Public Defenders
print  Print page  
Safe and Unsafe Use of Mobile Phone Evidence

Public Defenders
Criminal Law Conference

Paper by Reg Coutts1 and Hugh Selby2

1. Introduction

In 2007/8 the authors became involved in the review of the mobile phone evidence used to convict Mr Phuong Ngo in 2000 for organising the murder of John Newman, a member of the NSW Parliament, in 1994. The case was dubbed ‘the first political assassination3 in Australia’. Mr Ngo was convicted at his third trial where location information from mobile phone call records was used by the prosecution to infer his location at various critical times on the night of the murder. ABC 4 Corners ran a program in April 2008 airing what was a simmering debate about the safety of the verdict. Thereafter the NSW Chief Justice established an inquiry to report to him on whether the conviction was well founded or not. That inquiry is now underway.

Since reviewing the mobile phone evidence and the way it was presented in court, the authors have reviewed the way the courts have dealt with location information contained in mobile phone records across Australia and have referred to press reports of some overseas examples. Broadly, while the use of mobile phone location information has become very popular both in Australia and overseas, the way it has sometimes been used in NSW4 appears to be a case of “making too much of too little” potentially leading to unsafe verdicts over the last 15 years. The usual problem is to move from using the records to show that calls were made and received (which is unexceptional) to using the same records as a basis for showing that a phone (and thus its user) was moving from precisely this location to precisely that location – a use that is fraught with problems. The purpose of this paper is to examine this issue.

The paper will provide a tutorial introduction as to how call records, generated by mobile phone calls by the mobile phone network operators so as to bill customers, can provide law enforcement agencies with useful information. While most of the charge data concerns the timing and duration of calls, this paper focuses on the likely location of particular mobile calls based on the cell site included in the charge record. We will not deal with more information that is gathered for a telecommunications inception and will focus on the evidence that is usually sort by police from the carriers both in their enquiries and to develop a case as to the ‘inferred’ location of one or more parties from their mobile phone records.

1 Reg Coutts is the Emeritus Professor of Telecommunications of the University of Adelaide and MD of Coutts Communications

2 Hugh Selby is currently an academic with the Australian National University Law School

3 Note the implied motive in this banner headline!

4 Since the airing of the ABC 4 Corners program in April the co-author Reg Coutts has been asked to look at two other cases in NSW

The paper will not address the now growing number of mobile phones incorporating GPS5, or where the operator uses information from multiple base stations to provide the user and subsequently a 3rd party (eg 000 service) user location with better accuracy than that usually available and discussed here.

The paper will address the question what can mobile phone evidence tell us and what can’t mobile phone evidence tell us? The volume and complexity of mobile phone evidence from cases well known to co-author Coutts (involving dozens of mobile phone calls, both fixed and mobile) suggests a pattern of the courts ONLY being presented with calls that support the prosecution case. Thus the paper further asks the question what is required by way of training and experience to be an ‘expert’ and the briefing of that expert to be able to comment on mobile phone evidence in a way which assists rather than confuses or misleads the fact finder?

2. Background

The use of mobile phone evidence by law enforcement agencies is just one of several forms of ‘high tech’ evidence being used to investigate crime around the world raising questions about our Justice System. [Aronson R and McMurtrie J 2007] So today with explosion in the use of mobile phones “cellular forensics” [Al-Zarouni M 2006], as it is called has become a huge industry in the US where just the provision of mobile call history of suspects by carriers in the US is provided by a specially trained staff unit that operates 24X7! A recent article in Crime and Justice in the US6 provides a picture of this growing industry. While there are other issues such as the encroachment of privacy, this paper is concerned with how mobile phone information is used in evidence at trial so as to prove necessary facts, rather than in the investigation phase where it may be a useful tool.

Usually the ‘raw’ data is gleaned from historical call records of the carrier. Investigators find out what mobile phone numbers were accessed by a suspect (later the accused) and obtain the call records for times of interest. Rather less often investigators are monitoring the use of mobile phone numbers when a crime is being prepared and carried out.

The mere production by a carrier to a trial court of its mobile call history for a specified phone number is not a matter of expert evidence. Rather the making of those records is simply a contemporary example of a ‘business record’, being a record that is regularly created in the course of the business of providing equipment to make and receive mobile phone calls.

