It has for a considerable period of time been commonplace for the police to rely on mobile phone evidence in complex criminal investigations.
Where a suspect is arrested, for example, in possession of large quantities of drugs, then the police will inevitably look to seize any mobile phones in his possession.
The police will always try to access the mobile phone to consider its contents and see whether there is any material which will enable them to demonstrate how that suspect came to be in possession of those drugs. They will consider any messaging on the phone which is related to the “transaction” which led to the arrest. They will then look to use those messages to locate other individuals who might have been involved in directing the suspect to collect or deliver those drugs. They will then look to attribute the numbers of those who messaging shows were involved to specific individuals.
It is not though always the case that the police are able to access the contents of a phone.
Even if they are unable to do so, they will look to obtain information from the phone which enables them to progress the investigation.
Understanding how phone evidence is relied upon, the weight which can be attached to it and the means of undermining it, is essential to preparing a robust offence.
What information can the police obtain from seizing a phone?
A mobile phone handset will have an individual identifier known as an IMEI number. This is a 14- digit number which is unique to every mobile device and which can ordinarily be found on the handset.
If the mobile phone contains a SIM card then the SIM card will contain an IMSI number which is a 15-digit code which identifies the identify the registered subscriber to that SIM.
The SIM will have a phone number (known as the MSISDN) which is the number allocated to the SIM card which will normally be the number dialled to connect a call to that specific mobile phone.
What can the police do with this information?
The police will typically make a request of mobile phone network providers for the call data records relating to the phone seized using the IMEI and/or IMSI number.
The call data records they receive will typically contain this information.
The records are also likely to show the geographical locations in which the phone has been used through a combination of call data and GPRS data.
The police will then start the process of trying to identify the users of the phone involved in the same “transaction”.
The records will show the numbers of other phones with whom the suspect has been in contact.
A subscriber check might reveal the identity of the user of the contact phone. Often though this will not be the case as its user will not have registered the phone in his or her own name.
If this is so, then the police will consider the intelligence they have which might lead to the identification of a contact phone.
On other occasions they will rely on phone records alone to attribute a phone to an individual.
How do the police rely on call data to attribute a phone to an individual?
When a mobile phone is used either to send a text message/make a call or to access data (either through internet usage or messaging services which use data), then a record of that usage is made.
Where a cellular call is made, then a new call data record will be “opened”. This will include information such as the time that the call started and ended. It will also contain details of the cell used to transmit the call which will cover the geographical area from which the call has been made. This allows the police to understand the area in which the phone has been used.
Obviously, phones generally move but this does not mean that the geographical locations in which phones are used cannot assist the police in attributing a phone to an individual.
The police will often analyse the data to pinpoint the general location in which the contact phone is most commonly used. They will particularly focus on the “bed and breakfast” usage of the phone as even if the phone is shown as travelling significantly during the day, the vast majority of people will generally go to bed, and wake up, at their home address.
The police will then consider how the data can be used to identify a user within that geographical area. One common method is for them to identify the most frequent contacts of the phone from the call records. Where the most frequent contacts are, for example, with a known contact of an individual, such as a partner or parent, then the police will use this information to identify a suspect.
This is often the catalyst for a wider investigation.
This wider investigation is likely to involve surveillance and other investigative work.
It is usually the case though that a significant part of the prosecution case will involve the attribution of a phone to a suspect. Having done so, they will rely on phone data to demonstrate his involvement in the alleged criminality, by way of evidencing his movements, which might include meetings with others accused of involvement in the same enterprise, or by way of his contact with them as demonstrated by phone records.
Presentation of this material as evidence
Whilst the prosecution will, on occasion, use cell site experts to present evidence to a court, it is becoming much more common for them to do so through the use of police analysts.
These are not typically experts in cell site; rather they are employed by the police and trained to use software to analyse data. They will then produce evidential documents which set out the significance of the phone data when considered with other evidence obtained in the course of the investigation to seek to prove attribution and the usage of phones in a criminal context.
These documents often, on the face of it, provide strong evidence against a defendant.
It is important though to understand that they are often capable of being undermined in many cases when they are properly scrutinised.
Shortcomings with call data
As set out above, where a call is made from a phone using a cellular network, this will provide details of the general geographical location in which a phone has been used.
This though is subject to a number of significant limitations.
Some of the cells used might cover a very substantial geographical area with, in some instances, a radius of 20 kilometres or more.
