Cell site analysis - presentation slides

Hi Sam
Just wanted to respond to your recent presentation. Oh my what a dreary picture you paint of CSA!

Firstly, it is clear that your presentation has a heavy slant towards common defence arguments which of course is fine as long as the audience realise this. I can show CSA in another light when it is performed correctly and leveraging sound telecommunications engineering principles.

Let’s have a look at some of the themes in your presentation.

• Problems with current analysis - You seek to criticise or limit the scope of CSA based on your experience of a single CSA product – Nemo. You also state that data is usually collected for a maximum of 5 minutes. Perhaps this is how some individuals you have came across perform the analysis but it clearly is not how it should be done. People will always do things non-optimally at best or incorrectly at worst – however when CSA is performed correctly it is a very powerful tool. It is also clear you are basing your CSA critique on spot surveys to determine best serving cell. Using this approach alone is flawed and only gives a partial view of network coverage details. However, knowing the fixed, inherent properties of a telecoms network will enable you to provide a robust, verifiable examination.

• Variability of the Network – Throughout the presentation you state that networks are variable. You use terms like “odd behavior can be seen” and “it’s definitely variable – black spots in the kitchen” etc
However, network behavior is deterministic and more importantly consistent. 2G and 3G networks are standards-based to provide ubiquitous connectivity to users. If networks were not predictable then operators simply couldn’t plan their network coverage effectively and they certainly couldn’t operate them on a daily basis successfully. So when you talk about variable behavior you actually mean variable received RF signal levels – which is why there is a requirement to provide detailed Cell Site Surveys using RF measurements. If you have a “black spot” in your kitchen it is not due to the network – it is due to the local environment (interference, attenuation etc) and can be explained. Networks of course are intelligent enough to deal with signal fluctuations and load balancing etc. They act in a predetermined way as defined in the GSM/UMTS standards to provide cell handover etc so therefore the statement “consistent with network behavior” is perfectly valid.

• Scope of CSA “CSA cannot pinpoint a mobile telephone” – This is very much a subjective statement. You quote the theoretical maximum reach of a cell (35km) however it is very important to point out that the vast majority of cells have a much tighter range. You do state that in city centres the reach is lower – that should have read significantly lower to sometimes the order of tens of metres. In semi-urban areas the cell reach will be the order of a few kilometers. Also remember that this is the directional range due to sectoring.
This is therefore very important in criminal investigations and in many cases the locality of the mobile phone can be reduced to a very small geographical area. Future trends within telecoms will give us an even finer level of granularity for CSA.

• Handover – Handover can indeed occur in a static location and this simply is how the networks operate with overlapping cells. However far from undermining CSA this can indeed aid in the analysis of providing the likely region in which a mobile was present – especially if you have multiple cells recorded in the CDR’s in a short space of time.

• “CSA is and should only be used as circumstantial evidence” –We have seen with a number of criminal cases where CSA has been the cornerstone prosecution evidence securing convictions. CSA is accepted as forensic evidence in court and therefore it would be wrong to state that it is simply “peripheral” evidence that holds little or no weight.

• Complications – In your complications section you focus on CSA trying to replicate past events. However, cellular networks will operate in the same consistent manner time after time. The occurrence of a football match in the locality is “red-herring” as this does not affect the maximum coverage of a cell. The Cell Site Analyst should request any network engineering changes (which don’t happen all that often) and survey for any environmental changes. Let’s be honest about this, significant changes in landscape do not happen that frequently in order to undermine CSA. When we talk about residuals we should highlight that they are in-fact just that. I am happy to acknowledge that these factors will influence coverage but I am also contextualising these factors.

• Computer Science or Telecoms? – I have to say this is the first time I have heard this argument. Definitely have to disagree with you on this one. CSA is clearly an engineering discipline; to be more precise telecommunications engineering. I am suspecting that you do not have a good enough grasp of the telecoms industry and what skills a telecoms engineer has, to do this compare and contrast. Network operators have engineering specialists who plan and manage their cellular networks and similarly CSA requires telecommunications expertise.
Therefore CSA is best carried out by a qualified telecoms engineer.