The interpretation of those records, beyond the fact that a call was made at a particular time to a particular phone for a recorded time, is however, a matter for expert opinion. Decision makers (both trial judges and jurors) seek the help of experts when there is information that cannot be understood adequately, or at all, without the help of expert explanation and opinion. Because decision makers are forced to rely upon experts, and judges must give clear reasons for their decisions (such as whether to allow or not allow opinion evidence, or how much weight to give to evidence) it

5 GPS : here meant to mean the mobile phone contains a GPS (Global Positioning Service) ‘chip’ that allows location to within metres via satellite positing. 6 See
follows that decision makers require experts to be appropriately skilled, independent and impartial, and to explain matters in a clear, comprehensive and convincing manner.

When expert opinion is offered about whether a hypothesis is credible or not it is important that any limitations in the hypothesis are duly noted and explained. For example, if there are two competing versions of an event, and each is capable of being evaluated, it is grossly misleading to purport to evaluate one version while ignoring the other. From time to time the ‘interpretation’ of mobile phone evidence has forgotten these essentials, possibly leading to injustice.

3. Basics of a Mobile Network

This section describes the basics of a mobile phone network and the way records of calls made over and between networks are captured into a bill. More particularly, for this paper, we describe how these records for a mobile call also record the cell site for the outset of a call (or message) that can provide an indicator of location.

There are several related records generated by a single mobile phone call and the basic call data is captured in a Call Charge Record (CCR) including the time of the call, duration and (at least) the originating telephone number and the cell site used. CCRs are generated for every answered call and a CCR is generated by each of the networks traversed by the call to provide the basis for the retail bill to the calling party and an inter-carrier bill to enable operators to bill each other.

Network Call Data

Figure 3.1 – A Mobile Telephone Network

The diagram also shows a number of base stations (ie radio equipment) that communicate with the mobile phones establishing the location of the user that is the subject of this paper. Then the Base Station Controller (BSC) sets up a voice channel. The Base Station Controllers (BSCs) often co-located with the MSC sets up the communication from the mobile phone and interconnects the calls to other customers either in the mobile network or in the PSTN. Also shown is how messages (eg SMS) are delivered over the network over the Signalling Network. (ie the SS7 Network) not requiring any traffic channel where these also generate Cell ID information on their associated CCRs.

Coverage of the Service Area
Figure 3.1 shows a number of base stations (three in this figure) that are deployed every several km that provide ‘coverage’ over a full service area such as a city. To provide coverage an initial theoretical design is shown in Figure 3.2 where the coverage is provided by adjacent hexagons albeit of different areas to provide contiguous coverage. Each base station usually has a number of cell sites7 that use different frequencies and transmit in different directions from the base station and the pattern of hexagons is to assure the required ‘frequency re-use’ pattern to make best use of the available spectrum.

A typical urban base station coverage would be split into three sectors of coverage as shown in Figure 3.2 using direction antennas that amplify the signals in their forward direction constituting the arc of intended coverage and attenuate signals from other directions corresponding to the other sector directions. The intended coverage area for a particular cell site is deliberately confined in direction by the directional properties of the 120 degree sector antenna and confined in distance due to the power of the base station. Thus if a particular cell site is cited in a call charge record, a preliminary assumption would be to assume that the mobile phone user at the time of call establishment was located within the intended coverage area. However, there are several technical factors that complicate the potential to be overly definitive of the likely location of the mobile at the time of the call. Secondly, the language that has been used8 in some court cases in questions to the expert witness that the cell site location cited in the CCR for a particular mobile call is ‘consistent with’ the mobile being at a particular area (eg the crime scene) as it is ‘in the intended coverage area’ is potentially VERY misleading unless qualified through adequate cross examination.

Several technical factors that complicate making overly definite location statements based on the cell site cited in the CCR are summarised but there are ‘anomalous’ random propagation factors that can play a role but won’t be discussed.

First of all, the actual coverage area of a cell is very different from the idealised initial design due to the terrain of the area to be covered. A computer modelling prediction tool is used to enable detailed coverage design where the tool models the effects of the terrain and buildings that are available on a data base for the service area. A predicted dominant coverage from a 3 cell base station is shown in Figure 3.3 noting particularly the range of the coverage is variable. The computer prediction design is then followed up by selective drive tests to get better accuracy for more difficult spots

7 In this paper only 3 cell sites per base station that each cover an area of 120 degrees of arc from the base station are discussed. 8 A number of trial transcripts of evidence have been reviewed to inform this paper
within the coverage area. In none of the cases that the authors have been involved or in any of the cases reviewed has computer prediction maps or the results of drive tests been produced (by either side) in court to aid explanation of the problem.

