Clear all

Call Records, Cell Site Analysis & Omagh Bombing

Community Legend

Neutral Citation No. [2009] NIQB 50 Ref MOR7534

Judgment approved by the Court for handing down Delivered 08/06/09
(subject to editorial corrections)*







Link http//

Extraxt from the transcript

The Telephone Evidence

Shortly after the bomb it was established that the warning calls had been made from 2 telephone boxes in South Armagh close to the border. Police considered it likely that communication with those who made the warning calls was effected by mobile phone. Police then focused on mobile phone traffic between 2 p.m. and 230 p.m. in the Omagh and south Armagh areas. Details of subscribers were established as a result of which in October 1998 police asked Vodafone to check their systems in respect of 13 telephones operating on cell sites in Northern Ireland during the period 12/15 August 1998. The results of that analysis were made available on 11 November 1998 in a printed document referred to as TRS1 in these proceedings. Further requests for information were made to Vodafone and BT Cellnet in the United Kingdom and Eircell in the Republic of Ireland. Analysis of this material was conducted by Lisa Purnell on behalf of the police but she did not give evidence in this trial.

Raymond Green was a fraud and investigation manager employed by Vodafone from 1995 to 2004. He explained that Call Detail Records are the basis upon which billing records are prepared. Billing records are 99.997% accurate. Any errors are those of omission. He explained that the police requested data and Vodafone provided it in accordance with the Data Protection Act. He explained that TRS1 was a document prepared from a Toll Ticket Enquiry. The Toll Ticket is a printout of the original computer file and the inquiry related to all outgoing calls or calls received. The Vodafone system did not record incoming calls and in order to carry out the search it was necessary to search all the dialled numbers in order to identify calls received by these phones. The process was lengthy and required considerable resources. TRS1 was an Excel file prepared from the source data. This was only one of a number of such exercises carried out in the course of the investigation of this bomb and in February 1999 Vodafone were asked to carry out checks on 27 numbers between January and October 1998. In light of the importance of these documents to the company every effort is made to ensure their completeness and accuracy and Mr Green stated that there was no reason to doubt that the records produced were accurate.

Mr Green recognised the importance of original evidence. Before RIPA 2000 Vodafone usually retained the original electronic materials for six to 12 months. In 1998 the procedures were embryonic and the magnetic disc or tape on which the data was stored was not retained and is not now available. Procedures have now evolved to ensure that such data is retained so that it can be checked as original source material.

Expert evidence in relation to the phone material was provided by Mr Uglow and Mr Brown. Peter Uglow has been trained to MSc standard in forensic computing and has an expertise in the analysis and extraction of data from computers and mobile phones. He has supervised more than 250 cell site analysis reports which he has produced for both prosecution and defence, has made 60 appearances as a witness and is a registered expert witness. Peter Brown is a registered forensic practitioner. He worked for Vodafone from 1986 until 2004. He was Operations Executive in 1999/2000 and was responsible for the millennium transition. From 2002 he was Head of Service Quality and Assurance. Thereafter he has given evidence as an expert witness in more than 80 cases. I accept the expertise of both witnesses in the areas in which they have given evidence.

The mobile phone network operates by enabling mobile handsets and sim cards within them to communicate with masts known as cell sites or base stations using digital technology. Each network operator has a number of cell sites acting as transmitters and receivers which are usually placed on higher vantage points or in buildings. Each geographical area served is called a cell. The area served can be affected by the height of the mast, the number of antennas and their orientation, the output power of each of the masts and the geographical locality. The phone scans the signals it can see seeking the best quality signal it can find.

When the phone is in its idle state it is the necessary for the mobile phone network to identify the mast through which communication can be made so as to direct incoming traffic to that mast. The mobile phone provider knows which cell is connected and can identify it if a call has been made. If the mobile phone moves it may transfer from one mast to another. In order to ensure that they provide good quality signal mobile phone companies measure signals on the ground. Using computer data the network will produce predictive maps to deal with coverage.

