The Importance of Considering All Telephone Evidence

Cell site analysis is a forensic tool available to the investigating authorities in criminal cases to assist then in the attribution of mobile phones to an individual. 

 

Those of us working in the Criminal Justice System are familiar with phrases such as top/most used cell, wake/sleep analysis and co-location – all methodologies available and used to provide supporting evidence or opinion on the attribution of mobile phones to a specific individual. 

Often in these cases the defendant accepts attribution of some phone numbers but disputes others, these phone numbers sometimes being terms we hear such as ‘mission’, ‘burner’ or ‘dirty’ phones. 

 

Recent cases involving the EncroChat investigation attribution of the EncroPhone to an individual has been supported through correlation analysis of cell usage and co-location between a personal phone and the EncroDevice. 

 

Over the past few months we have been instructed in an number of cases where the Prosecution have forwarded that the accepted device appears to not move during the indictment period and therefore is an indication that an accepted personal phone has been left at home switched on but unused whilst the ‘mission’, ‘burner’ or ‘dirty’ phone is being used near to a key location or during a period covering an offence or travelling towards a key location. 

 

This period of inactivity is whereby the call records for the accepted personal phone show no outgoing voice calls or SMS events. The call records for the period of interest consist in some combination of Data Sessions, incoming voice calls that appear unanswered or incoming SMS. The associated cell usage suggesting the phone has remained in the same area throughout this period. The Prosecution forwarding that it is a reasonable proposition that this phone has been left at a particular location switched on but not being used. 

 

In times before smart phones such a proposition may have been reasonable. However, the technology and availability of services from a mobile device have moved on in recent years. 

 

The users of Smart phones now have many services available to them with the majority of these supported through internet connectivity. Some of these services include but are not restricted to iMessage, social media platforms, email access, video streaming, music streaming and general internet browsing. 

 

This is all activity that within the network provided call records is not shown, the only evidence that can be provided from the call records is that the mobile device had an open and available network Data Session and data was transferred during that session. The content of that data or what activity generated that data is unknown. 

 

The prosecution usually suggest that data can be passively generated without any user interaction. So the mobile device maybe receiving notifications or behind the scene updates. A proposition that is a reasonable argument. 

 

However, take the scenario, which is often the case that the Prosecution are asserting the phone has been left at home or an address of significance to the defendant. Many of us have Wi-Fi connectivity with our smart phones, so when at locations of importance to us the mobile device will automatically connect to the personal Wi-Fi router at that location, these being such places as home or our partners address. Any internet supported activity we then conduct on our phone will not be routed through our mobile Data Session connectivity but through the Wi-Fi connection. The volume of this Data transfer, will not appear within the network call records. 

 

So the prosecution are able to present to a jury that the phone remained connected to cells that serve the defendants home address and the recorded call events indicate no user interaction with the device. However, the defendant is adamant they were at home. 

 

In a number of these cases Tower Forensics have requested a copy of the forensic download completed by the prosecution for the handset in question. Or if one has not been completed by the Prosecution access to the handset so we can complete it ourselves. 

 

In some of these cases we have been met with the response ‘it has been reviewed by the OIC and there is no material that is relevant to the case or your defendant’. Through close liaison with defense representatives and persistence we have eventually been provided with the required download. 

 

Now you may be asking why is the content of the download so important in such cases. If the download has been completed properly then the contents can be examined to assess whether during the period the prosecution have asserted the phone was left unattended at home if any internet based activity has been recorded by the device. So checks can be made, for example, to see if any iMessage’s have been recorded, WhatsApp usage or any other social media, FaceTime calls, internet searches or app platform usage. 

 

In some of these cases Tower Forensics have been able to successfully show that during the period of ‘no user interaction’ forwarded by the Prosecution the device was actively being used. The associated cell usage suggesting the phone was in an area that includes the home address of the defendant. 

Such evidence has put to task the Prosecution’s assertions and their narrative that the defendant had left their accepted personal phone at home and taken the mission’, ‘burner’ or ‘dirty’ phone with them to commit the offence. 

 

As experts in the field of cell site analysis and mobile phone evidence we often see that failure by others to consider all the available phone evidence. 

 

We are here to support you with all of you mobile device investigation needs, get in touch today to discuss how we can help you.