Secondly, while the direction of coverage area defined by the sector antenna is more reliable than the distance as seen in Figure 3.3, the likely cell site to be used depends on the dominant cell amongst adjacent cells and can be VERY different from that intended in the broad coverage design. Figure 3.4 shows a computer prediction of the overall coverage area showing the dominant cells. This means that if the mobile is at the edge of the intended call coverage area where the mobile may have adequate field strength from several adjacent cells, the cell site chosen may literally depend on the time of day with traffic loading in these cells9 or a minor variation in orientation of the mobile relative to the head of the user. While these factors are often mentioned in transcripts as noted previously no actual field information potentially available is presented.

Thirdly, the likely cell site choice near the base station can be uncertain so that if the mobile is very close (ie low signal attenuation) to the ‘back’ of the base station where the antenna characteristics are more irregular then the cell site chosen can be in the opposite direction assumed from preliminary assumption. Such a possibility can be predicted by computer modelling as shown in Figure 3.5 as was done for the Phuong Ngo case. What can also be noticed from comparing the intended three sector coverage design shown in Figure 3.4 with the predicted coverage from computer modelling that takes into account both the antenna characteristics as referred to above but also the terrain and the ‘area of uncertainty’ is the area around the tower where either 1 of 2 cell sites may be the preferred call site for call establishment.

9 Even though a given cell may have the strongest signal level, in a cell traffic peak where there are no more channels the system will ‘retry’ an adjacent cell which has adequate signal level.

A broad conclusion that can be drawn from this discussion of the factors that complicate definite conclusions about the location area of a mobile phone at the time of a call is that it is generally easier to say in many cases the areas where the mobile phone was unlikely to have been at the time of a call! As is often found in forensic work it is ‘exclusion’ not ‘identification’ that is the safest use of available technology.

4. Requirements to be an Expert on Such Matters

Given the complexities of the interpretation of cell phone location information contained in call charge record data for mobile phone calls (and SMS messages), the paper summarises the knowledge and experience required in our view to be an expert.

The broad areas of knowledge required are:
Radio transmission knowledge including propagation, radio system design and antenna principles
Telecommunications network engineering including call management and

charging principles And the areas of experience required are:
The specifics of cellular mobile engineering including radio network planning and design
Basic telecommunications network switching
Billing systems

It should be noted that experience of cellular radio network planning, design and practice including the radio systems elements, propagation and the capabilities of computer coverage prediction tools is a very specialised area.

While broad area of knowledge is acquired through an appropriate Engineering Degree (eg Electronic Engineering), more specific knowledge in propagation together with operational experience in a mobile communications business or major equipment vendor would characterise an expert in this area.

5. Discussion of Cell Site Evidence Used in Australia

Before considering the use of cell site evidence in Australia, it is useful to highlight a few ‘prominent’ cases reported from overseas that illustrate the same pattern of ‘assumed’ accuracy of location from cell site information captured in call charge records. While there has been no opportunity to review how this ‘evidence’ was dealt with in the respective courts, they illustrate the global nature of the issue.

From the UK a report on the conviction of Ian Huntley in the press for the double murder trial in 2003 there were quite inaccurate cell phone location attributes cited, saying the mobile phone ‘can be traced to within a short distance’. In January 2008 in the US there was chorus of protest to appeal the conviction of R&B singer Waymond Anderson in 1993 in the US who has been in gaol for murder for 13 years,0,1655641.story?coll=la-home-headlines partly on the basis of cell phone records purportedly indicating location. The report says “call logs proved Anderson was in the neighbourhood….” and “the implacable digital testimony the defence didn’t dare challenge: Anderson’s cell phone.” It was only when the physical witnesses admitted they had been ‘verballed’ by police that the cell phone evidence was questioned!
In mid July 2008 one of the authors contacted all Australian Directors of Public Prosecutions asking about their practice in the use of cell site information from mobile phone call charge records. The response from the various jurisdictions is summarised in Attachment 1.

