Cell site analysis courses - value?

Hi FFD9

I am running CSA Fundamentals Course and I am always happy to identify my knowledge and experience. The course content for the CSA Fundamentals is here

http//www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=6041

FFD9,

Is this partly with Sam Raincock's course in mind? (I noticed one or two comments might relate to the details at http//www.forensicfocus.com/src-training-mobile-connection-records [link amended])

I'm sure Sam would be happy to discuss her background - do you want me to give her a nudge about this thread?

Jamie

Hey Jamie -

Couldn't get that link to work so can't check the referral.

My comments were not person specific. I simply intended to make a point regarding the perceived value of training courses - in particular those relating to highly specialised areas such as cell site analysis. It is, as you know, a subject which is rather sexy at the moment i.e. it sells well. A bit like 'Ethical Hacking' roll , in that respect.

However, it is also true that very few people can be said to be 'expert' in the field. For instance, the Met Police are said to have precisely one specialist. That, I think, would be a fair measure of how rare the relevant skill set is.

An impressive range of post nominals may be some measure of a trainer's abilities but it isn't the whole story (I have more than a dozen myself, so can say that with alacrity). At the end of the day, unless those qualifications are directly relevant to the subject matter concerned or - and probably more importantly - the person has solid training and work experience in the field, they are frankly not of much consequence.

For that reason, I say Caveat Emptor.

Couldn't get that link to work so can't check the referral.

Simply need to remove the closing bracket I think, here's the full URL

http//www.forensicfocus.com/src-training-mobile-connection-records

[snip]For that reason, I say Caveat Emptor.

I don't think anyone would disagree with that. Are there particular offerings out there which are raising red flags with regard to CSA training? I'd be very interested to know - please feel free to share your thoughts here or PM me privately if you prefer.

Jamie

FFD9

I completely agree with you. There are no formal training or qualifications that a person can possess in CSA. The other key is that a short training course will not alone make a CSA expert. My experience of CSA training is that beyond the technical part of the area you need to learn how to write a good report, think through the problems, experience cases, gain court experience and most importantly grow in confidence and general ability so they can tackle what they may be faced in the area. It’s like any other expert area….it takes time to become an expert. Hence, a training course can only assist in this process. The Ethical Hacking courses are a good example - you can do the CEH but you are not going to come out of it a pen tester.

My personal view is that research can assist someone gaining experience and knowledge. For example, if you read the GSM standards it implies the maximum received signal strength from a 2G cell is -40dBm. It would usually be said that this level would be very close to the cell. But is this what happens in practice? Similarly, what happens if you perform a drive test in one direction down the road and then drive in the other direction? What about if you come from a completely different direction? How variable are the received signal strengths – is this affected by anything? What about if you take readings in a house – how do the signal readings alter in the rooms of that house? Etc.

For those types of challenges a research degree or Greg's diploma would likely be good training options.

In summary, if you are looking to get into CSA via a short training course then you do need to assess the value of this. Unless you can work with someone else to gain casework experience as well as dedicate a lot of time to research and development it is likely to only provide you with an overview of the area for your general knowledge. However, this would be the same in any area - you generally wouldn't do a few CF courses and then go on to be an expert without working on cases or with a company to train you. The problem with CSA is that there are so few people in the area (and jobs) it is difficult to get the experience to enter into it.

My training course will feature only an overview of the CSA area. It will allow students who may have not seen a monitoring tool to test one out and see the type of data they generate. However, the course is mainly centred on CDRs so it will discuss how knowledge about how the CDRs depict cell information can sometimes assist in determine what has occurred to that call. For example, if the call was answered by a recipient telephone or an answerphone service. If you are looking for a course with a priminary goal to learn about the CSA area then this is probably not the course for you.

I fully understand your concerns about experts in any areas and how lawyers wouldn't necessarily pick up on errors. The good things about the CSA area is that in my experience, when differences of opinions arise, lawyers generally wish to resolve them via expert meetings and not in court. The majority of cases I have dealt with fundamental differences or errors being identified have been resolved by joint statements or revisions of statement and not boring a poor jury (or the lawyers) to sleep )

If you do want to know more about my background in CDRs or CSA then I am always happy provide this to anyone. Please feel free to email me or drop me a call (http//www.raincock.co.uk).

