at the scene, as the cell ID used will cover an extended area and, of course, locations that are not the scene. Given the unpredictable ways in which phones are used, however – what data there is supports the contention that the phone was at the scene.

The situation is equally clear cut if, at 12:00, the phone connected via a cell in central London. It is physically impossible for the phone to have connected to a cell in London whilst located in Birmingham, so (if the records from the network are correct) such data would be in conflict with or inconsistent with the phone having been in central Birmingham at 12:00.

If, at 12:00 and 12:01 say, the phone connected via cells in central Coventry, the scenario is slightly different. It is not, under all circumstances, physically impossible for the phone to have connected to a cell in Coventry whilst located in Birmingham. But in all normal circumstances – given the huge number of other more likely cells in Birmingham for the phone to have used, I would still say that this data was in conflict with the phone having been in central Birmingham at 12:00. Such an opinion could be reinforced by carrying out further work if required, but in general such further work would not be required.

But imagine the data was less clear cut. For example, now my phone’s call data records show a cell site in Coventry connected to by the phone at 11:00, a cell site in Solihull at 11:30, a cell site in eastern Birmingham at 11:45 and a cell site in Wolverhampton connected to at 12:30.

In my opinion this data is again ‘consistent’ with the phone having been at the central Birmingham scene at 12:00, as the logical journey of the phone would have been close to the scene. Indeed there are not many plausible routes other than the phone passing close to the scene at 12:00 that could generate such data – although again, I do not believe the data means that the phone definitely was at the scene (and nowhere else) at 12:00.

If, however, the call data for the cell in Wolverhampton was not so. All we would have was call data consistent with movement of a phone towards the centre of Birmingham, but even less evidence that the phone was in the centre of Birmingham. Such a scenario presents quite a grey area for evidence of opinion. Some experts may say the data is still consistent with the phone being in the centre of Birmingham at 12:00, whilst it may be argued that there is, in fact, NO data consistent with the phone being in the centre of Birmingham at 12:00.

I would say that the data is consistent with the phone having travelled towards the centre of Birmingham in the times leading up to 12:00, although there is no data showing it had been used in central Birmingham.

A final scenario would be where the phone connected to a cell site in Coventry at 11:00 and again to the same cell site in Coventry at 12:45. In this scenario it is quite POSSIBLE that the phone had time to travel to the centre of Birmingham and back, but there is no data that would lead me to expect that this had been the case. Here I would use the phrase ‘the data is ‘not inconsistent’ with the phone having been in the centre of Birmingham at 12:00 but there was no data indicating it had done so’.

This may seem like semantics. However, in a case where I gave evidence for the defence earlier this year (in Birmingham Crown Court as it happens), the prosecution expert asserted that there was cell site evidence ‘consistent’ with the defendant’s phone having been travelling away from a location of a crime at a particular time, when the cell site used for all of the relevant calls provided service at his home address. The prosecution expert’s use of the word ‘consistent’ here was challenged and the challenge was accepted by the court.

The judge, Justice John Royce in summing up said:

‘although the data is not in conflict with such a theory <that the defendant was at the relevant scene>.  The data <for the time in question.> is not consistent with being at the site.  It could possibly be that the phone was en route however from the site to the defendant’s home…’

the prosecution has been driven to trying to construct theories because of the absence of solid evidence.  They have tried to make bricks with but a few straws, and have done so with admirable skill and ingenuity.  But is this sufficient evidence to be left to the jury?  Could a jury, on this evidence, properly directed, safely convict?  The conclusion to which I am driven is that they could not. Accordingly, I shall direct the jury to return not guilty verdicts’

Had the prosecution expert’s semantics not been challenged, the outcome may have been different resulting, possibly, in a miscarriage of justice.

Advertisements

2 thoughts on “Cell site blog: ‘consistent’ data, or data ‘not inconsistent’

  1. Great article. Just one comment, and it is something I frequently note when reading Cell Site Forensics material, is that the statement that it is technically impossible to connect to a Birmingham based cell site while geographically located in London is not 100% accurate.

    As an engineer that works on carrier networks and frequently provides the technical network support to subpoena compliance teams (working in the US at this time), I have still yet to see a request come across my desk that has asked for maintenance records. In the scenario where you present movement it is extremely unlikely to be an issue as, as you say, consistency can be established, but if we consider attach to a single cell site there is always a potential that a cell site was undergoing maintenance and was loaded into a test-bed facility. Should a non-test MS/UE be able to attach to a test-bed? No. Does it happen in the real-world? Yes.

    Why do I bring this up? If I was in accused of something and the only thing you had placing me at a scene was an attach to a single cell site, my defence is going to ask whether you have knowledge of maintenance activity at that site at the time in question. When you don’t, the “how do you know that BTS/eNB load was not in a test bed elsewhere in the country at that time?” is going to make your material pretty flimsy. I know – quite a stretch, but the technicalities are what pokes holes in otherwise solid case presentations.

    Granted, I am not the one providing expert testimony in a court, simply the one who provides the technical details/explanations when our interface with external legal entities question something beyond their ‘default information supply’, but it always strikes me as odd that in networks that are in constant flux in terms of Operations are always considered so static in these cases. What has been your experience in such cases?

    Cheers,
    Steve

  2. Steve,

    Thank you for your interest and feedback.

    I was intending the blog to focus on language and semantics, however the point you raise is an interesting one and is part of a more general issue that: the conclusions drawn by an expert in cell site analysis are dependent on the accuracy of the data supplied by the network operators.

    If the data supplied is incorrect – either because their records are incorrect or because a particular cell was located away from its normal location for testing, then of course the conclusions drawn may be incorrect.

    The operators in the UK do supply evidential statements with their data if requested.

    In my experience though, testing would be performed on a BS or NodeB that:

    – Would not share the same ID and LAC as a live one
    – Would have its range and settings severely limited, and be located such as not to carry calls from ordinary subscribers.

    Furthermore, I believe much of the hardware testing in this fashion is performed by the equipment supplier (e.g. Nokia) rather than the networks. Thus the testing cell IDs are even less likely to pick up real callers.

    With reference to my blog, the “certainty” of a mobile phone not being in Birmingham would perhaps be enhanced if I had said that “at around 12:00 it had connected to several different cells all located in central London…”

    Iain

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s