Equally, the location of the cell does not in itself confirm how many other individuals live within that geographical location. This will depend on the location of the cell and the type of location it serves.
It is possible to undermine conclusions drawn from the cell usage relied upon by the prosecution by undertaking forensic radio surveys to determine the extent of coverage of a given cell. Where the area of cell coverage is large, and where this covers built up areas, then it can serve to significantly undermine the weight that can be attached to call data records relied upon to attribute a phone to a suspect.
Shortcomings with GPRS data
The conclusions that can be drawn from GPRS data are often much less reliable than with call data.
GPRS/mobile data connections work in a different way of cellular voice or text connections.
When a mobile device needs to exchange data, it effectively asks a cellular network to set up a new data session. The call data records will record the location of the cell being used by the phone at the time the data session was requested.
That call data session though might well remain open for a period of time even after the data has been transmitted. The length of time though for which a data session remains open varies from service provider to service provider and will usually remain open if the phone is not active during that period.
It might be the case though that a data session may last for a number of hours before the session is terminated either by the provider (due to lack of activity) or by the user (by, for example, closing the App).
Where the provider’s data session limit is reached, then it will open up a new call data session.
The call data records will show the cell which last provided coverage for the phone before the new session was started.
This might simply allow for a conclusion to be reached that at some point within a lengthy time period (being the time of the open data session), a defendant had been under the cover of the cell recorded. It will often not allow for a conclusion to be drawn as to when, within that lengthy period, he was present within the coverage of that cell.
Defending cases which rely on cell site data
It is important to understand the shortcomings with the various types of data being relied upon to be able to properly defend cases of this type.
At Reeds Solicitors, we have experience in dealing with cases of this nature and have achieved significant success in doing so, often supported by experts in cell site and through independent enquiries made to undermine conclusions advanced by the prosecution.
Examples of our experience in cell site data
In the case of JS, the prosecution had seized a mobile phone from our client. They were able to access this. They relied upon a message sent by our client to another stating that he was at a location in the North of England on a particular case to support an important limb of their case. Our client was subject to other proceedings ongoing at the same time in which the prosecution had served call data records. We were able to demonstrate from these call data records that at the time that our client made this assertion by text message, he was in a completely different part of the country and, as such, it could not have been correct.
In the case of AG, the police found a vehicle which contained a very large quantity of drugs. A key to that vehicle and a mobile phone were found in a container at our client’s home address. Our client denied that the key and the phone belonged to him. The prosecution contacted the previous registered keeper of the vehicle who was a car dealer. He stated that the vehicle was purchased by a male whose name was the same as our client’s. He gave a description of the male who had purchased it which matched him. Call data records show that the dealer had been in contact on the day of the sale with the user of the phone found at our client’s address. The prosecution relied on call date records and ANPR evidence to show that the phone and the vehicle were moved from the dealer’s premises to the location at which it was found by the police that same day.
The prosecution provided call data relating to phones attributed to our client in a series of schedules. They refused to provide the underlying the call data records from the provider. The schedule prepared for our client’s “contract” phone recorded that there was no cell data on the relevant date.
We were eventually able to obtain the original call data records. These showed that the prosecution had no cell data for our client’s contract phone on this date as their request for cell data related only to UK cells. The call data records showed that our client’s contact phone was hitting masts in another country. We obtained information from the Home Office and other documentation which showed that our client was not in the UK on the relevant date and therefore could not have been the person who purchased the vehicle. The prosecution dropped the charges relating to this vehicle as a result.
In the case of ES, our client was accused of conspiring with others to commit a very serious offence. Our client was based in the Midlands. A co-conspirator was based in the London area. The prosecution relied on analyst data to show that phones belonging to him and a co-conspirator had both hit the same cell on the south coast within 20 minutes of each other. They asserted that this was an important meeting in the context of the conspiracy. We were able to show that the analyst’s conclusions were incorrect and that he had misunderstood the way in which call data records of GPRS data sessions should be interpreted. Further the cell used was one which provided coverage to a very busy A road. Telematic data from the vehicles in which the defendants were travelling further showed that at all material times, the defendants were independently travelling at high speed throughout their respective journeys and that the meeting alleged was, in fact, impossible.
If you would like advice on any of the issues raised in this article, contact us today by calling 0333 240 7373, email us at [email protected], or use our contact form.