What emerges is that the evidence is almost always led by the prosecution and where there is no objection, the cell site evidence of ‘possible’ location is merely supporting a fact already well established and becomes an ‘agreed fact’. However, when such evidence is led by the prosecution to ‘pinpoint’ movement or location but is contested by an effective defence, examination of all the relevant records10 will often point to many anomalies. In summary, critical reliance should not be based on such evidence.

The reasons given for decision by Blaxell J in Western Australia cited in Appendix 1 is recommended as background reading (along with this paper!) for any lawyer participating in a hearing at which mobile phone evidence is being led.

6. Conclusions

In conclusion the ubiquity in the use of mobile phones in society has been recognised by law enforcement agencies around the world as a useful tool to potentially provide information on the location of persons of interest when using the phone. The basic cell site information recorded in the mobile phone call charge record is useful to indicate the likely location area where the call was made. More recent mobile phones that use more accurate location technology such as GPS are not discussed.

The paper describes the basics of how a network of overlapping cells is designed from initial theoretical coverage, detailed design using a software prediction tool followed up with selective drive test measurements. The ‘actual’ coverage characteristic is constantly evolving as more cells (and equipment) are added and the coverage is ‘tuned’ to maximise coverage but minimise interference. In this context of the complex changing ‘intended’ service area coverage, some of the sources of potential anomaly of asserting likely phone location from the recorded cell site are explained. There are more!

From examination of the Phung Ngo cell phone evidence11 including the expert witness transcripts, the feedback from other jurisdictions on the use of cell phone location data and with some reference to some overseas cases, it is clear while cell phone data is useful for police investigation, it should be used with great caution in a court as an authoritative form of evidence of location.

7. References

Aronson R and McMurtrie J (2007), ‘THE USE AND MISUSE OF HIGHTECH

    by Robert Aronson & Jacqueline McMurtrie, FORDHAM LAW

10 In some instances the prosecution only presents those call charge records that contain cell site information that support the prosecution scenario as noted in the Western Australia vs Coates case in WA as an example 11 One particular critical call record that was used to ‘locate’ the defendant at the site of the recovered murder weapon (alleged) was assessed in particular and was found to be unreliable. The particular base station and cell sites are the subjects of Figures 3.3 and 3.5 used in this paper
    REVIEW, Vol 76, 2007 Al-Zarouni M (2006), ‘Mobile Handset Forensic Evidence: A challenge for Law Enforcement’, School of Computer Science, Edith Cowan University, 2006

8. Acknowledgements

The authors would like to acknowledge the assistance of ATDI Australia in the use of their comprehensive radio network planning tool in the assessment of the cell site coverage of a particular base station in Cabramatta. Further, the authors appreciate the information provided by a number of DPPs as cited in Attahment 1.

Attachment 1 – Review of Case Experience in Australia

The question to be answered for this paper, given the experience of a number of cases12 in NSW was to what degree did courts in the various states across Australia rely on the accuracy of using cell site information contained in a mobile phone call charge record to assert the location of the caller at the time of a call or message.

Information Request
In mid July 2008, one of the authors contacted all Australian Directors of Public Prosecutions, asking as follows:

      ‘Request for information about criminal trials in which ‘mobile phone’ evidence to locate and/or show the movement of an accused or witness has been used.

      Since the late 1990’s there has been use in Australian criminal trials of technical evidence in which the alleged location and movements of an accused have been asserted on the bases of their mobile phone records. The argument has been made that calls were made and/or received in particular locations, based upon assertions about the way in such calls are transmitted and received.

      One such case, well known in NSW, is the successful prosecution of Mr Phuong NGO for the 1994 murder of Mr John Newman MLA. Technical evidence led from Telstra representative… was a foundation for the Crown case.

      We are aware that at least in NSW such evidence is routinely 'an agreed fact'.

      Experience can enhance wisdom and in 2008 we know rather more about the behaviour of transmissions than a decade ago. We are also better able to explain the strengths and limitations of opinions derived from using such communication records.

      … we are preparing a paper for a September conference in which we will combine the legal tests for admissible and reliable expert evidence and opinion with his technical expertise.

      To properly set the scene we need your help to identify any trials in your jurisdiction in which this evidence has been admitted or rejected by the trial judge.

      …our quest is for those occasions when evidence was led along the lines of, “From these phone records and using our understanding of mobile phone transmission it is my opinion that X would/could { have been in Y locality/ have been travelling in direction Z}”.