• 3G CSA…more headaches – I appreciate you probably only had a fixed time for your presentation and felt you didn’t want to cover 3G. However the way you left this further adds to your overall theme of “hard to predict, complex network behavior” etc. It should be important to note that 3G can be subjected to similar analysis as 2G and in some respects 3G makes CSA more effective.

Our key goal as professionals within Digital Forensics should be to provide fair, balanced and technically-sound training and analysis. This will ensure the right conclusions are made time each time.

Please feel free to respond to any of the points I have raised.

SGrills

Thank you for your lengthy reply. I shall answer your questions as I appreciate you have taken time to consider your comments and have invited a response to them. I shall address the points you made under your title areas

• Problems with current analysis
I have personally tested and used a number of network monitoring tools including Sagem, CSurv and Nemo and accept network data from any device if a reader is made available – e.g. from TEMs etc.

I base my 5 minutes statement on what I have previously encountered in a number of cases (it was an example of what may be encountered). Like you, I believe the spot readings approach is flawed. It was this approach I was discussing in my lecture and about how this may cause issues and incorrect opinions.

• Variability of the Network
The presentation was open to the public. I understand that when speaking with other telecoms people using terms such as “RF signal levels” is better technical terminology. However, this wasn’t a talk provided on this basis – it was not given to telecoms people or intended to be in an academic tone. It was a talk aimed so that no matter what a person’s telecoms or engineering knowledge, they would understand the examples and concepts. IET talks are open to the public and do include a growing membership of people who are purely IT.

Very few experts talk about this area for free and without restriction on attendance so I wished to spur interest to a wider audience. That was the talk's aim. The audience varied from business owners with little engineering knowledge to an engineering lecturer (including telecoms) and mobile network tester. I aimed for everyone to at least get something out of the lecture and I believe from the feedback they did.

My experience is that lay people find the use of technical language difficult to understand so my summary of the whole area in one hour had the primary aim of accessibility for all. I respect that every professional sees this differently and may have different teaching/language styles.

• Scope of CSA “CSA cannot pinpoint a mobile telephone”
Of course. The ability to give a geographical vicinity is dependent on many factors – in fact the talk did indeed discuss pico cells etc. The slides you are seeing are merely a summary. The directional diagrams involved a 10 minute discussion about direction the primary aim to obtain audience participation and to obtain their change of opinions based on information I provided to them. That’s my teaching style. I like to get people to think and question with audiences participating. That's exactly what happened in this session.

• Handover
Again, this was all in the lecture with examples with audience participation and questioning. This involved me discussing the example maps about how connections may show the telephone travelling or narrow down where it could be. In fact, I remember my inability to keep a laser pen steady (quite embarrassingly so) to demonstrate the basics of cell coverage areas and overlapping.

• “CSA is and should only be used as circumstantial evidence”
Circumstantial evidence indirectly proves a fact The reason I say it is circumstantial evidence is because it can not 'fully' attribute a person to a telephone as well as not being able to say it was being used in a particular house when the murder was occurring - most barristers I have worked state it thus circumstantial evidence. Indeed most experts qualify this with "CSA is not an exact science" or similar . It is thus in law different evidence than something like DNA. However, it can by its definition allow for additional evidence for a jury to determine if it correlates in with case scenarios. The main reason for this discussion in my lecture was that in my experience I have worked on cases where a great deal of emphasis has been made regarding the cell site analysis evidence where it was the only evidence in a case.

• Complications
I generally request network engineering change information – however, unfortunately the costs involved in the full analysis of this and obtaining the records is often cost prohibitive for cases involving legal aid.
The point about congestion was made because if you consider a substantial increase in network traffic, then cells may become congested and may become unavailable. Likewise, the network may apply penalties. Hence, if I were to take test call readings during an event of high congestion I may not receive a representative sample. It is this reason why these points were made in my lecture.

• Computer Science or Telecoms? –
It was a demonstration of the fact that in my experience basic data mining has allowed me to determine patterns that had previously been undiscovered. Such techniques I discussed are visualisation and database usage.