When the mobile is in the idle state the mast location through which the phone can access the network is held in the location register. That location is not stored by the network if the phone does not make or receive a call. When a call is made the billing record includes the time, date and duration so as to identify the cost incurred. That is stored as part of the Call Detail Records which include additional network material including the cell used. The cell site location may have a number of transmitters or receivers pointed in different directions.

There is a limit to the number of simultaneous calls that can be handled by a cell. In rural areas there are not as many masts because there is less phone traffic. In urban areas greater capacity is required. In urban areas typical coverage is 2 to 3 miles whereas in rural areas it is more likely to be 10 miles or more. Cell site coverage can range up to 35.2 km but the distance that will be covered depends on a number of factors. Where there are a number of masts networks may reduce this maximum to give concentrated coverage in a local area.

This technology is used in many countries as a result of which people can travel with their phones into the telephone systems of other countries. The networks have roaming agreements so that charges are passed to the right company. In 1998 these systems operated in United Kingdom and the Republic of Ireland. In the Republic of Ireland the relevant companies were Vodafone Ireland and Eircell. In Northern Ireland the relevant companies were Vodafone UK and BT Cellnet.

As a result of the earlier phone investigations to which I have referred a cell site analysis was conducted in respect of four phones, 076, 585, 980 and 430. I will refer only to the last 3 digits when identifying each phone. There was no dispute that the 585 phone was registered to Colm Murphy, the fifth named defendant, the 980 phone to Michael McDermott the father in law of Terence Morgan who in fact used the phone and was employed by Colm Murphy as a foreman on his building site in Dublin and the 430 phone to Oliver Traynor. 585 and 980 were Eircell contract phones capable of roaming in Northern Ireland. 430 was a BT Cellnet phone with a similar facility. The plaintiffs contend that 076 can be attributed to Seamus Daly, the sixth named defendant. This is a matter of substantial dispute to which I shall return. 076 was a pay as you go phone and in 1998 was not capable of roaming in Northern Ireland. The analysis specifically looked at 15 August 1998 and in particular at the Dundalk and Omagh areas. Toll Ticket Analysis was the name given to the billing system in the early days. Call data from Vodafone Ireland for a number of telephones including cell site data were examined as were coverage maps. Mr Uglow assessed the documentation that he had received which was similar to other material used by him and was happy that the information provided to him was adequate to support the conclusions which he reached.

This was the principal point of dispute between Mr Uglow and Mr Brown. Mr Brown contended that in the absence of the electronic records one could not be confident that the material did not contain errors or omissions. He noted that TRS1 had been compiled on excel and that there had been some intervention by way of human action or computer programme to produce that version. He accepted that there were no procedures in relation to the maintenance of such records in place in 1998 as far as he was aware. He accepted that his previous experience was entirely in relation to criminal cases since 2005 and he was approaching this case in exactly the same manner as he would any such case. He accepted that in his previous employment as head of service quality and assurance he had measured network performance including billing and that the court should treat Vodafone as a competent and well organised company. He did not take issue with Mr Green's evidence about the reliability of the billing system. He was able to trace all of the calls upon which Mr Uglow relied to the documents provided but in the absence of the original source data he was not prepared as an expert to accept any printed alternative. He agreed that a phone log trial carried out in Omagh by Mr Southall in May 1999 included a test of coverage of the cell site at Bridge Street Omagh and he did not dispute the finding that coverage did not exceed 5 kms on any of the roads in the area. Mr Brown also had access to floppy discs produced by Vodafone containing information on the outcome of a search requested by police in relation to Eire roamers between January and October 1998 and floppy discs relating to another enquiry about the receipt of calls by Eire roamers. He eventually satisfied himself that the calls with which he was concerned were in this material although it was common case that these materials were not in standard form from the network and were described as something of a mish-mash.