Kind regards

Sam Raincock

For those types of challenges a research degree or Greg's diploma would likely be good training options.

Thank you, Sam.

Perhaps its worth making clear also the distinction on CSA Fundamentals course materials. The reasoning behind the sections below is that once you undertake a case (not even your organisation can cover for you) as the examiner or expert you are responsible for what is in the report no matter how the content in it is generated.

My courses are designed as a flatplan of signposts for those who want to get into CSA, what to research, where to get your feet wet with experience, investigate the evidence, the signs to interpreting evidence, appreciate and understand the content for a report and advise the client/give evidence to court. Also, my courses are not simply limited to criminal, but highlight civil and commercial aspects too.

Section 1 Introduction
Section 2 Legal and Technical Frameworks
Section 3 GSM and 3GPP Standards
Section 4 Subscriber Check/Billing/Call Records Check List
Section 5 Example Subscriber Check
Section 6 Example Call Detail/Data Record (CDR)
Section 7 Example Subscriber Billing
Section 8 Example of Call Records
Section 9 Example Mobile Network Details
Section 10 Cross-referencing sources of evidence
Section 11 PLMN - Introduction to GSM/WCDMA Network Elements
Section 12 PLMN - Base Transceiver Station (BTS)
Section 13 PLMN - GSM & WCDMA Base Stations
Section 14 PLMN - GSM & WCDMA Mobile Switching Centre (MSC)
Section 15 PLMN - GSM & WCDMA Databases VLR EIR OMC HLR & AuC
Section 16 PLMN - GSM & WCDMA Support Databases
Section 17 Introduction to Cell Site Identification
Section 18 Introduction to Cell Site Analysis
Section 19 Cell Site Analysis - Tools
Section 20 Cell Site Analysis - Ideas on Site Surveys
Section 21 Cell Site Analysis - Ideas for Radio Testing
Section 22 Cell Site Analysis - Regulation/Industry Requirements that assists CSA
Section 23 Cell Site Analysis - Notable Review Material
Section 24 Sample Cell Site Investigation Check List
Section 25 Support Material - Evidence & Legal issues

There are no formal training or qualifications that a person can possess in CSA. The other key is that a short training course will not alone make a CSA expert.

As Sam points out there are no formal qualifications yet in CSA and the expectations must be set that a 1 or 3 day course cannot make you an expert. There are so many levels to CSA which need to be considered and that is gained through a mix of training coupled with going out and taking results and subsequent analysis of such results etc. Being skilled in report writing is important, however if you are conducting surveys your method of procedure is key. Everything hinges on this as in any digital forensic discipline.

However, it is also true that very few people can be said to be 'expert' in the field. For instance, the Met Police are said to have precisely one specialist. That, I think, would be a fair measure of how rare the relevant skill set is.

The met would be largely regarded as one of the leaders in CSA and they have secured engineers who previously worked in telecoms. Therefore, the best fit for CSA is someone who has extensive experience working in the networks. In addition to this, it is important to understand the telecoms standards, radio frequency transmission and associated artefacts such as attenuation and multipath propagation etc and how this influences network coverage. So a good grasp of transmission theory is also essential which someone with an electronic engineering degree would possess.

However, the course is mainly centred on CDRs so it will discuss how knowledge about how the CDRs depict cell information can sometimes assist in determine what has occurred to that call. For example, if the call was answered by a recipient telephone or an answerphone service. If you are looking for a course with a priminary goal to learn about the CSA area then this is probably not the course for you.

It is important to be able to interpret CDR’s to a rudimentary level in CSA cases as they form much of the focus of CSA analysis (i.e. the mobile details, time of calls, cells which were used etc). Sam’s course will no doubt show the audience that CDR’s can be subjected to analysis of finding call patterns, if calls were answered, integrity of records etc. This is important analysis which needs to be done but is an aside to CSA. Indeed, there are many cases where no CSA is required due to thorough CDR analysis in the first instance.

In summary, if you are looking to get into CSA via a short training course then you do need to assess the value of this. Unless you can work with someone else to gain casework experience as well as dedicate a lot of time to research and development it is likely to only provide you with an overview of the area for your general knowledge.