My comment about computer science was merely a 'tongue in cheek' remark about how I believe the analysis of data is useful and can bring great benefit to cell site analysis. I was not saying anything more than that which I am sure came across to those whom attended the lecture.

• 3G CSA…more headaches
I was referring to the potential for a variable network.

In summary, I appreciate your comments on my lecture slides. However, I am a little concerned because you didn’t attend the lecture, a number of meanings may have been lost. Like any lecture, the presentation is merely a summary and as you can see from the style of mine it was kept very chatty because that's how I teach.

With respect to discussion about expert independence. As an expert my duty is to the court which is something I feel utterly passionate about - I write my defence reports with warts and all and always have and always will (much to the disappointment of some barristers because they then can not use it). In fact, in a substantial number of cases working as defence expert I have found more evidence than presented by the Prosecution. I let the data drive my opinions and write a report based solely on it without any slant.

With respect to your comment "I am suspecting that you do not have a good enough grasp of the telecoms industry and what skills a telecoms engineer has, to do this compare and contrast.", I do not wish to be rude to you, however, I do believe it is neither appropriate or professional to state what you believe to be my grasp of telecommunications. Particularly since you are basing it on what you perceive, from presentation slides summarising a one hour lecture that you did not attend.

I think in summary your comment “Our key goal as professionals within Digital Forensics should be to provide fair, balanced and technically-sound training and analysis. This will ensure the right conclusions are made time each time.” would be exactly the same as mine but we perhaps just have different teaching/evidence giving styles. However, from your response I believe we both have a similar passion for the area. Hence, I sincerely wish you every success with your new cell site analysis training venture. My personal opinion is that the more people to openly teach the area without competitor restriction, the more it will improve and grow. This is my primary aim, passion and motivation behind all training I provide.

If you would like to discuss any points further then please do give me a call anytime.

Kind regards

Hi Sam,
I notice you do not invite me to respond to your comments publicly on this forum, however I think it is important the FF readers are privy to technical discussions regarding CSA. I think you will agree.

You did ask for comments on your slides from people from the FF forum which was after your lecture to the IET. Hence one would assume your slides should have been a fair representation of what was presented to the audience if you wanted honest feedback on this forum. The FF readership would have only had your slides to go on unfortunately.

However, I do know someone who was in Durham for this lecture and to be honest it was their feedback that prompted me to reply. So therefore I have an accurate description and therefore I believe my opinions are fair and rounded. It was not feedback on the presenter however it was on how CSA was portrayed. They came away from the lecture believing that networks “are unpredictable, totally variable and display odd behaviour” and that CSA had extremely limited scope, was being performed incorrectly and was largely a waste of time. I want to correct these misconceptions and this is the crux of my debate as I do not know you nor do I wish to attack you in the slightest.

• Overall theme of lecture – I still standby by comments regarding a definite slant towards a defence viewpoint. This is clearly evident from your slides and feedback from the lecture itself. Indeed you acknowledge in your slides that you have may have been too harsh on the scope and validity of CSA that you have a dedicated slide entitled “So why bother?” at the end of your lecture.
This is not a critique of how you personally delivered the lecture – it is merely on the content. Indeed, people will no doubt have learned things they didn’t know.

• Promoting Cell Site analysis – I would like to get your opinion on your rationale for the content of your slides. As you say, there were a range of non-technical people present. You had a great opportunity to inform the audience of cases where CSA was vital, the fact it is accepted as forensic evidence in court and clear instances when CSA can be verified beyond any reasonable doubt. However the content of the lecture was more focused on how certain individuals were performing CSA incorrectly, understating the scope and focusing on network complexity, complications etc. I'm not sure how I see this approach would enthuse non-technical people or pure IT people into this arena.

• Variability of the Network – I’m sorry but you totally missed the point I was making about this. I have no issue with using colloquial or more user-friendly terms. I was pointing out the fact that when you talked about variability you implied the networks are variable and very hard to predict when you should have been saying that it’s the RF signal levels which can be variable. You explained signal strength and went to the trouble of explaining dBm so therefore the distinction should have been easy to make. Most people understand signal bars on their handsets.