Mr Uglow produced a chart of 20 calls. This was supposed to represent all of the calls made by these phones during a period commencing just before 11 a.m. and finishing just after 8 p.m. on 15 August 1998. The information provided by each network is slightly different. Eircell and Vodafone Ireland only provide call records of outgoing calls and do not store the identification cells of incoming calls. Vodafone UK when roaming identifies the location of cells handling incoming calls. The information includes the direction of the antennae where relevant and appropriate. When a text message is received it would also be included. The checking or reading of the text is not recorded.

The cell site used for the call at 1058 a.m. by 076 is the Clermont Carn which is located North East of Dundalk. The call at 1241 p.m. from 585 to 980 was made using a cell site at Castleblaney to the north-west of Dundalk. This indicates that 585 was in the area north-west of Dundalk and that 980 was in the Republic of Ireland as no incoming cell site was identified.

The call at 1313 p.m. from 585 to 980 was made using a cell site at Emyvale in the Republic of Ireland. This indicates that 980 was in the Republic of Ireland and that 585 had travelled between 1241 p.m. and 1313 p.m. in a north-north westerly direction. The call at 1329 p.m. from 585 to 980 was made using the Aughnacloy cell site and was received using the same cell site. This indicates that both phones had roamed onto Vodafone UK and that both were in Northern Ireland.

The call at 1357 from 585 to 980 was made using sector 2 Bridge Street in the centre of Omagh and received using sector 1 of Pigeon Top which is located on Mount Pollnaght 5 miles west of Omagh. The call made at 1409 from 980 to 585 was made using sector 3 of Bridge Street Omagh and received using sector 1 of Pigeon Top. The call made at 1410 from 585 to 430 was made at sector 1 of Pigeon Top while 430 was on the digital network using the cell site at Clermont Carn to the north-east of Dundalk. At 1414 980 phoned 259 using sector 1 of Pigeon Top to the west of Omagh. At 1419 980 phoned 585 and both were using sector 1 of Pigeon Top. Based on this information between 1357 and 1419 all calls by 585 and 980 were handled either by sector 1 at Pigeon Top or by sectors 2 and 3 antennae at the cell site at Omagh Technical College.

There is a diagrammatic representation of the approximate coverage angle of sector 1 at Pigeon Top which shows that it faces towards Omagh and covers a wide area to both the North and South of the town. Mr Uglow estimated that the range to the east might be 20 miles or thereabouts. There is a map available showing the coverage of the cell site at Bridge Street Omagh. Such maps are produced using complicated algorithms and are checked with radio equipment. They are not necessarily totally accurate but they are a prediction of coverage. The calls between 585 and 980 using Bridge St sectors 2 or 3 indicate that the phones would have been in an area within 2 to 3 miles from the centre of Omagh. This was confirmed by Mr Southall in May 1999.

Warning calls were made from a public call box at McGeough's crossroads at 1429 to UTV and 1431 to the Samaritans. A further warning call was made from a public call box at Loyes crossroads at 1431 to UTV. The two cell sites in the vicinity of those public call boxes are Mulleyash Mt and Clermont Carn. The call made at 1410 from 585 to 430 was received using Clermont Carn. 430 made a call to 971 at 1437 using Mulleyash Mountain. At 1438 585 using Cranlome Hill made a call to 430 which again used Mulleyash Mt. This is consistent with the phone 430 being in the vicinity of the public call boxes when the warnings were given.

At 1513 585 phoned 980 using the Cavanagarvan cell site in the Republic of Ireland. There is no cell site for the receipt of the call by 980 which suggests that it also was in the Republic of Ireland at that stage. At 1530 585 phoned 371 using the Castleblaney cell site. At 1541 980 makes a call from the Clontibret cell site to a landline, 0801693861105. The duration of that call is one minute 55 seconds. The remaining calls are all made in the Republic of Ireland.