This would echo my thoughts. You would really need to get your hands on some kit to consolidate any theory you will pick up during training. Some people prefer Nemo Handy which is an excellent network monitoring tool. However I would personally recommend CSurv M-Tek as this product was designed from the ground up for CSA and includes essential features such as network map plugins which you can view in real time as well as the harvested network info at the same time. Many of the large forces use CSurv M-Tek so this is a full endorsement of its fit for CSA. It is also used by private professionals as well.
My company has been running a CSurv M-Tek certification course for a while now which has been well received by both major forces and private professionals up and down the UK. You should also consider whether your training is fair and balanced as you will have varying opinions on the usefulness of CSA between companies. It is important to hear both sides to ensure you get the scope and application of CSA correct.

My personal view is the primary purpose of performing cell site analysis is to assist in the justice process (and not to make money). Like any other forensic area, the skills required are fairly specific and require an appropriate training program to acquire all of the skills required.

Similarly, recent CSA cases have strongly highlighted the need for a quality validation within companies proving CSA cases (and my belief is in any legal case) and for this to be properly managed so that skilled staff perform the checks.

I am sure both Stephen and Greg’s courses will be great assistance in student’s learning of the area. However, this compliments casework experience and on the job training. Not having appropriate case training may open up a business to risks as well as issues for justice. It is common sense and would apply to all forensic areas.

However, as FFD9 states, CSA may be seen as the new buzz area which companies/people are wishing to enter. The difference with the CSA to other forensic disciplines is there are very few people working in the area to allow for people to join a company to be trained by them. However, if we relate CSA to computer forensics - how many people would believe it was acceptable for a person to go on a 3 day course and then call themselves a computer forensic expert? How many people would think it was acceptable for a graduate with even 3 years training in computer forensics to set up on their own and offer services as a computer forensic expert when they had no casework experience? It's all about managing expectations and common sense.

I have seen an expert have unflattering things being said about them in court and likewise I have seen cases in courts being dropped because of a Judge/Counsel stating an expert wasn’t one. It’s not pretty. It will also stay with the expert for a long time because officially they will need to declare the issues in all cases they work on. Company’s owe both a duty to their staff as well as the legal cases they work on.

Ultimately, anyone working on criminal cases can not see the pound signs before the quality ones. 25 years is a long time to rot in jail for something you haven’t done!

Kind regards

Sam Raincock

It is not entirely clear where you are coming from. You now provide training, OK. You start out and I followed where you were going in taking about training and access to it. I agree. But you do not define your training course and what people will learn on it. People will naturally want to know upfront what you are going to teach them and where you got the materials for that course?

I am sure you can provide an answer, but you import subjects that imply somehow your product will answer these questions.

…associated artefacts such as attenuation and multipath propagation etc and how this influences network coverage.

Are you claiming CSurv MTEK demonstrates 'attentuation' and 'multipath propagation' and from the readings you've obtained using this device this tells you how the network was influenced?

So a good grasp of transmission theory is also essential which someone with an electronic engineering degree would possess.

Your mentioned the above point and it is something that has been dealt with many times over in the past. Your statement implies that it would account for almost everyone conducting cell site analysis today, including the Police forces and perhaps, maybe your clients having this qualification? What if they do not have it?

I am balancing out here (looking at the other side of this coin so to speak) because your comments may put people off who want to do the subject. Also the qualification you mention has never been a determinating point in the past or now for conducting cell site analysis. Also, if I have a core network matter I cannot answer staff at the network operators provide (witness statement) the answers as naturally I wouldn't have access to each particular operator's internal information.

You would really need to get your hands on some kit to consolidate any theory you will pick up during training. Some people prefer Nemo Handy which is an excellent network monitoring tool. However I would personally recommend CSurv M-Tek as this product was designed from the ground up for CSA and includes essential features such as network map plugins which you can view in real time as well as the harvested network info at the same time. Many of the large forces use CSurv M-Tek so this is a full endorsement of its fit for CSA. It is also used by private professionals as well.

My company has been running a CSurv M-Tek certification course for a while now which has been well received by both major forces and private professionals up and down the UK. You should also consider whether your training is fair and balanced as you will have varying opinions on the usefulness of CSA between companies. It is important to hear both sides to ensure you get the scope and application of CSA correct.

You sell the product and therefore how likely are you, having a vested interested in the product, to be in the position to independently and objectively define and illustrate its failings and weakpoints, in addition to any limitation on radio evidence it doesn't collect?