• Scope of CSA “CSA cannot pinpoint a mobile telephone” – The slides (which you asked us FF users to review) are definitely skewed to present a non-representative view as to the granularity of CSA in terms of reducing a handset to a particular geographical area. If I were to ask the question “what is the typical speed of cars travelling in central London” it would be misrepresentative to start the answer by saying “Well…UK cars are electronically limited to 155mph…” without stating what the reality would be. 35km Cells are rare and the vast majority of cells that you will come across in CSA will be much, much less. When residual values are mentioned they should be qualified as such otherwise people will get the wrong impression of the scope of CSA. Also your comment on “odd behaviour in rural areas” is clearly incorrect as this is simply how networks operate – there is nothing “odd” about it, it is design intent. I did however enjoy your series of slides on cell direction. I thought this was a great idea and reinforces the idea that we should not be quick to jump to conclusions with CSA.

• “CSA is and should only be used as circumstantial evidence” – I am fully aware we are talking about a handset and not an individual. However, what I was getting across what that when you phrase it the way you did, coupled with all the “complications”, and “variability” discussions it will leave non-technical people feeling very underwhelmed by what CSA can actually achieve. CSA is fully accepted in court and is often the “silver bullet” which brings justice in a case. As society gets more and more dependant on their handsets then CSA will be further enhanced.

• Complications – The points you make about congestion (and penalties) is a common trap that people fall into regarding CSA. I’ve seen this many times before and have had to correct this.

• Computer Science or Telecoms? – When I made my comment about your lack of understanding about what skills a telecoms engineer would have I based that on your slides which stated that CSA lends itself to computer science techniques. On the same slide you cite 4 attributes which are in fact core telecoms engineering skills. One would assume from your slides that you were implying these techniques were the sole domain of computer science but that would be untrue. I’m glad you have admitted that you were only joking about this. The slides make it look like you were actually serious about this. I would be keen to hear what patterns you have discovered that Cell Site Analysts have been missing. Sharing ideas is what this should all be about and hence raising the bar in digital forensics. However, CSA has been using visualisation (mapping, 3-d modelling etc) for many years now and database usage is commonplace within Telecoms.

One thing I would like you to clarify is this statement – “Hand-overs are complex things. They are calculated by two algorithms – one for cells with strengths under -85dbm and the other over this strength”.
Can you clarify your definition of the 2 algorithms?

I want to thank you for taking the time to read my reply and I would encourage others on the forum to comment on the topics raised. The fact you took time out to deliver the IET lecture is a credit to you. Please take my comments in the spirit they were intended – I am merely commenting on the content (going for the ball rather than the player so to speak). When I suggest that the material is misrepresentative and has a certain leaning I am not suggesting for one minute that you are deliberately performing misdirection. However, we as individuals naturally form our ideas and approaches from our experience to date and the type of work we have been involved in.

You mention my "new training venture", maybe you can clarify what you mean by this as I've never mentioned such a thing. Perhaps you are getting me confused with someone else?

Please feel free to address any of the points I have raised.

SGrill

Thank you for the clarification about why you would like to discussed this in the forum. It is great to see you are open to discuss your knowledge and experiences in a public arena. I wish more people were open as I’d love to see the area a lot more accessible for people to learn.

In terms of your comments, I note you state that I had misinterpreted network penalties information and congestion. It would be great if you could discuss your knowledge of penalties and congestion – I for one would be very interested to hear your experiences of how these can be applied to CSA. I am sure this would be of great interest to most working and entering into the area. There is little easily accessible information available about how the network utilises penalties so it would be good if you could provide more information. I’d be particularly interested in hearing your thoughts about how it may affect the results of drive testing.

I would also be interested in hearing your case experience in terms of use of CSA in trials you have been involved in. It’s always good to hear other expert experiences of how evidence has been used etc. and I am sure from what you have said you will have experienced different things to what I have.