Pigeon Top provides a wide coverage and using it alone it is not possible to narrow down where the phones were but coupled with the use of cell sites in Omagh it allows one to determine that the phones using those cell sites were nearer to the centre of Omagh than Pigeon Top. If both phones were in Bridge Street it is not possible to say whether or not Pigeon Top might have been involved. Given the phone traffic between 585 and 980 it seems unlikely that they were together. Mr Brown agreed that the call at 1357 from 585 to 980 and the call at 1409 from 980 to 585 were consistent with the scout car entering Omagh and calling to the bomb car and the bomb car then entering Omagh and calling to the scout car.

Mr Uglow agreed that an expert should go back as far as possible to source data but the data available depended on the format produced by the network. The practices in the networks today differed from the way in which information was obtained and stored in 1998. Today there are stringent processes imposed upon networks requiring them to maintain and provide an electronic copy of their data. This is a read-only copy so as to prevent any possibility of interference. That was not in place in 1998. Mr Uglow was unable to say whether the original electronic data was still held by the networks when the RUC first requested it in late 1998 or early 1999. The original source data is magnetic tapes and the information on these tapes is generally brought forward onto a screen and printed off to produce paper information. Quite often backup tapes were also magnetic tapes. It is possible that the information requested by the police was held electronically by the networks but the networks at that time did not keep all material because of the enormous amount of data involved.

The documents seen by Mr Uglow were commensurate with being taken off the telephone system because of their format. Mr Uglow did not ask for source data but worked on the material provided. It was not unusual to find than a computer printout was not in date order. It depended on the way in which the query was formulated and the criteria for the search. The items might be in order of type as incoming or outgoing calls or could be obtained from different switches. Mr Uglow indicated that it was his understanding after the joint experts meeting that Mr Brown was happy with the paper copies as source data in relation to three of the phones, 076, 585 and 980. Both wanted further work in respect of 430 particularly in relation to the identification of cells used by that phone. In his evidence Mr Uglow said that he had subsequently obtained that information in a statement from Ms O'Donovan.

Mr Uglow relied on TRS1. Mr Uglow did not pick up certain errors in TRS1 which were picked up by Mr Brown. The only one relevant to the calls with which his evidence was concerned was the call from 980 at 1414. The cell site is described as 6145 whereas one would have expected it to be 61451. This document was manually created using Excel and was probably some form of human error. The last digit indicated the direction of the antenna at the relevant site.

The base station gets the identity of the mobile phone in order to bill it. The base station identifies the serial number of the phone and the serial number of the sim card within the phone. It was technically possible to copy a sim card but very rare. Each field of storage is protected by a pin number. Mr Uglow accepted that alterations can be made but said that although it might be easy to change an entry in an address book it would be much more difficult to change the technical parameters of the sim card.

The serial numbers of the phones can be changed and there are internet sites with unissued numbers. The telephone number, however, is associated with the sim card. Mr Uglow accepted that there can be duplicate calls on bills where the same call was stored in different parts of the network. He further accepted that sometimes the timings within the network are different because they are set against the atomic clock. He agreed that there was no fixed boundary to the coverage of any call except that it must be in the area where coverage was provided.

Mr Uglow agreed that there were additional calls identified by Mr Brown. The call analysis in relation to 076 only goes to 1504 and did not include later calls. There is a call from 585 to 04243088 at 1723. There is an analysis of that number in the papers but there are no records of mobile numbers and that explains why this call was not identified. The records include calls from 585 to 00353 numbers on 1 August 1998 which suggests that the 585 phone was in Northern Ireland on that date. The incoming calls at 1409 and 1419 are listed among the outgoing calls. This is an example of inconsistency in the way in which networks provide material. It was suggested to Mr Uglow that there was an inconsistency between the seven calls apparently made in the billing list provided for 585 at page 659 of the papers and the 11 references at page 661. He pointed out that the omissions appeared to be roaming calls which suggests that one was not comparing like with like. Mr Uglow accepted that there was a possibility of error when retrieving material from the Vodafone system which produced the Toll Ticket Enquiry.

