A Simple Guide to the Cell Site Process

The Police intelligence analyst will use different sources of data to produce a timeline or schedule. Included may be the movement of a phone, who the phone was in contact with, sometimes the content of a message, ANPR information, as well as CCTV cameras stills and vehicle tracking data. The final document can be a combination of several different sources of information that may require different experts to independently assess.

The mobile phone portion of the evidence itself can be a combination of three things. These are:

• Mobile phone download: This is information extracted from a phone itself and contains things like the content of text messages, images, and app content such as WhatsApp messages. Because information can be deleted, the download might not show all the calls, texts, images or communications made.
• Connection Records: These do not come from a phone but are provided by whichever of the four networks the phone SIM card or cards has been used with. The four main networks are EE, Three, Vodafone and O2. Other networks, like Tesco or GiffGaff, have one of the main four behind them. The connection records contain the date, time and the other number the phone was in contact with as well as the type of contact: SMS, MMS (both types of text messages) or a normal phone call.
• Call Data Records: These are similar to connection records, but in addition the above, the “cells” that were used to connect the calls or texts is provided. If the phone can access internet data, then mobile data (also called GPRS data) can also be requested that will list dates, times, cells and duration used.  For O2 only, there is another layer of data that can be requested called “DDR” that are system transactions. Normally, these are requested for small timeframes only, such as a single day, due to the high volume of data available.

It is call data records that form the basis of Cell Site Analysis.

The Cell Site Analysis (CSA) Process

The CSA process is relatively straight forward: First, get a copy of the raw call data records. Analyse them. Assess if a Radio Frequency survey is needed. Combine the analysis and RF survey together and do a report. Simple if time, funding, and complicity were not an issue.

The first hurdle from an independent expert perspective is often getting a copy of the raw call data records. Initially, the Police request call data records from the network who provide them in a .CSV file format. The police often load them into third party software and create their maps, schedules to put their case together. When the independent expert asks for a copy of the same raw data, they may receive a PDF copy (which can’t be used) or an Excel version that has been altered from its original by things like redaction, deletion or processing by other software with nothing to show that the altered version is materially the same as the raw. In these instances, the data at its best carries a degree of doubt and, at its worst, is unusable.

It is imperative to seek a copy of the raw data as early as possible to allow for the weeks it might take to get it. Without a copy of the raw data or at least a workable copy, the independent expert won’t have the benefit of using the same data that the Crown has used to create its case, which puts the Defence at a disadvantage.

With suitable call data records, it is possible to map out the location of a cell, the direction it points and the date/time it was used for each record. For each record, the general location of a phone can be assessed and by combining these you can create a movement map of a phone. This is the core of cell site analysis. In a large case, we may be mapping tens of thousands of these, which is why having sufficient time to review the data is vital to enable a fair look at the evidence.

In CSA, what is meant by general location of a phone?

Depending on things like the cell height, type, technology it is using and the surrounding terrain, cells can provide a service for relatively short distances of ½ to 1 km up to several kilometres, and in an arc centred on the cell going out around 120°. For this reason, it is not possible to say a phone was in a specific area using cell site analysis. The location will always be an area.

What are RF Surveys?

Cell site analysis can be underpinned by RF Surveys. These are created by going to a place or driving a route and using specialised equipment to measure cells active in that spot. If a cell is detected, then it can help to show where are phone may or may not have been. The problem with RF surveys is that they often do not detect all the available cells. In other words, even if a cell is not detected it does not mean that the cell will not provide coverage to that area. This is made more complicated by the fact that all surveys are done after the fact whereby cells may have changed/been decommissioned and also are done at street level, whereas phones are often used inside homes on floors above ground and potentially, exposure to different cells.

In other words, you cannot rely solely on RF survey results as an accurate depiction of cells in an area. There has to be consideration of those that may serve despite not being detected or were detected but at a weaker level. This is often missing from the Intelligence Analyst’s approach which focuses on the cells detected only.

How reliable is cell site analysis?

CSA can provide very strong circumstantial evidence if collected, analysed and then portrayed correctly. It can often “make or break” a case. There are general limitations to be aware of which are:

• CSA cannot identify who is holding a phone (called attribution), but things like common movement, common area of “residence” and the pattern of calls to people like family members and other landline numbers such as taxi companies, fast food establishments etc can support or refute its attribution. “Top Up” locations may also assist.
• CSA cannot pinpoint the location of a phone at a given time. It can only say the phone was in a certain area which can be from one to tens of square kilometres in size depending on numerous factors. The area of operation can be more precise if there are several cells within a short period of time indicating that the phone must have been in an area of shared coverage.
• Depending on the type of records used, CSA can give a precise time a cell was used (for calls, texts and generally for DDRs) or an imprecise time (for mobile/ GPRS data). This may not be obvious to a lay reader. GPRS records also vary in their interpretation according to the different service providers.
• The shared movement of two different phones (called co-location) may not involve use of the masts in the same places but can still be assessed. Generally, the further the distance travelled, combined with sufficient available data, the greater the power of co-location analysis to support or refute the phones were together.
• There are cases where CSA is simply not appropriate, such as involving very short distances, especially in and around normal residence or work areas.

Seek expert advice

If in doubt, it’s best to have an expert look at the data. Bear in mind, some CSA cases are vast and cell site experts are not plentiful; many have wait lists lasting weeks or months. It’s good to get ahead of this evidence and allow time for it to be reviewed where possible. If the evidence has been served late, then the Court should be made aware that it may take a while for an independent review.

We at Keith Borer Consultants have a team of cell site experts on hand. We’re always happy to assist and can advise accordingly. Email us at kbc@keithborer.co.uk (or kbc@keithborer.co.uk.cjsm.net), call us on 01913324999 or take a look at our website: www.keithborer.co.uk.