In terms of your technical questions

General Cell Site Analysis Points
I think perhaps we fundamentally disagree on the definition of CSA evidence use. My view from my experiences is that cell site analysis is not a “silver bullet” or an exact science in any respects or can be verified beyond reasonable doubt unless certain case scenarios are being compared. Every cell report from Pros and Defence that I have seen in recent times would agree with this – most use some phrasing such as “Cell site analysis is not an exact science/Cell site analysis can not pin-point a telephone” etc. some go to even state it’s weaknesses stronger.

I can only go by my own case work experience. However, in the assessments I have made in previous cases have found some serious flaws in other experts assessments of CSA evidence. This has resulted in the evidence being dropped, joint statements being produced or the most frustrating missed evidence that would have assisted in building a stronger case for the ‘other side’ never being revealed.

Data Analysis and Visualisation in CSA
My experience of these cases is that sometimes the network monitoring data is not analysed at all and it is merely spot checks involving noting information from network monitoring tool (signal strength reader). Where it is analysed then my experience is that it is mainly just the serving cell information that is examined without consideration of the other measured cells.

When I was talking about visualisation, I was referring to the way I visualise the data – I don’t use software packages. I write my own and I am also sad enough that I can look through data and often by just looking – pick up on patterns and anomalies. It was this I was discussing. It is this I believe is quite computer science (geeky).

The presentation included a discussion of two different types of CSA – travelling and large range as well as close proximity. These are all in the lecture slides including a section on travelling and the 10 minute discussion I had with the audience about the different scenarios. The network readings (signal strength readings) were discussed in the context of case scenarios with close proximity locations. I chose to talk about this because in my experience these are the majority of cases in which readings are taken. Again, in my experience experts generally do not take readings in travelling or large distance cases.

Network algorithms for Handovers
The algorithms for handovers are in the GSM standards. There are actually 4 but they deal with different scenarios. I can not remember offhand the standard’s definitions. Greg may know the document in question?

I did also find an interesting presentation on it too a few months ago which may be useful for the people on the forum. I will have a look and see if I can find it again.

Unfortunately, I have three cases to work on this week so perhaps I will take a look next week instead. I assume you probably know yourself where this information is? – if you wouldn’t mind providing the correct standard etc. that would be great so that everyone reading this could learn more too.

Technically Incorrect Terminology
I have previously agreed that RF signal levels variability is more accurate description. Thank you for the feedback – I shall qualify it next time.

Cell Site Analysis and Me
I note you question my intent in the CSA area. I only work in the area I believe I can make a good contribution. I would hate to see a person who hasn’t committed a crime being sent to prison for something they haven’t done based on inaccurate CSA evidence. I have in the past been able to challenge the evidence and assist in ensuring reports were accurate which has changes cases around. This is why I often work for free on appeal cases involving CSA evidence.

My Presentation
In hindsight, I perhaps shouldn’t have published my presentation as from your comments it is clearly open to misinterpretation. However, I like to be open about these things and there is little out there about the area and students had contacted me about obtaining copies. My intentions were only that. I will consider this further and may remove it and replace it with free articles instead in the future.

I look forward to reading your responses – particularly about penalty information. I may not reply for a few days since I have case deadlines to meet (12+ hour days at the moment S). However, I shall likely reply early next week.

Kind regards

Network algorithms for Handovers
The algorithms for handovers are in the GSM standards. There are actually 4 but they deal with different scenarios. I can not remember offhand the standard’s definitions. Greg may know the document in question?

I did also find an interesting presentation on it too a few months ago which may be useful for the people on the forum. I will have a look and see if I can find it again.

Hi Sam,

I think you are getting confused with what is an algorithm for making the handover decision and the actual types of handover.

There are four different types of handover in the GSM system, which involve transferring a call between

• Intra-cell Channels (time slots) in the same cell

• Intra-BSC Cells under the control of the same Base Station Controller (BSC)

• Inter-BSC Cells under the control of different BSCs, but belonging to the same Mobile services Switching Centre (MSC)

• Inter-MSC Cells under the control of different MSCs

The algorithm for when a handover decision should be taken, is not actually specified in the GSM recommendations.