I have already referred at paragraph 37 above to the fact that TRS1 represented the first inquiry made to Vodafone. Thereafter there were further inquiries in relation to incoming and outgoing calls involving some 27 phones in all and covering a period from January to October 1998. The information from these inquiries was available on floppy disks to which Mr Brown had access. Mr Uglow did not rely on them in preparing his report. Because these discs were not source materials Mr Brown was not confident that they were accurate records for the reasons set out above. Mr Green was unable to indicate who precisely had prepared these materials but indicated that it had been done under his direction. Mr Uglow agreed with Mr Brown that these materials came in non-standard formats and that it was unclear what inquiries were actually made to generate the material contained on the discs. There was, therefore, a clear risk that relevant calls might have been missed. In relation to these calls there was no evidence of the extent of cell site coverage so at best the indication of a location could be no better than a general indication.

The materials provided by the phone companies were subsequently analysed using a computer programme to assist in the visualisation of large quantities of information. Mr Uglow did not rely on this analysis as it clearly consisted of material in addition to phone information. The analyst did not give evidence to explain how the analysis was conducted. The calls referred to in the analysis are contained within the material provided by the phone companies to the police in the course of the investigation. Mr Green described this material as being as close to the prime record as one could get.

TRS1 is in my view a hearsay document. It was prepared by a member of Mr Green's staff who interrogated the mobile phone network in order to obtain material and then transferred that material onto an Excel file. I have already referred to some form of human error in the preparation of the document at paragraph 57 above. The floppy disks containing the information in relation to the period from January to October 1998 were again prepared by Mr Green's staff who carried out the interrogation and transferred the material onto the floppy disk from some other source, possibly the original source material. Although the original computer printout might not have been hearsay I consider that the floppy disks are hearsay. In any event I consider it appropriate to examine the considerations relevant to the weighing of hearsay evidence in article 5 of the Civil Evidence (Northern Ireland) Order 1997 in assessing the reliability of the material contained in TRS1 and the floppy disks. I am satisfied that it is not now possible to identify those who prepared these documents and that the makers of the documents accordingly are not available to give evidence.

Article 5 of the 1997 Order identifies the considerations relevant to the weighing of hearsay evidence.

"5. - (1) In estimating the weight (if any) to be given to hearsay evidence in civil proceedings the court shall have regard to any circumstances from which any inference can reasonably be drawn as to the reliability or otherwise of the evidence.
(2) Regard shall be had, in particular, to whether the party by whom the hearsay evidence is adduced gave notice to the other party or parties to the proceedings of his intention to adduce the hearsay evidence and, if so, to the sufficiency of the notice given.
(3) Regard may also be had, in particular, to the following-
(a) whether it would have been reasonable and practicable for the party by whom the evidence is adduced to have produced the maker of the original statement as a witness;
(b) whether the original statement was made contemporaneously with the occurrence or existence of the matters stated;
© whether the evidence involves multiple hearsay;
(d) whether any person involved had any motive to conceal or misrepresent matters;
(e) whether the original statement was an edited account, or was made in collaboration with another or for a particular purpose;
(f) whether the circumstances in which the evidence is adduced as hearsay are such as to suggest an attempt to prevent proper evaluation of its weight."

The material contained in TRS1 and the floppy disks put forward are a copy of information retained on machines which the phone companies maintain inter alia for the purpose of ensuring that their billing records are accurate and comprehensive. The possibility of human error has to be recognised and indeed one example of it was discovered in relation to one of the entries but it is common case that there is a high level of competence within Vodafone. The question on notice does not arise in this case since the maker of a copy is not now available although I am satisfied that Mr Brown was given every possible accommodation to ensure that he could be as fully informed as possible in order to present his expert opinion. Looking at the matters set out in article 5(3) it would not have been reasonable or practicable for the plaintiff to have produced the maker of the original statements since they can no longer be traced. The original statement in this case is the information contained within the computer systems of Vodafone and was contemporaneously made. It is possible that there was multiple hearsay in the production of the copies. There was no motive to conceal or misrepresent matters and the only editing of the information was designed to make it relevant and manageable. There are in my view no circumstances to suggest any attempt to prevent proper evaluation of the weight of this evidence.