      It would be of great assistance to know as follows:

12 Since the ABC 4 Corners program co-author has been asked to provide advice on two other cases in NSW where one of them raises similar concerns as to the use of cell phone evidence.

1 Whether such evidence is commonly led by the Prosecution with no objection from the Defence; and
2 Where the Defence does object then: the name of any such matter, when and where the trial took place, whether the evidence was allowed or rejected, the name of the trial judge, and the names of the prosecutor and the defence counsel.’

Response to the Request
This request bore useful results and we particularly appreciated the help we received
from the DPP’s of Western Australia and Tasmania, a senior Crown Prosecutor in
Queensland, and some research staff in Victoria. The high point were the comments
made by Blaxell J, sitting as judge alone in a recent murder trial in Perth (State of
Western Australia v Coates [2007] WASC 307,

His honour’s explanation should be background reading for any lawyer participating in a hearing at which mobile phone evidence is being led. Edited for relevance to this paper those remarks are (using the paragraph numbers in the report):

      211 A significant part of the prosecution case is based upon the Telstra and Optus records of all calls … to and from mobile telephones …These records were automatically generated at the time of each call, and in most instances include the telephone number of the party making the call; the time of the call (based on a 24 hour clock); the telephone number of the party receiving the call; the duration of the call; and the 'status' of the call (viz. whether or not it was answered). In respect of the mobile telephones, the Telstra records also include details of the cell towers (or radio base stations) through which each call was initiated and received at commencement. The Optus records only include information on the cell tower which received a call if the receiving telephone was connected to the Optus network. …

      212 It should be noted that each mobile telephone number attaches to the SIM card inside the handset, rather than to the mobile telephone as a whole. Accordingly, if at any time a SIM card was transferred from one handset to another, then the subsequent calls to and from that SIM card would also have been transferred.

      215 I have heard or received evidence of a technical and/or semi-expert nature as to the significance of the cell tower details in the Telstra and Optus records. This evidence shows that each provider has its own network of cell towers (or radio base stations) through which mobile telephone calls are transmitted and received. The number and geographical location of base stations depends upon factors such as customer demand, local terrain, and the presence of buildings or other obstructions. ….

      216 Each network is designed so that the field of influence of each individual base station is limited to a restricted area. In a central business district, the area of influence of a base station is approximately 3 -5 km. In a suburban area, the area of influence of a base station is approximately 3 -10 km …. However these distances can be affected by local obstructions such as buildings or hills, and the line of sight connection between a mobile telephone and the nearest base station might bend slightly depending upon the nature of the obstruction. successive station gets closer and the previous one gets left behind.

      219 It is against this background as to the characteristics of the Telstra and Optus base station systems that the evidence of particular telephone calls needs to be considered. The fact that a call was transmitted or received via a particular base station is strong but not conclusive evidence that (in the absence of any obstruction) that base station was the closest geographically to the time) were transmitted or received through the same base station, then that would strengthen the inference that it was that base station which was the closest.

Tasmania provided an example of an unsuccessful prosecution in which mobile phone records were insufficient proof. A and B were friends. B was in debt and it was alleged that A and B decided to burn B's car, claim it had been stolen, and then B would claim the insurance.

A was familiar with the area, B was not. A was to follow B to a site where B would set fire to the vehicle. On the way B became lost. There was a series of telephone and SMS messages between them on their mobile phones. The call records which the prosecution wanted to introduce seemed to show a pattern of calls from base stations which showed a pattern of travel up and around [the relevant area] by both callers, ending close to where the car was found. However, there were some anomalies. The anomalies were, or could have been, caused by overlapping of stations and calls being automatically redirected through stations more distant than the closest from which they originated if there was congestion. The apparent pattern was thus unreliable, and the prosecution called evidence from Telecom as to that very unreliability as part of its case (in the prosecution’s obligation of fairness).

The prosecution relied on the amount and timing of telephone traffic between A and B but did not rely on the "technology" of pinpointing movement via the calls: in fact, that use was eschewed and evidence presented that reliance should not be placed on the call records for that purpose.

The accused were acquitted.

Finally, for those who like to be referred to Court of Appeal consideration of the topic please see the Queensland case R v Aboud; R v Stanley [2003] QCA 499 at paragraphs 24 -29 for a discussion of the use of cell site evidence.

spacer spacer
Last updated: 4 July 2012
Lawlink NSW