The two basic algorithms used to make the handover decision are

• Minimum acceptable performance

• Power budget

We can agree to disagree on the scope and effectiveness of CSA. Law enforcement are using it more and more and are seeing great results. You seem to be successfully spotting when the CSA process is flawed, which is obviously essential in maintaining a fair judicial system. However, CSA itself as a forensic discipline should not be disparriaged because of errors in the method of procedure.

What I think would be best is that we create another thread on some of the technical points raised. So for example we can create a thread on penalties and congestion. We can both agree on the problem statement these attributes are likely to have on CSA and discuss this. I don’t believe they pose a problem for CSA but I have a fair idea as to why you might think they do. Anyway, we should discuss these technical areas in seperate threads (will help us all with the “data-mining” ;-)). I hope you agree this would be the best way forward?

Again thanks for providing a detailed response and credit to you for doing that as I know you are also working long hours.

Thanks to both you for a very interesting and informative read on issues related to CSA,

The information I was referring to was the following selection algorithms http//www.ehanworld.com/GSM/GSM.html This document isn’t perfect but at least you can see what I was referring to (it was merely the first thing I found in Google that explained it (somewhat) ). I believe it is discussed in GSM 3.22 (I thought it was 3.21 which is why I couldn’t find it).

SGrills, as much as I would love to spend time discussing things with you. Unfortunately, at this point in time, I do not have the time to do so. I work such long hours that I can not give such discussions the time they rightly deserve. I think it would be great if you were to simply explain some of the things like penalties etc. to the rest of the forum for other people to join in. However, from my point of view I can not give this type of commitment. This is not because I am not interested in what you have to say, on the contrary, I am just too tightly stretched with my work commitments.

I hope you can understand why I am stating this. It is no reflection on your posts just simply that at this moment I do not have the time with all my resources (and life) going into driving my business (and stressing about calculating VAT returns S). As a business owner yourself I am sure you understand. Perhaps one day we shall meet in a conference and have a good discussion about the area. I look forward to that time.

I wish you every success in your business. Kind regards

Mindsmith, thank you for the feedback. I am glad it has been a useful read.

The information I was referring to was the following selection algorithms http//www.ehanworld.com/GSM/GSM.html This document isn’t perfect but at least you can see what I was referring to (it was merely the first thing I found in Google that explained it (somewhat) ). I believe it is discussed in GSM 3.22 (I thought it was 3.21 which is why I couldn’t find it).

Hi Sam,

Again thanks for responding to my post. As you suggested, maybe I should simply explain/clarify some of the concepts raised and the FF readers can respond to that.

I think you might be getting confused with the definitions of Handover and cell selection and reselection. You mentioned that you thought there were 4 algorithms for handovers and cite this document.

The 4 algorithms C1 and C2 & C31 and C32 mentioned in this article are concerned with cell selection/reselection not handover which uses other algorithms.

As I stated above, the algorithm for when a handover decision should be taken is not defined in the GSM standard. It is the selection/reselection algorithms which are defined in the GSM standard.

Let us clear up on a few basics –

A mobile telephone (or Mobile station) can operate in two modes

• Idle (i.e. not during a call) – In idle mode, the cell selection and reselection algorthms (C1 & C2) are used

• Dedicated (i.e. during a call) – In dedicated mode changing a cell is called handover (HO) and uses the minmum acceptble performance or power budget algorithms

So, as you can see there are clear definitions as to what constitutes handover and what cell selection/reselection is. When you perform your tests the results will be different depending on the mode you are using. Knowing this is key for CSA.

I understand fully the reasons why you do not want to continue this technical debate on FF; I see where you are coming from. Let’s hope we meet up and can have a chat. I think you have responded very curtiously to me and I hope you feel I have also.

You are welcome to give me a call anytime as some things are best discussed that way. But please keep posting on CSA when you have time as there are 700-odd views on this thread and so far its been just the two of us raising points 😉

Mindsmith, it would be good to get your thoughts?

Thanks again Sam.