I am grateful to both Mr Uglow and Mr Brown for the careful and measured way in which they presented their evidence. The first issue which I am considering is the reliability of the individual entries asserting that a particular phone called another identified phone each of which was using cell sites for a duration of a particular number of seconds. The second issue is the extent to which I can be confident that the record before me of individual calls is comprehensive so as to exclude any possibility of being misled in particular by the absence of other calls. On the first issue although I cannot exclude the possibility of human error I consider that I can have a high level of confidence that the individual entries have generally been accurately transcribed or downloaded having regard to the high level of competence within Vodafone as a whole. On the second issue I draw a distinction between TRS1 and the floppy disk material. I am satisfied that there is a clear indication that the terms of interrogation of the phones examined within TRS1 was to establish all incoming and outgoing calls for the relevant period. I am, therefore, satisfied to a high standard that the material is comprehensive for the period covered. I am unable to take the same view about the floppy disks. It is clear from the format in which this material was subsequently provided that the terms of interrogation were unclear and I cannot exclude the possibility that there are other calls which have not been disclosed as a result of the particular form of interrogation. The level of confidence that the material is comprehensive is, therefore, diminished. I accept, however, that the existence of individual calls to and from certain phones using identified masts is evidence that calls were made to or from those phones using those masts at the time identified and that I can be confident of that fact to a high level. In reaching that conclusion I am not in any way criticising the evidence of Mr Brown but it seems to me that the level of confidence to which he aspired was something akin to certainty.

The purpose of the police investigation of the telephone system was to seek to identify the use of mobile phones in the transmission of the bomb into Omagh and the use of them to facilitate the making of the warning calls. The 585 and 980 phones were the mobile phone numbers which were thrown up for investigation as a result of that extensive and time consuming exercise. The records show the 585 phone travelling and making calls from Castleblaney at 1241, Emyvale at 1313, Aughnacloy at 1329 and Omagh at 1357. All of those calls were made to the 980 phone which was in the Republic of Ireland for the first 2 calls but in the vicinity of Aughnacloy for the third call and the vicinity of Omagh for the fourth call. 980 then used the Bridge Street cell at 1409 to phone 585 which received by using Pigeon Top. This shows a clear direction of travel for the 585 phone from Castleblaney, the general vicinity in which the bomb car was stolen, to Omagh. The 980 phone is regularly in contact with 585 and the evidence suggests it is travelling in the same direction at the same time. The timings of the calls are consistent with the delivery of the bomb to the centre of Omagh after 2 pm. This broadly accords with the evidence of the witnesses who claim to have seen the maroon vehicle. The 585 phone makes a call to the 430 phone at 1410. That phone receives the call by use of a cell site in the vicinity of the phone box from which the first warning call is made. 585 makes 2 further calls to 430 at 1437 and a minute later when that phone is using a cell site in the vicinity of the other phone box from which warning calls were made. Both 585 and 980 return to the Republic of Ireland by 1513 that day. I consider that the movements of these phones from the Republic of Ireland and back, the connection between them, the times of travel, the location from which they came having regard to the theft of the bomb car and the connection with the 430 phone in the vicinity of the call boxes from which the warning calls were made lead to an irresistible inference that 585 and 980 were the mobile phones which were used in the bomb run on 15 August 1998. There is no suggestion that the phone material has identified any other phones which could have played such a role.

Topic starter Posted : 19/08/2009 9:59 pm
Share to...